@fabricorg/platform-host 7.4.0 → 7.6.0

package/dist/index.cjs

@@ -309,6 +309,24 @@ function withoutPrivateHostFields(data, eventResultFields) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+var HostError = class extends Error {
+};
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function tryRedactErrorText(hook, context, message) {
+  if (!hook || message === "") return { success: true, text: message };
+  try {
+    const text = hook(context, message);
+    if (typeof text === "string" && text.length > 0) return { success: true, text };
+  } catch {
+  }
+  return { success: false };
+}
+function redactErrorText(hook, context, message) {
+  const result = tryRedactErrorText(hook, context, message);
+  return result.success ? result.text : "Error text withheld: the error-text redactor failed.";
+}
 function lifecycleId(prefix, invocationId, key) {
   const safeKey = key.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 96);
   return `${prefix}_${invocationId}_${safeKey}`;
@@ -371,7 +389,11 @@ function createExternalCompletionLifecycle(deps) {
       if (completion.provider !== void 0 && recorded.provider !== void 0 && completion.provider !== recorded.provider) {
         throw new ExternalCompletionError("provider_mismatch", `ActionInvocation ${actionInvocationId} was completed by "${recorded.provider}", not "${completion.provider}".`);
       }
-      const incomingDigest = completionDigest(completion, recorded.provider ?? completion.provider);
+      const provider = recorded.provider ?? completion.provider;
+      const rawDigest = completionDigest(completion, provider);
+      if (recorded.digest === rawDigest) return withConsistency(actionResult2(invocation), invocation.actionId);
+      completion = redactCompletion(invocation, completion, provider ?? "external");
+      const incomingDigest = completionDigest(completion, provider);
       if (recorded.digest === incomingDigest) {
         return withConsistency(actionResult2(invocation), invocation.actionId);
       }
@@ -401,8 +423,10 @@ function createExternalCompletionLifecycle(deps) {
     if (completion.provider !== void 0 && completion.provider !== pending.provider) {
       throw new ExternalCompletionError("provider_mismatch", `ActionInvocation ${actionInvocationId} awaits completion from "${pending.provider}", not "${completion.provider}".`);
     }
+    completion = redactCompletion(invocation, completion, completion.provider ?? pending.provider);
     const recordedAt = now();
     const externalCompletion = {
+      // completion has passed the hooks; retain the callback shape for compatibility.
       ...completion,
       provider: completion.provider ?? pending.provider,
       observedAt: completion.observedAt instanceof Date ? completion.observedAt.toISOString() : completion.observedAt,
@@ -423,7 +447,7 @@ function createExternalCompletionLifecycle(deps) {
       await deps.store.updateAdapterInvocation(pending.adapterInvocationId, {
         ...completion.result ? { output: withoutPrivateHostFields(completion.result, eventResultFields) } : {},
         updatedAt: recordedAt
-      });
+      }, { tenantId: invocation.tenantId, spaceId: invocation.spaceId, actionInvocationId: invocation.id });
       await appendEvent(invocation, {
         eventType: "ExternalOperationCompleted",
         ...subject,
@@ -435,7 +459,7 @@ function createExternalCompletionLifecycle(deps) {
       return withConsistency(actionResult2({ ...invocation, ...patch2, result: settles ? merged : invocation.result, ...settles ? { error: void 0 } : {} }), invocation.actionId);
     }
     const error = completion.error ?? `External operation "${pending.externalReference}" failed.`;
-    await deps.store.updateAdapterInvocation(pending.adapterInvocationId, { status: "failed", error, updatedAt: recordedAt });
+    await deps.store.updateAdapterInvocation(pending.adapterInvocationId, { status: "failed", error, updatedAt: recordedAt }, { tenantId: invocation.tenantId, spaceId: invocation.spaceId, actionInvocationId: invocation.id });
     await appendEvent(invocation, {
       eventType: "ExternalOperationFailed",
       ...subject,
@@ -446,6 +470,30 @@ function createExternalCompletionLifecycle(deps) {
     if (settles) emitInvocationStatusTelemetry(invocation, "failed", deps.telemetry, now(), invocation.status);
     return withConsistency(actionResult2({ ...invocation, ...patch }), invocation.actionId);
   }
+  function redactCompletion(invocation, completion, provider) {
+    let result = completion.result;
+    if (result && deps.redactExternalCompletionResult) {
+      try {
+        result = deps.redactExternalCompletionResult(invocation.actionId, provider, result);
+        if (!isRecord(result)) throw new HostError("Completion result redactor must return a non-null, non-array object.");
+      } catch {
+        throw new ExternalCompletionError("redaction_failed", "External completion result withheld: the result redactor failed; nothing was recorded.");
+      }
+    }
+    const error = completion.error == null ? void 0 : tryRedactErrorText(
+      deps.redactErrorText,
+      { actionId: invocation.actionId, source: "external_completion", provider },
+      completion.error
+    );
+    if (error && !error.success) {
+      throw new ExternalCompletionError("redaction_failed", "External completion error withheld: the error-text redactor failed; nothing was recorded.");
+    }
+    return {
+      ...completion,
+      ...completion.result !== void 0 ? { result } : {},
+      ...error?.success ? { error: error.text } : {}
+    };
+  }
   function completionDigest(completion, provider) {
     return crypto.createHash("sha256").update(platform.canonicalJson({
       provider: provider ?? null,
@@ -458,7 +506,7 @@ function createExternalCompletionLifecycle(deps) {
   }
   async function recordCompletionReconciliation(invocation, completion, reason) {
     const governanceStore = asGovernanceStore(deps.store);
-    if (!governanceStore) throw new Error("External completion reconciliation requires a governance-capable store.");
+    if (!governanceStore) throw new HostError("External completion reconciliation requires a governance-capable store.");
     const provider = completion.provider ?? invocation.pendingCompletion?.provider ?? invocation.externalCompletion?.provider ?? "external";
     const seed = crypto.createHash("sha256").update(`${provider}\0${completion.externalReference}\0${completion.kind ?? "refused"}`).digest("hex").slice(0, 32);
     await governanceStore.appendExternalReconciliation({
@@ -478,10 +526,10 @@ function createExternalCompletionLifecycle(deps) {
   async function reconcileOverdueCompletions(input = {}) {
     const recoverable = deps.store;
     if (!recoverable.listActionInvocations) {
-      throw new Error("Overdue completion reconciliation requires a store that can list invocations.");
+      throw new HostError("Overdue completion reconciliation requires a store that can list invocations.");
     }
     if (!asGovernanceStore(deps.store)) {
-      throw new Error("Overdue completion reconciliation requires a governance-capable store to record its findings.");
+      throw new HostError("Overdue completion reconciliation requires a governance-capable store to record its findings.");
     }
     const current = input.now ?? now();
     const candidates = await recoverable.listActionInvocations({
@@ -856,6 +904,10 @@ var ADMISSION_FAILED = Object.freeze({ kind: "failed" });
 var ADMISSION_TIMED_OUT = Object.freeze({ kind: "timed_out" });
 var ADMISSION_REFUSAL_CODE = /^[a-z][A-Za-z0-9_.:-]{0,127}$/;
 function createGovernedActionHost(options) {
+  const retryableExecutionMaxAttempts = options.retryableExecutionMaxAttempts ?? 5;
+  if (!Number.isInteger(retryableExecutionMaxAttempts) || retryableExecutionMaxAttempts <= 0) {
+    throw new Error("retryableExecutionMaxAttempts must be a positive integer.");
+  }
   if (options.composition) {
     if (!options.registry?.orderedModules) {
       throw new Error("Composition-bound Platform Host requires an explicit module registry.");
@@ -892,6 +944,9 @@ function createGovernedActionHost(options) {
   if (typeof admissionTimeoutMs !== "number" || !Number.isInteger(admissionTimeoutMs) || admissionTimeoutMs < 1 || admissionTimeoutMs > MAX_TIMER_MS) {
     throw new Error(`admissionTimeoutMs must be a whole number of milliseconds from 1 to ${MAX_TIMER_MS}.`);
   }
+  function caughtError(context, error) {
+    return error instanceof HostError ? errorMessage(error) : redactErrorText(options.redactErrorText, context, errorMessage(error));
+  }
   async function submitAction(input) {
     const read = snapshotSubmission(input);
     if (read.executionReason && !["initial", "offline_replay"].includes(read.executionReason)) {
@@ -1189,6 +1244,7 @@ function createGovernedActionHost(options) {
       spaceId,
       attributes: { actionVersion: invocation.actionVersion }
     });
+    let retryableGovernance = true;
     try {
       const parsed = action.schema.safeParse(invocation.parameters);
       if (!parsed.success) {
@@ -1341,6 +1397,7 @@ function createGovernedActionHost(options) {
         mode: "execute",
         now: now()
       });
+      retryableGovernance = false;
       for (const outcome of outcomes) {
         await options.store.appendPolicyEvaluation({
           id: lifecycleId("pol", actionInvocationId, outcome.policyId),
@@ -1384,12 +1441,16 @@ function createGovernedActionHost(options) {
       }
       let data;
       let domainEvents = [];
+      let pendingTransitionEvent;
       try {
         const runHandler = async (db, transaction) => {
           if (options.outbox && !transaction?.appendEventWithOutbox) {
-            throw new Error("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
+            throw new HostError("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
           }
           const binding = action.stateMachine;
+          let replayedTransition;
+          let pendingStateTransition;
+          let validatedTransition;
           if (binding) {
             const machine = stateMachineResolver(binding.entityType);
             const entityId = binding.getEntityId(parsed.data);
@@ -1419,9 +1480,45 @@ function createGovernedActionHost(options) {
                   db
                 }
               );
-              const replayingAppliedTransition = action.idempotent && currentState === targetState;
+              validatedTransition = { entityId, currentState, targetState, valid: transition.valid };
+              let replayingAppliedTransition = false;
+              if (action.idempotent && currentState === targetState && !transition.valid && entityId) {
+                let source;
+                if (transaction?.getEntityStateSource) {
+                  source = await transaction.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId);
+                } else if (options.store.getEntityStateSource) {
+                  source = await options.store.getEntityStateSource(tenantId, spaceId, binding.entityType, entityId);
+                } else {
+                  const eventStore = options.store;
+                  const listEvents = transaction?.listEvents?.bind(transaction) ?? eventStore.listEvents?.bind(eventStore);
+                  const events2 = listEvents ? await listEvents(tenantId, spaceId) : [];
+                  let latest;
+                  for (const event of events2) {
+                    if (event.tenantId === tenantId && event.spaceId === spaceId && event.subjectType === binding.entityType && event.subjectId === entityId && typeof event.payload?.toState === "string" && (!latest || event.sequence > latest.sequence)) latest = event;
+                  }
+                  if (latest && typeof latest.actionInvocationId === "string") {
+                    source = { state: latest.payload.toState, actionInvocationId: latest.actionInvocationId };
+                  }
+                }
+                replayingAppliedTransition = source?.actionInvocationId === actionInvocationId && source.state === currentState;
+              }
+              const pending = invocation.pendingStateTransition;
+              if (replayingAppliedTransition && pending && pending.entityType === binding.entityType && pending.entityId === entityId && pending.toState === currentState) {
+                replayedTransition = pending;
+              }
+              if (action.idempotent && transition.valid && entityId && action.eventPhase === "after_adapters") {
+                pendingStateTransition = {
+                  entityType: binding.entityType,
+                  entityId,
+                  fromState: currentState,
+                  toState: targetState
+                };
+                if (!transaction) {
+                  await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition });
+                }
+              }
               if (!transition.valid && !replayingAppliedTransition) {
-                throw new Error(transition.error ?? "Invalid state transition");
+                throw transition.error != null ? new Error(transition.error) : new HostError("Invalid state transition");
               }
             }
           }
@@ -1442,14 +1539,14 @@ function createGovernedActionHost(options) {
             parsed.data
           ) : { success: true, data: {} };
           if (!handlerResult.success) {
-            throw new Error(handlerResult.error ?? "Action handler failed");
+            throw handlerResult.error != null ? new Error(handlerResult.error) : new HostError("Action handler failed");
           }
           const handlerData = handlerResult.data ?? {};
           if (action.resultSchema) {
             const publicResult = withoutPrivateHostFields(handlerData, eventResultFields);
             const parsedResult = action.resultSchema.safeParse(publicResult);
             if (!parsedResult.success) {
-              throw new Error(`Action result validation failed at ${parsedResult.error.issues.map((issue) => issue.path.map(String).join(".") || "result").join(", ")}`);
+              throw new HostError(`Action result validation failed at ${parsedResult.error.issues.map((issue) => issue.path.map(String).join(".") || "result").join(", ")}`);
             }
           }
           const events = extractEvents(handlerData);
@@ -1457,7 +1554,7 @@ function createGovernedActionHost(options) {
             (event) => !action.emitsEvents.includes(event.eventType)
           );
           if (undeclaredEvent) {
-            throw new Error(
+            throw new HostError(
               `${action.actionId} emitted undeclared event type ${undeclaredEvent.eventType}`
             );
           }
@@ -1472,7 +1569,32 @@ function createGovernedActionHost(options) {
               );
             }
           }
-          return { data: handlerData, domainEvents: events };
+          let transitionEvent;
+          if (binding && validatedTransition?.entityId && (validatedTransition.valid || replayedTransition)) {
+            const { entityId, currentState, targetState } = validatedTransition;
+            const handlerEmittedTransition = events.some((event) => event.eventType === "StateTransitioned" && event.subjectType === binding.entityType && event.subjectId === entityId);
+            if (!handlerEmittedTransition) {
+              transitionEvent = {
+                eventType: "StateTransitioned",
+                subjectType: binding.entityType,
+                subjectId: entityId,
+                payload: {
+                  entityType: binding.entityType,
+                  entityId,
+                  fromState: replayedTransition?.fromState ?? currentState,
+                  toState: targetState,
+                  causedByAction: action.actionId
+                }
+              };
+            }
+          }
+          if (transitionEvent && action.eventPhase !== "after_adapters") {
+            await appendEvent(invocation, transitionEvent, "state:transition", 1, transaction);
+          }
+          if (transaction && pendingStateTransition) {
+            await transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition });
+          }
+          return { data: handlerData, domainEvents: events, pendingTransitionEvent: transitionEvent };
         };
         const atomicStore = asAtomicMutationStore(options.store);
         const executed = atomicStore ? await atomicStore.transactionWithEvents(
@@ -1480,9 +1602,22 @@ function createGovernedActionHost(options) {
         ) : await options.store.transaction((db) => runHandler(db));
         data = executed.data;
         domainEvents = executed.domainEvents;
+        pendingTransitionEvent = executed.pendingTransitionEvent;
       } catch (error) {
-        return fail2(invocation, "failed", errorMessage(error));
+        if (platform.isReconciliationRequiredError(error)) {
+          const message = caughtError({ actionId: invocation.actionId, source: "handler" }, error);
+          await persistInvocation(invocation, { status: "reconciliation_required", error: message });
+          return withConsistency({
+            actionInvocationId,
+            status: "reconciliation_required",
+            error: message,
+            ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
+            ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
+          }, action.actionId);
+        }
+        return fail2(invocation, "failed", caughtError({ actionId: invocation.actionId, source: "handler" }, error));
       }
+      const adapterInvocationScope = { tenantId: invocation.tenantId, spaceId: invocation.spaceId, actionInvocationId: invocation.id };
       let pendingHandoff = invocation.pendingCompletion;
       for (const [stepIndex, step] of (action.adapterSteps ?? []).entries()) {
         const input = step.getInput(parsed.data, data);
@@ -1490,12 +1625,13 @@ function createGovernedActionHost(options) {
         const adapter = adapters.require(step.adapterType, step.operation);
         const adapterInvocationId = lifecycleId("adp", actionInvocationId, String(stepIndex));
         const previousAdapterInvocation = await options.store.getAdapterInvocation(
-          adapterInvocationId
+          adapterInvocationId,
+          adapterInvocationScope
         );
         if (previousAdapterInvocation?.status === "succeeded") continue;
         if (pendingHandoff?.adapterInvocationId === adapterInvocationId) {
           const subject = options.adapterEventSubject?.(action.actionId, parsed.data, data) ?? { subjectType: "AdapterInvocation", subjectId: adapterInvocationId };
-          await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() });
+          await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() }, adapterInvocationScope);
           await appendEvent(invocation, {
             eventType: "ExternalOperationAccepted",
             subjectType: subject.subjectType,
@@ -1529,9 +1665,7 @@ function createGovernedActionHost(options) {
         const startedAt = now();
         const record = {
           id: adapterInvocationId,
-          actionInvocationId,
-          tenantId,
-          spaceId,
+          ...adapterInvocationScope,
           adapterType: step.adapterType,
           operation: step.operation,
           vendor: adapter.vendor,
@@ -1548,6 +1682,96 @@ function createGovernedActionHost(options) {
           subjectId: adapterEventSubject.subjectId,
           payload: { adapterType: step.adapterType, operation: step.operation }
         }, `adapter:${stepIndex}:started`);
+        async function appendDegradedAdapterEvidence(outputWithheld, message, accepted, output, externalReference, transaction) {
+          if (accepted) {
+            await appendEvent(invocation, {
+              eventType: "ExternalOperationAccepted",
+              subjectType: adapterEventSubject.subjectType,
+              subjectId: adapterEventSubject.subjectId,
+              payload: {
+                adapterType: step.adapterType,
+                operation: step.operation,
+                externalReference: accepted.externalReference,
+                ...accepted.dueAt ? { dueAt: accepted.dueAt.toISOString() } : {}
+              }
+            }, `adapter:${stepIndex}:accepted`, 1, transaction);
+          }
+          await appendEvent(invocation, {
+            eventType: "AdapterInvocationSucceeded",
+            subjectType: adapterEventSubject.subjectType,
+            subjectId: adapterEventSubject.subjectId,
+            payload: {
+              adapterType: step.adapterType,
+              operation: step.operation,
+              input: recordedInput,
+              ...outputWithheld ? { outputWithheld: true } : { output }
+            }
+          }, `adapter:${stepIndex}:succeeded`, 1, transaction);
+          const governanceStore2 = asGovernanceStore(options.store);
+          if (outputWithheld && governanceStore2) {
+            await (transaction ?? governanceStore2).appendExternalReconciliation({
+              id: lifecycleId("rec", actionInvocationId, `${adapter.vendor}:${adapterInvocationId}`),
+              actionInvocationId,
+              tenantId,
+              spaceId,
+              status: "pending",
+              provider: adapter.vendor,
+              ...externalReference ?? accepted?.externalReference ? { externalOperationId: externalReference ?? accepted?.externalReference } : {},
+              attempt: 1,
+              reason: message,
+              observedAt: now()
+            });
+          }
+        }
+        async function finalizeDegradedAdapterAtomically(patch, outputWithheld, message, accepted, output, externalReference) {
+          const atomicStore = asAtomicMutationStore(options.store);
+          if (!atomicStore) return false;
+          const needsReconciliation = outputWithheld && !!asGovernanceStore(options.store);
+          const previousStatus = invocation.status;
+          const finalize = () => atomicStore.transactionWithEvents(async (transaction) => {
+            if (!transaction.updateAdapterInvocation || needsReconciliation && !transaction.appendExternalReconciliation || invocation.leaseOwner && invocation.leaseToken !== void 0 && !transaction.updateLeasedActionInvocation) return false;
+            await appendDegradedAdapterEvidence(outputWithheld, message, accepted, output, externalReference, transaction);
+            await transaction.updateAdapterInvocation(adapterInvocationId, {
+              status: "succeeded",
+              ...outputWithheld ? {} : { output },
+              updatedAt: now()
+            }, adapterInvocationScope);
+            if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
+              if (!transaction.updateLeasedActionInvocation) {
+                throw new HostError("Leased atomic finalization requires transaction-scoped fencing support.");
+              }
+              const updated = await transaction.updateLeasedActionInvocation({
+                id: actionInvocationId,
+                tenantId,
+                spaceId,
+                workerId: invocation.leaseOwner,
+                leaseToken: invocation.leaseToken,
+                patch
+              });
+              if (!updated) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
+            } else {
+              await transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, patch);
+            }
+            return true;
+          });
+          let committed;
+          try {
+            committed = await finalize();
+          } catch (error) {
+            if (error instanceof RecoverableFinalizationError) throw error;
+            try {
+              committed = await finalize();
+            } catch (retryError) {
+              if (retryError instanceof RecoverableFinalizationError) throw retryError;
+              return false;
+            }
+          }
+          if (committed) emitInvocationStatusTelemetry(invocation, patch.status, options.telemetry, now(), previousStatus);
+          return committed;
+        }
+        const adapterErrorContext = { actionId: action.actionId, source: "adapter", adapterType: step.adapterType, operation: step.operation, provider: adapter.vendor };
+        const executionErrorContext = { actionId: action.actionId, source: "execution" };
+        let errorContext = executionErrorContext;
         let adapterDeadlineTimer;
         try {
           const adapterController = options.adapterDeadlineMs ? new AbortController() : void 0;
@@ -1555,15 +1779,15 @@ function createGovernedActionHost(options) {
           if (adapterController && deadlineMs) {
             const remaining = deadlineMs - now().getTime();
             if (remaining <= 0) {
-              throw new Error(`Adapter deadline already expired before execution: ${step.adapterType}:${step.operation}`);
+              throw new HostError(`Adapter deadline already expired before execution: ${step.adapterType}:${step.operation}`);
             }
             adapterDeadlineTimer = setTimeout(
-              () => adapterController.abort(new Error("Adapter deadline exceeded")),
+              () => adapterController.abort(new HostError("Adapter deadline exceeded")),
               remaining
             );
             adapterDeadlineTimer.unref?.();
           }
-          const circuitBreaker = circuitBreakers.forAdapter(adapter);
+          const circuitBreaker = circuitBreakers.forAdapter(adapter, { tenantId, spaceId });
           const result2 = await platform.executeWithAdapterRetry({
             ...circuitBreaker ? { circuitBreaker } : {},
             policy: step.retryPolicy ?? adapter.retryPolicy,
@@ -1571,13 +1795,15 @@ function createGovernedActionHost(options) {
             // Every await before the call happens here, before breaker
             // admission, so nothing awaits between admission and the adapter.
             prepareAttempt: async (attempt) => {
+              errorContext = executionErrorContext;
               await options.store.updateAdapterInvocation(adapterInvocationId, {
                 attempt,
                 updatedAt: now()
-              });
+              }, adapterInvocationScope);
             },
-            execute: (attempt, maxAttempts) => {
-              return adapter.execute(input, {
+            execute: async (attempt, maxAttempts) => {
+              errorContext = adapterErrorContext;
+              const adapterResult = await adapter.execute(input, {
                 tenantId,
                 spaceId,
                 actionInvocationId,
@@ -1589,6 +1815,8 @@ function createGovernedActionHost(options) {
                 ...deadlineMs ? { deadlineMs } : {},
                 ...adapterController ? { signal: adapterController.signal } : {}
               });
+              errorContext = executionErrorContext;
+              return adapterResult;
             },
             isSuccessful: (result3) => result3.success,
             getError: (result3) => result3.error,
@@ -1601,19 +1829,23 @@ function createGovernedActionHost(options) {
               return "transient_failure";
             }
           });
+          errorContext = adapterErrorContext;
           platform.assertAdapterOutcomeConsistency(result2);
+          errorContext = executionErrorContext;
           if (!result2.success) {
+            const resultError = result2.error == null ? result2.error : redactErrorText(options.redactErrorText, adapterErrorContext, result2.error);
             const outcome = result2.outcome ?? "transient_failure";
             if (outcome === "ambiguous") {
               const evidence = result2.outcomeEvidence;
-              const message = result2.error ?? "Adapter outcome is ambiguous; external effect may or may not have been applied";
+              const reason = evidence?.reason == null ? resultError : redactErrorText(options.redactErrorText, adapterErrorContext, evidence.reason);
+              const message = resultError ?? "Adapter outcome is ambiguous; external effect may or may not have been applied";
               const adapterReconciliation = {
                 kind: "adapter_outcome_ambiguous",
                 adapterType: step.adapterType,
                 operation: step.operation,
                 vendor: adapter.vendor,
                 adapterInvocationId,
-                ...evidence?.reason ?? result2.error ? { reason: evidence?.reason ?? result2.error } : {},
+                ...evidence?.reason ?? result2.error ? { reason } : {},
                 ...evidence?.externalReference ? { externalReference: evidence.externalReference } : {},
                 message
               };
@@ -1621,7 +1853,7 @@ function createGovernedActionHost(options) {
                 status: "ambiguous",
                 error: message,
                 updatedAt: now()
-              });
+              }, adapterInvocationScope);
               await appendEvent(invocation, {
                 eventType: "AdapterInvocationAmbiguous",
                 subjectType: adapterEventSubject.subjectType,
@@ -1659,24 +1891,56 @@ function createGovernedActionHost(options) {
             }
             await options.store.updateAdapterInvocation(adapterInvocationId, {
               status: "failed",
-              error: result2.error ?? "Adapter failed",
+              error: resultError ?? "Adapter failed",
               updatedAt: now()
-            });
+            }, adapterInvocationScope);
             await appendEvent(invocation, {
               eventType: "AdapterInvocationFailed",
               subjectType: adapterEventSubject.subjectType,
               subjectId: adapterEventSubject.subjectId,
               payload: { adapterType: step.adapterType, operation: step.operation }
             }, `adapter:${stepIndex}:failed`);
-            return fail2(invocation, "failed", result2.error ?? "Adapter failed");
+            return fail2(invocation, "failed", resultError ?? "Adapter failed");
           }
           const resultRecord = result2;
-          const output = isRecord(resultRecord.output) ? resultRecord.output : Object.fromEntries(
+          let output = isRecord(resultRecord.output) ? resultRecord.output : Object.fromEntries(
             Object.entries(resultRecord).filter(
               ([key]) => key !== "success" && key !== "error"
             )
           );
           const handoff = result2.acceptedExternalOperation;
+          if (options.redactAdapterOutput) {
+            try {
+              output = options.redactAdapterOutput(action.actionId, step.adapterType, step.operation, output);
+              if (!isRecord(output)) throw new HostError("Adapter output redactor must return a non-null, non-array object.");
+            } catch {
+              const message = "Adapter output withheld: the output redactor failed after the external effect; reconciliation required.";
+              const reference = typeof handoff?.externalReference === "string" ? handoff.externalReference.trim() : "";
+              const acceptedAt = now();
+              const deadlineMs2 = action.execution?.completionDeadlineMs;
+              const pendingCompletion = pendingHandoff ?? (reference ? {
+                provider: adapter.vendor,
+                adapterType: step.adapterType,
+                operation: step.operation,
+                adapterInvocationId,
+                externalReference: reference,
+                acceptedAt,
+                ...deadlineMs2 ? { dueAt: new Date(acceptedAt.getTime() + deadlineMs2) } : {}
+              } : void 0);
+              try {
+                const patch = { status: "reconciliation_required", error: message, ...pendingCompletion ? { pendingCompletion } : {} };
+                const accepted = pendingCompletion?.adapterInvocationId === adapterInvocationId ? pendingCompletion : void 0;
+                if (!await finalizeDegradedAdapterAtomically(patch, true, message, accepted, void 0, reference || void 0)) {
+                  await persistReconciliationVerdict(invocation, patch);
+                  await appendDegradedAdapterEvidence(true, message, accepted, void 0, reference || void 0);
+                  await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() }, adapterInvocationScope);
+                }
+              } catch {
+                throw new RecoverableFinalizationError(message);
+              }
+              return withConsistency({ actionInvocationId, status: "reconciliation_required", error: message, ...pendingCompletion ? { pendingCompletion } : {} }, action.actionId);
+            }
+          }
           if (handoff) {
             const reference = typeof handoff.externalReference === "string" ? handoff.externalReference.trim() : "";
             if (reference === "") {
@@ -1698,19 +1962,33 @@ function createGovernedActionHost(options) {
             const completion = action.execution?.completion ?? "immediate";
             const refuse = completion === "immediate" ? `Adapter ${step.adapterType}:${step.operation} handed off external operation "${reference}" but ${action.actionId} declares immediate completion; the external effect may be in flight.` : pendingHandoff ? `Adapter ${step.adapterType}:${step.operation} handed off a second external operation "${reference}" while "${pendingHandoff.externalReference}" is already pending; one invocation waits on one completion.` : void 0;
             if (refuse) {
-              await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", output, updatedAt: now() });
-              await persistInvocation(invocation, {
-                status: "reconciliation_required",
-                error: refuse,
-                ...pendingHandoff ? {} : { pendingCompletion: accepted }
-              });
+              let adapterFinalizedAtomically;
+              try {
+                const patch = {
+                  status: "reconciliation_required",
+                  error: refuse,
+                  ...pendingHandoff ? {} : { pendingCompletion: accepted }
+                };
+                adapterFinalizedAtomically = await finalizeDegradedAdapterAtomically(patch, false, refuse, pendingHandoff ? void 0 : accepted, output);
+                if (!adapterFinalizedAtomically) {
+                  await persistReconciliationVerdict(invocation, patch);
+                  await appendDegradedAdapterEvidence(false, refuse, pendingHandoff ? void 0 : accepted, output);
+                }
+              } catch {
+                throw new RecoverableFinalizationError(refuse);
+              }
               let error = refuse;
               try {
                 await externalCompletion.recordCompletionReconciliation(invocation, { externalReference: reference, provider: adapter.vendor }, refuse);
               } catch (logError) {
-                error = `${refuse} Reconciliation log unavailable: ${errorMessage(logError)}`;
+                error = `${refuse} Reconciliation log unavailable: ${caughtError({ actionId: invocation.actionId, source: "execution" }, logError)}`;
                 await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { error });
               }
+              try {
+                if (!adapterFinalizedAtomically) await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", output, updatedAt: now() }, adapterInvocationScope);
+              } catch {
+                throw new RecoverableFinalizationError(refuse);
+              }
               return withConsistency({
                 actionInvocationId,
                 status: "reconciliation_required",
@@ -1737,7 +2015,7 @@ function createGovernedActionHost(options) {
             status: "succeeded",
             output,
             updatedAt: now()
-          });
+          }, adapterInvocationScope);
           if (options.extractExecutionAttestation) {
             const attestation = await options.extractExecutionAttestation({
               actionInvocationId,
@@ -1766,12 +2044,13 @@ function createGovernedActionHost(options) {
             }
           }, `adapter:${stepIndex}:succeeded`);
         } catch (error) {
-          const message = errorMessage(error);
+          if (error instanceof RecoverableFinalizationError) throw error;
+          const message = caughtError(platform.isAdapterCircuitOpenError(error) ? adapterErrorContext : errorContext, error);
           await options.store.updateAdapterInvocation(adapterInvocationId, {
             status: "failed",
             error: message,
             updatedAt: now()
-          });
+          }, adapterInvocationScope);
           if (platform.isAdapterCircuitOpenError(error)) {
             await appendEvent(invocation, {
               eventType: "AdapterInvocationFailed",
@@ -1802,7 +2081,7 @@ function createGovernedActionHost(options) {
             try {
               await externalCompletion.recordCompletionReconciliation(invocation, { externalReference: pendingHandoff.externalReference, provider: pendingHandoff.provider, kind: "obligations" }, message);
             } catch (logError) {
-              error = `${message} Reconciliation log unavailable: ${errorMessage(logError)}`;
+              error = `${message} Reconciliation log unavailable: ${caughtError({ actionId: invocation.actionId, source: "execution" }, logError)}`;
               await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { error });
             }
             return withConsistency({ actionInvocationId, status: "reconciliation_required", error, pendingCompletion: pendingHandoff }, action.actionId);
@@ -1826,9 +2105,12 @@ function createGovernedActionHost(options) {
                 transaction
               );
             }
+            if (pendingTransitionEvent) {
+              await appendEvent(invocation, pendingTransitionEvent, "state:transition", 1, transaction);
+            }
             if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
               if (!transaction.updateLeasedActionInvocation) {
-                throw new Error("Leased atomic finalization requires transaction-scoped fencing support.");
+                throw new HostError("Leased atomic finalization requires transaction-scoped fencing support.");
               }
               const updated = await transaction.updateLeasedActionInvocation({
                 id: actionInvocationId,
@@ -1861,6 +2143,9 @@ function createGovernedActionHost(options) {
             for (const [index, event] of domainEvents.entries()) {
               await appendEvent(invocation, event, `domain:${index}`, action.version);
             }
+            if (pendingTransitionEvent) {
+              await appendEvent(invocation, pendingTransitionEvent, "state:transition", 1);
+            }
           }
           await persistInvocation(invocation, finalPatch);
         }
@@ -1880,7 +2165,15 @@ function createGovernedActionHost(options) {
       };
     } catch (error) {
       if (error instanceof RecoverableFinalizationError) throw error;
-      return fail2(invocation, "failed", errorMessage(error));
+      if (retryableGovernance && platform.isRetryableExecutionError(error)) {
+        const reason = executionReasonOverride === "approval_resume" ? "approval resume" : !invocation.leaseOwner || invocation.leaseToken === void 0 ? "not leased" : !action.idempotent ? "action not idempotent" : invocation.attemptCount >= retryableExecutionMaxAttempts ? `attempts exhausted (${invocation.attemptCount}/${retryableExecutionMaxAttempts})` : void 0;
+        if (!reason) throw error;
+        return fail2(invocation, "failed", caughtError(
+          { actionId: invocation.actionId, source: "execution" },
+          new Error(`Retryable execution not retried: ${reason}; ${errorMessage(error)}`)
+        ));
+      }
+      return fail2(invocation, "failed", caughtError({ actionId: invocation.actionId, source: "execution" }, error));
     }
   }
   async function resumeApprovedInvocation(actionInvocationId, tenantId, spaceId, decision) {
@@ -1963,9 +2256,9 @@ function createGovernedActionHost(options) {
   }
   async function recordExecutionAttestation(actionInvocationId, tenantId, spaceId, attestation, adapterInvocationId) {
     const governanceStore = asGovernanceStore(options.store);
-    if (!governanceStore) throw new Error("Execution attestations require a governance-capable store.");
+    if (!governanceStore) throw new HostError("Execution attestations require a governance-capable store.");
     const invocation = await options.store.getActionInvocation(actionInvocationId, tenantId, spaceId);
-    if (!invocation) throw new Error(`ActionInvocation not found: ${actionInvocationId}`);
+    if (!invocation) throw new HostError(`ActionInvocation not found: ${actionInvocationId}`);
     const id = lifecycleId("att", actionInvocationId, adapterInvocationId ?? `${attestation.provider}:${attestation.operation}:${attestation.externalOperationId ?? "external"}`);
     await governanceStore.appendExecutionAttestation({
       ...attestation,
@@ -2043,11 +2336,11 @@ function createGovernedActionHost(options) {
         ...traceContext ? { traceContext } : {}
       };
       if (transaction) {
-        if (!transaction.appendEventWithOutbox) throw new Error("Outbox egress requires an atomic transaction with appendEventWithOutbox.");
+        if (!transaction.appendEventWithOutbox) throw new HostError("Outbox egress requires an atomic transaction with appendEventWithOutbox.");
         await transaction.appendEventWithOutbox(envelope, metadata);
       } else {
         const outboxStore = asOutboxStore(options.store);
-        if (!outboxStore) throw new Error("Outbox egress requires an outbox-capable Platform Host store.");
+        if (!outboxStore) throw new HostError("Outbox egress requires an outbox-capable Platform Host store.");
         await outboxStore.appendEventWithOutbox(envelope, metadata);
       }
     } else {
@@ -2064,12 +2357,20 @@ function createGovernedActionHost(options) {
       ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
     };
   }
+  async function persistReconciliationVerdict(invocation, patch) {
+    try {
+      await persistInvocation(invocation, patch);
+    } catch (error) {
+      if (error instanceof RecoverableFinalizationError) throw error;
+      await persistInvocation(invocation, patch);
+    }
+  }
   async function persistInvocation(invocation, patch) {
     const previousStatus = invocation.status;
     if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
       const recoverable = options.store;
       if (!recoverable.updateLeasedActionInvocation) {
-        throw new Error("Leased execution requires a fencing-capable PlatformHostStore.");
+        throw new HostError("Leased execution requires a fencing-capable PlatformHostStore.");
       }
       const updated = await recoverable.updateLeasedActionInvocation({
         id: invocation.id,
@@ -2094,6 +2395,8 @@ function createGovernedActionHost(options) {
   const externalCompletion = createExternalCompletionLifecycle({
     store: options.store,
     telemetry: options.telemetry,
+    redactErrorText: options.redactErrorText,
+    redactExternalCompletionResult: options.redactExternalCompletionResult,
     eventResultFields,
     now,
     actionResolver,
@@ -2174,9 +2477,6 @@ function initialState(machine) {
 function isTerminal(status) {
   return ["completed", "failed", "blocked_by_policy", "reconciliation_required", "validation_failed"].includes(status);
 }
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function isAdmissionTime(value) {
   return value instanceof Date && Number.isFinite(value.getTime());
 }
@@ -2459,11 +2759,14 @@ var MemoryPlatformHostStore = class {
     await previous;
     let domainSnapshot;
     let snapshotCreated = false;
+    const undoLedgerWrites = [];
     try {
       domainSnapshot = transactionProvider.snapshot(this.db);
       snapshotCreated = true;
       const pendingEvents = [];
       const pendingUpdates = [];
+      const pendingAdapterUpdates = [];
+      const pendingReconciliations = [];
       const appendPending = async (event, metadata) => {
         if (this.events.some((candidate) => candidate.id === event.id) || pendingEvents.some((candidate) => candidate.event.id === event.id)) return;
         pendingEvents.push({ event, ...metadata ? { metadata } : {} });
@@ -2479,6 +2782,15 @@ var MemoryPlatformHostStore = class {
         appendEventWithOutbox: (event, metadata) => appendPending(event, metadata),
         nextEventSequence: async (tenantId, spaceId) => (await this.listEvents(tenantId, spaceId)).length + pendingEvents.filter((candidate) => candidate.event.tenantId === tenantId && candidate.event.spaceId === spaceId).length + 1,
         listEvents: async (tenantId, spaceId) => [...await this.listEvents(tenantId, spaceId), ...pendingEvents.map((candidate) => candidate.event).filter((event) => event.tenantId === tenantId && event.spaceId === spaceId)],
+        getEntityStateSource: async (tenantId, spaceId, entityType, entityId) => {
+          let source = await this.getEntityStateSource(tenantId, spaceId, entityType, entityId);
+          for (const { event } of pendingEvents) {
+            if (event.tenantId !== tenantId || event.spaceId !== spaceId || event.subjectType !== entityType || event.subjectId !== entityId) continue;
+            const state = event.payload?.toState;
+            if (typeof state === "string") source = typeof event.actionInvocationId === "string" ? { state, actionInvocationId: event.actionInvocationId } : void 0;
+          }
+          return source;
+        },
         getEntityState: async (tenantId, spaceId, entityType, entityId) => {
           let state = await this.getEntityState(tenantId, spaceId, entityType, entityId);
           for (const pending of pendingEvents) {
@@ -2489,26 +2801,62 @@ var MemoryPlatformHostStore = class {
           }
           return state;
         },
+        updateAdapterInvocation: async (id, patch, scope) => {
+          if (!await this.getAdapterInvocation(id, scope)) throw new Error(`AdapterInvocation not found: ${id}`);
+          pendingAdapterUpdates.push([id, patch, scope]);
+        },
+        appendExternalReconciliation: async (record) => {
+          pendingReconciliations.push(record);
+        },
         updateActionInvocation: async (id, tenantId, spaceId, patch) => {
-          pendingUpdates.push({ id, tenantId, spaceId, patch });
+          pendingUpdates.push({ id, tenantId, spaceId, patch: copyInvocationPatch(patch) });
         },
         updateLeasedActionInvocation: async (input) => {
           const record = await this.getActionInvocation(input.id, input.tenantId, input.spaceId);
           if (!record || record.status !== "running" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken) return false;
-          pendingUpdates.push({ id: input.id, tenantId: input.tenantId, spaceId: input.spaceId, patch: input.patch });
+          pendingUpdates.push({ id: input.id, tenantId: input.tenantId, spaceId: input.spaceId, patch: copyInvocationPatch(input.patch) });
           return true;
         }
       });
       for (const update of pendingUpdates) {
         if (!await this.getActionInvocation(update.id, update.tenantId, update.spaceId)) throw new Error(`ActionInvocation not found: ${update.id}`);
       }
+      const rememberRecord = (record) => {
+        const before = { ...record };
+        undoLedgerWrites.push(() => {
+          for (const key of Object.keys(record)) Reflect.deleteProperty(record, key);
+          Object.assign(record, before);
+        });
+      };
+      const rememberAppend = (rows, id) => {
+        if (!rows.some((row) => row.id === id)) undoLedgerWrites.push(() => {
+          const index = rows.findIndex((row) => row.id === id);
+          if (index !== -1) rows.splice(index, 1);
+        });
+      };
       for (const pending of pendingEvents) {
+        rememberAppend(this.events, pending.event.id);
+        rememberAppend(this.outbox, pending.event.id);
         if (pending.metadata) await this.appendEventWithOutbox(pending.event, pending.metadata);
         else await this.appendEvent(pending.event);
       }
-      for (const update of pendingUpdates) await this.updateActionInvocation(update.id, update.tenantId, update.spaceId, update.patch);
+      for (const record of pendingReconciliations) {
+        rememberAppend(this.externalReconciliations, record.id);
+        await this.appendExternalReconciliation(record);
+      }
+      for (const [id, patch, scope] of pendingAdapterUpdates) {
+        const record = await this.getAdapterInvocation(id, scope);
+        if (!record) throw new Error(`AdapterInvocation not found: ${id}`);
+        rememberRecord(record);
+        await this.updateAdapterInvocation(id, patch, scope);
+      }
+      for (const update of pendingUpdates) {
+        rememberRecord(await this.getActionInvocation(update.id, update.tenantId, update.spaceId));
+        await this.updateActionInvocation(update.id, update.tenantId, update.spaceId, update.patch);
+      }
       return result;
     } catch (error) {
+      for (const undo of undoLedgerWrites.reverse()) undo();
       if (snapshotCreated) transactionProvider.restore(this.db, domainSnapshot);
       throw error;
     } finally {
@@ -2536,6 +2884,10 @@ var MemoryPlatformHostStore = class {
     const record = await this.getActionInvocation(id, tenantId, spaceId);
     if (!record) throw new Error(`ActionInvocation not found: ${id}`);
     Object.assign(record, patch, { updatedAt: /* @__PURE__ */ new Date() });
+    if (Object.hasOwn(patch, "pendingStateTransition")) {
+      if (patch.pendingStateTransition) record.pendingStateTransition = { ...patch.pendingStateTransition };
+      else delete record.pendingStateTransition;
+    }
     if (Object.hasOwn(patch, "pendingCompletion") && patch.pendingCompletion === void 0) delete record.pendingCompletion;
     if (Object.hasOwn(patch, "externalCompletion") && patch.externalCompletion === void 0) delete record.externalCompletion;
     if (Object.hasOwn(patch, "error") && patch.error === void 0) delete record.error;
@@ -2626,11 +2978,11 @@ var MemoryPlatformHostStore = class {
     if (this.adapterInvocations.some((candidate) => candidate.id === record.id)) return;
     this.adapterInvocations.push(record);
   }
-  async getAdapterInvocation(id) {
-    return this.adapterInvocations.find((candidate) => candidate.id === id);
+  async getAdapterInvocation(id, scope) {
+    return this.adapterInvocations.find((candidate) => candidate.id === id && (scope === void 0 || candidate.tenantId === scope.tenantId && candidate.spaceId === scope.spaceId && candidate.actionInvocationId === scope.actionInvocationId));
   }
-  async updateAdapterInvocation(id, patch) {
-    const record = this.adapterInvocations.find((candidate) => candidate.id === id);
+  async updateAdapterInvocation(id, patch, scope) {
+    const record = this.adapterInvocations.find((candidate) => candidate.id === id && (scope === void 0 || candidate.tenantId === scope.tenantId && candidate.spaceId === scope.spaceId && candidate.actionInvocationId === scope.actionInvocationId));
     if (!record) throw new Error(`AdapterInvocation not found: ${id}`);
     Object.assign(record, patch);
   }
@@ -2735,6 +3087,15 @@ var MemoryPlatformHostStore = class {
   async nextEventSequence(tenantId, spaceId) {
     return this.events.filter((event) => event.tenantId === tenantId && event.spaceId === spaceId).length + 1;
   }
+  async getEntityStateSource(tenantId, spaceId, entityType, entityId) {
+    let source;
+    for (const event of this.events) {
+      if (event.tenantId !== tenantId || event.spaceId !== spaceId || event.subjectType !== entityType || event.subjectId !== entityId) continue;
+      const state = event.payload?.toState;
+      if (typeof state === "string") source = typeof event.actionInvocationId === "string" ? { state, actionInvocationId: event.actionInvocationId } : void 0;
+    }
+    return source;
+  }
   async getEntityState(tenantId, spaceId, entityType, entityId) {
     let state;
     for (const event of this.events) {
@@ -2814,6 +3175,9 @@ function cloneOutboxRequeue(requeue) {
     priorAvailableAt: new Date(requeue.priorAvailableAt)
   };
 }
+function copyInvocationPatch(patch) {
+  return { ...patch, ...patch.pendingStateTransition ? { pendingStateTransition: { ...patch.pendingStateTransition } } : {} };
+}
 async function applyPostgresMigrations(client, migrations) {
   const ordered = validateMigrations(migrations);
   const statements = ordered.map((migration) => migrationStatement(migration));
@@ -2907,9 +3271,12 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
           appendEventWithOutbox: (event, metadata) => scoped.appendEventWithOutbox(event, metadata),
           nextEventSequence: (tenantId, spaceId) => scoped.nextEventSequence(tenantId, spaceId),
           listEvents: (tenantId, spaceId) => scoped.listEvents(tenantId, spaceId),
+          getEntityStateSource: (tenantId, spaceId, entityType, entityId) => scoped.getEntityStateSource(tenantId, spaceId, entityType, entityId),
           getEntityState: (tenantId, spaceId, entityType, entityId) => scoped.getEntityState(tenantId, spaceId, entityType, entityId),
           updateActionInvocation: (id, tenantId, spaceId, patch) => scoped.updateActionInvocation(id, tenantId, spaceId, patch),
-          updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input)
+          updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input),
+          updateAdapterInvocation: (id, patch, scope) => scoped.updateAdapterInvocation(id, patch, scope),
+          appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record)
         });
       });
     }
@@ -3092,6 +3459,13 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ALTER TABLE fabric_platform.action_invocations
 					ADD COLUMN admitted_at timestamptz;
 			`
+    }, {
+      version: 7,
+      name: "pending_state_transition",
+      sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN IF NOT EXISTS pending_state_transition jsonb;
+			`
     }]);
   }
   async transaction(run) {
@@ -3172,6 +3546,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $12::boolean THEN $13::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $12::boolean THEN ($13::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE external_completion END,
+			 pending_state_transition=CASE WHEN $16::boolean THEN $17::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
 			 lease_expires_at=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
@@ -3193,7 +3568,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "pendingCompletion"),
         patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
         Object.hasOwn(patch, "externalCompletion"),
-        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
+        Object.hasOwn(patch, "pendingStateTransition"),
+        patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
       ]
     );
   }
@@ -3360,19 +3737,19 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       ]
     );
   }
-  async getAdapterInvocation(id) {
+  async getAdapterInvocation(id, scope) {
     const result = await this.sql.query(
-      `SELECT * FROM fabric_platform.adapter_invocations WHERE id=$1`,
-      [id]
+      `SELECT * FROM fabric_platform.adapter_invocations WHERE id=$1${scope ? " AND tenant_id=$2 AND space_id=$3 AND action_invocation_id=$4" : ""}`,
+      [id, ...scope ? [scope.tenantId, scope.spaceId, scope.actionInvocationId] : []]
     );
     return result.rows[0] ? toAdapterRecord(result.rows[0]) : void 0;
   }
-  async updateAdapterInvocation(id, patch) {
+  async updateAdapterInvocation(id, patch, scope) {
     await this.sql.query(
       `UPDATE fabric_platform.adapter_invocations SET
 			 status=COALESCE($2,status), output=COALESCE($3::jsonb,output),
 			 error=CASE WHEN $4::boolean THEN $5 ELSE error END,
-			 attempt=COALESCE($6,attempt), updated_at=COALESCE($7,now()) WHERE id=$1`,
+			 attempt=COALESCE($6,attempt), updated_at=COALESCE($7,now()) WHERE id=$1${scope ? " AND tenant_id=$8 AND space_id=$9 AND action_invocation_id=$10" : ""}`,
       [
         id,
         patch.status ?? null,
@@ -3380,7 +3757,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "error"),
         patch.error ?? null,
         patch.attempt ?? null,
-        patch.updatedAt ?? null
+        patch.updatedAt ?? null,
+        ...scope ? [scope.tenantId, scope.spaceId, scope.actionInvocationId] : []
       ]
     );
   }
@@ -3611,6 +3989,16 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     );
     return Number(result.rows[0].next_sequence);
   }
+  async getEntityStateSource(tenantId, spaceId, entityType, entityId) {
+    const result = await this.sql.query(
+      `SELECT payload->>'toState' AS state, action_invocation_id FROM fabric_platform.asset_events
+			 WHERE tenant_id=$1 AND space_id=$2 AND subject_type=$3 AND subject_id=$4
+			 AND payload ? 'toState' ORDER BY sequence DESC LIMIT 1`,
+      [tenantId, spaceId, entityType, entityId]
+    );
+    const row = result.rows[0];
+    return typeof row?.state === "string" && typeof row.action_invocation_id === "string" ? { state: row.state, actionInvocationId: row.action_invocation_id } : void 0;
+  }
   async getEntityState(tenantId, spaceId, entityType, entityId) {
     const result = await this.sql.query(
       `SELECT payload->>'toState' AS state FROM fabric_platform.asset_events
@@ -3734,6 +4122,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $14::boolean THEN ($15::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $16::boolean THEN $17::jsonb ELSE external_completion END,
+			 pending_state_transition=CASE WHEN $18::boolean THEN $19::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
 			 lease_expires_at=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
@@ -3759,7 +4148,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "pendingCompletion"),
         patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
         Object.hasOwn(patch, "externalCompletion"),
-        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
+        Object.hasOwn(patch, "pendingStateTransition"),
+        patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
       ]
     );
     return result.rows.length === 1;
@@ -3858,6 +4249,7 @@ function toActionRecord(row) {
     ...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
     ...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
     ...row.adapter_reconciliation ? { adapterReconciliation: row.adapter_reconciliation } : {},
+    ...row.pending_state_transition ? { pendingStateTransition: row.pending_state_transition } : {},
     ...row.pending_completion ? { pendingCompletion: toPendingCompletion(row.pending_completion) } : {},
     ...row.external_completion ? { externalCompletion: toExternalCompletion(row.external_completion) } : {},
     ...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},
@@ -4003,8 +4395,6 @@ function toOutboxRequeueRecord(row, prefix) {
     priorLeaseToken: Number(field("prior_lease_token"))
   };
 }
-
-// src/worker.ts
 var DEFAULT_BATCH_SIZE = 10;
 var DEFAULT_LEASE_DURATION_MS = 5 * 6e4;
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
@@ -4053,6 +4443,7 @@ async function runPlatformActionWorkerCycle(options) {
   let completed = 0;
   let failed = 0;
   let waitingForApproval = 0;
+  let deferred = 0;
   for (const invocation of claimed) {
     const stopHeartbeat = startLeaseHeartbeat(options, invocation, leaseDurationMs);
     try {
@@ -4066,7 +4457,8 @@ async function runPlatformActionWorkerCycle(options) {
       else if (result2.status === "waiting_for_approval") waitingForApproval += 1;
       else failed += 1;
     } catch (error) {
-      failed += 1;
+      if (platform.isRetryableExecutionError(error)) deferred += 1;
+      else failed += 1;
       options.onError?.(error, invocation);
     } finally {
       await stopHeartbeat();
@@ -4076,7 +4468,8 @@ async function runPlatformActionWorkerCycle(options) {
     claimed: claimed.length,
     completed,
     failed,
-    ...waitingForApproval > 0 ? { waitingForApproval } : {}
+    ...waitingForApproval > 0 ? { waitingForApproval } : {},
+    ...deferred > 0 ? { deferred } : {}
   };
   emitWorkerTelemetry(options.telemetry, "worker.cycle.completed", options.workerId, result);
   return result;
@@ -4303,6 +4696,32 @@ function submitInput(subject, scope, idempotencyKey) {
     idempotencyKey
   };
 }
+async function adapterProbe(subject) {
+  await subject.reset?.();
+  if (subject.ours.tenantId === subject.theirs.tenantId) fail("the two scopes must be in different tenants");
+  const suffix = globalThis.crypto.randomUUID();
+  const scope = {
+    tenantId: subject.ours.tenantId,
+    spaceId: `iso-probe-${suffix}`,
+    actionInvocationId: `iso_act_${suffix}`
+  };
+  const id = `iso_adp_${suffix}`;
+  const now = /* @__PURE__ */ new Date();
+  await subject.store.createAdapterInvocation({
+    id,
+    ...scope,
+    adapterType: "iso",
+    operation: "probe",
+    vendor: "iso",
+    status: "running",
+    input: {},
+    output: { probe: true },
+    attempt: 1,
+    createdAt: now,
+    updatedAt: now
+  });
+  return { id, scope };
+}
 function tenantIsolationChecks() {
   return [
     {
@@ -4447,6 +4866,54 @@ function tenantIsolationChecks() {
         if (leaked.length > 0) fail(`a viewer in the other tenant saw ${leaked.length} of our rows`);
         return [theirs.allowed ? "other tenant's viewer sees none of our rows" : "other tenant's viewer is denied"];
       }
+    },
+    {
+      id: "fabric.tenancy.adapter-invocation-read-scoped.v1",
+      async run(subject) {
+        const { id, scope } = await adapterProbe(subject);
+        try {
+          const theirs = { ...scope, tenantId: subject.theirs.tenantId, spaceId: subject.theirs.spaceId };
+          if (await subject.store.getAdapterInvocation(id, { ...scope, tenantId: subject.theirs.tenantId })) fail("an adapter invocation was readable under another tenant's scope");
+          if (await subject.store.getAdapterInvocation(id, theirs)) fail("an adapter invocation was readable under another tenant's scope");
+          if (await subject.store.getAdapterInvocation(id, { ...scope, spaceId: `${scope.spaceId}-other` })) fail("an adapter invocation was readable under another space's scope");
+          if (await subject.store.getAdapterInvocation(id, { ...scope, actionInvocationId: `${scope.actionInvocationId}-other` })) fail("an adapter invocation was readable under another action invocation's scope");
+          const ours = await subject.store.getAdapterInvocation(id, scope);
+          if (!ours || ours.id !== id || ours.tenantId !== scope.tenantId || ours.spaceId !== scope.spaceId || ours.actionInvocationId !== scope.actionInvocationId) fail("our own adapter invocation was not readable under our scope, so the check proves nothing");
+        } finally {
+          await subject.store.updateAdapterInvocation(id, { status: "failed", error: "tenant isolation probe; retired", updatedAt: /* @__PURE__ */ new Date() }, scope);
+        }
+        return ["adapter invocation readable under our scope and invisible outside it"];
+      }
+    },
+    {
+      id: "fabric.tenancy.adapter-invocation-write-scoped.v1",
+      async run(subject) {
+        const { id, scope } = await adapterProbe(subject);
+        const shape = (record) => JSON.stringify({ status: record.status, error: record.error, output: record.output, attempt: record.attempt });
+        try {
+          const before = await subject.store.getAdapterInvocation(id, scope);
+          if (!before) fail("our own adapter invocation was not readable under our scope, so the check proves nothing");
+          const untouched = shape(before);
+          for (const other of [
+            { ...scope, tenantId: subject.theirs.tenantId, spaceId: subject.theirs.spaceId },
+            { ...scope, tenantId: subject.theirs.tenantId },
+            { ...scope, spaceId: `${scope.spaceId}-other` },
+            { ...scope, actionInvocationId: `${scope.actionInvocationId}-other` }
+          ]) {
+            try {
+              await subject.store.updateAdapterInvocation(id, { status: "failed", error: "iso probe", updatedAt: /* @__PURE__ */ new Date() }, other);
+            } catch {
+            }
+            const after = await subject.store.getAdapterInvocation(id, scope);
+            if (!after || shape(after) !== untouched) fail("an adapter invocation changed under another scope");
+          }
+          await subject.store.updateAdapterInvocation(id, { status: "succeeded", updatedAt: /* @__PURE__ */ new Date() }, scope);
+          if ((await subject.store.getAdapterInvocation(id, scope))?.status !== "succeeded") fail("our own adapter invocation was not updated under our scope, so the check proves nothing");
+        } finally {
+          await subject.store.updateAdapterInvocation(id, { status: "failed", error: "tenant isolation probe; retired", updatedAt: /* @__PURE__ */ new Date() }, scope);
+        }
+        return ["adapter invocation untouched outside our scope and writable under ours"];
+      }
     }
   ];
 }