Idempotency
Every retried write is safe when it carries an Idempotency-Key.
Send a unique Idempotency-Key header on write requests. Replaying the same key with the same body returns the original response; reusing a key with a different body is rejected with 409.
This makes network retries safe — you can never accidentally create two payments for one order.