Preview the exact return command before an operator requests replay

Project context

A fictional equipment retailer lets customers choose a refund or replacement after inspection. Its payment and stock providers can time out after accepting an operation, so retrying the whole return is unsafe. Create a local TypeScript application, PostgreSQL state/outbox tables, and synthetic provider doubles with controllable outcomes; no starter code or fixtures are supplied. Use invented orders and integer minor-unit amounts only, with no real payments or external provider calls.

Setup prerequisites

• SQL transactions
• Idempotent commands
• Async failure handling
• State modeling

Preceding work

Complete these dependencies, or supply their agreed outputs before taking this ticket.

• PRECOVER-101 · Reject return decisions that skip inspection or reverse a completed refund
• PRECOVER-102 · Bind a repeated refund request to its original merchant and intent
• PRECOVER-103 · Commit approved return work and its dispatch record together
• PRECOVER-104 · Persist replacement progress across stock reservation and shipment creation
• PRECOVER-105 · Open the refund circuit without declaring timed-out refunds failed
• PRECOVER-106 · Keep stalled stock calls from consuming every refund execution slot
• PRECOVER-107 · Stop compensation retries when a replacement has already shipped

Acceptance criteria

• Show the immutable command identity, target return, intended next operation, current revision, and the reason replay is eligible or blocked.
• A preview is read-only; replay requires an explicit authorized command with expected revision and a fresh eligibility check.
• Reusing the replay request key returns the existing replay result, while completed or unresolved-ineligible operations cannot be forced through this path.

Implementation constraints

• Show only synthetic operational identifiers and bounded explanations; replay cannot edit the original refund amount or target operation.

Verification to include

• Preview one eligible status-check command and one completed command; confirm the preview performs no provider calls or writes.
• Complete a command after preview, then request replay with its stale revision; also try an unauthorized merchant and assert rejection.

Deliverables

• Replay preview and command endpoint contracts with stale/denied cases

Rollout and recovery

Expose preview before enabling the replay action; disable replay writes independently while keeping history and explanations available.

Value of the work

For the engineer: Practice durable workflow state, ambiguous provider outcomes, compensation, concurrency isolation, and recovery that survives process restarts.

For the team: Inspect whether a proposed workflow preserves refund and inventory invariants, contains provider failures, and gives operators a bounded recovery path.

Evidence boundaries

Outcome Evidence: Tests, patches, and runbooks are requested deliverables. They become Outcome Evidence only through a qualified Mission and immutable Evidence IDs.

Ownership Evidence: Independent adaptation must be observed under a declared verification policy and cite immutable Evidence IDs. Completing a planning ticket establishes no Ownership Evidence.