A retry that refunds is a bug, so the refund lives in onFailure and nowhere else

Our interview job retries three times and spends a credit once. Getting "refund exactly once" right took three different error paths, a point of no return, and a row lock on a balance nobody was contending for.