Checkout, on the worst day of the year
You own the checkout path for a marketplace. A shopper hits Pay, you write a capture to your ledger, and you call a payment processor that actually moves the money.
The processor charges on every call it accepts — including the ones it later reports as timed out. You cannot change that, and you cannot see the difference from the outside.
Thirty checkouts a second. Nobody waits more than two seconds, and nobody is charged twice.
Before anything runs: which of the things you have to hold gives way first, and what is the mechanism?
The slowest checkout in a hundred is under 2s
No shopper is charged twice
Every number appears here, on every change.