fix(recovery): allow delivered reconciliation retries

[kapustazh]

Summary

Allow a later read-only reconciliation job after the prior reconcile job is delivered. Preserve one pending manual retry under concurrent API calls.

Scope and acceptance criteria

• The change is limited to reconciliation outbox retry scheduling.
• UNKNOWN or SUBMITTING permits at most one pending manual reconcile job.
• After DELIVERED, a later read-only retry can be queued without changing intent authority or enabling settlement.
• Concurrent enqueue calls create only one pending retry.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.

Invariant notes:

The change only inserts reconcile_intent outbox work. It does not mutate intent authority, submit settlement, or weaken the one-intent/at-most-one-settlement invariant. Recovery remains read-only with settlementPermission: NEVER.

Validation

Commands and results:

pnpm format:check: PASS
pnpm lint: PASS
pnpm typecheck: PASS
pnpm test: PASS (64 files, 959 tests)
pnpm check:generated: PASS
pnpm validate:fixtures: PASS (9 contracts, 7 UI fixtures)
pnpm demo:e2e: PASS
git diff --check: PASS
PostgreSQL integration: pending required CI; no local container runtime

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 95709a8256a11f2c544b1d406e906ba8ea2d7867

• Candidate tree SHA: 4ea5bf3afef36288299fb84cf4da49ed1cc62844

• Candidate commit SHA: 206ad437da5fb3a059ea21723d2de8f27da907b7

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: Count-derived generation fails closed if outbox rows are ever purged; no purge path exists. Exact PostgreSQL concurrency behavior is CI-gated.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: fix(recovery): allow delivered reconciliation retries #66

• Remote head commit SHA: 206ad437da5fb3a059ea21723d2de8f27da907b7

• Remote head tree SHA: 4ea5bf3afef36288299fb84cf4da49ed1cc62844

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: Count-derived generation remains fail-closed if future outbox purging is added; no purge path exists.

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: Retry generation assumes outbox history is retained. A future purge could make insertion conflict and refuse a retry, but cannot create duplicate settlement.
• Rollback or recovery plan: Revert 206ad437da5fb3a059ea21723d2de8f27da907b7; existing fail-closed one-job-per-version behavior returns.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	206ad43	Sep 10 2026, 03:48 PM