I would add a crash test after the order transaction commits but before the key is marked completed. On retry, how do you find the existing order and avoid decrementing stock again? The provider key covers the charge, but that local step needs a guard too