Same netmask or /32 for secondary IP on Linux

Solution 1:

If I add it with a /24, it gets flagged secondary, so will not be used as the source of outgoing packets, but that leaves a risk of the two addresses being added in the wrong order by mistake. If I add it with /32, wrong order can't happen, but it doesn't get flagged as secondary, and I'm not sure what the bad effects of that may be.

I'm not sure what you mean here. You network interfaces are configured in a deterministic fashion when your system boots up. By properly configuring your networking you can decide which address is assigned first and which is assigned as the secondary address.

If you're on a RedHat-ish system, the primary network configuration file ifcfg-eth0 (for example) will be handled before any alias interfaces such as ifcfg-eth0:0. I'm less certain of the behavior on Debian-ish systems, but it looks like the /etc/network/interfaces file may be handled sequentially, so put your alias definitions after the primary address and you should be all set.

So, I'm wondering, which approach is least likely to break?

If both of your addresses are on the same network I don't know that either one is going to be more or less likely to break. For what it's worth, I usually configure secondary addresses with a /32 netmask, since the primary address already provides the necessary network route.