Try-Confirm-Cancel booking and pay

Design a booking-and-pay flow using a Try-Confirm-Cancel (TCC) pattern: a reservation must tentatively hold a hotel room (try), tentatively authorize the card (try), and only if BOTH tries succeed do you confirm both; if either fails or times out you cancel both. ~4,000 bookings/sec. The room-hold and the card-auth live in different services with no shared transaction, holds expire, and the confirm/cancel messages can be lost. How do you guarantee you never confirm a payment for a room you couldn't hold, or hold a room for a payment you couldn't take?