create-safest-tools 0.6.0 → 0.7.0

package/template/src/workflow-actions.ts

@@ -1,3 +1,6 @@
+import { reconcileAppealCompletion } from "./appeal-continuity";
+import { correctionReviewerEligible } from "./appeal-correction-state";
+import { workflowRunEventType } from "./workflow-event-transport";
 import { canonicalJson } from "./audit";
 import { BudgetControlError, reserveBudgets, settleBudgets } from "./budget-control";
 import { ConnectionExecutionError, executeConnectionJson } from "./connection-egress";
@@ -35,6 +38,8 @@ interface ActionComponentRow {
 interface ProposalRow {
   id: string;
   installationId: string;
+  integrationId: string;
+  appealId: string | null;
   reportId: string;
   runId: string;
   stepRunId: string;
@@ -54,9 +59,15 @@ interface ProposalRow {
   deliveryAttemptCount: number;
   deliveryTerminal: number;
   lastErrorCode: string | null;
+  acceptedAt: string | null;
+  confirmedAt: string | null;
+  confirmationDeadlineAt: string | null;
+  deliveryCycle: number;
+  cycleStartAttempt: number;
 }
 
 const ACTION_MAX_ATTEMPTS = 8;
+const ACTION_CONFIRMATION_TIMEOUT_MS = 15 * 60_000;
 
 export class RetryableActionProposalError extends Error {
   constructor(readonly delaySeconds: number) {
@@ -147,6 +158,7 @@ export async function prepareWorkflowAction(
     branchKey: string;
     stepRunId: string;
     authorityMode: WorkflowAuthorityMode;
+    awaitRecovery?: boolean;
   },
 ): Promise<Record<string, unknown>> {
   if (input.authorityMode === "shadow" || input.authorityMode === "off") throw new WorkflowEffectError("action_authority_insufficient");
@@ -170,14 +182,25 @@ export async function prepareWorkflowAction(
   const proposalId = `${input.stepRunId}:proposal`;
   const operationId = `action:${input.runId}:${input.node.id}:${input.branchKey || "main"}:${mapped.idempotency_key}`;
   const existing = await env.DB.prepare(`
-    SELECT id, state, payload_digest AS payloadDigest,
+    SELECT id, state, payload_digest AS payloadDigest, preconditions_json AS preconditionsJson,
       approval_policy_json AS approvalPolicyJson,
       delivery_terminal AS deliveryTerminal, last_error_code AS lastErrorCode
     FROM action_proposals WHERE operation_id = ?1 LIMIT 1
   `).bind(operationId).first<{
-    id: string; state: string; payloadDigest: string; approvalPolicyJson: string;
+    id: string; state: string; payloadDigest: string; preconditionsJson: string; approvalPolicyJson: string;
     deliveryTerminal: number; lastErrorCode: string | null;
   }>();
+  if (typeof preconditions.decision_code === "string" && preconditions.latest_decision_id === undefined) {
+    if (existing) {
+      const pinnedDecision = parsedObject(existing.preconditionsJson).latest_decision_id;
+      if (pinnedDecision !== undefined) preconditions.latest_decision_id = pinnedDecision;
+    } else {
+      const decision = await env.DB.prepare(`SELECT id, decision_code AS code FROM decisions WHERE report_id = ?1 ORDER BY created_at DESC, rowid DESC LIMIT 1`)
+        .bind(context.reportId).first<{ id: string; code: string }>();
+      if (!decision || decision.code !== preconditions.decision_code) throw new WorkflowEffectError("action_precondition_changed");
+      preconditions.latest_decision_id = decision.id;
+    }
+  }
   const policy = approvalMode(input.node, component, input.authorityMode);
   const expiresSeconds = Number(input.node.config.expiry_seconds ?? 86_400);
   if (!Number.isInteger(expiresSeconds) || expiresSeconds < 60 || expiresSeconds > 2_678_400) throw new WorkflowEffectError("action_expiry_invalid");
@@ -202,6 +225,8 @@ export async function prepareWorkflowAction(
     if (existing.state === "rejected") return { port: "rejected", proposalId: existing.id, payloadDigest, idempotentReplay: true };
     if (existing.state === "cancelled") return { port: "timeout", proposalId: existing.id, payloadDigest, idempotentReplay: true };
     if (existing.state === "failed" && existing.deliveryTerminal === 1) {
+      const expiry = parsedObject(existing.approvalPolicyJson).expires_at;
+      if (input.awaitRecovery && typeof expiry === "string" && expiry > now()) return { ...deliveryPending(existing.id, payloadDigest, expiry), recoveryRequired: true };
       return { port: "error", proposalId: existing.id, payloadDigest, errorCode: existing.lastErrorCode ?? "action_delivery_failed", idempotentReplay: true };
     }
     if (existing.state === "approval_required") {
@@ -226,13 +251,14 @@ export async function prepareWorkflowAction(
       id, installation_id, report_id, run_id, step_run_id, action_code,
       target_json, payload_json, preconditions_json, payload_digest,
       component_version_id, authority_mode, approval_policy_json, state,
-      operation_id, created_by_type, created_by_id, next_attempt_at, created_at, updated_at
-    ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, 'system', ?4, ?17, ?16, ?16)
+      operation_id, created_by_type, created_by_id, next_attempt_at, created_at, updated_at, decision_id
+    ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, 'system', ?4, ?17, ?16, ?16, (SELECT id FROM decisions WHERE id = ?18 AND report_id = ?3))
   `).bind(
     proposalId, context.installationId, context.reportId, input.runId, input.stepRunId,
     actionCode, canonicalJson(target), canonicalJson(payload), canonicalJson(preconditions),
     payloadDigest, componentVersionId, input.authorityMode, canonicalJson(approvalPolicy),
     initialState, operationId, timestamp, policy === "human" ? null : timestamp,
+    typeof preconditions.latest_decision_id === "string" ? preconditions.latest_decision_id : null,
   )];
   if (policy === "human") {
     const taskId = `${input.stepRunId}:action-approval-task`;
@@ -263,7 +289,7 @@ export async function prepareWorkflowAction(
 
 async function loadProposal(db: D1Database, proposalId: string): Promise<ProposalRow> {
   const proposal = await db.prepare(`
-    SELECT p.id, p.installation_id AS installationId, p.report_id AS reportId,
+    SELECT p.id, p.installation_id AS installationId, p.report_id AS reportId, p.appeal_id AS appealId,
       p.run_id AS runId, p.step_run_id AS stepRunId, p.action_code AS actionCode,
       p.target_json AS targetJson, p.payload_json AS payloadJson,
       p.preconditions_json AS preconditionsJson, p.payload_digest AS payloadDigest,
@@ -271,7 +297,10 @@ async function loadProposal(db: D1Database, proposalId: string): Promise<Proposa
       p.approval_policy_json AS approvalPolicyJson, p.state, p.operation_id AS operationId,
       r.workflow_version_id AS workflowVersionId, rp.policy_version_id AS policyVersionId,
       rp.queue_id AS queueId, p.delivery_attempt_count AS deliveryAttemptCount,
-      p.delivery_terminal AS deliveryTerminal, p.last_error_code AS lastErrorCode
+      p.delivery_terminal AS deliveryTerminal, p.last_error_code AS lastErrorCode,
+      rp.integration_id AS integrationId, p.accepted_at AS acceptedAt, p.confirmed_at AS confirmedAt,
+      p.confirmation_deadline_at AS confirmationDeadlineAt, p.delivery_cycle AS deliveryCycle,
+      p.cycle_start_attempt AS cycleStartAttempt
     FROM action_proposals p JOIN workflow_runs r ON r.id = p.run_id
     JOIN reports rp ON rp.id = p.report_id WHERE p.id = ?1 LIMIT 1
   `).bind(proposalId).first<ProposalRow>();
@@ -283,24 +312,37 @@ async function validatePreconditions(db: D1Database, proposal: ProposalRow): Pro
   const preconditions = parsedObject(proposal.preconditionsJson);
   const report = await db.prepare(`
     SELECT state, queue_id AS queueId,
-      (SELECT id FROM decisions WHERE report_id = reports.id ORDER BY created_at DESC, id DESC LIMIT 1) AS latestDecisionId,
+      (SELECT id FROM decisions WHERE report_id = reports.id ORDER BY created_at DESC, rowid DESC LIMIT 1) AS latestDecisionId,
+      (SELECT decision_code FROM decisions WHERE report_id = reports.id ORDER BY created_at DESC, rowid DESC LIMIT 1) AS latestDecisionCode,
       (SELECT target_reference FROM report_targets WHERE report_id = reports.id ORDER BY created_at, id LIMIT 1) AS targetReference
     FROM reports WHERE id = ?1 LIMIT 1
-  `).bind(proposal.reportId).first<{ state: string; queueId: string | null; latestDecisionId: string | null; targetReference: string | null }>();
+  `).bind(proposal.reportId).first<{ state: string; queueId: string | null; latestDecisionId: string | null; latestDecisionCode: string | null; targetReference: string | null }>();
   if (!report) throw new WorkflowEffectError("action_report_missing");
+  if (proposal.appealId) {
+    const eligible=await db.prepare(`SELECT c.id FROM appeal_corrections c JOIN appeal_decisions ad ON ad.id=c.appeal_decision_id JOIN appeals a ON a.id=ad.appeal_id JOIN decisions d ON d.id=a.decision_id JOIN reports r ON r.id=c.report_id JOIN action_proposals original ON original.id=c.original_proposal_id JOIN operator_users u ON u.id=c.approved_by
+      WHERE c.proposal_id=?1 AND c.appeal_id=?2 AND c.mode='automated' AND c.integration_id=?3 AND r.integration_id=c.integration_id AND r.state='appealed' AND ad.completion_state='waiting' AND ad.correction_confirmed_at IS NULL AND ad.outcome IN ('modified','reversed') AND ad.rationale_redacted_at IS NULL
+      AND d.maker_id!=c.approved_by AND ${correctionReviewerEligible}
+      AND original.state='applied' AND original.confirmed_at IS NOT NULL AND original.operation_id=c.original_operation_id AND original.target_json=c.original_target_json AND original.target_json=?4
+      AND original.payload_digest=?5 AND ad.id=?6 AND a.decision_id=?7
+      AND NOT EXISTS(SELECT 1 FROM appeal_decisions newer JOIN appeals na ON na.id=newer.appeal_id WHERE na.report_id=r.id AND newer.created_at>ad.created_at AND newer.outcome='upheld')`)
+      .bind(proposal.id,proposal.appealId,proposal.integrationId,proposal.targetJson,preconditions.original_payload_digest??null,preconditions.appeal_decision_id??null,preconditions.latest_decision_id??null).first();
+    if(!eligible)throw new WorkflowEffectError('appeal_correction_precondition_changed');
+  } else if (["appealed", "closed"].includes(report.state)) throw new WorkflowEffectError("action_case_no_longer_eligible");
   const checks: [JsonValue | undefined, unknown][] = [
     [preconditions.report_state, report.state],
     [preconditions.queue_id, report.queueId],
     [preconditions.latest_decision_id, report.latestDecisionId],
+    [preconditions.decision_code, report.latestDecisionCode],
     [preconditions.target_reference, report.targetReference],
   ];
   if (checks.some(([expected, actual]) => expected !== undefined && expected !== actual)) throw new WorkflowEffectError("action_precondition_changed");
 }
 
 async function emitActionResolution(env: Env, proposal: ProposalRow): Promise<void> {
-  const eventId = `${proposal.id}:delivery-resolution`;
+  if(proposal.appealId){await reconcileAppealCompletion(env.DB,proposal.reportId);return;}
+  const eventId = `${proposal.id}:delivery-resolution${proposal.deliveryCycle > 1 ? `:${proposal.deliveryCycle}` : ""}`;
   const eventType = `action.${proposal.id}.delivery-resolved`;
-  const eventKey = `action-delivery:${proposal.id}`;
+  const eventKey = `action-delivery:${proposal.id}:${proposal.deliveryCycle}`;
   const payload = {
     proposal_id: proposal.id,
     state: proposal.state,
@@ -327,7 +369,7 @@ async function emitActionResolution(env: Env, proposal: ProposalRow): Promise<vo
     .bind(proposal.runId).first<{ instanceId: string | null }>();
   if (!run?.instanceId) return;
   try {
-    await (await env.WORKFLOWS.get(run.instanceId)).sendEvent({ type: eventType, payload });
+    await (await env.WORKFLOWS.get(run.instanceId)).sendEvent({ type: await workflowRunEventType(env.DB, proposal.runId, eventType), payload });
     await env.DB.batch([
       env.DB.prepare(`UPDATE workflow_event_inbox SET delivered_at = ?2, delivery_attempts = delivery_attempts + 1, last_error_code = NULL WHERE id = ?1`).bind(eventId, now()),
       env.DB.prepare(`UPDATE workflow_dispatch_outbox SET state = 'delivered', last_error_code = NULL, updated_at = ?2 WHERE id = ?1`).bind(eventId, now()),
@@ -343,8 +385,8 @@ async function emitActionResolution(env: Env, proposal: ProposalRow): Promise<vo
 export async function pendingActionProposalJobs(db: D1Database, limit = 50): Promise<ActionProposalJob[]> {
   const rows = await db.prepare(`
     SELECT id, run_id AS runId FROM action_proposals
-    WHERE delivery_terminal = 0 AND delivery_attempt_count < ?2
-      AND ((state IN ('queued','failed') AND next_attempt_at <= ?1)
+    WHERE delivery_terminal = 0
+      AND ((state IN ('queued','failed') AND next_attempt_at <= ?1 AND (delivery_attempt_count - cycle_start_attempt < ?2 OR accepted_at IS NOT NULL))
         OR (state = 'applying' AND lease_expires_at <= ?1))
     ORDER BY next_attempt_at, id LIMIT ?3
   `).bind(now(), ACTION_MAX_ATTEMPTS, Math.max(1, Math.min(100, limit))).all<{ id: string; runId: string }>();
@@ -354,120 +396,164 @@ export async function pendingActionProposalJobs(db: D1Database, limit = 50): Pro
 export async function reconcileActionProposalEvents(env: Env, limit = 50): Promise<number> {
   const rows = await env.DB.prepare(`
     SELECT p.id FROM action_proposals p
-    WHERE (p.state = 'applied' OR (p.state = 'failed' AND p.delivery_terminal = 1))
-      AND NOT EXISTS (SELECT 1 FROM workflow_event_inbox e WHERE e.id = p.id || ':delivery-resolution')
+    WHERE p.appeal_id IS NULL AND (p.state = 'applied' OR (p.state = 'failed' AND p.delivery_terminal = 1))
+      AND NOT EXISTS (SELECT 1 FROM workflow_event_inbox e WHERE e.id = p.id || ':delivery-resolution' || CASE WHEN p.delivery_cycle > 1 THEN ':' || p.delivery_cycle ELSE '' END)
     ORDER BY p.updated_at, p.id LIMIT ?1
   `).bind(Math.max(1, Math.min(100, limit))).all<{ id: string }>();
   for (const row of rows.results) await emitActionResolution(env, await loadProposal(env.DB, row.id));
   return rows.results.length;
 }
 
+interface ActionReceipt {
+  action_id: string;
+  operation_id: string;
+  payload_digest: string;
+  status: "accepted" | "applied" | "failed";
+  terminal: boolean;
+  error_code: string | null;
+  retry_after_seconds: number;
+  provider_request_id: string | null;
+}
+
+function actionReceipt(value: Record<string, unknown>, proposal: ProposalRow): ActionReceipt {
+  if (value.action_id !== proposal.id || value.operation_id !== proposal.operationId || value.payload_digest !== proposal.payloadDigest) {
+    throw new WorkflowEffectError("action_result_identity_mismatch");
+  }
+  if (!["accepted", "applied", "failed"].includes(String(value.status))) throw new WorkflowEffectError("action_confirmation_required");
+  if (value.terminal !== undefined && typeof value.terminal !== "boolean") throw new WorkflowEffectError("action_result_invalid");
+  if (value.retry_after_seconds !== undefined && (!Number.isInteger(value.retry_after_seconds) || Number(value.retry_after_seconds) < 1 || Number(value.retry_after_seconds) > 21_600)) {
+    throw new WorkflowEffectError("action_result_invalid");
+  }
+  if (value.error_code !== undefined && (typeof value.error_code !== "string" || !/^[a-zA-Z0-9_.:-]{1,200}$/u.test(value.error_code))) throw new WorkflowEffectError("action_result_invalid");
+  if (value.provider_request_id !== undefined && (typeof value.provider_request_id !== "string" || value.provider_request_id.length > 500)) throw new WorkflowEffectError("action_result_invalid");
+  const status = value.status as ActionReceipt["status"];
+  return {
+    action_id: proposal.id, operation_id: proposal.operationId, payload_digest: proposal.payloadDigest, status,
+    terminal: status === "applied" || (status === "failed" && value.terminal !== false),
+    error_code: status === "failed" ? String(value.error_code ?? "action_provider_failed") : null,
+    retry_after_seconds: Number(value.retry_after_seconds ?? 30),
+    provider_request_id: typeof value.provider_request_id === "string" ? value.provider_request_id : null,
+  };
+}
+
+async function saveActionReceipt(
+  env: Env,
+  proposal: ProposalRow,
+  receipt: ActionReceipt,
+  actor: { type: "system" | "service_identity"; id: string },
+  attempt?: { number: number; leaseExpiresAt: string; connectionAttemptId: string; responseDigest: string },
+): Promise<{ proposal: ProposalRow; changed: boolean }> {
+  const timestamp = now();
+  const expiry = parsedObject(proposal.approvalPolicyJson).expires_at;
+  if (typeof expiry !== "string") throw new WorkflowEffectError("action_approval_expiry_missing");
+  const deadline = proposal.confirmationDeadlineAt ?? new Date(Math.min(Date.parse(expiry), Date.now() + ACTION_CONFIRMATION_TIMEOUT_MS)).toISOString();
+  const terminal = receipt.terminal || (receipt.status === "failed" && proposal.deliveryAttemptCount - proposal.cycleStartAttempt >= ACTION_MAX_ATTEMPTS);
+  const state = receipt.status === "accepted" ? "queued" : receipt.status;
+  const nextAttemptAt = receipt.status === "accepted" ? deadline : new Date(Date.now() + receipt.retry_after_seconds * 1_000).toISOString();
+  const receiptJson = canonicalJson(receipt);
+  const auditKey = `action-result:${proposal.operationId}:${proposal.deliveryCycle}:${await sha256(receiptJson)}`;
+  const result = await env.DB.batch([
+    env.DB.prepare(`UPDATE action_proposals SET state = ?2, delivery_terminal = ?3,
+      accepted_at = CASE WHEN ?2 = 'queued' THEN COALESCE(accepted_at, ?4) WHEN ?2 = 'failed' AND ?3 = 0 THEN NULL ELSE accepted_at END,
+      confirmed_at = CASE WHEN ?2 = 'applied' THEN ?4 ELSE confirmed_at END,
+      confirmation_deadline_at = CASE WHEN ?2 = 'queued' THEN ?5 WHEN ?2 = 'failed' AND ?3 = 0 THEN NULL ELSE confirmation_deadline_at END,
+      last_receipt_json = ?6, next_attempt_at = ?7, lease_expires_at = NULL, last_error_code = ?8, updated_at = ?4
+      WHERE id = ?1 AND delivery_terminal = 0 AND state IN ('queued','applying','failed')
+        AND delivery_attempt_count > cycle_start_attempt AND delivery_cycle = ?9
+        AND (?10 IS NULL OR (state = 'applying' AND delivery_attempt_count = ?10 AND lease_expires_at = ?11))
+        AND EXISTS (SELECT 1 FROM reports WHERE id = action_proposals.report_id AND integration_id = ?12)
+        AND (appeal_id IS NULL OR (json_extract(approval_policy_json,'$.expires_at') > MAX(?4,strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+          AND EXISTS(SELECT 1 FROM appeal_corrections c JOIN appeal_decisions ad ON ad.id=c.appeal_decision_id JOIN appeals a ON a.id=ad.appeal_id JOIN reports r ON r.id=c.report_id JOIN action_proposals original ON original.id=c.original_proposal_id
+            WHERE c.proposal_id=action_proposals.id AND c.mode='automated' AND c.integration_id=?12 AND c.original_target_json=action_proposals.target_json AND c.appeal_id=action_proposals.appeal_id AND ad.completion_state='waiting' AND ad.correction_confirmed_at IS NULL AND r.state='appealed'
+            AND original.operation_id=c.original_operation_id AND original.target_json=c.original_target_json AND original.state='applied' AND original.confirmed_at IS NOT NULL
+            AND a.decision_id=(SELECT id FROM decisions WHERE report_id=r.id ORDER BY created_at DESC,rowid DESC LIMIT 1)
+            AND ad.id=json_extract(action_proposals.preconditions_json,'$.appeal_decision_id')
+            AND NOT EXISTS(SELECT 1 FROM appeal_decisions newer JOIN appeals na ON na.id=newer.appeal_id WHERE na.report_id=r.id AND newer.created_at>ad.created_at AND newer.outcome='upheld'))))` )
+      .bind(proposal.id, state, terminal ? 1 : 0, timestamp, deadline, receiptJson, nextAttemptAt, receipt.error_code,
+        proposal.deliveryCycle, attempt?.number ?? null, attempt?.leaseExpiresAt ?? null, proposal.integrationId),
+    env.DB.prepare(`INSERT OR IGNORE INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at)
+      SELECT ?1, ?2, ?3, ?4, ?5, 'action_proposal', ?6, ?7, ?8 WHERE changes() = 1`)
+      .bind(crypto.randomUUID(), auditKey, receipt.status === "applied" ? "workflow.action_applied" : "workflow.action_result_received",
+        actor.type, actor.id, proposal.id, canonicalJson({ ...receipt, terminal, deliveryCycle: proposal.deliveryCycle,
+          ...(attempt ? { connectionAttemptId: attempt.connectionAttemptId, responseDigest: attempt.responseDigest } : {}) }), timestamp),
+  ]);
+  return { proposal: await loadProposal(env.DB, proposal.id), changed: result[0]?.meta.changes === 1 };
+}
+
 export async function processActionProposalJob(env: Env, job: ActionProposalJob): Promise<void> {
   const timestamp = now();
-  const leaseExpiresAt = new Date(Date.now() + 60_000).toISOString();
+  // A connection may run for up to 120 seconds. The action lease outlives it.
+  const leaseExpiresAt = new Date(Date.now() + 150_000).toISOString();
   const claimed = await env.DB.prepare(`
     UPDATE action_proposals SET state = 'applying',
-      delivery_attempt_count = delivery_attempt_count + 1,
+      delivery_attempt_count = delivery_attempt_count + CASE WHEN accepted_at IS NULL AND delivery_attempt_count - cycle_start_attempt < ?5 THEN 1 ELSE 0 END,
+      last_error_code = CASE WHEN accepted_at IS NULL AND delivery_attempt_count - cycle_start_attempt >= ?5 THEN 'action_delivery_attempts_exhausted' ELSE last_error_code END,
       lease_expires_at = ?3, updated_at = ?2
     WHERE id = ?1 AND run_id = ?4 AND delivery_terminal = 0
-      AND ((state IN ('queued','failed') AND next_attempt_at <= ?2)
+      AND ((state IN ('queued','failed') AND next_attempt_at <= ?2 AND (delivery_attempt_count - cycle_start_attempt < ?5 OR accepted_at IS NOT NULL))
         OR (state = 'applying' AND lease_expires_at <= ?2))
     RETURNING id
-  `).bind(job.proposalId, timestamp, leaseExpiresAt, job.runId).first();
+  `).bind(job.proposalId, timestamp, leaseExpiresAt, job.runId, ACTION_MAX_ATTEMPTS).first();
+  // Duplicate or premature queue deliveries are acknowledged. D1 reconciliation
+  // owns the next due attempt; repeatedly retrying here can exhaust the queue.
+  if (!claimed) return;
   let proposal = await loadProposal(env.DB, job.proposalId);
-  if (!claimed) {
-    if (proposal.state === "applied" || (proposal.state === "failed" && proposal.deliveryTerminal === 1)) return;
-    throw new RetryableActionProposalError(5);
-  }
+  const claimedAttempt = proposal.deliveryAttemptCount;
+  const claimedCycle = proposal.deliveryCycle;
   const approvalPolicy = parsedObject(proposal.approvalPolicyJson);
   let reservations: Awaited<ReturnType<typeof reserveBudgets>> = [];
+  let requestSent = false;
   try {
-    if (typeof approvalPolicy.expires_at !== "string" || approvalPolicy.expires_at <= timestamp) {
-      throw new WorkflowEffectError("action_approval_expired");
-    }
+    if (proposal.acceptedAt) throw new WorkflowEffectError("action_confirmation_timed_out");
+    if (proposal.lastErrorCode === "action_delivery_attempts_exhausted") throw new WorkflowEffectError("action_delivery_attempts_exhausted");
+    if (typeof approvalPolicy.expires_at !== "string" || approvalPolicy.expires_at <= timestamp) throw new WorkflowEffectError("action_approval_expired");
     await validatePreconditions(env.DB, proposal);
+    if (approvalPolicy.mode === "human") {
+      const approval = await env.DB.prepare(`SELECT id FROM action_approvals WHERE proposal_id = ?1 AND decision = 'approved' AND payload_digest = ?2 LIMIT 1`)
+        .bind(proposal.id, proposal.payloadDigest).first();
+      if (!approval) throw new WorkflowEffectError("action_approval_missing");
+    }
     const component = await actionComponent(env.DB, proposal.componentVersionId);
-    const reference = /^(?:(GET|POST|PUT|PATCH|DELETE|HEAD)\s+)?(\/[^\s]*)$/u.exec(component.implementationReference.trim());
+    const reference = /^(?:(POST|PUT|PATCH|DELETE)\s+)?(\/[^\s]*)$/u.exec(component.implementationReference.trim());
     if (!reference || !component.connectionVersionId) throw new WorkflowEffectError("action_component_operation_invalid");
     reservations = await reserveBudgets(env.DB, {
       installationId: proposal.installationId,
-      scopes: [
-        { type: "workflow", id: proposal.workflowVersionId },
-        { type: "component", id: proposal.componentVersionId },
-        ...(proposal.queueId ? [{ type: "queue", id: proposal.queueId }] : []),
-      ],
-      metric: "actions", amount: 1, operationType: "action_proposal",
-      operationId: proposal.operationId, attemptId: String(proposal.deliveryAttemptCount),
+      scopes: [{ type: "workflow", id: proposal.workflowVersionId }, { type: "component", id: proposal.componentVersionId },
+        ...(proposal.queueId ? [{ type: "queue", id: proposal.queueId }] : [])],
+      metric: "actions", amount: 1, operationType: "action_proposal", operationId: proposal.operationId, attemptId: String(claimedAttempt),
     });
+    requestSent = true;
     const result = await executeConnectionJson(env, {
-      connectionVersionId: component.connectionVersionId,
-      actionProposalId: proposal.id,
-      operationId: proposal.operationId,
-      attemptNumber: proposal.deliveryAttemptCount,
-      method: reference[1] ?? "POST",
-      path: reference[2]!,
+      connectionVersionId: component.connectionVersionId, actionProposalId: proposal.id,
+      operationId: proposal.operationId, attemptNumber: claimedAttempt, method: reference[1] ?? "POST", path: reference[2]!,
       body: {
-        schema_version: "1",
-        action_id: proposal.id,
-        operation_id: proposal.operationId,
-        payload_digest: proposal.payloadDigest,
-        action_code: proposal.actionCode,
-        target: parsedObject(proposal.targetJson),
-        payload: parsedObject(proposal.payloadJson),
-        preconditions: parsedObject(proposal.preconditionsJson),
-        workflow_version_id: proposal.workflowVersionId,
-        policy_version_id: proposal.policyVersionId,
+        schema_version: "1", action_id: proposal.id, operation_id: proposal.operationId, payload_digest: proposal.payloadDigest,
+        action_code: proposal.actionCode, target: parsedObject(proposal.targetJson), payload: parsedObject(proposal.payloadJson),
+        preconditions: parsedObject(proposal.preconditionsJson), workflow_version_id: proposal.workflowVersionId,
+        policy_version_id: proposal.policyVersionId, expires_at: approvalPolicy.expires_at,
       },
     });
-    const outputErrors = validateJsonSchemaValue(result.data as JsonValue, parsedObject(component.outputSchemaJson));
-    if (outputErrors.length) throw new WorkflowEffectError("action_response_schema_invalid");
-    const finishedAt = now();
-    await env.DB.batch([
-      env.DB.prepare(`UPDATE action_proposals SET state = 'applied', delivery_terminal = 1, lease_expires_at = NULL, last_error_code = NULL, updated_at = ?2 WHERE id = ?1 AND state = 'applying'`).bind(proposal.id, finishedAt),
-      env.DB.prepare(`
-        INSERT OR IGNORE INTO audit_events (
-          id, idempotency_key, action, actor_type, actor_id,
-          target_type, target_id, details_json, created_at
-        ) VALUES (?1, ?2, 'workflow.action_applied', 'system', ?3,
-          'action_proposal', ?4, ?5, ?6)
-      `).bind(crypto.randomUUID(), `workflow-action-applied:${proposal.operationId}`, proposal.runId, proposal.id, canonicalJson({
-        actionCode: proposal.actionCode, payloadDigest: proposal.payloadDigest,
-        connectionAttemptId: result.connectionAttemptId, responseDigest: result.responseDigest,
-      }), finishedAt),
-    ]);
-    await settleBudgets(env.DB, reservations, true).catch(() => {});
-    proposal = await loadProposal(env.DB, proposal.id);
-    await emitActionResolution(env, proposal);
+    if (validateJsonSchemaValue(result.data as JsonValue, parsedObject(component.outputSchemaJson)).length) throw new WorkflowEffectError("action_response_schema_invalid");
+    const receipt = actionReceipt(result.data, proposal);
+    proposal = (await saveActionReceipt(env, proposal, receipt, { type: "system", id: proposal.runId }, {
+      number: claimedAttempt, leaseExpiresAt, connectionAttemptId: result.connectionAttemptId, responseDigest: result.responseDigest,
+    })).proposal;
   } catch (error) {
-    const failure = error instanceof ConnectionExecutionError
+    const failure = error instanceof ConnectionExecutionError || error instanceof BudgetControlError
       ? new WorkflowEffectError(error.code, error.retryable, error.delaySeconds)
-      : error instanceof BudgetControlError
-        ? new WorkflowEffectError(error.code, error.retryable, error.delaySeconds)
-        : error instanceof WorkflowEffectError
-          ? error
-          : new WorkflowEffectError("action_delivery_failed", true, 15);
-    const terminal = !failure.retryable || proposal.deliveryAttemptCount >= ACTION_MAX_ATTEMPTS;
-    const delaySeconds = Math.max(1, Math.min(21_600, failure.delaySeconds * (2 ** Math.min(proposal.deliveryAttemptCount - 1, 7))));
-    await env.DB.prepare(`
-      UPDATE action_proposals SET state = 'failed', delivery_terminal = ?2,
-        next_attempt_at = ?3, lease_expires_at = NULL, last_error_code = ?4, updated_at = ?5
-      WHERE id = ?1 AND state = 'applying'
-    `).bind(
-      proposal.id, terminal ? 1 : 0,
-      new Date(Date.now() + delaySeconds * 1_000).toISOString(), failure.code, now(),
-    ).run();
-    await settleBudgets(env.DB, reservations, false);
+      : error instanceof WorkflowEffectError ? error : new WorkflowEffectError("action_delivery_failed", true, 15);
+    const terminal = !failure.retryable || claimedAttempt - proposal.cycleStartAttempt >= ACTION_MAX_ATTEMPTS;
+    const delaySeconds = Math.max(1, Math.min(21_600, failure.delaySeconds * (2 ** Math.min(claimedAttempt - proposal.cycleStartAttempt - 1, 7))));
+    await env.DB.prepare(`UPDATE action_proposals SET state = 'failed', delivery_terminal = ?2,
+      next_attempt_at = ?3, lease_expires_at = NULL, last_error_code = ?4, updated_at = ?5
+      WHERE id = ?1 AND state = 'applying' AND delivery_terminal = 0 AND delivery_attempt_count = ?6 AND delivery_cycle = ?7 AND lease_expires_at = ?8`)
+      .bind(proposal.id, terminal ? 1 : 0, new Date(Date.now() + delaySeconds * 1_000).toISOString(), failure.code, now(), claimedAttempt, claimedCycle, leaseExpiresAt).run();
     proposal = await loadProposal(env.DB, proposal.id);
-    if (proposal.state === "applied") {
-      await emitActionResolution(env, proposal);
-      return;
-    }
-    if (terminal) {
-      await emitActionResolution(env, proposal);
-      return;
-    }
-    throw new RetryableActionProposalError(delaySeconds);
+  } finally {
+    // A request can have reached the customer even if its response was lost.
+    await settleBudgets(env.DB, reservations, requestSent);
   }
+  if (proposal.state === "applied" || proposal.deliveryTerminal === 1) await emitActionResolution(env, proposal);
 }
 
 export async function acceptActionResult(
@@ -476,69 +562,56 @@ export async function acceptActionResult(
   integrationId: string,
 ): Promise<{ proposalId: string; state: string; idempotentReplay: boolean }> {
   const proposalId = typeof value.action_id === "string" ? value.action_id : "";
-  const operationId = typeof value.operation_id === "string" ? value.operation_id : "";
-  const payloadDigest = typeof value.payload_digest === "string" ? value.payload_digest : "";
-  const status = value.status;
-  if (!proposalId || proposalId.length > 500 || !operationId || operationId.length > 500
-    || !/^sha256:[a-f0-9]{64}$/u.test(payloadDigest)
-    || (status !== "applied" && status !== "failed")) {
-    throw new ApiError(400, "action_result_invalid", "action_id, operation_id, payload_digest, and a valid status are required.");
+  if (!proposalId || proposalId.length > 500 || !["applied", "failed"].includes(String(value.status))) {
+    throw new ApiError(400, "action_result_invalid", "An action identity and an applied or failed result are required.");
   }
-  let proposal = await loadProposal(env.DB, proposalId);
-  if (proposal.operationId !== operationId || proposal.payloadDigest !== payloadDigest) {
-    throw new ApiError(409, "action_result_identity_mismatch", "The action result does not match the immutable proposal operation and payload digest.");
+  // Scope the lookup itself: another integration cannot probe a case or replay
+  // a valid receipt learned elsewhere.
+  const owned = await env.DB.prepare(`SELECT p.id FROM action_proposals p JOIN reports r ON r.id = p.report_id
+    WHERE p.id = ?1 AND r.integration_id = ?2 LIMIT 1`).bind(proposalId, integrationId).first();
+  if (!owned) throw new ApiError(404, "action_result_unavailable", "This action is not available to this integration.");
+  const proposal = await loadProposal(env.DB, proposalId);
+  let receipt: ActionReceipt;
+  try { receipt = actionReceipt(value, proposal); }
+  catch (error) {
+    throw new ApiError(error instanceof WorkflowEffectError && error.code === "action_result_identity_mismatch" ? 409 : 400,
+      error instanceof WorkflowEffectError ? error.code : "action_result_invalid", "The result must match the immutable action operation and payload.");
   }
-  if (proposal.state === "applied" && status === "applied") return { proposalId, state: "applied", idempotentReplay: true };
-  if (proposal.state === "failed" && proposal.deliveryTerminal === 1 && status === "failed") return { proposalId, state: "failed", idempotentReplay: true };
-  if (!["queued", "applying", "failed"].includes(proposal.state) || proposal.deliveryTerminal === 1) {
-    throw new ApiError(409, "action_result_terminal", "The action proposal is not awaiting an asynchronous result.");
+  if (proposal.state === receipt.status && proposal.deliveryTerminal === 1) return { proposalId, state: proposal.state, idempotentReplay: true };
+  if (!["queued", "applying", "failed"].includes(proposal.state) || proposal.deliveryTerminal === 1 || proposal.deliveryAttemptCount <= proposal.cycleStartAttempt) {
+    throw new ApiError(409, "action_result_terminal", "The action is not awaiting a customer result.");
   }
-  const timestamp = now();
-  const terminal = value.terminal !== false;
-  const errorCode = typeof value.error_code === "string" && value.error_code.length <= 200
-    ? value.error_code : "action_provider_failed";
-  const nextAttemptAt = new Date(Date.now() + Math.max(1, Math.min(21_600, Number(value.retry_after_seconds) || 30)) * 1_000).toISOString();
-  await env.DB.batch([
-    env.DB.prepare(`
-      UPDATE action_proposals SET state = ?2, delivery_terminal = ?3,
-        next_attempt_at = ?4, lease_expires_at = NULL, last_error_code = ?5,
-        updated_at = ?6 WHERE id = ?1 AND delivery_terminal = 0
-    `).bind(
-      proposalId, status === "applied" ? "applied" : "failed",
-      status === "applied" || terminal ? 1 : 0, nextAttemptAt,
-      status === "applied" ? null : errorCode, timestamp,
-    ),
-    env.DB.prepare(`
-      INSERT OR IGNORE INTO audit_events (
-        id, idempotency_key, action, actor_type, actor_id,
-        target_type, target_id, details_json, created_at
-      ) VALUES (?1, ?2, 'workflow.action_result_received', 'service_identity', ?3,
-        'action_proposal', ?4, ?5, ?6)
-    `).bind(crypto.randomUUID(), `action-result:${operationId}:${status}`, integrationId, proposalId, canonicalJson({
-      status, payloadDigest, terminal: status === "applied" || terminal,
-      providerRequestId: typeof value.provider_request_id === "string" ? value.provider_request_id.slice(0, 500) : null,
-      errorCode: status === "failed" ? errorCode : null,
-    }), timestamp),
-  ]);
-  proposal = await loadProposal(env.DB, proposalId);
-  if (proposal.state === "applied" || proposal.deliveryTerminal === 1) await emitActionResolution(env, proposal);
-  else await env.DELIVERY_JOBS.send(actionJob(proposal.id, proposal.runId), { contentType: "json" }).catch(() => {});
-  return { proposalId, state: proposal.state, idempotentReplay: false };
+  const saved = await saveActionReceipt(env, proposal, receipt, { type: "service_identity", id: integrationId });
+  if (!saved.changed && saved.proposal.state !== receipt.status) throw new ApiError(409, "action_result_conflict", "Another result or operator action was recorded first. Refresh the action before retrying.");
+  if (saved.proposal.state === "applied" || saved.proposal.deliveryTerminal === 1) await emitActionResolution(env, saved.proposal);
+  return { proposalId, state: saved.proposal.state, idempotentReplay: !saved.changed };
 }
 
 export async function completeWorkflowAction(
   env: Env,
-  input: { proposalId: string; eventResult: { status: "received"; event: unknown } | { status: "timed_out" } },
+  input: { proposalId: string; awaitRecovery?: boolean; eventResult: { status: "received"; event: unknown } | { status: "timed_out" } },
 ): Promise<Record<string, unknown>> {
-  const proposal = await loadProposal(env.DB, input.proposalId);
+  let proposal = await loadProposal(env.DB, input.proposalId);
   if (proposal.state === "applied") return { port: "applied", proposalId: proposal.id, payloadDigest: proposal.payloadDigest };
   if (proposal.state === "rejected") return { port: "rejected", proposalId: proposal.id, payloadDigest: proposal.payloadDigest };
   if (proposal.state === "failed" && proposal.deliveryTerminal === 1) {
+    const expiry = parsedObject(proposal.approvalPolicyJson).expires_at;
+    if (input.awaitRecovery && input.eventResult.status !== "timed_out" && typeof expiry === "string" && expiry > now()) {
+      return { ...deliveryPending(proposal.id, proposal.payloadDigest, expiry), recoveryRequired: true, errorCode: proposal.lastErrorCode };
+    }
     return { port: "error", proposalId: proposal.id, payloadDigest: proposal.payloadDigest, errorCode: proposal.lastErrorCode ?? "action_delivery_failed" };
   }
   if (input.eventResult.status === "timed_out") {
-    await env.DB.prepare(`UPDATE action_proposals SET state = 'cancelled', delivery_terminal = 1, updated_at = ?2 WHERE id = ?1 AND state IN ('approval_required','approved','queued','failed') AND delivery_terminal = 0`)
-      .bind(proposal.id, now()).run();
+    await env.DB.batch([
+      env.DB.prepare(`UPDATE action_proposals SET state = CASE WHEN accepted_at IS NOT NULL OR state = 'applying' THEN 'failed' ELSE 'cancelled' END,
+        delivery_terminal = 1, lease_expires_at = NULL, last_error_code = 'action_confirmation_timed_out', updated_at = ?2
+        WHERE id = ?1 AND state IN ('approval_required','approved','queued','applying','failed') AND delivery_terminal = 0`)
+        .bind(proposal.id, now()),
+      env.DB.prepare(`UPDATE human_tasks SET state = 'cancelled', updated_at = ?2 WHERE action_proposal_id = ?1 AND state IN ('open','claimed')
+        AND EXISTS (SELECT 1 FROM action_proposals WHERE id = ?1 AND state IN ('cancelled','failed'))`).bind(proposal.id, now()),
+    ]);
+    proposal = await loadProposal(env.DB, proposal.id);
+    if (proposal.state === "applied") return { port: "applied", proposalId: proposal.id, payloadDigest: proposal.payloadDigest };
     return { port: "timeout", proposalId: proposal.id, payloadDigest: proposal.payloadDigest };
   }
   if (["queued", "applying", "failed"].includes(proposal.state)) {
@@ -571,6 +644,8 @@ export async function loadActionProposalDetail(db: D1Database, proposalId: strin
       p.authority_mode AS authorityMode, p.approval_policy_json AS approvalPolicyJson,
       p.state, p.operation_id AS operationId, p.compensates_proposal_id AS compensatesProposalId,
       p.delivery_attempt_count AS deliveryAttemptCount, p.delivery_terminal AS deliveryTerminal,
+      p.accepted_at AS acceptedAt, p.confirmed_at AS confirmedAt, p.confirmation_deadline_at AS confirmationDeadlineAt,
+      p.delivery_cycle AS deliveryCycle, p.last_receipt_json AS lastReceiptJson,
       p.next_attempt_at AS nextAttemptAt, p.last_error_code AS lastErrorCode,
       p.created_by_type AS createdByType, p.created_by_id AS createdById,
       p.created_at AS createdAt, p.updated_at AS updatedAt
@@ -586,6 +661,8 @@ export async function loadActionProposalDetail(db: D1Database, proposalId: strin
   return {
     proposal: {
       ...proposal,
+      receipt: typeof proposal.lastReceiptJson === "string" ? JSON.parse(proposal.lastReceiptJson) : null,
+      lastReceiptJson: undefined,
       target: typeof proposal.targetJson === "string" ? JSON.parse(proposal.targetJson) : {},
       payload: typeof proposal.payloadJson === "string" ? JSON.parse(proposal.payloadJson) : {},
       preconditions: typeof proposal.preconditionsJson === "string" ? JSON.parse(proposal.preconditionsJson) : {},
@@ -628,7 +705,7 @@ async function emitApprovalEvent(
     .bind(proposal.runId).first<{ instanceId: string | null }>();
   if (!instance?.instanceId) return;
   try {
-    await (await env.WORKFLOWS.get(instance.instanceId)).sendEvent({ type: eventType, payload });
+    await (await env.WORKFLOWS.get(instance.instanceId)).sendEvent({ type: await workflowRunEventType(env.DB, proposal.runId, eventType), payload });
     const deliveredAt = now();
     await env.DB.batch([
       env.DB.prepare(`UPDATE workflow_event_inbox SET delivered_at = ?2, delivery_attempts = delivery_attempts + 1, last_error_code = NULL WHERE id = ?1`).bind(approvalId, deliveredAt),
@@ -663,7 +740,7 @@ export async function decideActionProposal(
   }
   const approvalId = crypto.randomUUID();
   const timestamp = now();
-  await env.DB.batch([
+  try { await env.DB.batch([
     env.DB.prepare(`
       INSERT INTO action_approvals (
         id, proposal_id, approver_id, payload_digest, decision,
@@ -687,7 +764,10 @@ export async function decideActionProposal(
       session.actor.type, session.actor.id, proposalId,
       canonicalJson({ payloadDigest: proposal.payloadDigest, reason: input.reason?.trim() ?? null }), timestamp,
     ),
-  ]);
+  ]); } catch (error) {
+    if (String(error).includes("action_approval_state_changed")) throw new ApiError(409, "action_approval_changed", "The proposal changed or its authorization expired. Refresh it before deciding.");
+    throw error;
+  }
   const updated = await loadProposal(env.DB, proposalId);
   await emitApprovalEvent(env, updated, approvalId, input.decision, session.actor.id);
   return { proposalId, approvalId, state: input.decision, idempotentReplay: false };
@@ -701,22 +781,34 @@ export async function retryActionProposal(
   idempotencyKey: string,
 ): Promise<{ proposalId: string; state: string; idempotentReplay: boolean }> {
   const key = `action-retry:${idempotencyKey}`;
-  const prior = await env.DB.prepare(`SELECT target_id AS targetId FROM audit_events WHERE idempotency_key = ?1 AND action = 'action.retry_requested' LIMIT 1`)
-    .bind(key).first<{ targetId: string }>();
+  const prior = await env.DB.prepare(`SELECT target_id AS targetId, actor_id AS actorId FROM audit_events WHERE idempotency_key = ?1 AND action = 'action.retry_requested' LIMIT 1`)
+    .bind(key).first<{ targetId: string; actorId: string }>();
   if (prior) {
-    if (prior.targetId !== proposalId) throw new ApiError(409, "idempotency_key_reused", "This Idempotency-Key was already used for another action retry.");
-    return { proposalId, state: "queued", idempotentReplay: true };
+    if (prior.targetId !== proposalId || prior.actorId !== session.actor.id) throw new ApiError(409, "idempotency_key_reused", "This Idempotency-Key was already used for another action retry.");
+    const saved = await loadProposal(env.DB, proposalId);
+    if (saved.payloadDigest !== payloadDigest) throw new ApiError(409, "action_retry_digest_mismatch", "Retry requires the original payload digest.");
+    return { proposalId, state: saved.state, idempotentReplay: true };
   }
   const proposal = await loadProposal(env.DB, proposalId);
   if (proposal.payloadDigest !== payloadDigest) throw new ApiError(409, "action_retry_digest_mismatch", "Retry requires the exact immutable payload digest.");
   if (proposal.state !== "failed" || proposal.deliveryTerminal !== 1) throw new ApiError(409, "action_not_retryable", "Only a terminal failed action can be retried.");
   const timestamp = now();
-  await env.DB.batch([
-    env.DB.prepare(`UPDATE action_proposals SET state = 'queued', delivery_terminal = 0, delivery_attempt_count = 0, next_attempt_at = ?2, lease_expires_at = NULL, last_error_code = NULL, updated_at = ?2 WHERE id = ?1 AND state = 'failed' AND delivery_terminal = 1`)
-      .bind(proposalId, timestamp),
-    env.DB.prepare(`INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at) VALUES (?1, ?2, 'action.retry_requested', ?3, ?4, 'action_proposal', ?5, ?6, ?7)`)
-      .bind(crypto.randomUUID(), key, session.actor.type, session.actor.id, proposalId, canonicalJson({ payloadDigest }), timestamp),
+  const policy = parsedObject(proposal.approvalPolicyJson);
+  if (typeof policy.expires_at !== "string" || policy.expires_at <= timestamp) throw new ApiError(409, "action_approval_expired", "The action authorization expired. Review and authorize a new proposal before sending it.");
+  await validatePreconditions(env.DB, proposal);
+  const result = await env.DB.batch([
+    env.DB.prepare(`UPDATE action_proposals SET state = 'queued', delivery_terminal = 0,
+      cycle_start_attempt = delivery_attempt_count, delivery_cycle = delivery_cycle + 1,
+      accepted_at = NULL, confirmation_deadline_at = NULL, next_attempt_at = ?2, lease_expires_at = NULL, last_error_code = NULL, updated_at = ?2
+      WHERE id = ?1 AND state = 'failed' AND delivery_terminal = 1 AND delivery_cycle = ?3
+        AND json_extract(approval_policy_json, '$.expires_at') > ?2
+        AND (appeal_id IS NOT NULL OR EXISTS (SELECT 1 FROM workflow_runs WHERE id = action_proposals.run_id AND state NOT IN ('terminated','cancelled')))`)
+      .bind(proposalId, timestamp, proposal.deliveryCycle),
+    env.DB.prepare(`INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at)
+      SELECT ?1, ?2, 'action.retry_requested', ?3, ?4, 'action_proposal', ?5, ?6, ?7 WHERE changes() = 1`)
+      .bind(crypto.randomUUID(), key, session.actor.type, session.actor.id, proposalId, canonicalJson({ payloadDigest, deliveryCycle: proposal.deliveryCycle + 1 }), timestamp),
   ]);
+  if (result[0]?.meta.changes !== 1) throw new ApiError(409, "action_retry_conflict", "The action changed before the retry was saved. Refresh it and try again.");
   await env.DELIVERY_JOBS.send(actionJob(proposalId, proposal.runId), { contentType: "json" }).catch(() => {});
   return { proposalId, state: "queued", idempotentReplay: false };
 }