Idempotency and the ledger

An idempotency record is stored only when a job is accepted. The fingerprint is the canonical model, version, and validated input after defaults. The same key and fingerprint returns the original job, including when two requests race. A different fingerprint returns 409.

Credits are integer USD cents. Reserve moves funds from balance to reserved in the same transaction as the job and outbox row. Settle runs once on an allowed success. Release runs on failure or cancellation. Replaying settle or release does not move funds twice.

Rejected candidate requests do not reserve credits and do not consume the idempotency key.