Failures become states that can be inspected and recovered.

Processing runs are unique by outbox event. Replaying the webhook returns the same run. A repeated identical callback is harmless; a conflicting repeated callback is rejected.

Every run records the ticket revision it started from. If new evidence or a branch reply increments the ticket revision before completion, the old callback is stored as stale and cannot overwrite current processing state.

Worker leases expire. A crashed worker therefore does not permanently own an event. PostgreSQL remains the durable source of pending work rather than an in-memory queue.

Outbox attempts are bounded. Exhaustion sets a dead-letter timestamp and calls the internal API so support sees a failed processing state instead of a ticket that appears to be running forever.