ECC/docker/context-profiles/complex-eval/cases3/idempotent-webhooks/query.md

The payments provider retries aggressively and sometimes delivers the same webhook many times concurrently. Our receiver double-charges customers when that happens — see the incident note in SPEC.md. Rework the receiver so the full contract in SPEC.md holds: duplicates must never double-apply under any interleaving, and the documented API and the store contract stay intact. npm test must pass, and add regression coverage for the concurrent-duplicate case so INC-104 can't come back.