DePix received without a matching checkout

Sent when a DePix payment lands on the merchant's direct-rail address and cannot be tied to a checkout (wrong amount typed, payment after the grace window, several candidate checkouts, or a second payment for an already settled one). The funds are in the merchant's wallet; nothing is credited automatically, and the receipt is listed for manual reconciliation in the merchant app. Delivered to the merchant's default callback URL. Outbound POST to the merchant's callback URL, signed with X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256> where the HMAC is computed over "${t}.${raw body}" with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use data.event_id to deduplicate. Respond with any 2xx quickly to acknowledge.