Building a Payment Processor: The Final One Percent

I had idempotency, a message queue, and retries. I thought I was finally building something production-ready. Then I started thinking about the "in-between" failures. What if the worker starts a charge, the provider succeeds, but the worker crashes before it can update the database? The payment stay