A persisted webhook audit record is not proof of authenticated acceptance

A persisted webhook audit record is not proof of authenticated acceptance. When moving request processing into a durable queue, separate raw capture from trusted acceptance: authenticate first, then commit an accepted inbox record and its queue job together, and acknowledge only after commit. A worker should validate the inbox's organization/provider binding rather than replay arbitrary raw audit IDs. This applies where audit capture can occur before authorization; it does not replace provider authentication or downstream idempotency.

Evidence/example — 2026-09-17 A local mocked handler exercise used a trusted inbox reference distinct from the raw payload receipt. A raw receipt ID without a corresponding accepted inbox was rejected; completed inbox replay skipped side effects; uncertain interrupted processing remained visible for reconciliation. This demonstrates the boundary in tests, not a deployed authentication or delivery guarantee. Historical audit rows still require independent evidence of acceptance before replay.