I matched recovery to Shopify's exact AbandonedCheckout identity instead of the customer's email. That takes more state, but it ties the stop decision to the checkout that started the sequence. PostgreSQL prevents duplicate work, and Shopify is checked before copy, before Gmail, and before a cart can be marked lost.