@abloatai/humans 0.45.0 → 0.46.0

package/dist/local/sync/createClaimStream.js

@@ -83,6 +83,28 @@ export function createClaimStream(config, transport = null) {
             }
         }
     };
+    const observeForeignClaim = (heldBy, claim, participantKind, isAgent) => {
+        const description = claim.description ??
+            descriptionFromMeta(claim.meta) ??
+            'editing';
+        const { meta, ...details } = subTarget(claim);
+        activeByClaimId.set(claim.claimId, {
+            object: 'claim',
+            id: claim.claimId,
+            status: 'active',
+            heldBy,
+            participantKind: participantKindFromWire(participantKind, isAgent),
+            target: {
+                ...streamTarget(claim),
+                ...details,
+                ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
+            },
+            description,
+            ttlSeconds: Math.max(0, Math.floor((claim.expiresAt - Date.now()) / 1000)),
+            createdAt: claim.declaredAt,
+            expiresAt: claim.expiresAt,
+        });
+    };
     // ── Wire wiring ──────────────────────────────────────────────────
     let attached = null;
     const unsubs = [];
@@ -125,30 +147,7 @@ export function createClaimStream(config, transport = null) {
                 // `settled()`. Absent status means active (wire back-compat).
                 if (claim.status && claim.status !== 'active')
                     continue;
-                // Resolve the always-present public field, tolerating a frame that
-                // carries the value in `meta` rather than as an explicit description.
-                const description = claim.description ??
-                    descriptionFromMeta(claim.meta) ??
-                    'editing';
-                // The frame is parsed permissively, on purpose; `declaredMeta` is where
-                // that wire value becomes the shape the program declared.
-                const { meta, ...details } = subTarget(claim);
-                activeByClaimId.set(claim.claimId, {
-                    object: 'claim',
-                    id: claim.claimId,
-                    status: 'active',
-                    heldBy: event.userId,
-                    participantKind: participantKindFromWire(event.participantKind, event.isAgent),
-                    target: {
-                        ...streamTarget(claim),
-                        ...details,
-                        ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
-                    },
-                    description,
-                    ttlSeconds: Math.max(0, Math.floor((claim.expiresAt - Date.now()) / 1000)),
-                    createdAt: claim.declaredAt,
-                    expiresAt: claim.expiresAt,
-                });
+                observeForeignClaim(event.userId, claim, event.participantKind, event.isAgent);
                 mutated = true;
             }
             if (mutated)
@@ -168,6 +167,16 @@ export function createClaimStream(config, transport = null) {
             // a claim the server already rejected (would just spam both
             // sides with conflicts).
             ownClaims.delete(rejection.claimId);
+            // A holder on another server may have claimed before this client joined
+            // the row group, so its one-shot presence frame was missed. A conflict
+            // reply carries the authoritative holder summary; seed the same local
+            // state immediately instead of continuing to report the row as free.
+            if (rejection.reason === 'conflict' &&
+                rejection.heldBy &&
+                rejection.heldByClaim) {
+                observeForeignClaim(rejection.heldBy, rejection.heldByClaim, rejection.heldByKind);
+                notifyListeners();
+            }
             for (const l of rejectionListeners) {
                 try {
                     l(rejection);

package/dist/local/transactions/mutations/MutationQueue.d.ts

@@ -45,6 +45,15 @@ export interface MutationQueueConfig {
     maxBatchSize: number;
     batchDelay: number;
     maxRetries: number;
+    /**
+     * Minimum wall-clock window for retrying transient write failures with the
+     * same durable envelope and idempotency key. This absorbs managed-database
+     * promotion and brief regional network incidents without double-applying a
+     * write. Defaults to 120 seconds: the Aurora promotion drill recovered
+     * writes just beyond 60 seconds, so a one-minute boundary discarded exact
+     * envelopes at the instant the new writer became usable.
+     */
+    availabilityRetryWindowMs: number;
     conflictResolution: ConflictResolution;
     enablePersistence: boolean;
     enableOptimistic: boolean;
@@ -127,6 +136,7 @@ export declare class MutationQueue extends EventEmitter {
     private replicationLagTimeouts;
     private replicationLagErrors;
     private commitProcessing;
+    private commitRetryTimer;
     private lastCommitSequence;
     private durableReplayBlock;
     /** Browser-backed strict outbox; absent for standalone/in-memory consumers. */
@@ -418,6 +428,15 @@ export declare class MutationQueue extends EventEmitter {
             maxBatchSize: number;
             batchDelay: number;
             maxRetries: number;
+            /**
+             * Minimum wall-clock window for retrying transient write failures with the
+             * same durable envelope and idempotency key. This absorbs managed-database
+             * promotion and brief regional network incidents without double-applying a
+             * write. Defaults to 120 seconds: the Aurora promotion drill recovered
+             * writes just beyond 60 seconds, so a one-minute boundary discarded exact
+             * envelopes at the instant the new writer became usable.
+             */
+            availabilityRetryWindowMs: number;
             conflictResolution: ConflictResolution;
             enablePersistence: boolean;
             enableOptimistic: boolean;

package/dist/local/transactions/mutations/MutationQueue.js

@@ -104,6 +104,7 @@ export class MutationQueue extends EventEmitter {
     replicationLagTimeouts = new Map();
     replicationLagErrors = new Map();
     commitProcessing = false;
+    commitRetryTimer = null;
     lastCommitSequence = 0;
     durableReplayBlock = null;
     /** Browser-backed strict outbox; absent for standalone/in-memory consumers. */
@@ -125,7 +126,11 @@ export class MutationQueue extends EventEmitter {
     get commitLaneContext() {
         return {
             runtime: this.runtime,
-            config: { maxRetries: this.config.maxRetries },
+            config: {
+                maxRetries: this.config.maxRetries,
+                availabilityRetryWindowMs: this.config.availabilityRetryWindowMs,
+                retryBackoff: this.config.retryBackoff,
+            },
             commitLane: this.commitLane,
             commitNotifications: this.commitNotifications,
             commitMissingIds: this.commitMissingIds,
@@ -147,6 +152,14 @@ export class MutationQueue extends EventEmitter {
             noteAck: (syncId) => this.noteAck(syncId),
             isDefinitiveRejection: (error) => this.isDefinitiveRejection(error),
             isPermanentError: (error) => this.isPermanentError(error),
+            scheduleRetry: (delayMs) => {
+                if (this.commitRetryTimer !== null)
+                    clearTimeout(this.commitRetryTimer);
+                this.commitRetryTimer = setTimeout(() => {
+                    this.commitRetryTimer = null;
+                    void this.processCommitLane();
+                }, delayMs);
+            },
             emitCommitLifecycle: (event, payload) => this.emitCommitLifecycle(event, payload),
         };
     }
@@ -516,6 +529,7 @@ export class MutationQueue extends EventEmitter {
         maxBatchSize: 50, // send up to this many operations per commit
         batchDelay: 150, // milliseconds to wait for more operations before sending
         maxRetries: 3,
+        availabilityRetryWindowMs: 120_000,
         conflictResolution: {
             strategy: 'last-write-wins',
         },
@@ -1506,6 +1520,10 @@ export class MutationQueue extends EventEmitter {
             clearTimeout(this.commitOfflineGraceTimer);
             this.commitOfflineGraceTimer = null;
         }
+        if (this.commitRetryTimer !== null) {
+            clearTimeout(this.commitRetryTimer);
+            this.commitRetryTimer = null;
+        }
         // Clear store
         this.store.clear();
         this.localMutationPort.updates.clear();

package/dist/local/transactions/mutations/commitLane.d.ts

@@ -21,6 +21,7 @@ export interface CommitTransaction {
     createdAt: number;
     attempts: number;
     transientAttempts?: number;
+    firstTransientFailureAt?: number;
     lastSyncId?: number;
     correlationId?: string;
     error?: Error;
@@ -34,6 +35,11 @@ export interface CommitLaneContext {
     readonly runtime: RuntimeContext;
     readonly config: {
         maxRetries: number;
+        availabilityRetryWindowMs: number;
+        retryBackoff: {
+            baseMs: number;
+            capMs: number;
+        };
     };
     readonly commitLane: CommitTransaction[];
     readonly commitNotifications: Map<string, StaleNotification[]>;
@@ -52,6 +58,7 @@ export interface CommitLaneContext {
     readonly noteAck: (syncId: number | undefined) => void;
     readonly isDefinitiveRejection: (error: Error) => boolean;
     readonly isPermanentError: (error: Error) => boolean;
+    readonly scheduleRetry: (delayMs: number) => void;
     readonly emitCommitLifecycle: (event: string, payload: object) => void;
 }
 export interface CommitReceiptContext {

package/dist/local/transactions/mutations/commitLane.js

@@ -1,4 +1,4 @@
-import { AbloConnectionError } from '@abloatai/transaction/errors';
+import { transientRetryDelayMs } from './failureHandling.js';
 export function waitForCommitReceipt(ctx, clientTxId) {
     const drainNotifications = () => {
         const notifications = ctx.commitNotifications.get(clientTxId);
@@ -112,15 +112,18 @@ export async function processCommitLane(ctx) {
                 const error = cause instanceof Error ? cause : new Error(String(cause));
                 if (dispatchStarted && ctx.isDefinitiveRejection(error))
                     await ctx.removeDurableCommit(tx.id);
-                if (!(error instanceof AbloConnectionError))
-                    tx.transientAttempts = (tx.transientAttempts ?? 0) + 1;
-                const exhausted = (tx.transientAttempts ?? 0) > ctx.config.maxRetries;
+                tx.transientAttempts = (tx.transientAttempts ?? 0) + 1;
+                tx.firstTransientFailureAt ??= Date.now();
+                const outsideAvailabilityWindow = Date.now() - tx.firstTransientFailureAt >= ctx.config.availabilityRetryWindowMs;
+                const exhausted = tx.transientAttempts > ctx.config.maxRetries && outsideAvailabilityWindow;
                 if (!ctx.isPermanentError(error) && !exhausted) {
                     tx.status = 'pending';
+                    const delayMs = transientRetryDelayMs(error, tx.transientAttempts, ctx.config.retryBackoff);
                     ctx.runtime.logger.debug('[MutationQueue] commit lane transient', {
                         txId: tx.id.slice(0, 12), attempts: tx.attempts,
-                        transientAttempts: tx.transientAttempts ?? 0, message: error.message,
+                        transientAttempts: tx.transientAttempts, delayMs, message: error.message,
                     });
+                    ctx.scheduleRetry(delayMs);
                     break;
                 }
                 tx.status = 'failed';

package/dist/local/transactions/mutations/commitPayload.d.ts

@@ -54,6 +54,8 @@ export interface QueuedMutation {
     status: 'pending' | 'executing' | 'awaiting_delta' | 'completed' | 'failed' | 'rolled_back';
     createdAt: number;
     attempts: number;
+    /** First transient dispatch failure in the current availability incident. */
+    firstTransientFailureAt?: number;
     priority: 'normal' | 'high';
     priorityScore: number;
     writeOptions?: WriteOptions;

package/dist/local/transactions/mutations/failureHandling.d.ts

@@ -4,7 +4,7 @@ import type { QueuedMutation } from './commitPayload.js';
 import type { MutationStore } from './MutationStore.js';
 export interface FailureHandlingContext {
     readonly runtime: RuntimeContext;
-    readonly config: Pick<MutationQueueConfig, 'enableOptimistic' | 'maxRetries' | 'retryBackoff'>;
+    readonly config: Pick<MutationQueueConfig, 'enableOptimistic' | 'maxRetries' | 'retryBackoff' | 'availabilityRetryWindowMs'>;
     readonly store: MutationStore;
     readonly isPermanentError: (error: Error) => boolean;
     readonly rollbackOptimistic: (transaction: QueuedMutation, reason: string, error?: Error) => Promise<void>;
@@ -13,4 +13,5 @@ export interface FailureHandlingContext {
     readonly setLastPermanentErrorSignature: (signature: string) => void;
     readonly emit: (event: string, payload: object) => boolean;
 }
+export declare function transientRetryDelayMs(error: Error, attempt: number, retryBackoff: MutationQueueConfig['retryBackoff']): number;
 export declare function handleFailure(ctx: FailureHandlingContext, transaction: QueuedMutation, error: Error): Promise<void>;

package/dist/local/transactions/mutations/failureHandling.js

@@ -1,5 +1,17 @@
 import { AbloError } from '@abloatai/transaction/errors';
 import { extractStatusCode } from './commitPayload.js';
+export function transientRetryDelayMs(error, attempt, retryBackoff) {
+    const { baseMs, capMs } = retryBackoff;
+    let base = baseMs;
+    try {
+        const status = extractStatusCode(error);
+        if (status === 429 || status === 503)
+            base = Math.max(baseMs, 1_000);
+    }
+    catch { }
+    const ceiling = Math.min(capMs, base * Math.pow(2, Math.max(0, attempt - 1)));
+    return Math.floor(Math.random() * ceiling);
+}
 export async function handleFailure(ctx, transaction, error) {
     transaction.attempts++;
     // Check whether this is a permanent error that should not be retried.
@@ -95,22 +107,15 @@ export async function handleFailure(ctx, transaction, error) {
         ctx.emit(`transaction:failed:${transaction.id}`, { error });
         return;
     }
-    if (transaction.attempts < ctx.config.maxRetries) {
+    transaction.firstTransientFailureAt ??= Date.now();
+    const insideAvailabilityWindow = Date.now() - transaction.firstTransientFailureAt < ctx.config.availabilityRetryWindowMs;
+    if (transaction.attempts < ctx.config.maxRetries || insideAvailabilityWindow) {
         // Exponential backoff with full jitter on every transient retry:
         // `sleep = random(0, min(cap, base * 2^attempt))`. Throttling responses
         // (429/503) use a longer base than other transient errors. The re-enqueue
         // is scheduled rather than awaited, so one backing-off transaction cannot
         // stall unrelated commits.
-        const { baseMs, capMs } = ctx.config.retryBackoff;
-        let base = baseMs;
-        try {
-            const status = extractStatusCode(error);
-            if (status === 429 || status === 503)
-                base = Math.max(baseMs, 1_000);
-        }
-        catch { }
-        const ceiling = Math.min(capMs, base * Math.pow(2, transaction.attempts - 1));
-        const delay = Math.floor(Math.random() * ceiling);
+        const delay = transientRetryDelayMs(error, transaction.attempts, ctx.config.retryBackoff);
         ctx.store.updateStatus(transaction.id, 'pending');
         setTimeout(() => {
             // The queue may have shut down or the tx may have been settled

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/humans",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "The optional human-facing local-state package for Ablo: presence, live queries, and React bindings.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "directory": "packages/humans"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.45.0",
+    "@abloatai/transaction": "^0.46.0",
     "mobx": "^6.13.7",
     "uuid": "^11.1.0",
     "zod": "^4.4.3"

package/src/local/sync/createClaimStream.ts

@@ -44,6 +44,7 @@ import {
   claimDescription,
   descriptionFromMeta,
   participantKindFromWire,
+  type WireClaimSummary,
 } from '@abloatai/transaction/coordination/schema';
 import {
   isTargetTuple,
@@ -198,6 +199,38 @@ export function createClaimStream(
     }
   };
 
+  const observeForeignClaim = (
+    heldBy: string,
+    claim: WireClaimSummary,
+    participantKind?: 'user' | 'agent' | 'system',
+    isAgent?: boolean,
+  ): void => {
+    const description =
+      claim.description ??
+      descriptionFromMeta(claim.meta) ??
+      'editing';
+    const { meta, ...details } = subTarget(claim);
+    activeByClaimId.set(claim.claimId, {
+      object: 'claim',
+      id: claim.claimId,
+      status: 'active',
+      heldBy,
+      participantKind: participantKindFromWire(participantKind, isAgent),
+      target: {
+        ...streamTarget(claim),
+        ...details,
+        ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
+      },
+      description,
+      ttlSeconds: Math.max(
+        0,
+        Math.floor((claim.expiresAt - Date.now()) / 1000),
+      ),
+      createdAt: claim.declaredAt,
+      expiresAt: claim.expiresAt,
+    });
+  };
+
   // ── Wire wiring ──────────────────────────────────────────────────
   let attached: ClaimTransport | null = null;
   const unsubs: (() => void)[] = [];
@@ -241,37 +274,12 @@ export function createClaimStream(
           // drops it from `others`, which is what resolves a contender's
           // `settled()`. Absent status means active (wire back-compat).
           if (claim.status && claim.status !== 'active') continue;
-          // Resolve the always-present public field, tolerating a frame that
-          // carries the value in `meta` rather than as an explicit description.
-          const description =
-            claim.description ??
-            descriptionFromMeta(claim.meta) ??
-            'editing';
-          // The frame is parsed permissively, on purpose; `declaredMeta` is where
-          // that wire value becomes the shape the program declared.
-          const { meta, ...details } = subTarget(claim);
-          activeByClaimId.set(claim.claimId, {
-            object: 'claim',
-            id: claim.claimId,
-            status: 'active',
-            heldBy: event.userId,
-            participantKind: participantKindFromWire(
-              event.participantKind,
-              event.isAgent,
-            ),
-            target: {
-              ...streamTarget(claim),
-              ...details,
-              ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
-            },
-            description,
-            ttlSeconds: Math.max(
-              0,
-              Math.floor((claim.expiresAt - Date.now()) / 1000),
-            ),
-            createdAt: claim.declaredAt,
-            expiresAt: claim.expiresAt,
-          });
+          observeForeignClaim(
+            event.userId,
+            claim,
+            event.participantKind,
+            event.isAgent,
+          );
           mutated = true;
         }
         if (mutated) notifyListeners();
@@ -295,6 +303,22 @@ export function createClaimStream(
         // a claim the server already rejected (would just spam both
         // sides with conflicts).
         ownClaims.delete(rejection.claimId);
+        // A holder on another server may have claimed before this client joined
+        // the row group, so its one-shot presence frame was missed. A conflict
+        // reply carries the authoritative holder summary; seed the same local
+        // state immediately instead of continuing to report the row as free.
+        if (
+          rejection.reason === 'conflict' &&
+          rejection.heldBy &&
+          rejection.heldByClaim
+        ) {
+          observeForeignClaim(
+            rejection.heldBy,
+            rejection.heldByClaim,
+            rejection.heldByKind,
+          );
+          notifyListeners();
+        }
         for (const l of rejectionListeners) {
           try {
             l(rejection);

package/src/local/transactions/mutations/MutationQueue.ts

@@ -158,6 +158,15 @@ export interface MutationQueueConfig {
   maxBatchSize: number;
   batchDelay: number;
   maxRetries: number;
+  /**
+   * Minimum wall-clock window for retrying transient write failures with the
+   * same durable envelope and idempotency key. This absorbs managed-database
+   * promotion and brief regional network incidents without double-applying a
+   * write. Defaults to 120 seconds: the Aurora promotion drill recovered
+   * writes just beyond 60 seconds, so a one-minute boundary discarded exact
+   * envelopes at the instant the new writer became usable.
+   */
+  availabilityRetryWindowMs: number;
   conflictResolution: ConflictResolution;
   enablePersistence: boolean;
   enableOptimistic: boolean;
@@ -289,6 +298,7 @@ export class MutationQueue extends EventEmitter {
   private replicationLagTimeouts = new Map<string, ReturnType<typeof setTimeout>>();
   private replicationLagErrors = new Map<string, AbloConnectionError>();
   private commitProcessing = false;
+  private commitRetryTimer: ReturnType<typeof setTimeout> | null = null;
   private lastCommitSequence = 0;
   private durableReplayBlock: AbloIdempotencyError | null = null;
   /** Browser-backed strict outbox; absent for standalone/in-memory consumers. */
@@ -312,7 +322,11 @@ export class MutationQueue extends EventEmitter {
   private get commitLaneContext(): CommitLaneContext {
     return {
       runtime: this.runtime,
-      config: { maxRetries: this.config.maxRetries },
+      config: {
+        maxRetries: this.config.maxRetries,
+        availabilityRetryWindowMs: this.config.availabilityRetryWindowMs,
+        retryBackoff: this.config.retryBackoff,
+      },
       commitLane: this.commitLane,
       commitNotifications: this.commitNotifications,
       commitMissingIds: this.commitMissingIds,
@@ -336,6 +350,13 @@ export class MutationQueue extends EventEmitter {
       noteAck: (syncId) => this.noteAck(syncId),
       isDefinitiveRejection: (error) => this.isDefinitiveRejection(error),
       isPermanentError: (error) => this.isPermanentError(error),
+      scheduleRetry: (delayMs) => {
+        if (this.commitRetryTimer !== null) clearTimeout(this.commitRetryTimer);
+        this.commitRetryTimer = setTimeout(() => {
+          this.commitRetryTimer = null;
+          void this.processCommitLane();
+        }, delayMs);
+      },
       emitCommitLifecycle: (event, payload) => this.emitCommitLifecycle(event, payload),
     };
   }
@@ -782,6 +803,7 @@ export class MutationQueue extends EventEmitter {
     maxBatchSize: 50, // send up to this many operations per commit
     batchDelay: 150, // milliseconds to wait for more operations before sending
     maxRetries: 3,
+    availabilityRetryWindowMs: 120_000,
     conflictResolution: {
       strategy: 'last-write-wins',
     },
@@ -2004,6 +2026,10 @@ export class MutationQueue extends EventEmitter {
       clearTimeout(this.commitOfflineGraceTimer);
       this.commitOfflineGraceTimer = null;
     }
+    if (this.commitRetryTimer !== null) {
+      clearTimeout(this.commitRetryTimer);
+      this.commitRetryTimer = null;
+    }
 
     // Clear store
     this.store.clear();

package/src/local/transactions/mutations/commitLane.ts

@@ -1,12 +1,12 @@
 import type { RuntimeContext } from '../../RuntimeContext.js';
 import type { ReadDependency, TrackDependency, OnStaleMode, StaleNotification } from '@abloatai/transaction/coordination/schema';
-import { AbloConnectionError } from '@abloatai/transaction/errors';
 import type { MutationCommitResult } from '@abloatai/transaction/wire/commit';
 import type {
   DurableCommitEnvelope,
   DurableCommitOperation,
 } from '@abloatai/transaction/transactions/settlement/commitEnvelope';
 import type { SealDurableCommitInput } from './commitTransport.js';
+import { transientRetryDelayMs } from './failureHandling.js';
 
 export interface CommitTransaction {
   id: string;
@@ -26,6 +26,7 @@ export interface CommitTransaction {
   createdAt: number;
   attempts: number;
   transientAttempts?: number;
+  firstTransientFailureAt?: number;
   lastSyncId?: number;
   correlationId?: string;
   error?: Error;
@@ -38,7 +39,11 @@ export interface CommitTransaction {
 
 export interface CommitLaneContext {
   readonly runtime: RuntimeContext;
-  readonly config: { maxRetries: number };
+  readonly config: {
+    maxRetries: number;
+    availabilityRetryWindowMs: number;
+    retryBackoff: { baseMs: number; capMs: number };
+  };
   readonly commitLane: CommitTransaction[];
   readonly commitNotifications: Map<string, StaleNotification[]>;
   readonly commitMissingIds: Map<string, string[]>;
@@ -56,6 +61,7 @@ export interface CommitLaneContext {
   readonly noteAck: (syncId: number | undefined) => void;
   readonly isDefinitiveRejection: (error: Error) => boolean;
   readonly isPermanentError: (error: Error) => boolean;
+  readonly scheduleRetry: (delayMs: number) => void;
   readonly emitCommitLifecycle: (event: string, payload: object) => void;
 }
 
@@ -165,14 +171,24 @@ export async function processCommitLane(ctx: CommitLaneContext): Promise<void> {
       } catch (cause) {
         const error = cause instanceof Error ? cause : new Error(String(cause));
         if (dispatchStarted && ctx.isDefinitiveRejection(error)) await ctx.removeDurableCommit(tx.id);
-        if (!(error instanceof AbloConnectionError)) tx.transientAttempts = (tx.transientAttempts ?? 0) + 1;
-        const exhausted = (tx.transientAttempts ?? 0) > ctx.config.maxRetries;
+        tx.transientAttempts = (tx.transientAttempts ?? 0) + 1;
+        tx.firstTransientFailureAt ??= Date.now();
+        const outsideAvailabilityWindow =
+          Date.now() - tx.firstTransientFailureAt >= ctx.config.availabilityRetryWindowMs;
+        const exhausted =
+          tx.transientAttempts > ctx.config.maxRetries && outsideAvailabilityWindow;
         if (!ctx.isPermanentError(error) && !exhausted) {
           tx.status = 'pending';
+          const delayMs = transientRetryDelayMs(
+            error,
+            tx.transientAttempts,
+            ctx.config.retryBackoff,
+          );
           ctx.runtime.logger.debug('[MutationQueue] commit lane transient', {
             txId: tx.id.slice(0, 12), attempts: tx.attempts,
-            transientAttempts: tx.transientAttempts ?? 0, message: error.message,
+            transientAttempts: tx.transientAttempts, delayMs, message: error.message,
           });
+          ctx.scheduleRetry(delayMs);
           break;
         }
         tx.status = 'failed';

package/src/local/transactions/mutations/commitPayload.ts

@@ -108,6 +108,8 @@ export interface QueuedMutation {
   status: 'pending' | 'executing' | 'awaiting_delta' | 'completed' | 'failed' | 'rolled_back';
   createdAt: number;
   attempts: number;
+  /** First transient dispatch failure in the current availability incident. */
+  firstTransientFailureAt?: number;
   priority: 'normal' | 'high';
   priorityScore: number; // foreign-key-aware priority, derived, used for sorting
   writeOptions?: WriteOptions;

package/src/local/transactions/mutations/failureHandling.ts

@@ -7,7 +7,10 @@ import { extractStatusCode } from './commitPayload.js';
 
 export interface FailureHandlingContext {
   readonly runtime: RuntimeContext;
-  readonly config: Pick<MutationQueueConfig, 'enableOptimistic' | 'maxRetries' | 'retryBackoff'>;
+  readonly config: Pick<
+    MutationQueueConfig,
+    'enableOptimistic' | 'maxRetries' | 'retryBackoff' | 'availabilityRetryWindowMs'
+  >;
   readonly store: MutationStore;
   readonly isPermanentError: (error: Error) => boolean;
   readonly rollbackOptimistic: (transaction: QueuedMutation, reason: string, error?: Error) => Promise<void>;
@@ -17,6 +20,21 @@ export interface FailureHandlingContext {
   readonly emit: (event: string, payload: object) => boolean;
 }
 
+export function transientRetryDelayMs(
+  error: Error,
+  attempt: number,
+  retryBackoff: MutationQueueConfig['retryBackoff'],
+): number {
+  const { baseMs, capMs } = retryBackoff;
+  let base = baseMs;
+  try {
+    const status = extractStatusCode(error);
+    if (status === 429 || status === 503) base = Math.max(baseMs, 1_000);
+  } catch {}
+  const ceiling = Math.min(capMs, base * Math.pow(2, Math.max(0, attempt - 1)));
+  return Math.floor(Math.random() * ceiling);
+}
+
 export async function handleFailure(ctx: FailureHandlingContext, transaction: QueuedMutation, error: Error): Promise<void> {
     transaction.attempts++;
 
@@ -120,20 +138,17 @@ export async function handleFailure(ctx: FailureHandlingContext, transaction: Qu
       return;
     }
 
-    if (transaction.attempts < ctx.config.maxRetries) {
+    transaction.firstTransientFailureAt ??= Date.now();
+    const insideAvailabilityWindow =
+      Date.now() - transaction.firstTransientFailureAt < ctx.config.availabilityRetryWindowMs;
+
+    if (transaction.attempts < ctx.config.maxRetries || insideAvailabilityWindow) {
       // Exponential backoff with full jitter on every transient retry:
       // `sleep = random(0, min(cap, base * 2^attempt))`. Throttling responses
       // (429/503) use a longer base than other transient errors. The re-enqueue
       // is scheduled rather than awaited, so one backing-off transaction cannot
       // stall unrelated commits.
-      const { baseMs, capMs } = ctx.config.retryBackoff;
-      let base = baseMs;
-      try {
-        const status = extractStatusCode(error);
-        if (status === 429 || status === 503) base = Math.max(baseMs, 1_000);
-      } catch {}
-      const ceiling = Math.min(capMs, base * Math.pow(2, transaction.attempts - 1));
-      const delay = Math.floor(Math.random() * ceiling);
+      const delay = transientRetryDelayMs(error, transaction.attempts, ctx.config.retryBackoff);
 
       ctx.store.updateStatus(transaction.id, 'pending');
       setTimeout(() => {