feat(money-account-upgrade-controller): persist upgrade status and add retry

Track fully upgraded accounts in persisted controller state, keyed by
lowercased address and fingerprinted against the active upgrade config,
so upgradeAccount skips the step sequence once an account is recorded
as upgraded and re-runs it when the config changes.

Add upgradeAccountWithRetry, retrying failed attempts with capped
exponential backoff (10s/20s/40s/60s, 5 attempts by default) and
AbortSignal cancellation. Failures that cannot resolve by retrying
(account delegated to a third-party EIP-7702 implementation, or
unexpected on-chain code) are marked terminal via TerminalUpgradeError
and are not retried.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Jwhiles

packages/money-account-upgrade-controller/CHANGELOG.md

@@ -7,8 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add persisted state tracking fully upgraded accounts ([#9999](https://github.com/MetaMask/core/pull/9999))
+  - `MoneyAccountUpgradeControllerState` now contains `upgradedAccounts`, keyed by lowercased account address. Each entry records when the upgrade sequence completed and a fingerprint of the config it completed under (see new `MoneyAccountUpgradeStatus` type).
+  - The constructor now accepts an optional `state` option, merged with the defaults; add `getDefaultMoneyAccountUpgradeControllerState` to construct those defaults.
+- Add `upgradeAccountWithRetry` method and matching `MoneyAccountUpgradeController:upgradeAccountWithRetry` messenger action ([#9999](https://github.com/MetaMask/core/pull/9999))
+  - Retries failed `upgradeAccount` attempts with capped exponential backoff (10s, 20s, 40s, then 60s between attempts; 5 attempts by default). Terminal failures and non-step errors are rethrown without retrying. Accepts an `AbortSignal` to cancel waiting between attempts.
+- Add `TerminalUpgradeError` and `isTerminalMoneyAccountUpgradeError`, and a `terminal` property on `MoneyAccountUpgradeStepError`, marking failures that cannot resolve by retrying — currently an account delegated to a third-party EIP-7702 implementation, or an account with unexpected on-chain code ([#9999](https://github.com/MetaMask/core/pull/9999))
+
 ### Changed
 
+- `upgradeAccount` now skips the step sequence entirely when the account is recorded in state as upgraded under the active config fingerprint, and records the account after a successful run. If the chain, CHOMP contract addresses, or Delegation Framework version change, the fingerprint no longer matches and the sequence re-runs ([#9999](https://github.com/MetaMask/core/pull/9999))
 - Bump `@metamask/messenger` from `^1.2.0` to `^2.0.0` ([#9392](https://github.com/MetaMask/core/pull/9392))
 - Bump `@metamask/authenticated-user-storage` from `^3.0.0` to `^3.0.1` ([#9458](https://github.com/MetaMask/core/pull/9458))
 

packages/money-account-upgrade-controller/src/MoneyAccountUpgradeController-method-action-types.ts

@@ -13,15 +13,43 @@ import type { MoneyAccountUpgradeController } from './MoneyAccountUpgradeControl
  * {@link MoneyAccountUpgradeStepError} that records which step failed (the
  * original error is preserved as `cause`).
  *
+ * A run that completes is recorded in state (keyed by lowercased address,
+ * fingerprinted against the active config); subsequent calls for a
+ * recorded account return immediately without running any steps. If the
+ * active config no longer matches the recorded fingerprint, the sequence
+ * re-runs.
+ *
  * @param address - The Money Account address to upgrade.
  */
 export type MoneyAccountUpgradeControllerUpgradeAccountAction = {
   type: `MoneyAccountUpgradeController:upgradeAccount`;
   handler: MoneyAccountUpgradeController['upgradeAccount'];
 };
 
+/**
+ * Runs the upgrade sequence via
+ * {@link MoneyAccountUpgradeController.upgradeAccount}, retrying failed
+ * attempts with capped exponential backoff (10s, 20s, 40s, then 60s
+ * between attempts). Rethrows the last error without further attempts when
+ * the failure is terminal (see `isTerminalMoneyAccountUpgradeError`), when
+ * it is not a step failure at all, or when `maxAttempts` is exhausted.
+ *
+ * @param address - The Money Account address to upgrade.
+ * @param options - Retry options.
+ * @param options.signal - Aborts waiting between attempts and prevents
+ * further attempts. An aborted run rejects with an error stating the retry
+ * was aborted.
+ * @param options.maxAttempts - Maximum number of attempts, including the
+ * first. Defaults to 5.
+ */
+export type MoneyAccountUpgradeControllerUpgradeAccountWithRetryAction = {
+  type: `MoneyAccountUpgradeController:upgradeAccountWithRetry`;
+  handler: MoneyAccountUpgradeController['upgradeAccountWithRetry'];
+};
+
 /**
  * Union of all MoneyAccountUpgradeController action types.
  */
 export type MoneyAccountUpgradeControllerMethodActions =
-  MoneyAccountUpgradeControllerUpgradeAccountAction;
+  | MoneyAccountUpgradeControllerUpgradeAccountAction
+  | MoneyAccountUpgradeControllerUpgradeAccountWithRetryAction;