Building a Robust Webhook Consumer

Your service receives payment.succeeded and payment.refunded webhooks from a payment provider. The provider documents that it retries failed deliveries with backoff for up to 3 days and does not guarantee ordering. Your endpoint currently: verifies nothing, updates the order status directly from the payload, and returns 200 after all processing finishes (~4 s, because it also sends an email).

1. List the failure modes of the current design and the concrete change that fixes each.
2. Show how you would verify the webhook is genuine, including what you sign over and how you defend against replay.
3. A payment.refunded event for order 77 arrives before the payment.succeeded event because the first delivery of the latter failed. How does your consumer avoid ending with the wrong final state?