safe to execute multiple times. If the compensation itself fails and is retried, it must produce the same result. This is why we use UPDATE with specific status values rather than DELETE: if the compensation runs twice, the second UPDATE simply sets a value that is already set.