---
{
  "id": "platform.delivery.reliability-limits-and-debugging",
  "topic": "delivery",
  "title": "Delivery reliability, limits, billing, and debugging",
  "locale": "en",
  "version": "2026-08-09.1",
  "summary": "Delivery retries only transient failures, distinguishes queued from delivered, auto-disables unhealthy endpoints, and charges at enqueue.",
  "content": "Timeout, connection failure, and HTTP 5xx are transient. They retry with deterministic jitter around 1 minute, 5 minutes, 30 minutes, 2 hours, then 8 hours, with a hard five-attempt cap; exhaustion becomes `dead`. HTTP 4xx and redirects are permanent and become `failed` immediately. HTTP 410 Gone disables the endpoint. Twenty consecutive failures change it to `auto_disabled` and notify the owner. Disabling an endpoint terminalizes its queued and in-flight deliveries. Canonical delivery statuses are `queued`, `delivering`, `delivered`, `failed`, `dead`, and `acked` for Pull.\n\nEnqueue uses a per-endpoint 60-per-minute token bucket and a per-owner 1,000-per-UTC-day quota. Direct Agent sends and Workflow delivery steps share both quotas. The Redis decision fails closed; rejected calls are not charged. A serialized service payload may be at most 256 KiB. The 64 KiB total argument envelope applies specifically to the direct `arinova.delivery.send` Action; a Workflow step does not go through that Action, though its graph and rendered payload have their own bounds. Upload oversized data elsewhere and send a link. Enqueue success charges credit immediately. Current runtime does not automatically refund a later `failed` or `dead` delivery. Terminal history is retained for 30 days.\n\nStart debugging with the action's typed error. `resource_not_found` means the endpoint is absent or not granted to this Agent; it intentionally does not reveal which. `resource_conflict` means it is not active; ask the owner to verify or enable it in Office > Outgoing Deliveries. `permission_denied` includes top-up guidance, `rate_limited` includes retry details, and `invalid_arguments` covers event format or size. Then ask the owner to inspect delivery history and the endpoint failure count; never infer delivery from `queued`. Delivery history intentionally retains no payload, and Workflow run detail stores only `contentBytes`, so neither surface can recover sent content later.\n",
  "aliases": [
    "delivery retry",
    "queued not delivered",
    "dead delivery",
    "endpoint auto disabled",
    "delivery rate limit",
    "傳送失敗",
    "重試佇列",
    "自動停用"
  ],
  "tags": [
    "delivery",
    "reliability",
    "limits",
    "debugging"
  ],
  "relatedActions": [
    "arinova.delivery.list_endpoints",
    "arinova.delivery.send"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/delivery/reliability-limits-and-debugging/"
}
---

Timeout, connection failure, and HTTP 5xx are transient. They retry with deterministic jitter around 1 minute, 5 minutes, 30 minutes, 2 hours, then 8 hours, with a hard five-attempt cap; exhaustion becomes `dead`. HTTP 4xx and redirects are permanent and become `failed` immediately. HTTP 410 Gone disables the endpoint. Twenty consecutive failures change it to `auto_disabled` and notify the owner. Disabling an endpoint terminalizes its queued and in-flight deliveries. Canonical delivery statuses are `queued`, `delivering`, `delivered`, `failed`, `dead`, and `acked` for Pull.

Enqueue uses a per-endpoint 60-per-minute token bucket and a per-owner 1,000-per-UTC-day quota. Direct Agent sends and Workflow delivery steps share both quotas. The Redis decision fails closed; rejected calls are not charged. A serialized service payload may be at most 256 KiB. The 64 KiB total argument envelope applies specifically to the direct `arinova.delivery.send` Action; a Workflow step does not go through that Action, though its graph and rendered payload have their own bounds. Upload oversized data elsewhere and send a link. Enqueue success charges credit immediately. Current runtime does not automatically refund a later `failed` or `dead` delivery. Terminal history is retained for 30 days.

Start debugging with the action's typed error. `resource_not_found` means the endpoint is absent or not granted to this Agent; it intentionally does not reveal which. `resource_conflict` means it is not active; ask the owner to verify or enable it in Office > Outgoing Deliveries. `permission_denied` includes top-up guidance, `rate_limited` includes retry details, and `invalid_arguments` covers event format or size. Then ask the owner to inspect delivery history and the endpoint failure count; never infer delivery from `queued`. Delivery history intentionally retains no payload, and Workflow run detail stores only `contentBytes`, so neither surface can recover sent content later.