A queue visibility window is a delivery mechanism. It is not a lock on the provider. Amazon SQS documents that delivery may duplicate even within the visibility period, and a long task can extend visibility subject to service limits. A worker can lose its ability to delete a message while its outbound request remains in flight. Increasing the timeout reduces accidental redelivery, but it does not make exactly-once effects.

Keep a durable run and step record separate from the queue message. A worker claims a step with a monotonically increasing ownership epoch, renews its claim while healthy, and checks ownership before starting new work or recording a terminal result. On redelivery, B loads the same run and operation ID rather than inventing a second step. If A already submitted the credit, neither A nor B is allowed to submit another distinct credit until the first operation is resolved. The broker stores a canonical effect request and idempotency key before dispatch. If the provider supports that key, use it according to its documented retention and matching rules. If not, reconcile by provider transaction lookup or route the unknown case to a human. A local epoch cannot force an already sent provider request to stop.

Two workers overlap after a lease expires
The new owner can advance local state. The old provider request may still commit, so the shared operation stays unresolved until provider evidence arrives.

If A returns after losing its claim, reject its stale local state write, but accept provider evidence through a separate operation-result path that is keyed to the already recorded effect. Otherwise we could throw away the only receipt proving that the customer was credited. The result path verifies the provider identity and operation, then conditionally settles the operation once. B observes that state and resumes dependent work only after the effect is confirmed. This separates fencing of workflow state from deduplication and reconciliation of external effects.

What if heartbeats are flaky? Renew early, observe renewal failures, and stop dispatching new effects when ownership is uncertain. A heartbeat is a liveness hint, not evidence that the provider call failed. Test lease expiry just before send, after send but before response, after provider commit with lost response, and while both workers are alive. Count duplicate dispatch attempts and duplicate provider effects separately. The queue may redeliver a hundred times. The customer should still get one authorized economic operation or an honest unresolved state.