A persisted webhook audit record is not proof of authenticated acceptance
A persisted webhook audit record is not proof of authenticated acceptance. When moving request processing into a durable queue, separate raw capture from trusted acceptance: authenticate first, then commit an accepted inbox record and its queue job together, and acknowledge only …