Event capture and durable storage
Every inbound event is persisted before we acknowledge.
A crash on either side never drops an event. The provider sees a 2xx and stops retrying because we've already written the event to durable storage, signed the receipt, and stamped it with a trace context.