Fix Slack reply recovery after successful mutations

[3mdistal]

Summary

• preserve verified A2A artifact checkpoints while delegated work continues, preferring a later final result and using the checkpoint only as a truthful terminal fallback
• persist formatted integration replies before provider delivery and retry delivery only, without rerunning successful mutations or allowing later thread turns to overtake recovery
• atomically carry provider receipts and deterministic conversation message IDs across retry transitions so retries preserve one conversation-history identity
• make recoverable A2A checkpoint persistence ordered, boundedly retried, fail loud when it cannot become durable, and support verified organization-only A2A secrets

Why

A Slack correction could successfully update the existing Content record but leave the thread silent. Retrying the whole integration task would risk replaying the mutation. This change separates mutation truth from delivery truth: the stable Content identity is retained, while only the missing provider reply is retried.

Provider posting remains at-least-once when acceptance is ambiguous before a receipt is returned. Slack does not expose a generic exactly-once primitive for this reply path, so an accepted post followed by a lost provider response can still produce a duplicate reply. The durable guarantee here is that recovery preserves exact conversation-history identity and never reruns the successful Content mutation.

Verification

• 204 focused tests across A2A artifact provenance and continuations, checkpoint persistence, pending-task storage, processor routing, webhook delivery, and integration-history replay
• @agent-native/core TypeScript 7 typecheck
• oxfmt check on all modified source and test files
• changeset validation
• git diff --check
• independent final code reviews: no remaining code blockers

QA

No preview Slack bot or integration environment exists. Real Slack-to-Content QA remains intentionally deferred until this PR is merged and deployed. The frozen deployed story is: rename the Content record, correct unrelated fields in the same Slack thread, preserve the stable ID and live title, create no duplicate Content record, and receive one truthful confirmation on the clean provider path.

[github-actions]

Here's a visual recap of what changed:

Open the full interactive recap

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Incremental Code Review Summary

The latest PR head fixes the previously reported A2A provenance issue. withPersistedArtifactMarker now builds a deduplicated verification-secret list containing the explicit organization secret and the global A2A_SECRET, then passes it to extractA2AArtifactIdentities before signing the outer marker. This preserves nested organization-signed artifacts in organization-only deployments while retaining global-secret compatibility.

The added regression coverage exercises organization-scoped nested marker verification, and the continuation processor still propagates the applicable secret set when validating and persisting recoverable checkpoints. The broader delivery retry, deterministic history-ID, FIFO task ordering, and serialized checkpoint paths remain consistent with the prior review.

The previously open artifact-marker comment was verified fixed and resolved. The incremental review agents found no additional confirmed bugs in the latest changes. This is a standard-risk change because it modifies shared integration persistence and retry state.

✅ Result: No new actionable findings.

🧪 Browser testing: Skipped — PR only modifies backend/integration logic and tests, with no user-facing browser UI impact.