payments has no unique index on external_id, so the onConflict:'external_id' upsert was unreliable and fell back to an insert that stripped external_id -- creating duplicate, non-idempotent rows on every re-sync, and not tenant-scoped. Now: look up which PayPal transaction ids already exist in THIS space and insert only the new rows (external_id preserved). No schema change.