Separate access from notifications
Treat a download entitlement and its notification email as separate records. A repeated payment event should find the existing entitlement for the order and product, rather than create a second license. This is a proposed implementation pattern, not a claim about an existing Web3Cart feature.
Use a stable fulfillment key
Define a unique key from the store, order line and entitlement type. Check that payment is verified under the store’s configured policy before granting access. Enforce uniqueness in storage; a read followed by an insert alone can race when two workers run together.
Recover without granting twice
Record delivery state and notification state separately. If email fails after access is created, retry the notification using the existing access record. Keep personal data and download secrets out of routine logs. Route conflicting order or payment references to review.
Test the awkward sequence
Send the same verified event twice, then send two copies concurrently. Expect one entitlement. Simulate an email failure after entitlement creation and retry: access should remain unchanged. Finally send an unverified event; it should grant no access. Record the expected and observed outcomes before enabling automatic fulfillment.