Reconcile provider acceptance with durable automation state

When an at-most-once workflow claims an action before calling an external provider, provider acceptance and the durable claim outcome need an explicit reconciliation path. If acceptance occurs but later local persistence fails or rolls back, retries may be blocked by idempotency while downstream work waits for a receipt that was never committed. Preserve the provider receipt in a separately reconcilable ledger, surface stale claims, and make recovery reconcile state or route to a human.

This applies to irreversible or ambiguity-prone outbound effects. Known provider acceptance is not permission to resend, and it does not prove carrier delivery or human receipt. Tests should cover the boundary where the provider succeeds and post-send persistence fails.