Never double-charge: the UPDATE is the lock

Fixed Temporal workflow IDs, an UPDATE that doubles as a lock, and fail-closed reconciliation: layering double-charge protection into a payments system.