Diagnosis
- Missing events — check the endpoint returns 2xx within the timeout
- Duplicates — expected; deduplicate on event id
- Signature failures — verify against the raw body before parsing
- Local development — expose your endpoint over HTTPS with a tunnel