Spending the allowance before the provider call, and setting the refunded flag in the same D1 batch as the refund itself, is how I'd build it too. I couldn't work out one case from the post. When a job stuck in processing gets closed out on the guest's next try, is that an unknown outcome with no refund, or do you check with the provider first?