No receipt, no retry

The provider returned 200. N17Q paused the workflow.

The response body lacked the resource identity and committed revision required by the tool contract. A later status query needed one of those values. The adapter had evidence that a request was accepted and no evidence that the promised artifact existed in the right state.

Calling the step complete would let every downstream action build on an assumption.

I stopped treating the missing receipt as a logging defect. It was missing product state, and the workflow had no honest basis for moving on.

Success belonged to the postcondition

Transport protocols reported that bytes moved and a remote endpoint responded. Product capabilities promised outcomes: a draft stored, a review request created, a file available at a digest, or a message accepted for a destination.

N17Q defined a postcondition for each consequential capability and the evidence sufficient to establish it. HTTP status could contribute. It did not decide alone.

The workflow advanced only when its state reducer reached an observed completion supported by contract-authoritative evidence.

Execution success became a claim the system could show its work for.

The early code stored raw JSON and called it a receipt. Downstream consumers parsed different fields and reached different conclusions.

N17Q normalized provider evidence into a versioned receipt: effect intent, normalized consequence digest, connection, provider references, observation time, result class, postcondition facts, residual uncertainty, and safe raw evidence handle.

Adapters knew provider formats. The core workflow consumed product-shaped facts. Unknown or conflicting fields remained explicit.

A receipt was not a screenshot of success copy. It was the durable bridge from attempt to world observation.

Receipt strength was ordered

Not every observation proved the same thing.

Request prepared established no remote effect. Sent established possible exposure. Accepted established provider acknowledgement. Resource referenced established identity. Queried state established an observation at a time. Verified postcondition established the product's expected state under the contract.

N17Q used capability-specific evidence reducers to advance through these levels. Later weak evidence did not overwrite earlier strong evidence. Contradictions created a reconciliation state.

The workflow knew exactly how much certainty it possessed.

Missing did not mean failed

The absent resource reference could result from a malformed response, proxy truncation, provider regression, asynchronous acceptance, or an effect that completed after the response.

N17Q classified the attempt boundary and moved the intent to outcome unknown. It did not release the effect reservation or create another intent. Recovery followed the contract: query by stable key, wait through visibility window, inspect a collection carefully, or request human review.

If none of those paths could establish state, the workflow stayed paused.

Uncertainty was safer than a convenient negative inference.

A receipt could be present and insufficient

One provider returned a job ID for every accepted request. The job could later fail before creating the artifact. Treating the ID as completion advanced the workflow too early.

N17Q's receipt schema distinguished operation reference from result reference. A job receipt enabled status observation. It did not satisfy the artifact postcondition until terminal state and output identity were observed.

The interface displayed Accepted for processing rather than Created. The next step depended on the stronger state.

Good receipt design resisted the provider's most optimistic label.

Identity made receipts composable

A receipt had to bind to the one semantic intent the workflow was pursuing. Provider request IDs and resource IDs alone were not enough.

N17Q verified connection namespace, idempotency mapping, normalized consequence digest where supported, and intent lineage. A resource found by query could complete the intent only if its observable attributes matched the approved consequence.

An unrelated preexisting resource with the same title did not become proof. A receipt from another environment did not cross namespaces.

Evidence became useful when it had a stable subject.

A read did not change remote state, but its result supported later claims. N17Q recorded source identity, query, revision or retrieval time, completeness, truncation, and provenance.

If a response omitted pagination state, the system could not claim the result represented all records. If a file read was truncated, downstream analysis carried that limitation. Cached and fixture observations were labeled.

These read receipts entered the evidence graph rather than the effect ledger's mutation count.

Completion of analysis depended on what had actually been observed.

Exit code zero did not prove that a report existed or a test covered the current candidate. A command could succeed while writing the wrong path.

N17Q captured command attempt, environment, sealed workspace snapshot, declared outputs, content digests, and verification result. The receipt linked the intended artifact to observed bytes.

Tests added scope and input snapshot. Build success added produced artifacts but not deployment.

The same receipt discipline connected local execution to durable workflow state.

The receipt was immutable; interpretation evolved

Provider evidence captured at one time should not be edited when a later query clarified state. N17Q appended observations and reduced them into current intent status.

The original response, parsed receipt, query results, and reconciliation decisions remained linked. A reducer revision could reinterpret the evidence retrospectively as a new analysis without rewriting history.

This mattered when an adapter bug had misclassified a field. Fixing it revealed affected runs and allowed controlled remediation.

Receipts were evidence records, not mutable status rows.

If a provider changed a field from string to object or omitted a documented key, permissive parsing could produce an empty value that looked like absence.

N17Q validated bounded raw responses before normalization. Unexpected shape created a typed contract drift finding. The attempt state reflected the send boundary; receipt state remained insufficient.

Raw safe evidence was retained for diagnosis under policy. The model received a product error, not the whole provider payload.

Parser failure never became proof that the effect failed.

Signatures and authenticity were separate

A webhook could carry a valid provider signature and still refer to another connection, resource, or stale event. Authenticity did not establish semantic relevance.

N17Q verified signature and replay protection at ingress, then matched connection, event identity, intent, resource, and postcondition. Invalid events were quarantined. Valid unmatched events remained observations requiring investigation.

The receipt recorded both authenticity result and semantic binding.

Trusting the sender was only one part of trusting the evidence.

Asynchronous providers could send results after the original worker exited. Keeping a process callback open was not a workflow strategy.

N17Q ingested events into a durable, deduplicated inbox keyed by connection and provider event identity. A reducer attached eligible observations to active intents and woke paused workflows. Ordering and retries remained visible.

Unknown events could not cause actions directly. They entered bounded triage.

The workflow could wait without occupying a model session or forgetting what it was waiting for.

Receipt deadlines came from contracts

Waiting forever hid a stuck workflow. Timing out too quickly encouraged duplicate action.

Tool contracts declared expected acknowledgement, visibility, retention, and terminal windows where known. N17Q scheduled logical checkpoints and escalation. At each deadline it could query, continue waiting, request manual inspection, or close with unresolved state.

Crossing a deadline changed recovery options; it did not prove absence.

Time made uncertainty actionable without converting it into fiction.

Downstream steps declared receipt requirements

Not every next step needed the strongest completion evidence. A local note could be prepared after provider acceptance. Sending a notification that included the final resource URL required observed identity. Deleting a temporary artifact might require verified persistence first.

N17Q tasks declared input predicates over prior step state. The scheduler activated a node only when required receipts were present and current.

This avoided one global definition of done while preserving explicit dependencies.

Workflow topology followed evidence rather than optimistic sequence.

Users interpreted a spinner as an active process and a red error as failure. Outcome unknown was neither.

N17Q showed Waiting for confirmation, last known boundary, expected next observation, deadline, and safe actions. It made clear that repeating the effect was unavailable. The user could leave; durable state would wake on a receipt.

If manual inspection became necessary, the handoff named exact safe identifiers and what not to repeat.

The pause felt deliberate because the interface explained the missing evidence.

Model summaries could not promote state

The assistant might say “the report was uploaded” based on a 200 response. N17Q extracted the claim and compared it with receipt state.

The final account was assembled from deterministic effects and artifacts, then allowed a model to explain them. A stronger unsupported statement was flagged or replaced with the highest proven claim: request accepted, confirmation pending.

Context compaction also received structured receipt state. A summary sentence could not turn unknown into completed.

Language followed the evidence ceiling.

Providers retried webhooks and workers retried queries. Receiving the same evidence twice should not create two completions or wake two downstream effects.

N17Q deduplicated transport events by provider identity where reliable and made reducers idempotent over evidence identity. Semantically equivalent observations could coexist without advancing state twice.

Conflicting duplicates were retained and flagged. Event identity scope and retention lived in the connection contract.

Exactly-once processing was replaced by repeatable reduction into one durable intent.

Responses could include personal data, private URLs, or provider diagnostics. Persisting every raw payload indefinitely would make observability a liability.

N17Q stored minimal normalized facts for workflow state, bounded encrypted raw evidence where required, safe digests, and retention metadata. Interfaces projected only eligible fields.

Redaction did not remove the fact that evidence had been redacted. If a future audit required unavailable raw content, the system disclosed the gap.

Receipts were durable enough to support claims and narrow enough to respect the data boundary.

Contract drift generated operational work

When a receipt schema changed, affected active intents paused. The adapter team could update the parser, replay retained evidence through the new reducer, and inspect any changed status.

N17Q did not retry the external action to obtain a friendlier response. It worked from existing evidence first. If evidence was irrecoverable, owners received an unresolved handoff.

Conformance probes and fixture tests caught many changes before they reached live-like runs.

Missing receipts became visible maintenance signals rather than mysterious agent failures.

The first recovery loop pasted every response into the model and asked whether the action appeared complete. That made state dependent on wording, context length, and provider error prose.

N17Q implemented deterministic reducers per capability contract. They accepted typed observations, current logical time, and prior intent state, then returned the next supported state plus conflicts. The model could propose which eligible observation to gather next; it could not declare the reduction result.

Reducers had fixture corpora for delayed, duplicated, malformed, and out-of-order evidence.

Product state stopped depending on an improvised reading of JSON.

A report could be stored in one service and its link sent through another. The message receipt did not prove the report remained accessible; the storage receipt did not prove the intended audience received the link.

N17Q represented separate effect intents and a dependency chain. The notification candidate bound to the verified artifact identity and access state. If storage policy changed before send, the final gate paused the second effect.

The final account showed both receipts and the relationship between them.

Workflow completion became the conjunction of supported consequences, not the success of the last API call.

Receipt revocation changed current state

A resource could be deleted, access revoked, or a previously terminal job rolled back by the provider. The original completion receipt remained historically valid while the current postcondition no longer held.

N17Q appended the new observation and moved dependent current-state views accordingly. Completed downstream effects were not undone; pending ones reevaluated. Reports distinguished “was created successfully” from “is currently available.”

This temporal model avoided both rewriting history and serving stale completion as present truth.

Receipts proved an observed state at a time, not immortality.

When automated reconciliation failed, a person might inspect the provider and enter a resource reference or mark an effect absent. Treating that note as equivalent to a signed provider event overclaimed certainty.

N17Q recorded actor, method, observed time, supplied identifiers, and confidence. Policy defined which decisions manual evidence could support. High-impact resolution could require a second review or provider-side export.

The handoff made the question specific enough that a person knew what to inspect.

Human observation could resolve uncertainty without becoming anonymous magic in the state table.

Normal users needed a concise final account. Technical reviewers sometimes needed to verify the evidence without access to the live provider.

N17Q produced a bounded audit bundle containing normalized receipts, safe raw references where permitted, contract and reducer versions, effect lineage, relevant world observations, and content digests. Secrets and reusable request tokens stayed excluded.

The bundle validator checked internal references and disclosed expired evidence. It did not claim that an export could prove facts the original system never captured.

Portability made receipts durable beyond one interface while preserving their limits.

Receipts bounded notifications

The old workflow notified the user as soon as the adapter returned success, then corrected itself if later reconciliation failed. That made product messaging outrun product knowledge.

N17Q tied each notification template to a minimum receipt state. Accepted, confirmed, available, and verified had different language. Unknown outcome produced a waiting notice only when useful. A later state transition appended an update rather than silently replacing the earlier message.

Notification deduplication used intent and state transition identity, so callback retries did not spam the user.

Communication became another consumer of evidence, not a source of optimism.

Success rate hid providers that often returned unusable confirmations. N17Q measured receipt completeness, time to verified postcondition, reconciliation frequency, contradictory evidence, manual-resolution burden, and contract drift.

These metrics affected tool eligibility and recovery projections. An adapter could be operationally available while temporarily restricted for consequential work because its evidence quality had degraded.

The dashboard linked aggregate trends to bounded example traces without exposing content.

Reliability meant producing facts the workflow could depend on, not merely returning responses quickly.

Fixtures returned success without identity, job references without terminal state, duplicated callbacks, old revisions, mismatched resource attributes, and signed events from the wrong connection.

Hard invariants asserted no downstream step without its receipt predicate, no duplicate effect after unknown outcome, and no completed claim beyond evidence strength. Model grading assessed clarity of the pause and handoff.

The simulated world independently recorded whether the resource existed.

Receipt handling was evaluated where optimism had the greatest chance to be wrong.

The workflow waited for the right fact

In the repaired scenario, the provider accepted the create and returned a malformed body without a resource reference. N17Q stored the raw evidence, marked the attempt possibly completed, and paused the dependent notification.

A scheduled query used the original effect identity. After the visibility window, it found one resource whose artifact digest and destination matched the intent. The reducer produced a verified receipt, and only then did the workflow prepare the notification.

If the query had remained inconclusive, the run would have stopped without creating again.

The 200 response was not ignored. It was given exactly the evidentiary weight it deserved.

A receipt is how an execution becomes a fact the rest of the product may rely on. When that receipt is missing, the responsible workflow does not fill the gap with confidence.

It pauses, gathers the evidence the contract allows, and advances only when the promised state is actually supported.

That pause is not hesitation. It is the mechanism that prevents every later step from turning one missing fact into an entire chain of fictional completion.

The workflow remains truthful precisely because it refuses to outrun what its receipts can establish.