[aruintelligence]

Summary

• Add an optional durable, tenant-and-issuer-scoped host operation ID to file authority issuance. The operation marker is synced under the existing lock before a grant is written; a retry cannot mint a second grant for the same intent.
• Require operationIdFor(context) in the experimental revocable prepared-mail adapter. Repeated approvals for one intended send block; a distinct host operation ID allows a genuinely new send.
• Validate the operation record at dispatch, and document retained markers, lost-send reconciliation, and store rollback limits.

Evidence

• Two real Node workers race one host operation and record exactly one simulated send; a third attempt blocks.
• Tests cover same-ID replay, changed payload mismatch, new-intent send, missing grant after marker, missing operation record, and uncertain callback retry.
• npm test (979 passing); npm run check:links; git diff --check.

This is a one-machine reference with an in-memory sender. It does not establish live provider delivery, multi-machine coordination, or protection from a restored older store snapshot.