# Mart rerun-recovery matrix (engineering context; not an approval document)

## Scope and invariant

This is the Mart domain delivery record for pre-run Internet rerun cleanup.
It is not a new benchmark phase and it is unreachable from a normal
measurement Run.  Cleanup may only use the existing Mart registry, normal
claimed-work transactions, and read-only readiness proof.  It must not reset a
business row by direct SQL, invent an edge, or turn a retained fatal execution
into an ordinary retry.

The 28-edge/62-tuple registry is a new frozen authority.  Strict route/model
digest validation rejects earlier prepared artifacts; there is no compatibility
reader or rerun migration, so an affected environment must use Fresh Prepare.

All reads and mutations are fenced by the selected user authority, run,
attempt, bound world, lane, and owner.  Older rows from another authority are
not an error and must not sort ahead of selected work.  Historical promotion,
identity, ledger, and cursor records remain history.  Inventory is compensated
only by each terminal order line's fulfilled quantity; it is never reset to an
initial table value.  Store and courier capacity must return to their prepared
baselines, and payment history stays terminal and auditable while its open hold
returns to zero.

The only aggregate proof is `VerifyMartRerunStateReady`.  It is read-only and
checks terminal orders, queue/execution completion, per-line reservation and
fulfilled-line compensation, payment terminality/open holds, net capacity,
inventory reservation buckets, store buckets, and courier buckets.

## Recovery dispositions

| Class | Legal rerun disposition | Result |
| --- | --- | --- |
| `C` — cancellation-capable | Publish the existing sealed `M-CANCEL-S` winner, execute its normal transaction, then strict-stale close the retained predecessor. | System-cancelled terminal order; capacity/hold/reservation effects are released by the ordinary transaction. |
| `N` — post-pickup or finance | Resume only the existing sealed natural successor with the same operation identity after zero-effect proof; keep driving legal successors in the same `DomainEngine` until terminal. | Delivery/finance reaches a legal terminal state; no post-pickup cancellation is fabricated. |
| `T` — terminal normal output | No predecessor retry is invented.  The rerun-only terminal compensation transaction returns only line-level fulfilled stock and the aggregate verifier reads the result. | Terminal order remains historical; line conservation and capacity baseline are proven. |
| `R` — root admission | Root is written by `AdmissionSink`, not by a predecessor queue.  The later selected rerun consumes that committed root through `C` logic. | Root source remains authenticated and its later cancellation reaches aggregate readiness. |

`expired` is deliberately **not** an ingress for `T` or `R`: a terminal
normal output has a completed queue/execution pair, and an Admission root has
no queue/execution pair at all.  The expired locator is therefore unable to
identify either as a claim.  Their legal pre-run ingress is only ready or
point rehydration from the committed source; tests must not manufacture an
empty expired scan and call that coverage.

Every retained fatal class is covered: `validation`, `authority`,
`wrong_database`, `identity`, `cardinality`, `state_version`, `actor`,
`capacity`, `finance`, `queue_fencing`, `proof_conflict`, `deadline`,
`business_outcome`, and `evidence`.  A class is preserved exactly through
success, commit-response-lost proof/replay, and strict stale closeout.  A
failure before a legal winner leaves the original class, queue and resources
unchanged; it is not released to normal retry.

## Frozen 62-cell registry matrix

Each listed source state is one registry cell.  The `cells` column is the
number of source-state cells represented by that row; the rows sum to 62.
`C`, `N`, `T`, and `R` refer to the disposition table above.  “Normal output”
means the actual normal Mart transaction commits the source/event/fact into the
same raw transactional store that the subsequent production `DomainEngine`
entry reads; it is not a separately fabricated predecessor.

| Edge | Exact source state(s) | Target state | Cells | Rerun class | Ordinary resource/finance effect |
| --- | --- | --- | ---: | --- | --- |
| `M-SCH-CREATE` | `none` | `mart_scheduled` | 1 | R | creates hold |
| `M-SCH-ACT` | `mart_scheduled` | `mart_submitted` | 1 | C | releases future soft reserve if present; retains hold |
| `M-SUBMIT` | `none` | `mart_submitted` | 1 | R | creates hold |
| `M-INVENTORY-OK` | `mart_submitted`, `mart_substitution_pending` | `mart_inventory_reserved` | 2 | C | reserves inventory/pick slot; retains or adjusts hold |
| `M-SUBSTITUTE` | `mart_submitted` | `mart_substitution_pending` | 1 | C | reserves available lines only; retains hold |
| `M-INVENTORY-REJECT` | `mart_submitted`, `mart_substitution_pending` | `mart_inventory_rejected` | 2 | T | releases inventory/pick slot and open hold |
| `M-INVENTORY-TIMEOUT` | `mart_submitted`, `mart_substitution_pending` | `mart_inventory_timeout_terminal` | 2 | T | releases inventory/pick slot and open hold |
| `M-PICK` | `mart_inventory_reserved` | `mart_picking` | 1 | C | converts pick-slot reserve to occupied; retains adjusted hold |
| `M-PACK` | `mart_picking` | `mart_packed` | 1 | C | retains occupied pick capacity and hold |
| `M-READY` | `mart_packed` | `mart_ready` | 1 | C | releases pick slot; retains adjusted hold |
| `M-ASSIGN` | `mart_ready`, `mart_reassign_pending` | `mart_courier_assigned` | 2 | C | provider available → committed; retains hold |
| `M-REASSIGN-P` | `mart_courier_assigned` | `mart_reassign_pending` | 1 | C | releases provider once; retains hold |
| `M-REASSIGN-T` | `mart_courier_assigned` | `mart_reassign_pending` | 1 | C | releases provider once; retains hold |
| `M-SUPPLY-REJECT` | `mart_reassign_pending` | `mart_supply_rejected` | 1 | T | releases all once and open hold |
| `M-PICKUP` | `mart_courier_assigned` | `mart_picked_up` | 1 | N | provider committed → occupied; retains adjusted hold |
| `M-DELIVERING` | `mart_picked_up` | `mart_in_delivery` | 1 | N | retains occupied provider and adjusted hold |
| `M-SPLIT-ROLLOVER` | `mart_in_delivery` | `mart_courier_assigned` | 1 | C | releases prior occupied provider; retains adjusted hold |
| `M-PAYABLE` | `mart_in_delivery` | `mart_payable` | 1 | N | releases occupied provider; makes capture eligible |
| `M-PAY-OK` | `mart_payable`, `mart_payment_failed_retryable` | `mart_completed` | 2 | N | captures and creates balanced settlement |
| `M-PAY-RETRY` | `mart_payable`, `mart_payment_failed_retryable` | `mart_payment_failed_retryable` | 2 | N | retains the retryable payment intent |
| `M-PAY-FAIL` | `mart_payable`, `mart_payment_failed_retryable` | `mart_payment_failed_terminal` | 2 | T | settles or reverses the intent |
| `M-SETTLE` | `mart_completed` | `mart_settled` | 1 | T | closes balanced intent |
| `M-DEADLINE` | `mart_scheduled`, `mart_inventory_reserved`, `mart_picking`, `mart_packed`, `mart_ready`, `mart_reassign_pending`, `mart_courier_assigned` | `mart_deadline_missed` | 7 | T | releases all once; stage-appropriate release/refund |
| `M-CANCEL-C` | `mart_scheduled`, `mart_submitted`, `mart_substitution_pending`, `mart_inventory_reserved`, `mart_picking`, `mart_packed`, `mart_ready`, `mart_reassign_pending`, `mart_courier_assigned` | `mart_cancelled_customer` | 9 | T | releases all once; stage-appropriate release/refund |
| `M-CANCEL-SHOP` | `mart_submitted`, `mart_substitution_pending`, `mart_inventory_reserved`, `mart_picking`, `mart_packed`, `mart_ready` | `mart_cancelled_store` | 6 | T | releases all once; stage-appropriate release/refund |
| `M-CANCEL-P` | `mart_courier_assigned` | `mart_cancelled_provider` | 1 | T | releases all once; stage-appropriate release/refund |
| `M-CANCEL-S` | `mart_scheduled`, `mart_submitted`, `mart_substitution_pending`, `mart_inventory_reserved`, `mart_picking`, `mart_packed`, `mart_ready`, `mart_reassign_pending`, `mart_courier_assigned` | `mart_cancelled_system` | 9 | T | releases all once; stage-appropriate release/refund |
| `M-NOSHOW` | `mart_courier_assigned` | `mart_no_show_cancelled` | 1 | T | releases all once; stage-appropriate release/refund |
| **Total** |  |  | **62** |  |  |

## Executable closure evidence

The following tests are the production-path evidence for every matrix cell.
All use the thin raw transactional store only as a transaction adapter: normal
production mutations become visible only on `Commit`, and subsequent engine
or verifier reads use a new store-backed production query session.  The store
does not choose edges, route handlers, or prefill business outcomes.

| Matrix scope | Entrances and outcomes | Executable test |
| --- | --- | --- |
| All 60 queued normal writers (62 registry tuples minus 2 direct roots) | commits the ordinary event/fact/queue/execution mutation from each queued registry tuple; write resources are leased and post-commit effects are read back | `TestMartNormalHistoricalTransactionsCommitEveryQueuedTuple` |
| 12 `C` normal outputs | committed normal output → retained fatal → ready, point, expired → `M-CANCEL-S` winner → strict stale → terminal aggregate proof; 14 classes | `TestMartCommittedNormalCancellableOutputsFeedRerunTerminalProof` |
| 12 `C` normal outputs with earlier foreign candidate | same three production entrances select current run, selected user, and bound world before ordering and leave an earlier same-run/same-user/different-world foreign row byte-for-byte unchanged; 14 classes | `TestMartCommittedNormalCancellableOutputsIgnoreForeignCandidates` |
| 7 `N` normal outputs | committed normal output → retained fatal → ready, point, expired → same-identity legal successor chain → terminal aggregate proof; 14 classes | `TestMartCommittedNormalNaturalOutputsFeedRerunTerminalProof` |
| 7 `N` normal outputs with earlier foreign candidate | same three production entrances process only the selected run/user/world and leave an earlier same-run/same-user/different-world foreign row unchanged; 14 classes | `TestMartCommittedNormalNaturalOutputsIgnoreForeignCandidates` |
| 41 `T` normal outputs | committed terminal output → ready or point; expired is N/A because no claimed predecessor exists → line-level compensation if due → terminal aggregate proof | `TestMartCommittedNormalTerminalOutputsReachRerunReady` |
| 50 cancellable source cells, including paths not produced by a particular normal output class | ready, point, expired; success, commit-response-lost, stale, and fail-closed outcomes; all 14 retained classes | `TestMartRerunCancellableDurableTerminalRegistryEntries`, `TestMartRerunCancellableDurableCommitLostTerminalRegistryEntries`, `TestMartRerunCancellableDurableFailureRegistry` |
| 50 cancellable source cells with earlier foreign queue/execution | ready, point, expired current-vs-foreign ordering and immutability | `TestMartRerunCancellableDurableForeignCandidatesStayUntouched` |
| post-pickup/finance active source cells | legal natural chain, commit-response-lost, foreign and fail-closed paths | `TestMartRerunNaturalDurableRegistryTerminalChains`, `TestMartRerunNaturalDurableCommitLostRegistryTerminalChains`, `TestMartRerunNaturalDurableForeignCandidatesStayUntouched`, `TestMartRerunNaturalDurableFailureRegistry` |
| `M-SUBMIT` and `M-SCH-CREATE` roots | real `AdmissionSink` commit → same-store ready or point rerun → terminal proof; expired is N/A because roots have no queue claim; includes commit-response-lost, earlier same-run/same-user/different-world foreign root, and pre-commit write failure/rollback | `TestMartDurableRootAdmissionCommitReadback` |
| settlement natural edge | real production loader predicate: matching market/currency, `settlement_at >= now`, deterministic `(settlement_at, settlement_batch_id)` ordering, resource write/readback | `TestMartDurableSettlementCandidateHonorsProductionPredicateAndOrdering` |
| persisted logical time | read-only persisted maximum across selected timeline coordinates, including foreign authority future settlement timestamp | `TestReadMartPersistedLogicalWatermarkUsesDurableTimelineAndIsReadOnly`, `TestReadMartPersistedLogicalWatermarkMixedFutureTimeline`, `TestReadMartPersistedLogicalWatermarkIncludesCommittedForeignSettlementMax` |
| normal/Rerun isolation | a normal batch clears rerun-only mode before it can issue rerun cleanup SQL; an actual normal claimed retained-fatal residue fails closed without durable writes or rerun-only sessions | `TestMartNormalBatchClearsPriorDrainMode`, `TestMartNormalBatchWithActualRetainedFatalNeverOpensRerunCleanup` |

## Explicit non-goals and failure boundary

Normal Run does not call rerun cleanup, alter scheduling/retry semantics, or
pay a recovery-path QPS cost.  A physical contradiction — for example a
claimed source with conflicting authenticated event/fact/order proof — is not
an automatic cleanup case.  The code leaves its order, queue, class, and
resources unchanged and returns the invariant error for RCA.

This document records local closure evidence only.  It does not authorize an
E2E run or a QPS conclusion: an independent exact-HEAD review of Mart, plus
the corresponding Ride and Food closure reviews, remains required by the root
rerun-recovery gate.