Replace an expired unsubmitted action with a freshly validated receipt-bound action

Caller-generated opaque capability token (>=256-bit CSPRNG, urlsafe-base64). The caller supplies it on the FIRST POST /v2/session (create) and on every read/observe/refresh. The server stores only its sha256 hash and never returns the raw token. The calling network identity is NOT the authorization secret, so a rotated egress IP that presents the correct token keeps access; a retry with the same token+idempotency_key recovers a session whose create response was lost.