Stage one: the notice arrives
Signature checked, store recognised, one indexed row written, accepted. No admin call, no cache write, no parsing. The row is not a copy of the product — it is a note saying look at this identifier in this store, and none of the product fields in the notice are kept.
That last detail is the security-relevant one. The store name arrives in a header that sits outside the signature, so it is treated as an address rather than as evidence: the truth about the product is read later from that store’s own API with that store’s own credentials. A misaddressed note can at worst ask one store about an identifier it does not have, which returns nothing.
Stage two: the hourly run
Once an hour the accumulated rows are processed together: the changed products are fetched, only those records are replaced, and the envelope is rewritten once rather than once per product.
A run handles up to 250 products, so a very large edit finishes across consecutive runs instead of being dropped or attempted all at once.
A store that has never been set up cannot create rows at all: if there is no knowledge base for it the notice is refused and nothing is written, so an unrecognised store cannot fill the queue.