the error path read the retry count and the repo row before taking the lock, so a status change committed in between was overwritten. it also set the repo active with an error status, which brought back an account that went inactive while the fetch failed. both reads now happen in the locked txn that writes, and a failed fetch leaves an inactive account's status alone.