Setup steps
- Register the application's HTTPS callback URL for the tenant.
- Store each callback idempotently before returning a successful response.
- Treat the callback as a signal and verify status before critical fulfillment.
- Use the operations records to reconcile missing or conflicting updates.