I'm trying to understand the best way to approach a situation where WooCommerce, a payment gateway webhook, and an external fulfillment system can all update the same order within a few seconds of each other.

For example, say a customer completes checkout, but the payment gateway's confirmation webhook is delayed. Meanwhile, a fulfillment integration picks up the order, and then the webhook arrives while another background process is updating its status.

My understanding is that WordPress doesn't provide transactional guarantees across all of these operations, and relying on order status alone isn't necessarily enough to prevent duplicate processing.

Would the better approach be to make every operation idempotent using unique event IDs, or would you also implement some form of locking around order updates?

I'm also curious how HPOS changes the equation, particularly when plugins are still using older post/meta-based assumptions.

For developers who've dealt with this at scale, how do you prevent duplicate fulfillment or conflicting state changes without creating a system where failed jobs leave orders permanently locked?

I'm less interested in specific plugin recommendations and more interested in the architectural approach you'd trust in production.