Protect webhook consumers against duplicate delivery and out-of-order carrier events.
Replay defense and ordering control are different jobs. Replays are handled with event IDs, deduplication ledgers, and idempotent consumers. Ordering is handled with timestamps, versions, sequence numbers, or a monotonic status projection. One control does not replace the other.
Carrier webhooks are often eventually consistent, so your downstream state machine must tolerate valid status updates arriving late. Preserve the raw timeline for debugging even if your public shipment state stays monotonic.