Before an AI tool performs a consequential action, commit the worker’s claim, its attempt ID, and the required audit event in a single transaction. After a crash, recovery can review these records before any further send attempts.

Human Approval as a System Boundary defines when permission is granted to dispatch a fixed support reply. Retries Are Not a Recovery Strategy explains why a missing response does not indicate whether the dispatch occurred. This article implements the records and transactions that support these rules.

The example uses EF Core with a file-backed SQLite database. It tracks one admitted reply through competing workers, a lost provider response, and reconciliation. The provider is a test double. No real email API or provider idempotency guarantee is involved.

The companion example on GitHub provides the complete implementation and automated failure checks.…