Risks

Current Risks

• webhook processing is still in-process rather than queue-backed
• Clover recovery depends on the payment poll and on replaying raw webhook events
• idempotency keys currently behave like permanent dedup entries
• campaign send behavior depends on cron execution
• strict admin access still relies on email-domain enforcement
• tenant isolation must stay consistent across every route and query

Why These Matter

These are the places where a small regression can create a financial or cross-tenant issue.