@fabricorg/platform-host 7.5.0 → 7.6.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, ExecutionAttestation, ExternalReconciliation, PolicyObligation, PolicyObligationStatus, ModuleRegistry, ActionDefinition, AdapterImplementation, AdapterCircuitBreakerProvider, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
+import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, PolicyObligation, PolicyObligationStatus, ExecutionAttestation, ExternalReconciliation, ModuleRegistry, ActionDefinition, AdapterImplementation, AdapterCircuitBreakerProvider, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
 export { canonicalJson } from '@fabricorg/platform';
 import { AssemblyLockfile } from '@fabricorg/assembly';
 
@@ -264,6 +264,18 @@ interface ActionInvocationRecord {
     authorizationReconciliation?: AuthorizationReconciliationOutcome;
     /** Durable evidence when an adapter returned an ambiguous outcome requiring reconciliation. */
     adapterReconciliation?: AdapterReconciliationOutcome;
+    /**
+     * Transition Host validated for an idempotent after_adapters action, saved
+     * after handler/result/event validation inside a mutation transaction, or before
+     * the handler otherwise. Supports recovered StateTransitioned emission and is
+     * retained as evidence after completion.
+     */
+    pendingStateTransition?: {
+        entityType: string;
+        entityId: string;
+        fromState: string;
+        toState: string;
+    };
     /**
      * A handoff the host is waiting on. While present the invocation is
      * `running` without a lease: it is not stuck, it is somebody else's turn,
@@ -518,6 +530,19 @@ interface PlatformHostMutationTransaction<TDb> {
     getEntityState?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     updateLeasedActionInvocation?(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
+    /**
+     * Update an adapter row in this transaction, with the same optional
+     * tenant/space/invocation scope semantics as the store method. Host uses
+     * this to commit degraded adapter evidence and its terminal verdict together.
+     * Omit this member if the adapter row cannot share this transaction.
+     */
+    updateAdapterInvocation?: PlatformHostStore<TDb>["updateAdapterInvocation"];
+    /**
+     * Append governance reconciliation evidence in this transaction. Host uses
+     * this for degraded finalization when adapter output is withheld. Omit this
+     * member if governance evidence cannot share the event/verdict transaction.
+     */
+    appendExternalReconciliation?: GovernancePlatformHostStore<TDb>["appendExternalReconciliation"];
 }
 type OutboxStatus = "pending" | "published" | "dead_letter";
 type EventPayloadClassification = "public" | "internal" | "confidential" | "restricted";
@@ -819,7 +844,7 @@ interface ClaimActionInvocationsInput {
  * - `claimActionInvocations` must never claim a running invocation without a
  *   lease, which is what a parked invocation is.
  */
-type ActionInvocationPatch = Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation" | "pendingCompletion" | "externalCompletion">>;
+type ActionInvocationPatch = Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation" | "pendingStateTransition" | "pendingCompletion" | "externalCompletion">>;
 interface UpdateLeasedActionInvocationInput {
     id: string;
     tenantId: string;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, ExecutionAttestation, ExternalReconciliation, PolicyObligation, PolicyObligationStatus, ModuleRegistry, ActionDefinition, AdapterImplementation, AdapterCircuitBreakerProvider, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
+import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, PolicyObligation, PolicyObligationStatus, ExecutionAttestation, ExternalReconciliation, ModuleRegistry, ActionDefinition, AdapterImplementation, AdapterCircuitBreakerProvider, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
 export { canonicalJson } from '@fabricorg/platform';
 import { AssemblyLockfile } from '@fabricorg/assembly';
 
@@ -264,6 +264,18 @@ interface ActionInvocationRecord {
     authorizationReconciliation?: AuthorizationReconciliationOutcome;
     /** Durable evidence when an adapter returned an ambiguous outcome requiring reconciliation. */
     adapterReconciliation?: AdapterReconciliationOutcome;
+    /**
+     * Transition Host validated for an idempotent after_adapters action, saved
+     * after handler/result/event validation inside a mutation transaction, or before
+     * the handler otherwise. Supports recovered StateTransitioned emission and is
+     * retained as evidence after completion.
+     */
+    pendingStateTransition?: {
+        entityType: string;
+        entityId: string;
+        fromState: string;
+        toState: string;
+    };
     /**
      * A handoff the host is waiting on. While present the invocation is
      * `running` without a lease: it is not stuck, it is somebody else's turn,
@@ -518,6 +530,19 @@ interface PlatformHostMutationTransaction<TDb> {
     getEntityState?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     updateLeasedActionInvocation?(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
+    /**
+     * Update an adapter row in this transaction, with the same optional
+     * tenant/space/invocation scope semantics as the store method. Host uses
+     * this to commit degraded adapter evidence and its terminal verdict together.
+     * Omit this member if the adapter row cannot share this transaction.
+     */
+    updateAdapterInvocation?: PlatformHostStore<TDb>["updateAdapterInvocation"];
+    /**
+     * Append governance reconciliation evidence in this transaction. Host uses
+     * this for degraded finalization when adapter output is withheld. Omit this
+     * member if governance evidence cannot share the event/verdict transaction.
+     */
+    appendExternalReconciliation?: GovernancePlatformHostStore<TDb>["appendExternalReconciliation"];
 }
 type OutboxStatus = "pending" | "published" | "dead_letter";
 type EventPayloadClassification = "public" | "internal" | "confidential" | "restricted";
@@ -819,7 +844,7 @@ interface ClaimActionInvocationsInput {
  * - `claimActionInvocations` must never claim a running invocation without a
  *   lease, which is what a parked invocation is.
  */
-type ActionInvocationPatch = Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation" | "pendingCompletion" | "externalCompletion">>;
+type ActionInvocationPatch = Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation" | "pendingStateTransition" | "pendingCompletion" | "externalCompletion">>;
 interface UpdateLeasedActionInvocationInput {
     id: string;
     tenantId: string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { canonicalJson, AdapterRegistry, assertAdapterCircuitBreakerConfig, AdapterCircuitBreakerRegistry, isRetryableExecutionError, createFabricId, assertGovernanceRuntimeEvidence, FABRIC_GOVERNANCE_CONTRACT_VERSION, assertMutationGovernanceContext, evaluatePolicyDefinitions, aggregatePolicyOutcomes, evaluateStateMachineTransition, executeWithAdapterRetry, isAdapterCircuitOpenError, assertAdapterOutcomeConsistency } from '@fabricorg/platform';
+import { canonicalJson, AdapterRegistry, assertAdapterCircuitBreakerConfig, AdapterCircuitBreakerRegistry, isRetryableExecutionError, createFabricId, assertGovernanceRuntimeEvidence, FABRIC_GOVERNANCE_CONTRACT_VERSION, assertMutationGovernanceContext, evaluatePolicyDefinitions, aggregatePolicyOutcomes, evaluateStateMachineTransition, isReconciliationRequiredError, executeWithAdapterRetry, isAdapterCircuitOpenError, assertAdapterOutcomeConsistency } from '@fabricorg/platform';
 export { canonicalJson } from '@fabricorg/platform';
 import { performance } from 'perf_hooks';
 import { assertAssemblyRuntimeCompatible } from '@fabricorg/assembly';
@@ -1447,6 +1447,8 @@ function createGovernedActionHost(options) {
             throw new HostError("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
           }
           const binding = action.stateMachine;
+          let replayedTransition;
+          let pendingStateTransition;
           let validatedTransition;
           if (binding) {
             const machine = stateMachineResolver(binding.entityType);
@@ -1499,6 +1501,21 @@ function createGovernedActionHost(options) {
                 }
                 replayingAppliedTransition = source?.actionInvocationId === actionInvocationId && source.state === currentState;
               }
+              const pending = invocation.pendingStateTransition;
+              if (replayingAppliedTransition && pending && pending.entityType === binding.entityType && pending.entityId === entityId && pending.toState === currentState) {
+                replayedTransition = pending;
+              }
+              if (action.idempotent && transition.valid && entityId && action.eventPhase === "after_adapters") {
+                pendingStateTransition = {
+                  entityType: binding.entityType,
+                  entityId,
+                  fromState: currentState,
+                  toState: targetState
+                };
+                if (!transaction) {
+                  await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition });
+                }
+              }
               if (!transition.valid && !replayingAppliedTransition) {
                 throw transition.error != null ? new Error(transition.error) : new HostError("Invalid state transition");
               }
@@ -1552,7 +1569,7 @@ function createGovernedActionHost(options) {
             }
           }
           let transitionEvent;
-          if (binding && validatedTransition?.valid && validatedTransition.entityId) {
+          if (binding && validatedTransition?.entityId && (validatedTransition.valid || replayedTransition)) {
             const { entityId, currentState, targetState } = validatedTransition;
             const handlerEmittedTransition = events.some((event) => event.eventType === "StateTransitioned" && event.subjectType === binding.entityType && event.subjectId === entityId);
             if (!handlerEmittedTransition) {
@@ -1563,7 +1580,7 @@ function createGovernedActionHost(options) {
                 payload: {
                   entityType: binding.entityType,
                   entityId,
-                  fromState: currentState,
+                  fromState: replayedTransition?.fromState ?? currentState,
                   toState: targetState,
                   causedByAction: action.actionId
                 }
@@ -1573,6 +1590,9 @@ function createGovernedActionHost(options) {
           if (transitionEvent && action.eventPhase !== "after_adapters") {
             await appendEvent(invocation, transitionEvent, "state:transition", 1, transaction);
           }
+          if (transaction && pendingStateTransition) {
+            await transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, { pendingStateTransition });
+          }
           return { data: handlerData, domainEvents: events, pendingTransitionEvent: transitionEvent };
         };
         const atomicStore = asAtomicMutationStore(options.store);
@@ -1583,6 +1603,17 @@ function createGovernedActionHost(options) {
         domainEvents = executed.domainEvents;
         pendingTransitionEvent = executed.pendingTransitionEvent;
       } catch (error) {
+        if (isReconciliationRequiredError(error)) {
+          const message = caughtError({ actionId: invocation.actionId, source: "handler" }, error);
+          await persistInvocation(invocation, { status: "reconciliation_required", error: message });
+          return withConsistency({
+            actionInvocationId,
+            status: "reconciliation_required",
+            error: message,
+            ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
+            ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
+          }, action.actionId);
+        }
         return fail2(invocation, "failed", caughtError({ actionId: invocation.actionId, source: "handler" }, error));
       }
       const adapterInvocationScope = { tenantId: invocation.tenantId, spaceId: invocation.spaceId, actionInvocationId: invocation.id };
@@ -1650,7 +1681,7 @@ function createGovernedActionHost(options) {
           subjectId: adapterEventSubject.subjectId,
           payload: { adapterType: step.adapterType, operation: step.operation }
         }, `adapter:${stepIndex}:started`);
-        async function appendDegradedAdapterEvidence(outputWithheld, message, accepted, output, externalReference) {
+        async function appendDegradedAdapterEvidence(outputWithheld, message, accepted, output, externalReference, transaction) {
           if (accepted) {
             await appendEvent(invocation, {
               eventType: "ExternalOperationAccepted",
@@ -1662,7 +1693,7 @@ function createGovernedActionHost(options) {
                 externalReference: accepted.externalReference,
                 ...accepted.dueAt ? { dueAt: accepted.dueAt.toISOString() } : {}
               }
-            }, `adapter:${stepIndex}:accepted`);
+            }, `adapter:${stepIndex}:accepted`, 1, transaction);
           }
           await appendEvent(invocation, {
             eventType: "AdapterInvocationSucceeded",
@@ -1674,10 +1705,10 @@ function createGovernedActionHost(options) {
               input: recordedInput,
               ...outputWithheld ? { outputWithheld: true } : { output }
             }
-          }, `adapter:${stepIndex}:succeeded`);
+          }, `adapter:${stepIndex}:succeeded`, 1, transaction);
           const governanceStore2 = asGovernanceStore(options.store);
           if (outputWithheld && governanceStore2) {
-            await governanceStore2.appendExternalReconciliation({
+            await (transaction ?? governanceStore2).appendExternalReconciliation({
               id: lifecycleId("rec", actionInvocationId, `${adapter.vendor}:${adapterInvocationId}`),
               actionInvocationId,
               tenantId,
@@ -1691,6 +1722,52 @@ function createGovernedActionHost(options) {
             });
           }
         }
+        async function finalizeDegradedAdapterAtomically(patch, outputWithheld, message, accepted, output, externalReference) {
+          const atomicStore = asAtomicMutationStore(options.store);
+          if (!atomicStore) return false;
+          const needsReconciliation = outputWithheld && !!asGovernanceStore(options.store);
+          const previousStatus = invocation.status;
+          const finalize = () => atomicStore.transactionWithEvents(async (transaction) => {
+            if (!transaction.updateAdapterInvocation || needsReconciliation && !transaction.appendExternalReconciliation || invocation.leaseOwner && invocation.leaseToken !== void 0 && !transaction.updateLeasedActionInvocation) return false;
+            await appendDegradedAdapterEvidence(outputWithheld, message, accepted, output, externalReference, transaction);
+            await transaction.updateAdapterInvocation(adapterInvocationId, {
+              status: "succeeded",
+              ...outputWithheld ? {} : { output },
+              updatedAt: now()
+            }, adapterInvocationScope);
+            if (invocation.leaseOwner && invocation.leaseToken !== void 0) {
+              if (!transaction.updateLeasedActionInvocation) {
+                throw new HostError("Leased atomic finalization requires transaction-scoped fencing support.");
+              }
+              const updated = await transaction.updateLeasedActionInvocation({
+                id: actionInvocationId,
+                tenantId,
+                spaceId,
+                workerId: invocation.leaseOwner,
+                leaseToken: invocation.leaseToken,
+                patch
+              });
+              if (!updated) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
+            } else {
+              await transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, patch);
+            }
+            return true;
+          });
+          let committed;
+          try {
+            committed = await finalize();
+          } catch (error) {
+            if (error instanceof RecoverableFinalizationError) throw error;
+            try {
+              committed = await finalize();
+            } catch (retryError) {
+              if (retryError instanceof RecoverableFinalizationError) throw retryError;
+              return false;
+            }
+          }
+          if (committed) emitInvocationStatusTelemetry(invocation, patch.status, options.telemetry, now(), previousStatus);
+          return committed;
+        }
         const adapterErrorContext = { actionId: action.actionId, source: "adapter", adapterType: step.adapterType, operation: step.operation, provider: adapter.vendor };
         const executionErrorContext = { actionId: action.actionId, source: "execution" };
         let errorContext = executionErrorContext;
@@ -1850,9 +1927,13 @@ function createGovernedActionHost(options) {
                 ...deadlineMs2 ? { dueAt: new Date(acceptedAt.getTime() + deadlineMs2) } : {}
               } : void 0);
               try {
-                await persistReconciliationVerdict(invocation, { status: "reconciliation_required", error: message, ...pendingCompletion ? { pendingCompletion } : {} });
-                await appendDegradedAdapterEvidence(true, message, pendingCompletion?.adapterInvocationId === adapterInvocationId ? pendingCompletion : void 0, void 0, reference || void 0);
-                await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() }, adapterInvocationScope);
+                const patch = { status: "reconciliation_required", error: message, ...pendingCompletion ? { pendingCompletion } : {} };
+                const accepted = pendingCompletion?.adapterInvocationId === adapterInvocationId ? pendingCompletion : void 0;
+                if (!await finalizeDegradedAdapterAtomically(patch, true, message, accepted, void 0, reference || void 0)) {
+                  await persistReconciliationVerdict(invocation, patch);
+                  await appendDegradedAdapterEvidence(true, message, accepted, void 0, reference || void 0);
+                  await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() }, adapterInvocationScope);
+                }
               } catch {
                 throw new RecoverableFinalizationError(message);
               }
@@ -1880,13 +1961,18 @@ function createGovernedActionHost(options) {
             const completion = action.execution?.completion ?? "immediate";
             const refuse = completion === "immediate" ? `Adapter ${step.adapterType}:${step.operation} handed off external operation "${reference}" but ${action.actionId} declares immediate completion; the external effect may be in flight.` : pendingHandoff ? `Adapter ${step.adapterType}:${step.operation} handed off a second external operation "${reference}" while "${pendingHandoff.externalReference}" is already pending; one invocation waits on one completion.` : void 0;
             if (refuse) {
+              let adapterFinalizedAtomically;
               try {
-                await persistReconciliationVerdict(invocation, {
+                const patch = {
                   status: "reconciliation_required",
                   error: refuse,
                   ...pendingHandoff ? {} : { pendingCompletion: accepted }
-                });
-                await appendDegradedAdapterEvidence(false, refuse, pendingHandoff ? void 0 : accepted, output);
+                };
+                adapterFinalizedAtomically = await finalizeDegradedAdapterAtomically(patch, false, refuse, pendingHandoff ? void 0 : accepted, output);
+                if (!adapterFinalizedAtomically) {
+                  await persistReconciliationVerdict(invocation, patch);
+                  await appendDegradedAdapterEvidence(false, refuse, pendingHandoff ? void 0 : accepted, output);
+                }
               } catch {
                 throw new RecoverableFinalizationError(refuse);
               }
@@ -1898,7 +1984,7 @@ function createGovernedActionHost(options) {
                 await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { error });
               }
               try {
-                await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", output, updatedAt: now() }, adapterInvocationScope);
+                if (!adapterFinalizedAtomically) await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", output, updatedAt: now() }, adapterInvocationScope);
               } catch {
                 throw new RecoverableFinalizationError(refuse);
               }
@@ -2672,11 +2758,14 @@ var MemoryPlatformHostStore = class {
     await previous;
     let domainSnapshot;
     let snapshotCreated = false;
+    const undoLedgerWrites = [];
     try {
       domainSnapshot = transactionProvider.snapshot(this.db);
       snapshotCreated = true;
       const pendingEvents = [];
       const pendingUpdates = [];
+      const pendingAdapterUpdates = [];
+      const pendingReconciliations = [];
       const appendPending = async (event, metadata) => {
         if (this.events.some((candidate) => candidate.id === event.id) || pendingEvents.some((candidate) => candidate.event.id === event.id)) return;
         pendingEvents.push({ event, ...metadata ? { metadata } : {} });
@@ -2711,26 +2800,62 @@ var MemoryPlatformHostStore = class {
           }
           return state;
         },
+        updateAdapterInvocation: async (id, patch, scope) => {
+          if (!await this.getAdapterInvocation(id, scope)) throw new Error(`AdapterInvocation not found: ${id}`);
+          pendingAdapterUpdates.push([id, patch, scope]);
+        },
+        appendExternalReconciliation: async (record) => {
+          pendingReconciliations.push(record);
+        },
         updateActionInvocation: async (id, tenantId, spaceId, patch) => {
-          pendingUpdates.push({ id, tenantId, spaceId, patch });
+          pendingUpdates.push({ id, tenantId, spaceId, patch: copyInvocationPatch(patch) });
         },
         updateLeasedActionInvocation: async (input) => {
           const record = await this.getActionInvocation(input.id, input.tenantId, input.spaceId);
           if (!record || record.status !== "running" || record.leaseOwner !== input.workerId || record.leaseToken !== input.leaseToken) return false;
-          pendingUpdates.push({ id: input.id, tenantId: input.tenantId, spaceId: input.spaceId, patch: input.patch });
+          pendingUpdates.push({ id: input.id, tenantId: input.tenantId, spaceId: input.spaceId, patch: copyInvocationPatch(input.patch) });
           return true;
         }
       });
       for (const update of pendingUpdates) {
         if (!await this.getActionInvocation(update.id, update.tenantId, update.spaceId)) throw new Error(`ActionInvocation not found: ${update.id}`);
       }
+      const rememberRecord = (record) => {
+        const before = { ...record };
+        undoLedgerWrites.push(() => {
+          for (const key of Object.keys(record)) Reflect.deleteProperty(record, key);
+          Object.assign(record, before);
+        });
+      };
+      const rememberAppend = (rows, id) => {
+        if (!rows.some((row) => row.id === id)) undoLedgerWrites.push(() => {
+          const index = rows.findIndex((row) => row.id === id);
+          if (index !== -1) rows.splice(index, 1);
+        });
+      };
       for (const pending of pendingEvents) {
+        rememberAppend(this.events, pending.event.id);
+        rememberAppend(this.outbox, pending.event.id);
         if (pending.metadata) await this.appendEventWithOutbox(pending.event, pending.metadata);
         else await this.appendEvent(pending.event);
       }
-      for (const update of pendingUpdates) await this.updateActionInvocation(update.id, update.tenantId, update.spaceId, update.patch);
+      for (const record of pendingReconciliations) {
+        rememberAppend(this.externalReconciliations, record.id);
+        await this.appendExternalReconciliation(record);
+      }
+      for (const [id, patch, scope] of pendingAdapterUpdates) {
+        const record = await this.getAdapterInvocation(id, scope);
+        if (!record) throw new Error(`AdapterInvocation not found: ${id}`);
+        rememberRecord(record);
+        await this.updateAdapterInvocation(id, patch, scope);
+      }
+      for (const update of pendingUpdates) {
+        rememberRecord(await this.getActionInvocation(update.id, update.tenantId, update.spaceId));
+        await this.updateActionInvocation(update.id, update.tenantId, update.spaceId, update.patch);
+      }
       return result;
     } catch (error) {
+      for (const undo of undoLedgerWrites.reverse()) undo();
       if (snapshotCreated) transactionProvider.restore(this.db, domainSnapshot);
       throw error;
     } finally {
@@ -2758,6 +2883,10 @@ var MemoryPlatformHostStore = class {
     const record = await this.getActionInvocation(id, tenantId, spaceId);
     if (!record) throw new Error(`ActionInvocation not found: ${id}`);
     Object.assign(record, patch, { updatedAt: /* @__PURE__ */ new Date() });
+    if (Object.hasOwn(patch, "pendingStateTransition")) {
+      if (patch.pendingStateTransition) record.pendingStateTransition = { ...patch.pendingStateTransition };
+      else delete record.pendingStateTransition;
+    }
     if (Object.hasOwn(patch, "pendingCompletion") && patch.pendingCompletion === void 0) delete record.pendingCompletion;
     if (Object.hasOwn(patch, "externalCompletion") && patch.externalCompletion === void 0) delete record.externalCompletion;
     if (Object.hasOwn(patch, "error") && patch.error === void 0) delete record.error;
@@ -3045,6 +3174,9 @@ function cloneOutboxRequeue(requeue) {
     priorAvailableAt: new Date(requeue.priorAvailableAt)
   };
 }
+function copyInvocationPatch(patch) {
+  return { ...patch, ...patch.pendingStateTransition ? { pendingStateTransition: { ...patch.pendingStateTransition } } : {} };
+}
 async function applyPostgresMigrations(client, migrations) {
   const ordered = validateMigrations(migrations);
   const statements = ordered.map((migration) => migrationStatement(migration));
@@ -3141,7 +3273,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
           getEntityStateSource: (tenantId, spaceId, entityType, entityId) => scoped.getEntityStateSource(tenantId, spaceId, entityType, entityId),
           getEntityState: (tenantId, spaceId, entityType, entityId) => scoped.getEntityState(tenantId, spaceId, entityType, entityId),
           updateActionInvocation: (id, tenantId, spaceId, patch) => scoped.updateActionInvocation(id, tenantId, spaceId, patch),
-          updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input)
+          updateLeasedActionInvocation: (input) => scoped.updateLeasedActionInvocation(input),
+          updateAdapterInvocation: (id, patch, scope) => scoped.updateAdapterInvocation(id, patch, scope),
+          appendExternalReconciliation: (record) => scoped.appendExternalReconciliation(record)
         });
       });
     }
@@ -3324,6 +3458,13 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ALTER TABLE fabric_platform.action_invocations
 					ADD COLUMN admitted_at timestamptz;
 			`
+    }, {
+      version: 7,
+      name: "pending_state_transition",
+      sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN IF NOT EXISTS pending_state_transition jsonb;
+			`
     }]);
   }
   async transaction(run) {
@@ -3404,6 +3545,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $12::boolean THEN $13::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $12::boolean THEN ($13::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE external_completion END,
+			 pending_state_transition=CASE WHEN $16::boolean THEN $17::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
 			 lease_expires_at=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
@@ -3425,7 +3567,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "pendingCompletion"),
         patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
         Object.hasOwn(patch, "externalCompletion"),
-        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
+        Object.hasOwn(patch, "pendingStateTransition"),
+        patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
       ]
     );
   }
@@ -3977,6 +4121,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 pending_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE pending_completion END,
 			 completion_due_at=CASE WHEN $14::boolean THEN ($15::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
 			 external_completion=CASE WHEN $16::boolean THEN $17::jsonb ELSE external_completion END,
+			 pending_state_transition=CASE WHEN $18::boolean THEN $19::jsonb ELSE pending_state_transition END,
 			 lease_owner=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
 			 lease_expires_at=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
@@ -4002,7 +4147,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "pendingCompletion"),
         patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
         Object.hasOwn(patch, "externalCompletion"),
-        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null,
+        Object.hasOwn(patch, "pendingStateTransition"),
+        patch.pendingStateTransition ? JSON.stringify(patch.pendingStateTransition) : null
       ]
     );
     return result.rows.length === 1;
@@ -4101,6 +4248,7 @@ function toActionRecord(row) {
     ...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
     ...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
     ...row.adapter_reconciliation ? { adapterReconciliation: row.adapter_reconciliation } : {},
+    ...row.pending_state_transition ? { pendingStateTransition: row.pending_state_transition } : {},
     ...row.pending_completion ? { pendingCompletion: toPendingCompletion(row.pending_completion) } : {},
     ...row.external_completion ? { externalCompletion: toExternalCompletion(row.external_completion) } : {},
     ...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},