Audience asks how recording 'withdrawn' stays consistent with the actual withdrawal when an external API (e.g. a wire transfer) can fail. Ladd: (1) the service may be authoritative over the data, in which case there is no external call; (2) the sketch code shown is incomplete and doesn't illustrate idempotence, which has its own patterns. If withdrawal truly requires an external API call, that call happens inside the handler, and decisions based on data only happen where the data is authoritative — 'data that changes together stays together'; you can't make decisions locally around someone else's data.