@north-light/crouter 0.3.312 → 0.3.314

package/dist/daemon/crtrd.js

@@ -46,11 +46,10 @@ import { writeFileSync, readFileSync, rmSync, mkdirSync, } from 'node:fs';
 import { dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { crtrHome } from '../core/canvas/paths.js';
-import { listNodes, migrateLegacyPidIdentities, } from '../core/canvas/index.js';
+import { listNodeMemoryTargets, listNodes, } from '../core/canvas/index.js';
 import { createApiServer } from './api/server.js';
 import { reconcileUndeliveredTickets } from './human/sweep.js';
-import { recoverRunningActionDeliveries } from '../core/canvas/human-deliveries.js';
-import { recoverRunningOutcomeDeliveries } from '../core/canvas/node-outcome-deliveries.js';
+import { resetHandedOffDeliveries } from '../core/canvas/deliveries.js';
 import { sweepReviews } from './review/sweep.js';
 import { pidfilePath } from './pidfile.js';
 import { rendererWarning } from '../core/runtime/package-health.js';
@@ -60,12 +59,12 @@ import { ControllerDeathReconciler } from './reconcilers/controller-death.js';
 import { NodeLifecycleReconciler } from './reconcilers/node-lifecycle/tick.js';
 import { NodeDeadlineReconciler } from './reconcilers/node-deadline.js';
 import { CronLaneReconciler } from './reconcilers/cron-lane.js';
-import { HumanDeliveryLaneReconciler } from './reconcilers/human-delivery-lane.js';
-import { NodeOutcomeDeliveryLaneReconciler } from './reconcilers/node-outcome-delivery-lane.js';
+import { DeliveryLaneReconciler } from './reconcilers/delivery-lane.js';
+import { migrateLegacyExecutionIdentities } from '../core/canvas/executions.js';
 import { PendingReviewSubmitReconciler } from './reconcilers/pending-review-submit.js';
 import { StorageMaintenanceReconciler } from './reconcilers/storage-maintenance.js';
 import { BashDeadlineReconciler } from './reconcilers/bash-deadline.js';
-import { captureLivenessSnapshot, capturePidCommand, captureTeardownSnapshot, isPidAlive, killProcessTreePids, } from '../core/canvas/pid.js';
+import { captureLivenessSnapshot, capturePidCommand, captureTeardownSnapshot, isPidAlive, isAnyPidAlive, killProcessTreePids, } from '../core/canvas/pid.js';
 import { bindFleet, boundFleet } from '../core/runtime/fleet.js';
 import { bindDaemonControl, clearDaemonControl } from './control.js';
 import { execDaemon, spawnDaemon } from './manage.js';
@@ -73,14 +72,19 @@ import { reconcileAndMigrateBoot } from '../core/canvas/boot.js';
 import { resolveInstallId } from '../core/canvas/install-id.js';
 import { setInstallId } from '../core/runtime/nodes.js';
 import { claimDaemonOwnership, releaseDaemonOwnership } from '../core/canvas/daemon-owner.js';
+import { migrate, openDb } from '../core/canvas/db.js';
 import { prewarmRecentRecipes, reapStaleSpares } from '../core/runtime/warm-pool.js';
 import { DaemonFleet } from './fleet.js';
 import { BOOT_MIGRATIONS } from './boot-migrations.js';
 import { emitEvent } from '../core/events/emit.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { bindDaemonEventSource } from '../core/events/source.js';
-import { ensureOnDiskMigrations } from '../migrations/activation.js';
-import { clearDaemonStartupBlocked } from './startup-block-marker.js';
+import { activateOnDiskMigrations, MigrationBlockedError, runForcedOnDiskMigrations } from '../migrations/activation.js';
+import { profilesRoot, withProfileManifestLock } from '../core/profiles/manifest.js';
+import { runProfileManifestMigrations } from '../migrations/profile-manifests.js';
+import { convertLegacyProviderStore, convertLegacyScopedStore } from '../core/scoped-state/migrate.js';
+import { userScopeRoot } from '../core/scope.js';
+import { piAgentDir } from '../core/runtime/package-health.js';
 // A broker DECLARES its owning canvas in argv at spawn (host.ts launch:
 // `broker-cli.js --canvas-home <home> --epoch <id> <nodeId>`), so ownership is
 // an exact match on this daemon's own canvas home — no path inference. An
@@ -113,15 +117,12 @@ const CENSUS_POLL_MS = 150;
 async function reapPriorEpochBrokers(epoch) {
     const snapshot = captureLivenessSnapshot();
     if (snapshot === null) {
-        // No process table — the census cannot run. The supervision tick still
-        // classifies rows; a surviving prior-epoch broker is at worst a duplicate
-        // engine risk the next daemon boot's census retries.
         emitEvent({
             level: 'error',
             event: 'daemon.census.snapshot_failed',
             fields: { invariant: 'prior-epoch brokers are reaped before readiness' },
         });
-        return;
+        throw new Error('prior-epoch broker census could not capture the process table');
     }
     const home = crtrHome();
     const victims = [];
@@ -168,16 +169,43 @@ async function reapPriorEpochBrokers(epoch) {
     }
     // Bounded graceful wait, then SIGKILL each survivor's captured tree.
     const deadline = Date.now() + PRIOR_EPOCH_TERM_GRACE_MS;
-    while (Date.now() < deadline && signaled.some((s) => isPidAlive(s.pid))) {
+    while (Date.now() < deadline && signaled.some((s) => isAnyPidAlive(s.snap.tree.length > 0 ? s.snap.tree : [s.pid]))) {
         await new Promise((resolve) => setTimeout(resolve, CENSUS_POLL_MS));
     }
     let sigkilled = 0;
     for (const s of signaled) {
-        if (!isPidAlive(s.pid))
+        const tree = s.snap.tree.length > 0 ? s.snap.tree : [s.pid];
+        if (!isAnyPidAlive(tree))
             continue;
-        killProcessTreePids(s.snap.tree.length > 0 ? s.snap.tree : [s.pid], 'SIGKILL', s.snap.identities);
+        killProcessTreePids(tree, 'SIGKILL', s.snap.identities);
         sigkilled++;
     }
+    if (sigkilled > 0)
+        await new Promise((resolve) => setTimeout(resolve, CENSUS_POLL_MS));
+    // Only a fresh full table sample proves a prior writer is gone.
+    const finalSnapshot = captureLivenessSnapshot();
+    if (finalSnapshot === null) {
+        emitEvent({
+            level: 'error',
+            event: 'daemon.census.snapshot_failed',
+            fields: { invariant: 'prior-epoch brokers are reaped before readiness', stage: 'final' },
+        });
+        throw new Error('prior-epoch broker census could not capture the final process table');
+    }
+    const survivors = [];
+    for (const [pid, processInfo] of finalSnapshot.processes) {
+        const command = processInfo.command;
+        if (processInfo.zombie || !command.includes('broker-cli.js'))
+            continue;
+        if (!brokerCommandDeclaresCanvasHome(command, home))
+            continue;
+        if (brokerCommandEpoch(command) === epoch)
+            continue;
+        survivors.push(pid);
+    }
+    if (survivors.length > 0) {
+        throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${survivors.join(', ')}`);
+    }
     emitEvent({
         level: 'info',
         event: 'daemon.census.completed',
@@ -220,17 +248,21 @@ async function teardownFleet(fleet) {
         t.unref();
     });
     await Promise.allSettled(items.map((item) => Promise.race([item.exited.then(() => { }), timeout])));
-    let sigkilled = 0;
+    const sigkilled = [];
     for (const item of items) {
         if (!isPidAlive(item.pid))
             continue;
         killProcessTreePids(item.snap.tree.length > 0 ? item.snap.tree : [item.pid], 'SIGKILL', item.snap.identities);
-        sigkilled++;
+        sigkilled.push(item);
     }
+    // A signal only requests termination. The handle's exit promise is the
+    // authoritative proof that each escalated broker has exited, so cleanup must
+    // not release its daemon ownership claim before these promises settle.
+    await Promise.all(sigkilled.map((item) => item.exited));
     emitEvent({
         level: 'info',
         event: 'daemon.fleet_teardown.completed',
-        fields: { brokers: items.length, sigkilled },
+        fields: { brokers: items.length, sigkilled: sigkilled.length },
     });
 }
 // Pidfile
@@ -277,8 +309,7 @@ const controllerDeath = new ControllerDeathReconciler();
 const nodeLifecycle = new NodeLifecycleReconciler();
 const nodeDeadline = new NodeDeadlineReconciler();
 const cronLane = new CronLaneReconciler();
-const humanDeliveryLane = new HumanDeliveryLaneReconciler();
-const nodeOutcomeDeliveryLane = new NodeOutcomeDeliveryLaneReconciler();
+const deliveryLane = new DeliveryLaneReconciler();
 const pendingReviewSubmit = new PendingReviewSubmitReconciler();
 const storageMaintenance = new StorageMaintenanceReconciler();
 const bashDeadline = new BashDeadlineReconciler();
@@ -310,8 +341,7 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
     // canceled and terminalized here, after the lifecycle pass has had its say.
     nodeDeadline.run(now);
     cronLane.run(now, { lifecycle });
-    humanDeliveryLane.run(now, { lifecycle });
-    nodeOutcomeDeliveryLane.run(now, { lifecycle });
+    deliveryLane.run(now, { lifecycle });
     pendingReviewSubmit.run(now, { lifecycle });
     storageMaintenance.run(now, { lifecycle, fleet });
     await bashDeadline.run(now, { rows });
@@ -348,11 +378,11 @@ export async function runDaemon(opts = {}) {
     }
     const claim = ownership.claim;
     try {
-        await ensureOnDiskMigrations();
-        // Migrations passed, so whatever once blocked startup here is resolved.
-        // Retire the suppression marker on the success path rather than making any
-        // repair route remember to: the daemon getting this far IS the proof.
-        clearDaemonStartupBlocked();
+        await reapPriorEpochBrokers(claim.token);
+        runProfileManifestMigrations(profilesRoot(), { dryRun: false, withLock: withProfileManifestLock });
+        convertLegacyScopedStore({ kind: 'user', root: userScopeRoot() });
+        await convertLegacyProviderStore(piAgentDir());
+        migrate(openDb());
     }
     catch (migrationError) {
         try {
@@ -377,6 +407,18 @@ export async function runDaemon(opts = {}) {
     let cleanupInFlight;
     let apiServer;
     let apiServerClosed = false;
+    let startup = {
+        phase: 'initializing',
+        message: 'daemon startup is initializing its on-disk memory migration and normal services are unavailable',
+        blockerPaths: [],
+    };
+    // This slot is occupied before the repair socket binds, and remains occupied
+    // through normal startup. A request never receives another request's report.
+    let migrationInFlight = 'initial startup activation';
+    let resume = null;
+    function startupBlock() {
+        return startup.phase === 'ready' ? null : { phase: startup.phase, message: startup.message, blockerPaths: startup.blockerPaths };
+    }
     function registerDetached(work) {
         detached.add(work);
         void work.finally(() => {
@@ -591,23 +633,88 @@ export async function runDaemon(opts = {}) {
             }
         });
     }
-    try {
-        process.on('SIGINT', onSigint);
-        process.on('SIGTERM', onSigterm);
-        process.on('exit', onExit);
-        bindDaemonEventSource();
+    let admissionFailure = null;
+    async function admitStartup() {
+        if (admissionFailure !== null) {
+            const message = admissionFailure instanceof Error ? admissionFailure.message : String(admissionFailure);
+            throw { status: 500, code: 'admission_failed', message: `daemon admission previously failed: ${message}` };
+        }
+        if (startup.phase === 'ready') {
+            return { admitted: false, already_admitted: true, startup_phase: 'ready' };
+        }
+        if (startup.phase !== 'prepared' && startup.phase !== 'recovering') {
+            throw {
+                status: 409,
+                code: 'not_prepared',
+                message: startup.message,
+            };
+        }
+        const admitted = startup.phase === 'prepared';
+        try {
+            await resumeStartup();
+            startup = { phase: 'ready', message: '', blockerPaths: [] };
+            return admitted
+                ? { admitted: true, already_admitted: false, startup_phase: 'ready' }
+                : { admitted: false, already_admitted: true, startup_phase: 'ready' };
+        }
+        catch (error) {
+            admissionFailure = error;
+            const message = error instanceof Error ? error.message : String(error);
+            throw { status: 500, code: 'admission_failed', message: `daemon admission failed: ${message}` };
+        }
+    }
+    async function repairMigrations(req) {
+        if (migrationInFlight !== null) {
+            throw {
+                status: 409,
+                code: 'migration_in_progress',
+                message: `on-disk migration is already running (${migrationInFlight})`,
+            };
+        }
+        migrationInFlight = 'repair';
+        try {
+            const result = await runForcedOnDiskMigrations({
+                dryRun: req.dryRun,
+                explicitDirs: req.dirs,
+                nodes: listNodeMemoryTargets(),
+            });
+            if (req.dryRun || !result.finalVerificationSucceeded || startup.phase !== 'blocked') {
+                return { result, resumed: false };
+            }
+            if (opts.prepare) {
+                startup = {
+                    phase: 'prepared',
+                    message: 'daemon storage is prepared and normal services are unavailable until admission',
+                    blockerPaths: [],
+                };
+                return { result, resumed: false };
+            }
+            try {
+                await resumeStartup();
+                startup = { phase: 'ready', message: '', blockerPaths: [] };
+                return { result, resumed: true };
+            }
+            catch (error) {
+                const resumeError = error instanceof Error ? error.message : String(error);
+                // The route must flush this result before cleanup closes its connection.
+                setTimeout(() => { void requestCleanup().catch(() => { }); }, 1_000);
+                return { result, resumed: false, resumeError };
+            }
+        }
+        finally {
+            migrationInFlight = null;
+        }
+    }
+    async function completeStartup() {
         interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
-        // Mint this daemon's epoch and bind the ONE fleet registry for the process
-        // BEFORE anything can launch a broker (the API server or any tick): every
-        // launch funnels through headlessBrokerHost.launch, which
-        // registers with the bound fleet — an unbound launch throws (design D-2).
-        const epoch = randomBytes(8).toString('hex');
+        const epoch = claim.token;
         fleet = new DaemonFleet({ epoch, enqueue });
         bindFleet(fleet);
-        // The self-control seam the API's handover handler reaches this closure
-        // through (see control.ts). Bound alongside the fleet so anything that can
-        // launch a broker can also hand the fleet over.
-        bindDaemonControl({ epoch, requestHandover, registerDetached });
+        startup = {
+            phase: 'recovering',
+            message: 'daemon startup recovery is running and normal services are unavailable',
+            blockerPaths: [],
+        };
         operationIdContext.fresh(() => {
             emitEvent({
                 level: 'info',
@@ -615,18 +722,11 @@ export async function runDaemon(opts = {}) {
                 fields: { pid: process.pid, interval_ms: interval },
             });
         });
-        // Resolve the canvas-install id EARLY — before any other startup work
-        // that might mint a node id. A thrown error here (invalid CRTR_INSTALL_ID,
-        // or a stored/env mismatch) propagates out of this try block into the
-        // existing `catch (startupError)` below, which is exactly the "hard fail
-        // daemon boot" requirement — no separate catch/rethrow needed.
         const installId = resolveInstallId();
         setInstallId(installId);
         operationIdContext.fresh(() => {
             emitEvent({ level: 'info', event: 'daemon.install_id.resolved', fields: { install_id: installId } });
         });
-        // The pinned termrender renderer is an advisory dependency; setup repairs
-        // an unprovisioned venv without blocking supervision.
         operationIdContext.fresh(() => {
             let warning;
             try {
@@ -643,21 +743,13 @@ export async function runDaemon(opts = {}) {
                 });
             }
         });
-        // Complete ticket delivery before API traffic can observe terminal answers.
         await operationIdContext.fresh(async () => {
             await sweepReviews();
             await reconcileUndeliveredTickets();
-            // Unlike a cron one-shot, a completion is at-least-once: destinations deduplicate request IDs, so a dead daemon's running delivery is re-queued immediately.
-            recoverRunningActionDeliveries(Date.now());
-            // Same at-least-once contract for node outcome deliveries: a delivery the
-            // dead daemon had marked running is re-queued rather than stranded.
-            recoverRunningOutcomeDeliveries(Date.now());
+            resetHandedOffDeliveries(Date.now());
         });
-        // Boot reconciliation clears stale process identities before any tick can
-        // inspect them, then migrates legacy identities only with proven same-boot
-        // provenance.
         operationIdContext.fresh(() => {
-            const { reconcile, migrated } = reconcileAndMigrateBoot(migrateLegacyPidIdentities);
+            const { reconcile, migrated } = reconcileAndMigrateBoot(migrateLegacyExecutionIdentities);
             if (reconcile.changed) {
                 emitEvent({
                     level: 'info',
@@ -676,11 +768,6 @@ export async function runDaemon(opts = {}) {
                 });
             }
         });
-        // Boot-time filesystem repairs (design: src/daemon/boot-migrations.ts) run
-        // unconditionally, in order, before supervision can revive anything.
-        // Today's one entry is the pre-cutover inbox-identity migration: rows
-        // without identities or ISO-timestamp cursors are fatal to the strict
-        // reader and crash-loop every legacy broker at inbox seed.
         operationIdContext.fresh(() => {
             for (const migration of BOOT_MIGRATIONS) {
                 const result = migration.apply();
@@ -693,27 +780,65 @@ export async function runDaemon(opts = {}) {
                 }
             }
         });
-        // Startup epoch census (design flow C step 1): reap every prior-epoch
-        // broker on this canvas BEFORE the readiness mirror invites API traffic —
-        // no adoption across epochs, ever.
-        await operationIdContext.fresh(() => reapPriorEpochBrokers(epoch));
-        writePidfile();
-        // The Unix API socket is the daemon's readiness boundary. A rejected bind
-        // enters the existing startup catch, which closes resources and releases
-        // this invocation's pidfile mirror and ownership claim before propagating.
-        apiServer = createApiServer({ tcp: opts.tcp });
-        await apiServer.ready;
-        // Pre-warm the node pool for the most recent project recipes, so the first
-        // create after a boot is warm too. Fire-and-forget (the mints run off the
-        // work lane), so it never delays supervision. Boot-time dead rows are the
-        // node-lifecycle tick's business: the first tick classifies every one of
-        // them through the same policy table exit events use, under the same cap.
-        // Collect the spares this daemon's predecessor left behind BEFORE minting
-        // new ones: every broker of the prior epoch was torn down, and no sweep
-        // resumes a spare, so each is a dead row holding a node dir.
         enqueue(() => { reapStaleSpares(); prewarmRecentRecipes(); });
         intervalTimer = setInterval(enqueueTick, interval);
         enqueueTick();
+    }
+    function resumeStartup() {
+        return resume ??= completeStartup().catch((error) => {
+            startup = {
+                phase: 'initializing',
+                message: 'daemon startup recovery failed and normal services are unavailable',
+                blockerPaths: [],
+            };
+            throw error;
+        });
+    }
+    try {
+        process.on('SIGINT', onSigint);
+        process.on('SIGTERM', onSigterm);
+        process.on('exit', onExit);
+        // Bind restricted diagnostics and repair before the socket can accept a
+        // request. No normal route is admitted until `startup` becomes ready.
+        bindDaemonEventSource();
+        const epoch = claim.token;
+        bindDaemonControl({ epoch, requestHandover, registerDetached, startupBlock, admitStartup, repairMigrations });
+        writePidfile();
+        // The socket is the repair boundary, not readiness. A rejected bind still
+        // enters this catch and releases this invocation's pidfile and ownership.
+        apiServer = createApiServer({ tcp: opts.tcp });
+        await apiServer.ready;
+        try {
+            await activateOnDiskMigrations({ nodes: listNodeMemoryTargets() });
+        }
+        catch (error) {
+            migrationInFlight = null;
+            if (error instanceof MigrationBlockedError) {
+                startup = {
+                    phase: 'blocked',
+                    message: error.message,
+                    blockerPaths: error.blockerPaths,
+                };
+                return requestCleanup;
+            }
+            throw error;
+        }
+        try {
+            if (opts.prepare) {
+                startup = {
+                    phase: 'prepared',
+                    message: 'daemon storage is prepared and normal services are unavailable until admission',
+                    blockerPaths: [],
+                };
+            }
+            else {
+                await resumeStartup();
+                startup = { phase: 'ready', message: '', blockerPaths: [] };
+            }
+        }
+        finally {
+            migrationInFlight = null;
+        }
         return requestCleanup;
     }
     catch (startupError) {

package/dist/daemon/fleet.js

@@ -17,7 +17,7 @@ import { fullName } from '../core/canvas/labels.js';
 import { isSafeNodeId } from '../core/canvas/paths.js';
 import { transition } from '../core/runtime/lifecycle.js';
 import { fanDoctrineWake } from '../core/runtime/close.js';
-import { hasCleanAbort, isBusy, readTransportPoisonVerdict } from '../core/runtime/busy.js';
+import { readInterruptedTurn, readTransportPoisonVerdict } from '../core/canvas/recovery.js';
 import { hasPendingWake } from './reconcilers/live-obligation.js';
 import { clearRespawnPolicy, deferRespawnWhileOffline, MAX_RESPAWN_ATTEMPTS, OFFLINE_RESPAWN_RETRY_MS, recordRespawnPolicy, respawnBackoffMs, } from './reconcilers/node-lifecycle/respawn-policy.js';
 import { probeOnline as probeOnlineReal } from '../core/runtime/connectivity.js';
@@ -300,11 +300,10 @@ export class DaemonFleet {
             clearRespawnPolicy(nodeId);
             return 'forget';
         }
-        // Two durable witnesses mean the dead broker had a turn in flight. A dirty
-        // death leaves the busy marker behind; a bounded graceful abort clears busy
-        // as the run settles, then writes the clean-abort certificate. Both need the
-        // same recovery: resume the saved transcript and re-drive the stopped turn.
-        const interruptedTurn = isBusy(nodeId) || hasCleanAbort(nodeId);
+        // The execution-scoped turn witness survives either a dirty death or a
+        // broker-certified abort. Both need the same recovery: resume the saved
+        // transcript and re-drive the stopped turn.
+        const interruptedTurn = readInterruptedTurn(nodeId)?.interrupted === true;
         const action = classifyDeadNode(meta, interruptedTurn, hasPendingWake(nodeId));
         switch (action) {
             case 'forget':

package/dist/daemon/human/finish.d.ts

@@ -1,28 +1,16 @@
-import { type CancelTicketOptions, type CompletePageOptions } from '../../core/human/tickets.js';
 import type { TicketResult } from '../../core/human/types.js';
-/** Every ticket-ending action retires the ticket's feedback companion — done
- * with a canonical final when approved, never left resident. Idempotent and replay-safe; a
- * corrupt feedback file must not block result publication. Exported for the
- * daemon-start sweep, which must settle terminal tickets whether or not a
- * reply bridge exists. */
-export declare function settleFeedbackCompanion(ticketId: string, outcome: 'approved' | 'canceled'): Promise<void>;
-/**
- * The one completion path for a page ticket: claim takeover, exclusive result
- * publication, then optional reply delivery. Every addressing surface routes
- * through this function, so the reply-route descriptor is the sole authority
- * on whether completion reaches a bridge.
- */
+export interface CompletePageOptions {
+    completedAt?: string;
+    actor?: string;
+}
+export interface CancelTicketOptions {
+    reason?: string;
+    actor?: string;
+    disposition?: 'canceled' | 'dismissed';
+}
+/** Settle a page request directly in human_requests; result files and bridge nodes are not part of this path. */
 export declare function resolvePageTicket(ticketId: string, responses: unknown, opts?: CompletePageOptions): Promise<TicketResult>;
-/** Cancel a ticket with the store's first-writer-wins publication. */
 export declare function cancelHumanTicket(ticketId: string, opts: CancelTicketOptions): Promise<TicketResult>;
-/** Schedule the settled request's completion action, if it bound one. Only the
- * settlement winner calls this; the daemon-start sweep replays it for a
- * settlement that died before enqueueing, and the insert is idempotent on the
- * request id so neither path can create a second delivery. */
-export declare function releaseActionDelivery(ticketId: string): void;
-/**
- * Deliver a terminal ticket result to its bridge. The canonical response is the
- * receipt: every action below is replay-safe, so lost delivery can be retried
- * by a later resolve/cancel attempt or the daemon-start sweep.
- */
+/** Legacy callers use this as a replay hook. Settlement effects are repaired by sweepHumanRequests. */
 export declare function deliverTerminalResult(ticketId: string): Promise<boolean>;
+export declare function settleFeedbackCompanion(ticketId: string, outcome: 'approved' | 'canceled'): Promise<void>;