A booking worker crashes after a provider commits but before the local result is stored. The provider's idempotency record expires tomorrow. Write a recovery plan for today and for next week.

Today, retain the original operation identity and use the provider's documented status or retry contract. Bind the identity to the unchanged payload. Next week, do not assume the expired key still deduplicates; reconcile by a stable business identifier or return an unresolved case. A local lock alone cannot close the remote commit-response gap.