Webhook replay boundary

Use it before every handler or provider-integration release and after duplicate-effect or signature incidents. Four sibling probes verify that signatures bind the exact raw body, enforce signature and timestamp freshness, require explicit idempotency keys to be non-empty, stable across redeliveries, and unique across event IDs while covering provider retry horizons, and prove verification/claim/side-effect/ack ordering; a synthesis join exposes replay paths that isolated signature checks miss and orders fixes by severity. It reads JSON only, sends no webhook, executes no handler, writes no idempotency record, and makes no network calls. Run with input=evidence/webhook-scenarios.json or omit input for the bundled demo. Limits: HMAC-SHA256 is the portable modeled scheme, secrets in input should be synthetic or safely exported test material, database isolation and crash behavior are assessed only from declared scenario facts, an