@hotmeshio/hotmesh 0.25.5 → 0.26.0

package/build/services/store/providers/postgres/postgres.d.ts

@@ -162,6 +162,18 @@ declare class PostgresStoreService extends StoreService<ProviderClient, Provider
      * picks it up — no intermediate table, no polling, fully transactional.
      */
     registerTimeHook(jobId: string, gId: string, activityId: string, _type: WorkListTaskType, deletionTime: number, dad: string, transaction?: ProviderTransaction): Promise<void>;
+    /**
+     * Disarms a scheduled timehook (soft delete) for one activity of a
+     * job — the mirror of registerTimeHook, called when the SIGNAL wins
+     * an SLA-gated wait so the armed timeout cannot fire against the
+     * settled workflow. Scoped by the jid index, then narrowed to the
+     * activity via the message metadata. Dimensional addressing is
+     * deliberately NOT matched: a job's waits on one activity are
+     * sequential (cycle N settles before cycle N+1 arms), so at most one
+     * timer per (jid, aid) is armed at a time, and the signal composite's
+     * address can differ from the stored one at cycle offsets.
+     */
+    expireTimeHook(jobId: string, activityId: string): Promise<number>;
     getNextTask(_listKey?: string): Promise<[
         listKey: string,
         jobId: string,
@@ -274,13 +286,14 @@ declare class PostgresStoreService extends StoreService<ProviderClient, Provider
     claimEscalationByMetadata(params: import('../../../../types/hmsh_escalations').ClaimByMetadataParams): Promise<import('../../../../types/hmsh_escalations').ClaimByMetadataResult>;
     releaseEscalation(params: import('../../../../types/hmsh_escalations').ReleaseEscalationParams): Promise<import('../../../../types/hmsh_escalations').ReleaseEscalationResult>;
     /**
-     * Executes a pre-built wake publish inside the currently open resolve
-     * transaction, guarded by a SAVEPOINT so a wake failure can never roll
-     * back the resolve itself. Returns true when the wake row committed
-     * with the transaction; false means the caller should fall back to
-     * post-commit delivery.
+     * Composes the wake as a data-modifying CTE appended to a settle
+     * statement (resolve/cancel). The INSERT fires iff the settle CTE
+     * (`fromCTE`) produced a row whose signal_key matches the wake — one
+     * atomic statement, safe on any connection type (Client or Pool),
+     * with no transaction window for unrelated queries to interleave
+     * into. Appends the wake params to `params` in place.
      */
-    private enqueueEscalationWake;
+    private composeEscalationWakeCTE;
     resolveEscalation(params: import('../../../../types/hmsh_escalations').ResolveEscalationParams, wakeCommand?: import('../../../../types/hmsh_escalations').EscalationWakeCommand): Promise<import('../../../../types/hmsh_escalations').ResolveEscalationResult & {
         signalKey?: string | null;
         topic?: string | null;
@@ -302,7 +315,9 @@ declare class PostgresStoreService extends StoreService<ProviderClient, Provider
         topic?: string | null;
         wakeEnqueued?: boolean;
     }>;
-    cancelEscalation(id: string, namespace?: string): Promise<import('../../../../types/hmsh_escalations').CancelEscalationResult>;
+    cancelEscalation(id: string, namespace?: string, wakeCommand?: import('../../../../types/hmsh_escalations').EscalationWakeCommand): Promise<import('../../../../types/hmsh_escalations').CancelEscalationResult & {
+        wakeEnqueued?: boolean;
+    }>;
     escalateEscalationToRole(params: import('../../../../types/hmsh_escalations').EscalateToRoleParams): Promise<import('../../../../types/hmsh_escalations').EscalationEntry | null>;
     updateEscalation(params: import('../../../../types/hmsh_escalations').UpdateEscalationParams): Promise<import('../../../../types/hmsh_escalations').EscalationEntry | null>;
     appendEscalationMilestones(params: import('../../../../types/hmsh_escalations').AppendMilestonesParams): Promise<import('../../../../types/hmsh_escalations').EscalationEntry | null>;
@@ -316,5 +331,18 @@ declare class PostgresStoreService extends StoreService<ProviderClient, Provider
     escalationStats(params?: import('../../../../types/hmsh_escalations').StatsEscalationsParams): Promise<import('../../../../types/hmsh_escalations').EscalationStats>;
     listDistinctEscalationTypes(namespace?: string): Promise<string[]>;
     releaseExpiredEscalations(_namespace?: string): Promise<number>;
+    /**
+     * Deletes terminal escalation rows (`resolved`/`cancelled`/`expired`) whose
+     * `updated_at` is older than the given horizon. Terminal rows are inert —
+     * every state transition guards `status = 'pending'` — so pruning them is
+     * the engine-blessed retention path for the audit backlog.
+     *
+     * Single statement: the candidate SELECT (`FOR UPDATE SKIP LOCKED`) and the
+     * DELETE are one atomic unit, so concurrent pruners and readers never block
+     * each other and a row is either fully gone or fully present. `limit` bounds
+     * rows per call to keep vacuum pressure flat; callers loop until `deleted`
+     * returns 0.
+     */
+    pruneEscalations(params: import('../../../../types/hmsh_escalations').PruneEscalationsParams): Promise<import('../../../../types/hmsh_escalations').PruneEscalationsResult>;
 }
 export { PostgresStoreService };

package/build/services/store/providers/postgres/postgres.js

@@ -814,43 +814,52 @@ class PostgresStoreService extends __1.StoreService {
             const wasInsert = lockResult.rows[0]?.inserted;
             const isPending = captured?.startsWith('$pending::');
             if (isPending && redelivery) {
-                //consume the marker and commit its redelivery as ONE unit: the
-                //pending wake becomes a durable engine stream message in the
-                //same transaction that destroys the marker, so the wake
-                //survives a crash at any instant. A crash before COMMIT leaves
-                //the marker intact for the resume path to consume again.
-                const pendingData = captured.slice('$pending::'.length);
-                const message = JSON.stringify({
-                    type: 'webhook',
-                    status: 'success',
-                    code: 200,
-                    metadata: {
-                        guid: (0, utils_1.guid)(),
-                        aid: redelivery.aid,
-                        topic: redelivery.topic,
-                    },
-                    data: JSON.parse(pendingData),
-                });
+                //consume the marker and commit its redelivery as ONE statement:
+                //the pending wake becomes a durable engine stream message in
+                //the same atomic unit that destroys the marker, so the wake
+                //survives a crash at any instant. Single-statement composition
+                //is safe on any connection type (Client or Pool) and cannot
+                //interleave with unrelated queries. The consume is guarded on
+                //the value still being a pending marker, and the redelivered
+                //payload is read from the row itself — a marker refreshed by a
+                //newer signal between capture and consume delivers the NEWER
+                //payload rather than a stale copy.
                 const schemaName = this.kvsql().safeName(this.appId);
-                await this.pgClient.query('BEGIN');
-                try {
-                    await this.pgClient.query(`UPDATE ${tableName}
-             SET value = $1, expiry = NOW() + INTERVAL '${delay} seconds'
-             WHERE key = $2`, [jobId, storedKey]);
-                    await this.pgClient.query(`INSERT INTO ${schemaName}.engine_streams
+                const res = await this.pgClient.query(`WITH prev AS (
+             SELECT value FROM ${tableName}
+             WHERE key = $1 FOR UPDATE
+           ),
+           consumed AS (
+             UPDATE ${tableName} t
+             SET value = $2, expiry = NOW() + INTERVAL '${delay} seconds'
+             FROM prev
+             WHERE t.key = $1 AND prev.value LIKE '$pending::%'
+             RETURNING prev.value AS pending_value
+           )
+           INSERT INTO ${schemaName}.engine_streams
              (stream_name, message, priority)
-             VALUES ($1, $2, 5)`, [this.appId, message]);
-                    await this.pgClient.query('COMMIT');
-                }
-                catch (redeliveryError) {
-                    await this.pgClient.query('ROLLBACK');
-                    throw redeliveryError;
+           SELECT $3,
+             json_build_object(
+               'type', 'webhook',
+               'status', 'success',
+               'code', 200,
+               'metadata', json_build_object(
+                 'guid', $4::text, 'aid', $5::text, 'topic', $6::text),
+               'data', substr(consumed.pending_value, 11)::json
+             )::text,
+             5
+           FROM consumed
+           RETURNING id`, [storedKey, jobId, this.appId, (0, utils_1.guid)(), redelivery.aid, redelivery.topic]);
+                if ((res.rowCount ?? 0) > 0) {
+                    this.logger.warn('hook-signal-pending-redelivered', {
+                        key: signalKey,
+                        topic: redelivery.topic,
+                    });
+                    return { success: true };
                 }
-                this.logger.warn('hook-signal-pending-redelivered', {
-                    key: signalKey,
-                    topic: redelivery.topic,
-                });
-                return { success: true };
+                //the marker vanished between capture and consume (a concurrent
+                //duplicate Leg1 consumed it) — idempotent no-op
+                return { success: false };
             }
             if (!wasInsert) {
                 //step 2: row existed — overwrite with hook value
@@ -1022,10 +1031,12 @@ class PostgresStoreService extends __1.StoreService {
             metadata: { guid: (0, utils_1.guid)(), jid: jobId, gid: gId, dad: msgDad, aid },
             data: { timestamp: Date.now() },
         });
+        //jid column stamped so job-scoped expiry (interrupt purge, timeout
+        //disarm) can address armed timers through the partial jid index
         const sql = `INSERT INTO ${schemaName}.engine_streams
-      (stream_name, message, priority, visible_at)
-      VALUES ($1, $2, 5, NOW() + INTERVAL '${Math.max(delayMs, 0)} milliseconds')`;
-        const params = [this.appId, message];
+      (stream_name, jid, message, priority, visible_at)
+      VALUES ($1, $2, $3, 5, NOW() + INTERVAL '${Math.max(delayMs, 0)} milliseconds')`;
+        const params = [this.appId, jobId, message];
         if (transaction && typeof transaction.addCommand === 'function') {
             transaction.addCommand(sql, params);
         }
@@ -1033,6 +1044,26 @@ class PostgresStoreService extends __1.StoreService {
             await this.pgClient.query(sql, params);
         }
     }
+    /**
+     * Disarms a scheduled timehook (soft delete) for one activity of a
+     * job — the mirror of registerTimeHook, called when the SIGNAL wins
+     * an SLA-gated wait so the armed timeout cannot fire against the
+     * settled workflow. Scoped by the jid index, then narrowed to the
+     * activity via the message metadata. Dimensional addressing is
+     * deliberately NOT matched: a job's waits on one activity are
+     * sequential (cycle N settles before cycle N+1 arms), so at most one
+     * timer per (jid, aid) is armed at a time, and the signal composite's
+     * address can differ from the stored one at cycle offsets.
+     */
+    async expireTimeHook(jobId, activityId) {
+        const schemaName = this.kvsql().safeName(this.appId);
+        const res = await this.pgClient.query(`UPDATE ${schemaName}.engine_streams
+       SET expired_at = NOW()
+       WHERE jid = $1 AND expired_at IS NULL AND visible_at > NOW()
+         AND (message::jsonb ->> 'type') = 'timehook'
+         AND (message::jsonb -> 'metadata' ->> 'aid') = $2`, [jobId, activityId]);
+        return res.rowCount ?? 0;
+    }
     async getNextTask(_listKey) {
         //no-op: time hooks are now engine_streams messages with future visible_at.
         //the engine's normal dequeue handles them when they become visible.
@@ -1832,85 +1863,95 @@ class PostgresStoreService extends __1.StoreService {
         return { ok: true, entry: row.entry_json };
     }
     /**
-     * Executes a pre-built wake publish inside the currently open resolve
-     * transaction, guarded by a SAVEPOINT so a wake failure can never roll
-     * back the resolve itself. Returns true when the wake row committed
-     * with the transaction; false means the caller should fall back to
-     * post-commit delivery.
+     * Composes the wake as a data-modifying CTE appended to a settle
+     * statement (resolve/cancel). The INSERT fires iff the settle CTE
+     * (`fromCTE`) produced a row whose signal_key matches the wake — one
+     * atomic statement, safe on any connection type (Client or Pool),
+     * with no transaction window for unrelated queries to interleave
+     * into. Appends the wake params to `params` in place.
      */
-    async enqueueEscalationWake(wakeCommand, signalKey, escalationId) {
-        if (!wakeCommand || !signalKey || wakeCommand.forSignalKey !== signalKey) {
-            return false;
-        }
-        await this.pgClient.query('SAVEPOINT escalation_wake');
-        try {
-            await this.pgClient.query(wakeCommand.sql, wakeCommand.params);
-            return true;
-        }
-        catch (error) {
-            await this.pgClient.query('ROLLBACK TO SAVEPOINT escalation_wake');
-            this.logger.warn('escalation-wake-enqueue-error', {
-                escalationId,
-                error: error.message,
-            });
-            return false;
+    composeEscalationWakeCTE(wakeCommand, params, fromCTE) {
+        if (!wakeCommand) {
+            return { wakeCTE: '', wakeCount: '0::int AS wake_count' };
         }
+        const schemaName = this.kvsql().safeName(this.appId);
+        const base = params.length;
+        params.push(this.appId, wakeCommand.message, wakeCommand.forSignalKey);
+        return {
+            wakeCTE: `,
+        wake AS (
+          INSERT INTO ${schemaName}.engine_streams (stream_name, message, priority)
+          SELECT $${base + 1}, $${base + 2}, 5 FROM ${fromCTE}
+          WHERE ${fromCTE}.signal_key = $${base + 3}
+          RETURNING id
+        )`,
+            wakeCount: '(SELECT COUNT(*) FROM wake)::int AS wake_count',
+        };
     }
     async resolveEscalation(params, wakeCommand) {
         const { id, namespace, resolverPayload, metadata } = params;
         const payloadJson = resolverPayload ? JSON.stringify(resolverPayload) : null;
-        // metaJson is bound at a fixed index; the CASE no-ops when null so resolution
-        // can merge into the GIN-indexed metadata without disturbing the param layout.
         const metaJson = metadata ? JSON.stringify(metadata) : null;
-        // Explicit transaction: FOR UPDATE locks the row; WHERE guard on UPDATE is the TOCTOU
-        // barrier — a concurrent caller whose UPDATE matches 0 rows sees 'already-resolved'.
-        // On crash before COMMIT neither write lands; on crash after COMMIT both are durable.
-        // The resolved row's signal_key is the durable proof for recovery sweeps.
-        await this.pgClient.query('BEGIN');
-        try {
-            const lockResult = await this.pgClient.query(`SELECT id, signal_key, topic, status FROM public.hmsh_escalations
-         WHERE id = $1 ${namespace ? 'AND namespace = $2' : ''} FOR UPDATE`, namespace ? [id, namespace] : [id]);
-            if (!lockResult.rows[0]) {
-                await this.pgClient.query('ROLLBACK');
-                return { ok: false, reason: 'not-found' };
-            }
-            const { signal_key, topic, status } = lockResult.rows[0];
-            if (status === 'cancelled') {
-                await this.pgClient.query('ROLLBACK');
+        //single statement: FOR UPDATE lock, TOCTOU-guarded UPDATE, and the
+        //wake INSERT are one atomic unit. The wake commits WITH the
+        //resolve — a crash after the statement leaves both the resolved row
+        //and its wake message durable; before, neither. The engine_streams
+        //INSERT trigger emits the delivery NOTIFY on commit. Safe on any
+        //connection type; no window for unrelated queries to interleave.
+        const sqlParams = namespace
+            ? [id, payloadJson, metaJson, namespace]
+            : [id, payloadJson, metaJson];
+        const { wakeCTE, wakeCount } = this.composeEscalationWakeCTE(wakeCommand, sqlParams, 'resolved');
+        const result = await this.pgClient.query(`
+      WITH target AS MATERIALIZED (
+        SELECT id, signal_key, topic, status FROM public.hmsh_escalations
+        WHERE id = $1 ${namespace ? 'AND namespace = $4' : ''}
+        LIMIT 1 FOR UPDATE
+      ),
+      resolved AS (
+        UPDATE public.hmsh_escalations e
+        SET status = 'resolved', resolved_at = NOW(), resolver_payload = $2,
+            metadata = CASE WHEN $3::jsonb IS NOT NULL
+                            THEN COALESCE(e.metadata, '{}'::jsonb) || $3::jsonb
+                            ELSE e.metadata END,
+            updated_at = NOW()
+        FROM target
+        WHERE e.id = target.id AND target.status = 'pending'
+        RETURNING e.*
+      )${wakeCTE}
+      SELECT t.id, t.status AS prior_status, t.signal_key, t.topic,
+        CASE
+          WHEN r.id IS NOT NULL THEN 'resolved'
+          WHEN t.id IS NULL     THEN 'not-found'
+          ELSE 'blocked'
+        END AS outcome,
+        row_to_json(r.*) AS entry_json,
+        ${wakeCount}
+      FROM (SELECT * FROM target) t
+      FULL OUTER JOIN (SELECT * FROM resolved) r ON r.id = t.id
+    `, sqlParams);
+        const row = result.rows[0];
+        if (!row || row.outcome === 'not-found')
+            return { ok: false, reason: 'not-found' };
+        if (row.outcome === 'blocked') {
+            if (row.prior_status === 'cancelled')
                 return { ok: false, reason: 'already-cancelled' };
-            }
-            if (status === 'expired') {
+            if (row.prior_status === 'expired') {
                 // The wait's SLA timer fired first and the workflow resumed with
                 // false — the resolver payload has nowhere to go. Name it, so the
                 // operator learns the deadline passed rather than believing the
                 // resolution landed.
-                await this.pgClient.query('ROLLBACK');
                 return { ok: false, reason: 'already-expired' };
             }
-            const updateResult = await this.pgClient.query(`UPDATE public.hmsh_escalations
-         SET status = 'resolved', resolved_at = NOW(), resolver_payload = $2,
-             metadata = CASE WHEN $3::jsonb IS NOT NULL
-                             THEN COALESCE(metadata, '{}'::jsonb) || $3::jsonb
-                             ELSE metadata END,
-             updated_at = NOW()
-         WHERE id = $1 ${namespace ? 'AND namespace = $4' : ''} AND status = 'pending'
-         RETURNING *`, namespace ? [id, payloadJson, metaJson, namespace] : [id, payloadJson, metaJson]);
-            if (!updateResult.rows[0]) {
-                await this.pgClient.query('ROLLBACK');
-                return { ok: false, reason: 'already-resolved' };
-            }
-            //the wake commits WITH the resolve: a crash after COMMIT leaves both
-            //the resolved row and its wake message durable; a crash before
-            //leaves neither. The engine_streams INSERT trigger emits the
-            //delivery NOTIFY on commit.
-            const wakeEnqueued = await this.enqueueEscalationWake(wakeCommand, signal_key, id);
-            await this.pgClient.query('COMMIT');
-            return { ok: true, entry: updateResult.rows[0], signalKey: signal_key, topic, wakeEnqueued };
-        }
-        catch (e) {
-            await this.pgClient.query('ROLLBACK');
-            throw e;
+            return { ok: false, reason: 'already-resolved' };
         }
+        return {
+            ok: true,
+            entry: row.entry_json,
+            signalKey: row.signal_key,
+            topic: row.topic,
+            wakeEnqueued: row.wake_count > 0,
+        };
     }
     /**
      * Non-locking preview of the row `resolveEscalationByMetadata` would
@@ -1938,46 +1979,66 @@ class PostgresStoreService extends __1.StoreService {
         const filter = JSON.stringify({ [key]: value });
         const payloadJson = resolverPayload ? JSON.stringify(resolverPayload) : null;
         const metaJson = metadata ? JSON.stringify(metadata) : null;
-        await this.pgClient.query('BEGIN');
-        try {
-            const lockResult = await this.pgClient.query(`SELECT id, signal_key, topic, status FROM public.hmsh_escalations
-         WHERE ${namespace ? 'namespace = $3 AND' : ''}
-               metadata @> $1::jsonb
-           AND ($2::text[] IS NULL OR role = ANY($2::text[]))
-           AND status IN ('pending', 'cancelled')
-         ORDER BY priority ASC, created_at ASC
-         LIMIT 1 FOR UPDATE`, namespace ? [filter, roles ?? null, namespace] : [filter, roles ?? null]);
-            if (!lockResult.rows[0]) {
-                await this.pgClient.query('ROLLBACK');
-                return { ok: false, reason: 'not-found' };
-            }
-            const { id, signal_key, topic, status } = lockResult.rows[0];
-            if (status === 'cancelled') {
-                await this.pgClient.query('ROLLBACK');
+        //single statement — see resolveEscalation for the atomicity contract
+        const sqlParams = namespace
+            ? [filter, roles ?? null, payloadJson, metaJson, namespace]
+            : [filter, roles ?? null, payloadJson, metaJson];
+        const { wakeCTE, wakeCount } = this.composeEscalationWakeCTE(wakeCommand, sqlParams, 'resolved');
+        const result = await this.pgClient.query(`
+      WITH target AS MATERIALIZED (
+        SELECT id, signal_key, topic, status FROM public.hmsh_escalations
+        WHERE ${namespace ? 'namespace = $5 AND' : ''}
+              metadata @> $1::jsonb
+          AND ($2::text[] IS NULL OR role = ANY($2::text[]))
+          AND status IN ('pending', 'cancelled')
+        ORDER BY priority ASC, created_at ASC
+        LIMIT 1 FOR UPDATE
+      ),
+      resolved AS (
+        UPDATE public.hmsh_escalations e
+        SET status = 'resolved', resolved_at = NOW(), resolver_payload = $3,
+            metadata = CASE WHEN $4::jsonb IS NOT NULL
+                            THEN COALESCE(e.metadata, '{}'::jsonb) || $4::jsonb
+                            ELSE e.metadata END,
+            updated_at = NOW()
+        FROM target
+        WHERE e.id = target.id AND target.status = 'pending'
+        RETURNING e.*
+      )${wakeCTE}
+      SELECT t.id, t.status AS prior_status, t.signal_key, t.topic,
+        CASE
+          WHEN r.id IS NOT NULL THEN 'resolved'
+          WHEN t.id IS NULL     THEN 'not-found'
+          ELSE 'blocked'
+        END AS outcome,
+        row_to_json(r.*) AS entry_json,
+        ${wakeCount}
+      FROM (SELECT * FROM target) t
+      FULL OUTER JOIN (SELECT * FROM resolved) r ON r.id = t.id
+    `, sqlParams);
+        const row = result.rows[0];
+        if (!row || row.outcome === 'not-found')
+            return { ok: false, reason: 'not-found' };
+        if (row.outcome === 'blocked') {
+            if (row.prior_status === 'cancelled')
                 return { ok: false, reason: 'already-cancelled' };
-            }
-            const updateResult = await this.pgClient.query(`UPDATE public.hmsh_escalations
-         SET status = 'resolved', resolved_at = NOW(), resolver_payload = $2,
-             metadata = CASE WHEN $3::jsonb IS NOT NULL
-                             THEN COALESCE(metadata, '{}'::jsonb) || $3::jsonb
-                             ELSE metadata END,
-             updated_at = NOW()
-         WHERE id = $1 AND status = 'pending'
-         RETURNING *`, [id, payloadJson, metaJson]);
-            if (!updateResult.rows[0]) {
-                await this.pgClient.query('ROLLBACK');
-                return { ok: false, reason: 'already-resolved' };
-            }
-            const wakeEnqueued = await this.enqueueEscalationWake(wakeCommand, signal_key, id);
-            await this.pgClient.query('COMMIT');
-            return { ok: true, entry: updateResult.rows[0], signalKey: signal_key, topic, wakeEnqueued };
-        }
-        catch (e) {
-            await this.pgClient.query('ROLLBACK');
-            throw e;
+            return { ok: false, reason: 'already-resolved' };
         }
+        return {
+            ok: true,
+            entry: row.entry_json,
+            signalKey: row.signal_key,
+            topic: row.topic,
+            wakeEnqueued: row.wake_count > 0,
+        };
     }
-    async cancelEscalation(id, namespace) {
+    async cancelEscalation(id, namespace, wakeCommand) {
+        //single statement: the cancellation wake is a data-modifying CTE
+        //that fires iff the cancel lands AND the row's signal_key matches
+        //the wake — atomic on any connection type (Client or Pool), with
+        //no BEGIN/COMMIT window for unrelated queries to interleave into
+        const params = namespace ? [id, namespace] : [id];
+        const { wakeCTE, wakeCount } = this.composeEscalationWakeCTE(wakeCommand, params, 'cancelled');
         const result = await this.pgClient.query(`
       WITH target AS MATERIALIZED (
         SELECT id, status FROM public.hmsh_escalations
@@ -1991,23 +2052,24 @@ class PostgresStoreService extends __1.StoreService {
         WHERE public.hmsh_escalations.id = target.id
           AND target.status = 'pending'
         RETURNING public.hmsh_escalations.*
-      )
+      )${wakeCTE}
       SELECT t.id, t.status AS prior_status,
         CASE
           WHEN c.id IS NOT NULL THEN 'cancelled'
           WHEN t.id IS NULL     THEN 'not-found'
           ELSE 'already-terminal'
         END AS outcome,
-        row_to_json(c.*) AS entry_json
+        row_to_json(c.*) AS entry_json,
+        ${wakeCount}
       FROM (SELECT * FROM target) t
       FULL OUTER JOIN (SELECT * FROM cancelled) c ON c.id = t.id
-    `, namespace ? [id, namespace] : [id]);
+    `, params);
         if (!result.rows[0] || result.rows[0].outcome === 'not-found')
             return { ok: false, reason: 'not-found' };
         if (result.rows[0].outcome === 'already-terminal')
             return { ok: false, reason: 'already-terminal' };
         const entry = result.rows[0].entry_json;
-        return { ok: true, entry };
+        return { ok: true, entry, wakeEnqueued: result.rows[0].wake_count > 0 };
     }
     async escalateEscalationToRole(params) {
         const { id, targetRole, namespace } = params;
@@ -2156,6 +2218,7 @@ class PostgresStoreService extends __1.StoreService {
        WHERE id = ANY($2::uuid[])
          ${namespace ? 'AND namespace = $4' : ''}
          AND status = 'pending'
+         AND signal_key IS NULL
        RETURNING *`, namespace ? [payloadJson, ids, metaJson, namespace] : [payloadJson, ids, metaJson]);
         return result.rows;
     }
@@ -2255,5 +2318,44 @@ class PostgresStoreService extends __1.StoreService {
         // assigned_until, so no background sweep is needed to release expired claims.
         return 0;
     }
+    /**
+     * Deletes terminal escalation rows (`resolved`/`cancelled`/`expired`) whose
+     * `updated_at` is older than the given horizon. Terminal rows are inert —
+     * every state transition guards `status = 'pending'` — so pruning them is
+     * the engine-blessed retention path for the audit backlog.
+     *
+     * Single statement: the candidate SELECT (`FOR UPDATE SKIP LOCKED`) and the
+     * DELETE are one atomic unit, so concurrent pruners and readers never block
+     * each other and a row is either fully gone or fully present. `limit` bounds
+     * rows per call to keep vacuum pressure flat; callers loop until `deleted`
+     * returns 0.
+     */
+    async pruneEscalations(params) {
+        const TERMINAL = ['resolved', 'cancelled', 'expired'];
+        const statuses = params.statuses?.length
+            ? params.statuses.filter((s) => TERMINAL.includes(s))
+            : [...TERMINAL];
+        if (!statuses.length)
+            return { deleted: 0 };
+        const limit = Math.max(1, Math.min(params.limit ?? 10000, 100000));
+        const values = [statuses, params.olderThan, limit];
+        let nsClause = '';
+        if (params.namespace) {
+            values.push(params.namespace);
+            nsClause = `AND namespace = $${values.length}`;
+        }
+        const result = await this.pgClient.query(`WITH doomed AS (
+         SELECT ctid FROM public.hmsh_escalations
+         WHERE status = ANY($1::text[])
+           AND status IN ('resolved', 'cancelled', 'expired')
+           AND updated_at < NOW() - $2::interval
+           ${nsClause}
+         LIMIT $3
+         FOR UPDATE SKIP LOCKED
+       )
+       DELETE FROM public.hmsh_escalations e
+       USING doomed WHERE e.ctid = doomed.ctid`, values);
+        return { deleted: result.rowCount ?? 0 };
+    }
 }
 exports.PostgresStoreService = PostgresStoreService;