I removed every delete from my exactly-once guard. Then the bugs moved.

Your monitoring will not flag a duplicate charge. Every one of them is a 200. The refund succeeded. It succeeded again four hundred milliseconds later on a second worker, and once more after a lost response made the client retry. Three successes, three green spans, three log lines that say ok. The customer's statement is the only place the incident exists. Guardrails are usually built around may this happen? — permissions, scopes, approval gates. This is the other question, and almost nothing asks it: did I already? I spent a week building a small answer to it, and then had it torn apart four times. This is what each round moved, and why the last three rounds found nothing where I was looking. The easy half The mechanism is one line and it is genuinely correct: fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600) O_EXCL is a compare-and-swap on existence. Exactly one process creates the file; everyone else gets FileExistsError. No daemon, no Redis, n