Model ambiguous provider outcomes after grant consumption

[ocularminds]

Context

SafeExecutor consumes a single-use grant before invoking the downstream handler. If the provider accepts the action but the handler then times out or loses the response, the current ACTION_EXECUTION_FAILED error cannot distinguish a definite failure from an action that may already have happened. Blind retries with a fresh grant can duplicate side effects.

Acceptance criteria

• Define an execution outcome model that distinguishes blocked, definitely failed before provider dispatch, completed, and unknown after grant consumption.
• Extend the trusted handler contract so it can report dispatch and provider-idempotency state without exposing credentials or execution tokens.
• Never automatically invoke a handler twice after a grant has been consumed.
• Provide a recovery or reconciliation interface keyed by the trusted idempotency key so providers can return an existing result or prove that no action occurred.
• Require a fresh decision before any new side effect after an ambiguous outcome, unless reconciliation returns the original provider result.
• Add concurrency and negative tests covering provider timeout, connection reset, duplicate recovery attempts, and successful reconciliation; update the threat model and handler guidance.