Add durable failure recovery and delivery reconciliation

Goal

Make silent drops, false progress, stuck typing, duplicate replies, and uncertain tool outcomes observable and recoverable across provider, Workflow, Eve, product tools, and outbound delivery.

Scope

• Received, working, complete, delayed, failed, retried, and needs-clarification state model.
• Durable execution/delivery ledger adapter.
• Bounded timeouts, retry policy, idempotent reconciliation, and dead-letter visibility.
• Honest user-facing recovery copy.
• Alerts for accepted inbound events without timely terminal outcomes.

Acceptance criteria

• Failure-injection tests cover duplicate/out-of-order webhooks, model/tool/provider timeout, deployment interruption, stale authorization, and outbound failure.
• Typing stops on every terminal path.
• No success reply can be generated without a successful canonical tool result.
• Transient retries cannot duplicate writes or user-facing terminal messages.