# Content temporarily unavailable
# PR #1592: retry decision grammar review

## Reviewed executable state and law

- Reviewed executable commit: `d283256048628e8a8aabd6e0b0dac0f9d8108638`.
- Production subject at that commit: `760e54204541f260be34f0e93087e9598cb769b6`; the two intervening commits change only the settlement oracle and coverage map.
- Primary owner: `packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts`.
- Review method: self-review under the oracle guide and mutant gap hunt. No independent reviewer is claimed.

The accepted `shouldRetry` law has three valid answers. `true` retries, `false`
terminates, and `undefined` delegates to the existing default decision. An
omitted hook also delegates. `NonRetriableError` bypasses the hook. A thrown
hook error or any other return value fails that outbox row. The maintainer's
earlier row-local decision authorizes terminal removal; this repair does not
change that product policy. The default policy's current AbortError and message
classifications are preservation controls, not a general HTTP status policy.

The old seven-case table already included ordinary error plus `false`, so it
could reject a false-as-delegation mutant. It omitted the opposite override,
AbortError, several default message classes, and Promise results. A null result
already had public `commit()` and cleanup witnesses. The first expansion still
missed later fixed examples because fast-check counted examples against its
12-run budget. Status mutants for 400, 403, 422, and 404 survived that first
expansion. The executable repair reserves 33 fixed runs before 12 generated
runs in each normal campaign, then asserts that all 32 error/answer cells ran.

## Executed controls

The final model crosses eight fixture error kinds with four hook answers. It
checks the first stored retry record or acknowledged terminal deletion, exact
outbox IDs and retry counts, caller promises, provider calls, and Collection
rows. A separate public hook-fault driver crosses throw, null, zero, and
Promise results and checks the first terminal marker against a retry record.
The fixed matrix uses one FIFO peer, one additional auth case uses three, and
the generated runs vary peer count from one to three. A later-failure witness
checks retry count one. The controlled storage does not establish native
durability, real timer accuracy, or provider idempotency.

On the reviewed executable commit, the settlement oracle passed 51 of 51
tests; package typecheck, test-file ESLint, Prettier, and `git diff --check`
passed. The following temporary mutants were restored after their runs:

| Mutant | Distinguishing history | Outcome |
| --- | --- | --- |
| Treat `false` as `undefined` | ordinary error, explicit terminal answer | Assertion failure: stored `retry` versus expected `terminal`. |
| Await a Promise hook result | 401 error, Promise of `true` | Assertion failure: stored `retry` versus expected `terminal`. |
| Retry AbortError by default | AbortError, delegated answer | Assertion failure at stored decision. |
| Retry 400 by default | 400 message, delegated answer | Assertion failure at stored decision. |
| Retry 403 by default | 403 message, delegated answer | Assertion failure at stored decision. |
| Retry 422 by default | 422 message, delegated answer | Assertion failure at stored decision. |
| Terminate 404 by default | 404 message, delegated answer | Assertion failure at stored decision. |
| Restore the old 12-run budget | Normal campaign | Reach assertion failure: 12 observed cells versus 32 declared cells. |

The first run of the 400/403/422/404 mutants **survived** before the budget
repair. They are not counted as kills from that version. All reported kills
above reached assertions after the final budget repair; none was a timeout,
setup failure, or unreached edit. Direct replay of the false-as-delegation
mutant with seed `-1799994628` and path `5` reproduced the same ordinary/false
comparison on the reviewed executable commit.

## Oracle guide audit

| Requirement | Outcome |
| --- | --- |
| ORC-001 authority and limits | Pass. The README, type contract, approved row-local decision, and existing default behavior support the bounded law above. HTTP status meaning, native storage, timers, and provider effects remain outside it. |
| ORC-002 independent judgment | Pass. The expected decision is a declarative truth table and three-answer rule. It does not call the production retry classifier. The provider-error helper only constructs fixture inputs. |
| ORC-003 distinguishable responsibilities | Pass. Opening prose states the law; local prose accompanies the model, 32-cell grammar, public driver, and stored-decision comparison. |
| ORC-004 grammar controls | Pass. Fixed examples reconstruct every error/answer cell; the reach assertion fails if the campaign budget excludes one. The two explicit answers, delegation, omission, permanent bypass, error classes, and peer-count variation each have a stated role. The nearby invalid null, zero, and Promise answers belong to the separate fault grammar; duplicate IDs and storage failures remain separate owners/cuts. |
| ORC-005 path and observation | Pass. Public transactions call `commit()` through the real executor, outbox, scheduler, and Collection. The first durable decision is compared before later peer progress can hide it. |
| ORC-006 checker calibration | Pass. The temporary wrong designs in the table fail at their intended stored-decision or reach assertion. Initial survivors are recorded separately. |
| ORC-007 fixed/random replay | Pass. Both normal campaigns run the same property for 45 cases, one fixed seed and one seedless. Seed/path replay reproduced the false-as-delegation comparison directly. |
| ORC-008 state minimality | Not triggered. The new decision table is stateless; no reference-model state was added or merged. |
| ORC-009 vocabulary mapping | Pass. Fixture-only error-kind labels select Error instances; `storedDecision` projects the retry-record or terminal-deletion observation and is not a production state. Outbox phases retain glossary terms. |
| ORC-010 failure fidelity | Pass. The new comparison fails before peer waits on a wrong decision. Existing `finally` cleanup releases provider gates and preserves the primary assertion; direct replay reproduced it. |
| ORC-011 second formulation | Not triggered for the optional hook law: no distinct shared semantic fault was established. The generic 404 policy remains a separate design question, not an expected result inferred from this hook oracle. |
| ORC-012 review evidence | This versioned record names the executable commit, scope, controls, applicable outcomes, and remaining limits. It follows the executable commits. |
| ORC-013 boundary witness | Pass. Ordinary/false distinguishes terminal override from delegation, auth/true distinguishes retry override from the default, and 404/defer distinguishes the default retry branch from the adjacent terminal message cases. The Promise witness distinguishes synchronous validation from awaiting. |
| ORC-014 controlled-premise handoff | No native-host claim is made. Fake storage controls the durable decision cut; real IndexedDB completion remains separate receiving work. |

## Remaining scope

The table is exhaustive only for its eight error fixtures and four hook
answers. It does not prove every string matching edge case in the default
policy, every retry count, or every interleaving. The existing second-error
witness covers count one; the row-local cleanup matrices cover peer admission
and storage failures. The coverage map keeps native storage and broader offline
recovery limits with their owners and RFC #1659.

## Final production follow-up

The production and documentation follow-up executable commit is
`c4cd2dd8de085a8cc1680f7eb8bc8a67b740428e`. It keeps the retry decision
law and the oracle unchanged. The settlement oracle passed 51/51 cases. A
package run excluding the separate uncommitted leadership/FIFO experiment
passed 217 tests in 17 files; package typecheck, source and oracle ESLint,
Prettier, and diff checks passed.

The false-as-delegation, Promise-await, AbortError, 400, 403, 422, and 404
temporary mutants were rerun on that executable commit. Each failed at the
stored-decision assertion. Direct seed/path replay again reached the
ordinary/false assertion. The temporary source edits were restored exactly;
none of these results relies on a timeout or a setup error. No later executable
change is part of this record.