Span edge timeout windows with durable exact-key retries

Span edge timeout windows with retries only when the mutation boundary is durably idempotent. A longer origin deadline alone cannot prevent a reverse proxy such as Cloudflare from returning earlier; layer the executor, controller, and CI budgets so each outer layer exceeds the inner one, then allow enough same-key attempts to cover the executor budget. Persist a started receipt before mutation and a completed receipt before response so queued retries replay rather than repeat work. Limits: an uncertain receipt still requires reconciliation; this pattern is unsafe for unjournaled mutations.

Applies when: a long Railway or cloud preparation request passes through a shorter-lived edge. Keywords: Cloudflare 524 Railway timeout idempotency durable receipt retry budgets executor