fix(billing-polar): reject failed webhooks so providers can retry delivery

[kang-heewon]

Summary

Internal Polar webhook failures now reject with WebhookProcessingProblem, allowing Croco HTTP controllers to return 500 and Polar to retry. Original causes and rollback diagnostics remain available; completed duplicates still succeed and signature verification is unchanged.

Paid-order retries now upsert by billing account and order ID and publish with a stable webhook-derived event ID through publishIdempotently. Custom BillingStore.saveOrder implementations must support that upsert contract. Callers previously inspecting success: false must handle the rejection and preserve the error response.

Closes #2656

Validation

Elevated profile for persistence and retry behavior across billing-core and billing-polar.

• Original negative control: 15 regression failures. Review repair: two store and two handler regressions fail before their fixes.

• billing-core: 180 tests passed. billing-polar: 171 tests passed. Both package typechecks and lint passed.

• Reconstructed handlers recover from publication-after-acceptance and completion failures with one stored order and the same logical event ID.

• Independent code review and integration/evidence review passed on f8efc20fae6c536ea7c706ba6f6a4f386aeed1c8; final cleanup was a no-op.

• Full build, tests, and typecheck each passed 243/243 tasks on the repaired head; all normal Git hooks passed.

• Repository checks: 27 applicable gates have passing aggregate evidence. The first contract-cache test failed; the unchanged contract suite then passed 683 tests and the prerequisite-skipped benchmark passed. Companion architecture and public API checks passed.

• Signed HTTP smoke on the repaired build returned a redacted 500 after DB failure and 200 on same-event retry.

Evidence identity

Head: f8efc20fae6c536ea7c706ba6f6a4f386aeed1c8. Assessed target base: c2a26539a965065486813fda9462a0bae6d82212. Base drift from the original validation affects unrelated search, auth, and customer-health contracts; no rebase was needed.

CI, review companion, and benchmark passed on the repaired head. All required checks passed; the PR is conflict-free with no unresolved review threads.

Compatibility

Custom stores and publishers remain responsible for their documented durable upsert and idempotent publication contracts. Failed reservation rollback retains the existing store recovery requirement. Order timestamps preserve provider createdAt when supplied; the existing missing-date behavior is unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Approval pending

CodeRabbit has no unresolved comments, but it could not review the latest commit because the review limit was reached. Follow the review guidance in this comment to continue.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T05:51:33.779337Z	2af2534	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	63.0μs	30.0ms	8.2μs	+670.5%	❌	-
CrocoApp lambdaHandler (10 controllers)	2.2ms	50.0ms	258.4μs	+758.0%	❌	-
Lambda cold-start simulation	2.7ms	80.0ms	418.1μs	+540.4%	❌	-
Lambda cold-start with headers	1.6ms	80.0ms	369.7μs	+335.6%	❌	-
Lambda cold-start with binary body	1.5ms	80.0ms	339.1μs	+356.9%	❌	-
Lambda cold-start with query params	1.5ms	80.0ms	301.3μs	+407.1%	❌	-
Lambda cold-start with authorizer context	1.5ms	80.0ms	299.8μs	+403.6%	❌	-
Lambda cold-start realistic scenario	1.5ms	80.0ms	299.2μs	+404.4%	❌	-
EventBusConfig.start (10 handlers)	1.6μs	10.0ms	1.4μs	+13.3%	✅	-
EventPublisher.publishNow single event	1.8μs	2.0ms	1.7μs	+8.3%	✅	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	-11.2%	✅	-
Container.get singleton (cold)	97.8μs	5.0ms	70.3μs	+39.2%	❌	-
Container.register × 50 components	3.1ms	10.0ms	3.2ms	-3.4%	✅	-
Container.validate (50 components)	3.8ms	20.0ms	3.4ms	+13.5%	✅	-
Container.get singleton (warm)	1.4μs	500.0μs	1.6μs	-14.1%	✅	-
TelemetryRuntime.init (lambda preset)	12.9μs	200.0ms	1.1ms	-98.8%	✅	-
lambdaPreset config creation	1.5μs	2.0ms	1.4μs	+4.2%	✅	-

_{Updated: 2026-09-08T06:24:07.402Z · Commit: f8efc20}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2af2534f35

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".