Title: When your idempotency store is down, do you fail open or fail closed?

I run the money paths on a payments platform (mobile money + cards, East Africa). Every money operation claims a unique key before it executes; duplicates are refused. The case I keep getting pushback on is the claim write itself failing. We chose to let the payment through and log it, because blocking legitimate payments over an idempotency-store blip felt worse than a rare double that reconciliation catches. Others say that is exactly backwards for money. Where did you land, and did an incident change your mind?