Found it: the callback has no idempotency check, so provider retries write the invoice twice. I'll dedupe by event ID and add tests for the retry case.
Done. Here is what changed:
- Dedupe by event_id; duplicate callbacks return 200
- Retry logs include event ID and attempt count
- Added 3 retry-case tests, all passing
Ask Baton AI to continue, fix, or explain… ('@' to mention files)