# Failure recovery

On a timeout after `content_article_job_start`, retry with the same idempotency key and byte-for-byte equivalent source, provider, and model selection. The server returns the same durable job. Never reuse that key for different inputs.

On a stale version while cancelling, call `content_article_job_get`, inspect the current state, and cancel only if it is still non-terminal. Never increment a version locally.

On a stale source, changed knowledge hash, runtime signature failure, or workflow/runtime mismatch, the host fails closed before Gate 2. Never substitute cached Voice or local files. Start a new job only after the previous job is terminal and the source is available again.

On a worker lease-expiry failure, do not request transcripts through another tool. Start a new job after source leases are reclaimable.

While the host records `revision_required`, keep monitoring the same job. The coordinator resumes the same producer session with the failed rule IDs or structured peer acceptance conditions.

On the third non-acceptance, runtime mismatch, invalid context, or failed reviewer independence check, stop for human intervention.

Use `content_article_job_cancel` only when the user explicitly asks to stop a non-terminal job. Cancellation and failure are not evidence that an article was reviewed or accepted.