Finder report · duplicate-webhook

The finder reproduces the classic duplicate-delivery bug with PayPal's real redelivery, then proves the one-line fix.

Same scenario, same check, run before and after the change. Each verdict rests on the store's own rows, not on the absence of an error.

Before

1bug

BUG

run 20261023231552-60ea96 · 2026-10-23 23:15 UTC

After

0bugs

run 20261024011812-208f4e · 2026-10-24 01:18 UTC

Report

A redelivered capture event fulfills the order twice duplicate-webhook · PAYMENT.CAPTURE.COMPLETED

Check	Expected	Before60ea96	Flag	After208f4e	Flag
Deliveries of the resent event	at least 2: the resend has to arrive	2	in range	2	in range
Fulfillments for that event id	exactly 1, however many deliveries	2	too high	1	in range
Redeliveries recognized and ignored	every delivery after the first	0	too low	1	in range
Deliveries verified as PayPal's	all of them	2 of 2	in range	2 of 2	in range

before the fix20261023231552-60ea96

Order: 3Y2144672G186725Y
Capture: 80644537PH409550V · card order USD 25.00
Event: WH-23242717T8452430B-4FP87531JX1278159
Report: evidence/finder/2026-10-23-duplicate-webhook-before-fix.md

23:16:17fulfilled · verified · signing certificate from api.sandbox.paypal.com
23:17:51fulfilled again · verified · signing certificate from api.sandbox.paypal.com

after the fix20261024011812-208f4e

Order: 9XW82145R0198523E
Capture: 7FK80862277639113 · card order USD 25.00
Event: WH-1XN5343594084053N-3NH67648AD6825106
Report: evidence/finder/2026-10-24-duplicate-webhook-after-fix.md

01:18:37fulfilled · verified
01:19:21recognized as a repeat and ignored · verified

The change between the two runs

store/lib/merchant.ts:18

- export const DEDUPE_BY_EVENT_ID = false;

+ export const DEDUPE_BY_EVENT_ID = true;

commit d6b8ff6 · fix(store): dedupe webhook events by event id · merged in PR #6

How a verdict is decided

BUG only when one event id was fulfilled twice.
OK only when the event was fulfilled once and a redelivery reached the store and was ignored.
Anything else, including a redelivery PayPal never sent, is INCONCLUSIVE, never OK.

Run this check againA live finder run needs the judge passcode, at /live. These two runs took about 70 seconds and 2 minutes, mostly waiting on PayPal's redelivery.