运维扩展

var tenantId = currentUser.User.TenantId;
var actorKey = currentUser.User.ActorUserId;
var deliveryId = command.DeliveryId.Trim();
// ① 敏感操作先过审批门：ApprovalTicket 无效即拒绝（DeliveryFailureApprovalRequired）。
if (!await approvalGate.ValidateAsync(command.ApprovalTicket, cancellationToken))
    return Result.Failure(OpsExtensionErrors.DeliveryFailureApprovalRequired);
// ② 动作前先落意图审计；意图审计写不进去则整体失败关闭（DeliveryFailureAuditUnavailable）。
var intentPersisted = await DeliveryFailureAudit.TryRecordAsync(activityAuditSink,
    new ActivityRecord("DeliveryFailure.Webhook.Retry.Intent", actorKey, tenantId,
        true, $"delivery={deliveryId}", command.ApprovalTicket, clock.UtcNow),
    logger, cancellationToken);
if (!intentPersisted) return Result.Failure(OpsExtensionErrors.DeliveryFailureAuditUnavailable);
// ③ 意图落库后才执行真实重投：Adapter 重入 WebhookDeliveryService，保留 owner guard。
var retry = await webhookRetry.RetryAsync(tenantId, deliveryId, cancellationToken);
var outcome = retry.IsSuccess ? retry.GetValueOrThrow().Status : retry.Error.Code;
// ④ 完成审计使用 CancellationToken.None：即使请求中止也必须留下处置结果。
var completionPersisted = await DeliveryFailureAudit.TryRecordAsync(activityAuditSink,
    new ActivityRecord("DeliveryFailure.Webhook.Retry.Completed", actorKey, tenantId,
        retry.IsSuccess, $"delivery={deliveryId},outcome={outcome}",
        command.ApprovalTicket, clock.UtcNow),
    logger, CancellationToken.None);
// ⑤ 真实重投失败优先返回其错误；完成审计缺失则以 OutcomeUnknown 显式暴露未知态。
if (retry.IsFailure) return Result.Failure(retry.Error);
if (!completionPersisted) return Result.Failure(OpsExtensionErrors.DeliveryFailureOutcomeUnknown);
return Result.Success(retry.GetValueOrThrow());