Good point that the payload was frozen at enqueue time. Marking the row cancelled instead of deleting it keeps the audit trail clean. Would you also re-render the payload from current data on retry, or always drop it once access is gone?