A stable order identity
Every order coming from Custom API / Headless keeps a stable external identifier and idempotency key. A replayed webhook or API call must never create a second order. This also protects retries after timeouts or network errors.
