Make generation quotas safe to retry

Any web action that calls a slower service has to handle a familiar failure: the server may finish...