The flipped signature payload between orders and subscriptions is exactly the kind of thing that eats a day. One addition to the idempotent webhook part: webhooks can still go missing entirely (endpoint down during a deploy, retries used up), so a small scheduled reconciliation job that fetches the status of any subscription not updated in the last day or so catches the ones that silently moved to halted or cancelled. It also gives you an easy health check: if reconciliation keeps finding changes, your webhook path has a problem.