I removed every delete from my exactly-once guard. Then the bugs moved.

Your monitoring will not flag a duplicate charge. Every one of them is a 200. The refund succeeded. It succeeded again four hundred milliseconds later on a second worker, and once more after a lost response made the client retry. Three successes, three green spans, three log lines that say ok. The customer's statement is the only place the...