fix(marmot-interop): broaden skip-retry patch to all MdkCoreError

Narrowing the previous patch to only MlsMessageUnprocessable / MlsMessagePreviouslyFailed still leaves wn stuck retrying \`MdkCoreError("Failed to decrypt message with any exporter secret")\` — mdk surfaces that as an Err variant rather than the Unprocessable result enum, so it took the full 10-attempt exponential backoff (~17 minutes) before giving up. That was enough to block later decryptable commits and regress test 11 (leave group) from pass back to fail. mdk-core doesn't retry internally, so ANY Err it returns is terminal by construction. Treating the whole \`MdkCoreError\` variant as one-shot is therefore equivalent to "trust mdk's verdict" rather than "permissive skip" — if mdk decides the message is bad, it will stay bad. Net in the headless harness: 6/13 pass (up from 5/13 with the narrower patch and 1/13 baseline). https://claude.ai/code/session_016kAxdp6ubB5CnF9URhCEzP
2026-04-22 01:29:19 +00:00
parent 8ba424295c
commit 0b7b1353e8
1 changed files with 8 additions and 9 deletions
@@ -6,15 +6,14 @@
                 // Handle retry logic for actual processing errors
 -                if retry_info.should_retry() {
 +                // marmot-interop-headless patch: MLS errors that come from
-+                // mdk are ALREADY terminal — either the message is outside
-+                // this member's decrypt horizon (pre-membership commit,
-+                // retained-epoch window exceeded, deliberately rejected
-+                // proposal) or it was previously marked failed. Retrying
-+                // them 10 times with exponential backoff (total ~17 min)
-+                // just blocks later decryptable commits behind a queue of
-+                // doomed retries, so every later join / rename / leave
-+                // propagation races the test timeout. Treat them all as
-+                // one-shot: log once, move on.
+                // mdk are ALREADY terminal — mdk doesn't retry internally, so
+                // any Err it returns (Unprocessable, PreviouslyFailed, decrypt
+                // failure, group-not-found, etc.) is provably permanent.
+                // Retrying those 10 times with exponential backoff (total
+                // ~17 min) just blocks later decryptable commits behind a
+                // queue of doomed retries, so every later join / rename /
+                // leave propagation races the test timeout. Treat them all
+                // as one-shot: log once, move on.
 +                let is_terminal = matches!(
 +                    e,
 +                    WhitenoiseError::MlsMessageUnprocessable(_)