security hardening

prisma/schema.prisma

@@ -188,6 +188,13 @@ model ProcessedWebhook {
   webhookId   String   @id
   topic       String
   shopDomain  String
+  // Reserve/commit lifecycle for at-least-once side-effect processing:
+  //   "processing" — reserved, side-effect work in flight (acts as the lock)
+  //   "done"       — work completed successfully; future retries are dropped
+  // A "processing" row older than the stale lease (see dedupe.server.ts) is
+  // treated as a crashed reservation and may be reclaimed. Existing rows
+  // migrated from the old (record-before-work) design default to "done".
+  status      String   @default("done")
   receivedAt  DateTime @default(now())
 
   @@index([shopDomain, topic])