Checkout spans inventory, payment, order management, and notifications, often across different databases and providers. There is usually no single ACID transaction across all of them. Define a workflow with durable steps, timeouts, retries, and compensating actions.

An idempotency key identifies one logical client operation across retries. Store the key, relevant request fingerprint, and outcome with a uniqueness constraint. Reusing a key with a different payload should produce a defined conflict rather than silently returning an unrelated result.

Reconciliation is a first-class safety mechanism. Periodically compare orders, payment provider transactions, refunds, and inventory reservations. Alert on mismatches and resolve them through auditable repair workflows. Reconciliation handles the cases that synchronous code cannot conclusively determine after network failures.