Service architecture
The payments service owns the ledger and exposes a single write path. Reads are served from a replica, so any caller that needs strong consistency must go through the write path explicitly.
Every state transition is idempotent. A duplicate request with the same key returns the original result rather than double-charging the customer.
Timeouts retry with backoff, capped at two attempts, after which the request is parked on the dead-letter queue for manual review.