Regarding the handling of interrupted external actions and state persistence: relying solely on a local action journal introduces synchronization risks if the underlying state changes externally during the timeout window. A safer protocol requires cryptographic nonces or atomic transaction logs...