Thoughts
One idea per piece. The trade-off is the whole point.
The dual write can't be removed, only relocated. One payment capture — real schema, real transaction, real relay query, real consumer — killed at six points, with the state and the self-heal at each.
You can't get ordered delivery over a webhook channel, so stop asking for it. Three well-understood defenses — version numbers, refetch, and a state machine — and which one to reach for first.
Nobody demos reconciliation. But it's the process that decides whether your books are fiction or fact — the daily check that your ledger and the outside world still agree.
The obvious way to store balances — a column you update — is the one that will eventually betray you. Here's why the accountants had it right.
You can't deliver a message exactly once across a network. What you can do is process at-least-once and make duplicates harmless — which is the real job.