@oimlsmart/platform-server 0.1.2 → 0.1.4

package/migrations/0018_notify_email.sql

@@ -0,0 +1,51 @@
+-- TODO.notify/04 — the email channel's delivery store (migration 0018
+-- in the shared numbering; 0017 is the cones wave's — identity-features
+-- /09). One row per (event, recipient) — the fan-out's record of WHO
+-- the event reached and on WHICH channel mark (TODO.notify/00: "the
+-- delivery lands on the audit/notification store (a notification row
+-- per recipient with the channel marks)"):
+--
+--   reason        the resolution's STRONGEST reason (subscribed /
+--                 assigned / author / actor / role-default) — every
+--                 notification carries its why, the delivery row
+--                 included;
+--   email         the resolved email posture (immediate | digest | off)
+--                 — the channel split's outcome (the inbox is the
+--                 constant, never a column);
+--   email_status  NULL when email = 'off'; else the email leg's state:
+--                 sent | failed | rate_limited for the immediate leg,
+--                 digest_pending → digest_sent | digest_failed for the
+--                 daily rollup, digest_dropped when the event left the
+--                 store before the rollup, 'unavailable' when the
+--                 instance carries NO mailer (the honest degradation:
+--                 nothing queues — a console-posture instance marks the
+--                 row unavailable at event time and the digest never
+--                 accumulates);
+--   email_at      the terminal stamp (the send / the drop), NULL while
+--                 pending.
+--
+-- The rows name the user + the event WITHOUT foreign keys (the
+-- subscriptions store's own posture, migration 0014's: the user's
+-- delivery record is their own, never the workflow's) — the demo reset
+-- and the retention sweep delete events while a delivery row simply
+-- never joins. The UNIQUE (event_id, user_id) makes the fan-out
+-- idempotent (a re-driven event updates, never duplicates). The
+-- mailer's own audit (entity_type 'email') stands alongside — this
+-- table is the PER-RECIPIENT notification record, the audit trail the
+-- per-SEND one. The package's migrations test pins this set's end state
+-- to schema.sql (src/store/sqlite) in lockstep.
+CREATE TABLE IF NOT EXISTS notify_deliveries (
+  id TEXT PRIMARY KEY,
+  event_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  email TEXT NOT NULL,
+  email_status TEXT,
+  email_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE (event_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id);
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id);
+-- The digest rollup + the retry sweep read by status.
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status);

package/migrations/0019_org_member_category.sql

@@ -0,0 +1,34 @@
+-- Migration 0019 — the OIML Member category (TODO.identity-features/10,
+-- the taxonomy correction): the org_registry gains the two designation
+-- LINK columns and the CS status facet.
+--
+-- The corrected model: the Utilizer/Associate are DESIGNATED BODIES
+-- (their own organization rows, signing the Declaration per PD-08),
+-- never statuses on a member; "OIML Member" is the category with the
+-- member-state / corresponding-member kinds. The links:
+--
+--   designated_by  the designating body: a Utilizer's is its MEMBER
+--                  STATE, an Associate's its CORRESPONDING MEMBER, a
+--                  Test Laboratory's its associated ISSUING AUTHORITY
+--                  (the participants model's designated_by:
+--                  issuing_authority);
+--   proposed_by    an Issuing Authority's proposing MEMBER STATE (a
+--                  member state participates in the OIML-CS by
+--                  PROPOSING an IA and DESIGNATING a Utilizer);
+--   cs_status      the designated bodies' Declaration standing
+--                  (signed-active / suspended / withdrawn — the CS
+--                  layer's fact projected onto the identity plane).
+--
+-- Expand-only, and deliberately NULL-defaulted: the kind enforcement of
+-- the links (which kind may point at which) is the PROGRAM's write path
+-- (the store keeps the kind column opaque by doctrine), and a legacy
+-- row — a utilizer/associate curated before this migration — keeps its
+-- home untouched: the links read NULL ("not recorded"), never a
+-- destructive move. The journals' discipline holds.
+-- schema.sql carries the same end state for fresh databases —
+-- test/migrations.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+ALTER TABLE org_registry ADD COLUMN designated_by TEXT;
+ALTER TABLE org_registry ADD COLUMN proposed_by TEXT;
+ALTER TABLE org_registry ADD COLUMN cs_status TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -35,6 +35,8 @@ import {
   type IdentityLink,
   type IdentityProvider,
   type MfaPending,
+  type NotifyDelivery,
+  type NotifyDeliveryStatus,
   type NotifyEntityMute,
   type NotifyInboxState,
   type NotifyPreferences,
@@ -176,8 +178,9 @@ function toAdminRow(user: UserRecord & { last_login?: string | null; provider?:
  *  (none WITHOUT ROWID — schema.sql). The TODO.notify/01 event store
  *  wipes with them — its rows reference the workflow entities a reset
  *  removes (the feed's read-time visibility gate would drop the orphans
- *  anyway; wiping keeps the demo honest). */
-const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations'] as const
+ *  anyway; wiping keeps the demo honest). TODO.notify/04: the delivery
+ *  store wipes alongside (its rows reference the wiped events). */
+const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations', 'notify_deliveries'] as const
 
 export class D1ServerStore implements ServerStore {
   constructor(private readonly db: D1Database) {}
@@ -320,6 +323,16 @@ export class D1ServerStore implements ServerStore {
            )`,
         ).run()
         await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
+        // TODO.identity-features/10 (the OIML Member category): the
+        // designation links + the CS status facet arrive with migration
+        // 0019 — a dev D1 predating it grows the columns here (the
+        // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
+        // recorded: existing rows keep their posture silently.
+        const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
+        const names = new Set(cols.results.map(c => c.name))
+        if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
+        if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
+        if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
       })()
     }
     return this.orgRegistrySupportEnsured
@@ -2185,6 +2198,9 @@ export class D1ServerStore implements ServerStore {
       country: (row.country as string | null) ?? null,
       contacts,
       participantRef: (row.participant_ref as string | null) ?? null,
+      designatedBy: (row.designated_by as string | null) ?? null,
+      proposedBy: (row.proposed_by as string | null) ?? null,
+      csStatus: (row.cs_status as string | null) ?? null,
       state: row.state as OrgRegistryState,
       createdAt: row.created_at as string,
       createdBy: (row.created_by as string | null) ?? null,
@@ -2216,14 +2232,18 @@ export class D1ServerStore implements ServerStore {
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
     createdBy?: string | null
   }): Promise<OrgRegistryOrg | null> {
     await this.ensureOrgRegistrySupport()
     const res = await this.stmt(
-      `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, created_by)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, designated_by, proposed_by, cs_status, created_by)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       input.id, input.name, input.shortName ?? null, input.kind ?? null, input.country ?? null,
-      JSON.stringify(input.contacts ?? []), input.participantRef ?? null, input.createdBy ?? null,
+      JSON.stringify(input.contacts ?? []), input.participantRef ?? null,
+      input.designatedBy ?? null, input.proposedBy ?? null, input.csStatus ?? null, input.createdBy ?? null,
     ).run()
     if ((res.meta.changes ?? 0) === 0) return null
     return this.getOrgRegistryOrg(input.id)
@@ -2239,6 +2259,9 @@ export class D1ServerStore implements ServerStore {
       country?: string | null
       contacts?: OrgRegistryContact[]
       participantRef?: string | null
+      designatedBy?: string | null
+      proposedBy?: string | null
+      csStatus?: string | null
     },
     actor?: string | null,
   ): Promise<OrgRegistryOrg | null> {
@@ -2251,6 +2274,9 @@ export class D1ServerStore implements ServerStore {
     if (patch.country !== undefined) { sets.push('country = ?'); params.push(patch.country) }
     if (patch.contacts !== undefined) { sets.push('contacts = ?'); params.push(JSON.stringify(patch.contacts)) }
     if (patch.participantRef !== undefined) { sets.push('participant_ref = ?'); params.push(patch.participantRef) }
+    if (patch.designatedBy !== undefined) { sets.push('designated_by = ?'); params.push(patch.designatedBy) }
+    if (patch.proposedBy !== undefined) { sets.push('proposed_by = ?'); params.push(patch.proposedBy) }
+    if (patch.csStatus !== undefined) { sets.push('cs_status = ?'); params.push(patch.csStatus) }
     sets.push("updated_at = datetime('now')", 'updated_by = ?')
     params.push(actor ?? null)
     const res = await this.stmt(`UPDATE org_registry SET ${sets.join(', ')} WHERE id = ?`, ...params, id).run()
@@ -2823,12 +2849,132 @@ export class D1ServerStore implements ServerStore {
     return D1ServerStore.toNotifyInboxState(row!)
   }
 
+  // ── the email channel's delivery store (TODO.notify/04) ───────────
+  // The SAME statements as sqlite/notify.ts's sync half (D1 is SQLite).
+  // The defensive ensure mirrors the instrument_registrations posture:
+  // a dev D1 migrated from before migration 0018 lacks the table.
+
+  private notifyDeliverySupportEnsured: Promise<void> | null = null
+
+  private ensureNotifyDeliverySupport(): Promise<void> {
+    if (!this.notifyDeliverySupportEnsured) {
+      this.notifyDeliverySupportEnsured = (async () => {
+        await this.db.prepare(
+          `CREATE TABLE IF NOT EXISTS notify_deliveries (
+             id TEXT PRIMARY KEY,
+             event_id TEXT NOT NULL,
+             user_id TEXT NOT NULL,
+             reason TEXT NOT NULL,
+             email TEXT NOT NULL,
+             email_status TEXT,
+             email_at TEXT,
+             created_at TEXT NOT NULL DEFAULT (datetime('now')),
+             UNIQUE (event_id, user_id)
+           )`,
+        ).run()
+        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
+        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
+        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
+      })()
+    }
+    return this.notifyDeliverySupportEnsured
+  }
+
+  private static toNotifyDelivery(row: Record<string, unknown>): NotifyDelivery {
+    return {
+      id: row.id as string,
+      eventId: row.event_id as string,
+      userId: row.user_id as string,
+      reason: row.reason as string,
+      email: row.email as NotifyDelivery['email'],
+      emailStatus: (row.email_status as NotifyDelivery['emailStatus']) ?? null,
+      emailAt: (row.email_at as string | null) ?? null,
+      createdAt: row.created_at as string,
+    }
+  }
+
+  async putNotifyDelivery(input: {
+    id: string
+    eventId: string
+    userId: string
+    reason: string
+    email: NotifyDelivery['email']
+    emailStatus: NotifyDelivery['emailStatus']
+  }): Promise<NotifyDelivery> {
+    await this.ensureNotifyDeliverySupport()
+    await this.stmt(
+      `INSERT INTO notify_deliveries (id, event_id, user_id, reason, email, email_status, email_at)
+       VALUES (?, ?, ?, ?, ?, ?, CASE WHEN ? IS NULL OR ? = 'digest_pending' THEN NULL ELSE datetime('now') END)
+       ON CONFLICT (event_id, user_id) DO UPDATE SET
+         reason = excluded.reason,
+         email = excluded.email`,
+      input.id, input.eventId, input.userId, input.reason, input.email, input.emailStatus, input.emailStatus, input.emailStatus,
+    ).run()
+    const row = await this.stmt(
+      'SELECT * FROM notify_deliveries WHERE event_id = ? AND user_id = ?', input.eventId, input.userId,
+    ).first<Record<string, unknown>>()
+    return D1ServerStore.toNotifyDelivery(row!)
+  }
+
+  async getNotifyDelivery(eventId: string, userId: string): Promise<NotifyDelivery | null> {
+    await this.ensureNotifyDeliverySupport()
+    const row = await this.stmt(
+      'SELECT * FROM notify_deliveries WHERE event_id = ? AND user_id = ?', eventId, userId,
+    ).first<Record<string, unknown>>()
+    return row ? D1ServerStore.toNotifyDelivery(row) : null
+  }
+
+  async listNotifyDeliveriesForEvent(eventId: string): Promise<NotifyDelivery[]> {
+    await this.ensureNotifyDeliverySupport()
+    const res = await this.stmt(
+      'SELECT * FROM notify_deliveries WHERE event_id = ? ORDER BY created_at, id', eventId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toNotifyDelivery)
+  }
+
+  async notifyDigestPendingUsers(): Promise<string[]> {
+    await this.ensureNotifyDeliverySupport()
+    const res = await this.stmt(
+      "SELECT DISTINCT user_id FROM notify_deliveries WHERE email_status = 'digest_pending' ORDER BY user_id",
+    ).all<{ user_id: string }>()
+    return res.results.map(r => r.user_id)
+  }
+
+  async notifyDigestPendingForUser(userId: string): Promise<NotifyDelivery[]> {
+    await this.ensureNotifyDeliverySupport()
+    const res = await this.stmt(
+      "SELECT * FROM notify_deliveries WHERE user_id = ? AND email_status = 'digest_pending' ORDER BY created_at, id", userId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toNotifyDelivery)
+  }
+
+  async notifyFailedDeliveries(limit = 100): Promise<NotifyDelivery[]> {
+    await this.ensureNotifyDeliverySupport()
+    const res = await this.stmt(
+      "SELECT * FROM notify_deliveries WHERE email_status = 'failed' ORDER BY created_at, id LIMIT ?", limit,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toNotifyDelivery)
+  }
+
+  /** The status mark: the terminal marks stamp email_at; a re-queue to
+   *  'digest_pending' CLEARS it (a pending row carries no stamp). */
+  async markNotifyDelivery(id: string, status: NotifyDeliveryStatus): Promise<void> {
+    await this.ensureNotifyDeliverySupport()
+    if (status === 'digest_pending') {
+      await this.stmt('UPDATE notify_deliveries SET email_status = ?, email_at = NULL WHERE id = ?', status, id).run()
+    } else {
+      await this.stmt("UPDATE notify_deliveries SET email_status = ?, email_at = datetime('now') WHERE id = ?", status, id).run()
+    }
+  }
+
   // ── provisioning / dev support ───────────────────────────────────
 
   async wipeWorkflowStores(range?: { after: number; through: number }): Promise<number> {
     // The register table joins the wipe defensively (a dev D1 migrated
-    // from before migration 0016 lacks it — the ensure posture).
+    // from before migration 0016 lacks it — the ensure posture). The
+    // delivery store (0018) the same.
     await this.ensureInstrumentRegistrationSupport()
+    await this.ensureNotifyDeliverySupport()
     // The wipe's tables in one batch (all-or-nothing, the putEntity
     // pattern). A ranged round charges one bounded statement per table;
     // the range-less form is the direct-call default (small stores,
@@ -2842,12 +2988,14 @@ export class D1ServerStore implements ServerStore {
 
   async workflowStoreRowCeiling(): Promise<number> {
     await this.ensureInstrumentRegistrationSupport()
+    await this.ensureNotifyDeliverySupport()
     const row = await this.stmt(
       `SELECT MAX(ceiling) AS ceiling FROM (
          SELECT MAX(rowid) AS ceiling FROM entity_changes
          UNION ALL SELECT MAX(rowid) FROM evidence_records
          UNION ALL SELECT MAX(rowid) FROM entities
          UNION ALL SELECT MAX(rowid) FROM events
+         UNION ALL SELECT MAX(rowid) FROM notify_deliveries
          UNION ALL SELECT MAX(rowid) FROM instrument_registrations)`,
     ).first<{ ceiling: number | null }>()
     return row?.ceiling ?? 0

package/src/store/sqlite/notify.ts

@@ -16,12 +16,18 @@
 // per-event read/done markers the computed feed joins (one row per
 // (user, event), written lazily at the first act on the row).
 //
+// Plus TODO.notify/04's delivery store: notify_deliveries, one row per
+// (event, recipient) — the email channel's per-recipient record (the
+// reason, the resolved posture, the email leg's state; the digest
+// sweep's queue and the retry sweep's read).
+//
 // The D1 store (../d1.ts) runs the SAME statements against the binding;
 // the d1-store suite's tripwire pins the two schemas in lockstep.
 // ═══════════════════════════════════════════════════════════════════
 
 import { getDb } from './store'
 import type {
+  NotifyDelivery,
   NotifyEntityMute,
   NotifyInboxState,
   NotifyPreferences,
@@ -245,3 +251,104 @@ export function putNotifyInboxState(input: {
       .get(input.userId, input.eventId) as InboxStateRow,
   )
 }
+
+// ── the email channel's delivery store (TODO.notify/04) ──────────────
+
+interface DeliveryRow {
+  id: string
+  event_id: string
+  user_id: string
+  reason: string
+  email: string
+  email_status: string | null
+  email_at: string | null
+  created_at: string
+}
+
+function toNotifyDelivery(row: DeliveryRow): NotifyDelivery {
+  return {
+    id: row.id,
+    eventId: row.event_id,
+    userId: row.user_id,
+    reason: row.reason,
+    email: row.email as NotifyDelivery['email'],
+    emailStatus: row.email_status as NotifyDelivery['emailStatus'],
+    emailAt: row.email_at,
+    createdAt: row.created_at,
+  }
+}
+
+/** The fan-out's write: the upsert on UNIQUE (event_id, user_id). The
+ *  status only ever moves FORWARD through the caller's marks — the
+ *  upsert itself never overwrites a terminal stamp (a re-driven event
+ *  refreshes reason + posture, keeps the email leg's state). An INITIAL
+ *  write carrying a terminal status stamps email_at (pending states —
+ *  NULL and 'digest_pending' — never carry a stamp). */
+export function putNotifyDelivery(input: {
+  id: string
+  eventId: string
+  userId: string
+  reason: string
+  email: NotifyDelivery['email']
+  emailStatus: NotifyDelivery['emailStatus']
+}): NotifyDelivery {
+  const db = getDb()
+  db.prepare(
+    `INSERT INTO notify_deliveries (id, event_id, user_id, reason, email, email_status, email_at)
+     VALUES (?, ?, ?, ?, ?, ?, CASE WHEN ? IS NULL OR ? = 'digest_pending' THEN NULL ELSE datetime('now') END)
+     ON CONFLICT (event_id, user_id) DO UPDATE SET
+       reason = excluded.reason,
+       email = excluded.email`,
+  ).run(input.id, input.eventId, input.userId, input.reason, input.email, input.emailStatus, input.emailStatus, input.emailStatus)
+  return toNotifyDelivery(
+    db.prepare('SELECT * FROM notify_deliveries WHERE event_id = ? AND user_id = ?')
+      .get(input.eventId, input.userId) as DeliveryRow,
+  )
+}
+
+export function getNotifyDelivery(eventId: string, userId: string): NotifyDelivery | null {
+  const row = getDb()
+    .prepare('SELECT * FROM notify_deliveries WHERE event_id = ? AND user_id = ?')
+    .get(eventId, userId) as DeliveryRow | undefined
+  return row ? toNotifyDelivery(row) : null
+}
+
+export function listNotifyDeliveriesForEvent(eventId: string): NotifyDelivery[] {
+  const rows = getDb()
+    .prepare('SELECT * FROM notify_deliveries WHERE event_id = ? ORDER BY created_at, id')
+    .all(eventId) as DeliveryRow[]
+  return rows.map(toNotifyDelivery)
+}
+
+/** The digest sweep's first read: the DISTINCT users holding pending
+ *  rows (one digest message per user per run). */
+export function notifyDigestPendingUsers(): string[] {
+  const rows = getDb()
+    .prepare("SELECT DISTINCT user_id FROM notify_deliveries WHERE email_status = 'digest_pending' ORDER BY user_id")
+    .all() as Array<{ user_id: string }>
+  return rows.map(r => r.user_id)
+}
+
+export function notifyDigestPendingForUser(userId: string): NotifyDelivery[] {
+  const rows = getDb()
+    .prepare("SELECT * FROM notify_deliveries WHERE user_id = ? AND email_status = 'digest_pending' ORDER BY created_at, id")
+    .all(userId) as DeliveryRow[]
+  return rows.map(toNotifyDelivery)
+}
+
+/** The retry sweep's read: the failed immediates, oldest first. */
+export function notifyFailedDeliveries(limit = 100): NotifyDelivery[] {
+  const rows = getDb()
+    .prepare("SELECT * FROM notify_deliveries WHERE email_status = 'failed' ORDER BY created_at, id LIMIT ?")
+    .all(limit) as DeliveryRow[]
+  return rows.map(toNotifyDelivery)
+}
+
+/** The status mark. The terminal marks stamp email_at; a re-queue to
+ *  'digest_pending' CLEARS it (a pending row carries no stamp). */
+export function markNotifyDelivery(id: string, status: NonNullable<NotifyDelivery['emailStatus']>): void {
+  const terminal = status === 'digest_pending' ? null : "datetime('now')"
+  getDb()
+    .prepare(`UPDATE notify_deliveries SET email_status = ?, email_at = ${terminal ?? 'NULL'} WHERE id = ?`)
+    .run(status, id)
+}

package/src/store/sqlite/schema.sql

@@ -220,6 +220,33 @@ CREATE TABLE IF NOT EXISTS notify_inbox_state (
 );
 CREATE INDEX IF NOT EXISTS idx_notify_inbox_state_user ON notify_inbox_state (user_id);
 
+-- TODO.notify/04 — the email channel's delivery store (migration 0018):
+-- one row per (event, recipient), the fan-out's record of who the event
+-- reached and on which channel mark. reason is the resolution's
+-- strongest reason; email the resolved posture (immediate | digest |
+-- off — the inbox is the constant, never a column); email_status the
+-- email leg's state (NULL when off; sent | failed | rate_limited;
+-- digest_pending → digest_sent | digest_failed | digest_dropped;
+-- 'unavailable' on a mailer-less instance — nothing queues there).
+-- NO foreign keys (the subscriptions store's posture): a wiped event
+-- simply never joins. UNIQUE (event_id, user_id) keeps the fan-out
+-- idempotent. The mailer's per-SEND audit (entity_type 'email') stands
+-- alongside — this table is the PER-RECIPIENT record.
+CREATE TABLE IF NOT EXISTS notify_deliveries (
+  id TEXT PRIMARY KEY,
+  event_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  email TEXT NOT NULL,
+  email_status TEXT,
+  email_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE (event_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id);
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id);
+CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status);
+
 -- The evidence store (TODO.ops/09 — the monitor daemon's durable
 -- streams): append-only records across restarts. The adapter contract
 -- (src/evidence-store/adapter.ts) is tiny: append, query, getByIds,
@@ -641,7 +668,7 @@ CREATE INDEX IF NOT EXISTS idx_mfa_pending_user ON mfa_pending (user_id);
 -- registry never merge (the spec's §4), and a membership row's honesty
 -- (its lifecycle state) never depends on a join.
 -- The D1 migration set carries the identical end state
--- (0013_org_registry.sql).
+-- (0013_org_registry.sql + 0019_org_member_category.sql).
 -- ═══════════════════════════════════════════════════════════════════
 CREATE TABLE IF NOT EXISTS org_registry (
   id TEXT PRIMARY KEY,
@@ -657,6 +684,17 @@ CREATE TABLE IF NOT EXISTS org_registry (
   -- The participant-link annotation (which participant record the org
   -- mirrors); documentation only.
   participant_ref TEXT,
+  -- The designation links + the CS status facet (0019_org_member_category.sql,
+  -- TODO.identity-features/10): a Utilizer's designated_by is its MEMBER
+  -- STATE, an Associate's its CORRESPONDING MEMBER, a Test Laboratory's
+  -- its associated ISSUING AUTHORITY; an Issuing Authority's proposed_by
+  -- is its proposing MEMBER STATE; cs_status is the designated bodies'
+  -- Declaration standing (signed-active / suspended / withdrawn). All
+  -- NULL = not recorded; the kind enforcement is the program's write
+  -- path, the store keeps the columns opaque.
+  designated_by TEXT,
+  proposed_by TEXT,
+  cs_status TEXT,
   state TEXT NOT NULL DEFAULT 'active',
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   created_by TEXT,

package/src/store/sqlite/store.ts

@@ -115,6 +115,22 @@ function migrateAuthTables(db: Database.Database): void {
   if (membershipCols.length && !membershipCols.some(c => c.name === 'cone')) {
     db.exec('ALTER TABLE org_memberships ADD COLUMN cone TEXT')
   }
+  // TODO.identity-features/10 (the OIML Member category): the
+  // designation links + the CS status facet arrive with migration 0019 —
+  // a dev file predating it grows the columns here. NULL = not recorded:
+  // existing rows keep their posture silently.
+  const registryCols = db.prepare('PRAGMA table_info(org_registry)').all() as Array<{ name: string }>
+  if (registryCols.length) {
+    if (!registryCols.some(c => c.name === 'designated_by')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN designated_by TEXT')
+    }
+    if (!registryCols.some(c => c.name === 'proposed_by')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT')
+    }
+    if (!registryCols.some(c => c.name === 'cs_status')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN cs_status TEXT')
+    }
+  }
   // TODO.identity-sso/02+03 (the strong-authentication wave): the amr
   // provenance columns on sessions → codes → access tokens.
   if (!sessionCols.some(c => c.name === 'amr')) {
@@ -1008,6 +1024,9 @@ interface OrgRegistryRow {
   country: string | null
   contacts: string
   participant_ref: string | null
+  designated_by: string | null
+  proposed_by: string | null
+  cs_status: string | null
   state: OrgRegistryState
   created_at: string
   created_by: string | null
@@ -1042,6 +1061,9 @@ function orgRegistryPayload(row: OrgRegistryRow): OrgRegistryOrg {
     country: row.country,
     contacts: parseOrgContacts(row.contacts),
     participantRef: row.participant_ref,
+    designatedBy: row.designated_by ?? null,
+    proposedBy: row.proposed_by ?? null,
+    csStatus: row.cs_status ?? null,
     state: row.state,
     createdAt: row.created_at,
     createdBy: row.created_by,
@@ -1071,14 +1093,18 @@ export function createOrgRegistryOrg(input: {
   country?: string | null
   contacts?: OrgRegistryContact[]
   participantRef?: string | null
+  designatedBy?: string | null
+  proposedBy?: string | null
+  csStatus?: string | null
   createdBy?: string | null
 }): OrgRegistryOrg | null {
   const res = getDb().prepare(
-    `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, created_by)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, designated_by, proposed_by, cs_status, created_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     input.id, input.name, input.shortName ?? null, input.kind ?? null, input.country ?? null,
-    JSON.stringify(input.contacts ?? []), input.participantRef ?? null, input.createdBy ?? null,
+    JSON.stringify(input.contacts ?? []), input.participantRef ?? null,
+    input.designatedBy ?? null, input.proposedBy ?? null, input.csStatus ?? null, input.createdBy ?? null,
   )
   if (res.changes === 0) return null
   return getOrgRegistryOrg(input.id)
@@ -1095,6 +1121,9 @@ export function updateOrgRegistryOrg(
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
   },
   actor?: string | null,
 ): OrgRegistryOrg | null {
@@ -1106,6 +1135,9 @@ export function updateOrgRegistryOrg(
   if (patch.country !== undefined) { sets.push('country = ?'); params.push(patch.country) }
   if (patch.contacts !== undefined) { sets.push('contacts = ?'); params.push(JSON.stringify(patch.contacts)) }
   if (patch.participantRef !== undefined) { sets.push('participant_ref = ?'); params.push(patch.participantRef) }
+  if (patch.designatedBy !== undefined) { sets.push('designated_by = ?'); params.push(patch.designatedBy) }
+  if (patch.proposedBy !== undefined) { sets.push('proposed_by = ?'); params.push(patch.proposedBy) }
+  if (patch.csStatus !== undefined) { sets.push('cs_status = ?'); params.push(patch.csStatus) }
   sets.push("updated_at = datetime('now')", 'updated_by = ?')
   params.push(actor ?? null)
   const res = getDb().prepare(`UPDATE org_registry SET ${sets.join(', ')} WHERE id = ?`).run(...params, id)

package/src/store/sqlite.ts

@@ -96,12 +96,19 @@ import {
 import {
   deleteNotifyEntityMute,
   deleteNotifyRule,
+  getNotifyDelivery,
   getNotifyPreferences,
+  listNotifyDeliveriesForEvent,
   listNotifyEntityMutes,
   listNotifyInboxStates,
   listNotifyRules,
+  markNotifyDelivery,
+  notifyDigestPendingForUser,
+  notifyDigestPendingUsers,
   notifyEntityMutesForEvent,
+  notifyFailedDeliveries,
   notifyRulesForEvent,
+  putNotifyDelivery,
   putNotifyEntityMute,
   putNotifyInboxState,
   putNotifyPreferences,
@@ -165,7 +172,7 @@ import {
   updateOpAccount,
   updateUserName,
 } from './sqlite/op-accounts-store'
-import { installStore, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
+import { installStore, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
 import {
   advanceWebauthnCounter,
   consumeMfaPending,
@@ -199,8 +206,10 @@ import {
  *  gate would drop the orphans anyway; wiping keeps the demo honest).
  *  TODO.register/03: the instrument register wipes too — the e2e
  *  isolation contract resets it with the rest of the mutable workflow
- *  state. */
-const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations'] as const
+ *  state. TODO.notify/04: the delivery store wipes alongside — its rows
+ *  reference the wiped events (the per-recipient record is the
+ *  workflow's, never the user's own state). */
+const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations', 'notify_deliveries'] as const
 
 export function createSqliteServerStore(): ServerStore {
   return {
@@ -962,6 +971,36 @@ export function createSqliteServerStore(): ServerStore {
       return putNotifyInboxState(input)
     },
 
+    // ── the email channel's delivery store (TODO.notify/04) ──
+    async putNotifyDelivery(input: {
+      id: string
+      eventId: string
+      userId: string
+      reason: string
+      email: NotifyDelivery['email']
+      emailStatus: NotifyDeliveryStatus | null
+    }): Promise<NotifyDelivery> {
+      return putNotifyDelivery(input)
+    },
+    async getNotifyDelivery(eventId: string, userId: string): Promise<NotifyDelivery | null> {
+      return getNotifyDelivery(eventId, userId)
+    },
+    async listNotifyDeliveriesForEvent(eventId: string): Promise<NotifyDelivery[]> {
+      return listNotifyDeliveriesForEvent(eventId)
+    },
+    async notifyDigestPendingUsers(): Promise<string[]> {
+      return notifyDigestPendingUsers()
+    },
+    async notifyDigestPendingForUser(userId: string): Promise<NotifyDelivery[]> {
+      return notifyDigestPendingForUser(userId)
+    },
+    async notifyFailedDeliveries(limit?: number): Promise<NotifyDelivery[]> {
+      return notifyFailedDeliveries(limit)
+    },
+    async markNotifyDelivery(id: string, status: NotifyDeliveryStatus): Promise<void> {
+      markNotifyDelivery(id, status)
+    },
+
     // ── provisioning / dev support ──
     async wipeWorkflowStores(range?: { after: number; through: number }): Promise<number> {
       const db = getDb()
@@ -983,6 +1022,7 @@ export function createSqliteServerStore(): ServerStore {
            UNION ALL SELECT MAX(rowid) FROM evidence_records
            UNION ALL SELECT MAX(rowid) FROM entities
            UNION ALL SELECT MAX(rowid) FROM events
+           UNION ALL SELECT MAX(rowid) FROM notify_deliveries
            UNION ALL SELECT MAX(rowid) FROM instrument_registrations)`,
       ).get() as { ceiling: number | null }
       return row.ceiling ?? 0

package/src/store.ts

@@ -278,6 +278,44 @@ export interface NotifyInboxState {
   createdAt: string
 }
 
+// ── the email channel's delivery store (TODO.notify/04) ──────────────
+
+/** The email leg's state on a delivery row: NULL when the resolved
+ *  posture is 'off' (the inbox carries the event, the mailbox never
+ *  does); 'sent' / 'failed' / 'rate_limited' for the immediate leg (the
+ *  retry sweep re-attempts 'failed'); 'digest_pending' → 'digest_sent' /
+ *  'digest_failed' for the daily rollup ('digest_dropped' when the event
+ *  left the store before the rollup ran); 'unavailable' when the
+ *  instance carries NO mailer (the honest degradation: nothing queues —
+ *  a console-posture instance marks the row at event time and the digest
+ *  never accumulates). */
+export type NotifyDeliveryStatus =
+  | 'sent' | 'failed' | 'rate_limited' | 'unavailable'
+  | 'digest_pending' | 'digest_sent' | 'digest_failed' | 'digest_dropped'
+
+/** One delivery row (TODO.notify/00: "a notification row per recipient
+ *  with the channel marks"): the fan-out's record that the event reached
+ *  this user — the resolution's STRONGEST reason, the resolved email
+ *  posture, and the email leg's state. The inbox is the constant, never
+ *  a column. UNIQUE (event_id, user_id): a re-driven event updates, never
+ *  duplicates. NO foreign keys (the subscriptions store's posture) — a
+ *  wiped event simply never joins. The mailer's per-SEND audit
+ *  (entity_type 'email') stands alongside; this table is the
+ *  PER-RECIPIENT record. */
+export interface NotifyDelivery {
+  id: string
+  eventId: string
+  userId: string
+  /** The resolution's strongest reason (NOTIFY_REASON_PRECEDENCE's first). */
+  reason: string
+  /** The resolved email posture (the channel split's outcome). */
+  email: NotifyChannelPreference
+  emailStatus: NotifyDeliveryStatus | null
+  /** The terminal stamp (the send / the drop); NULL while pending. */
+  emailAt: string | null
+  createdAt: string
+}
+
 // ── the OIDC Provider (TODO.identity/01) ─────────────────────────────
 
 /** A registered relying party (an instance allowed to request tokens).
@@ -860,19 +898,40 @@ export interface OrgRegistryContact {
  *  scheme consumer); the program side bounds the assignable per-org
  *  roles by it. `participantRef` is the OPTIONAL annotation documenting
  *  which participant record the org mirrors (the link's documentation,
- *  never a key the store resolves). */
+ *  never a key the store resolves).
+ *
+ *  TODO.identity-features/10 (the OIML Member category, the taxonomy
+ *  correction): the designation links + the CS status facet (migration
+ *  0019). `designatedBy` is the designating body (a Utilizer's member
+ *  state, an Associate's corresponding member, a Test Laboratory's
+ *  associated issuing authority); `proposedBy` is an Issuing
+ *  Authority's proposing member state; `csStatus` is the designated
+ *  bodies' Declaration standing ('signed-active' | 'suspended' |
+ *  'withdrawn'). All three are opaque strings to the store — the
+ *  per-kind link enforcement (which kind may point at which) is the
+ *  program's write path; NULL reads "not recorded", honestly. */
 export interface OrgRegistryOrg {
   id: string
   /** The display name. */
   name: string
   shortName: string | null
   /** The participant kind ('issuing-authority' | 'test-laboratory' |
-   *  'utilizer' | 'associate' on the OIML-CS program), NULL for a
+   *  'utilizer' | 'associate' on the OIML-CS program, 'member-state' |
+   *  'corresponding-member' on the OIML Member category), NULL for a
    *  non-participant org. Opaque to the store. */
   kind: string | null
   country: string | null
   contacts: OrgRegistryContact[]
   participantRef: string | null
+  /** The designating body's org id (TODO.identity-features/10) — the
+   *  designated-body kinds carry it; NULL = not recorded. */
+  designatedBy: string | null
+  /** The proposing member state's org id (the issuing-authority kind). */
+  proposedBy: string | null
+  /** The Declaration's standing on the designated bodies
+   *  ('signed-active' | 'suspended' | 'withdrawn'); NULL = not
+   *  recorded. */
+  csStatus: string | null
   state: OrgRegistryState
   createdAt: string
   createdBy: string | null
@@ -1664,6 +1723,9 @@ export interface ServerStore {
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
     createdBy?: string | null
   }): Promise<OrgRegistryOrg | null>
   /** Edit the display data (the id is the stable slug — never editable);
@@ -1678,6 +1740,9 @@ export interface ServerStore {
       country?: string | null
       contacts?: OrgRegistryContact[]
       participantRef?: string | null
+      designatedBy?: string | null
+      proposedBy?: string | null
+      csStatus?: string | null
     },
     actor?: string | null,
   ): Promise<OrgRegistryOrg | null>
@@ -1873,6 +1938,36 @@ export interface ServerStore {
     done?: boolean
   }): Promise<NotifyInboxState>
 
+  // ── the email channel's delivery store (TODO.notify/04) ──
+  /** The fan-out's write (the upsert on UNIQUE (event_id, user_id) — a
+   *  re-driven event updates, never duplicates). Answers the stored row. */
+  putNotifyDelivery(input: {
+    id: string
+    eventId: string
+    userId: string
+    reason: string
+    email: NotifyChannelPreference
+    emailStatus: NotifyDeliveryStatus | null
+  }): Promise<NotifyDelivery>
+  /** The by-pair read (the idempotence leg + the proofs). */
+  getNotifyDelivery(eventId: string, userId: string): Promise<NotifyDelivery | null>
+  /** One event's delivery rows (the proofs; the fan-out's own log). */
+  listNotifyDeliveriesForEvent(eventId: string): Promise<NotifyDelivery[]>
+  /** THE DIGEST SWEEP's reads: the users holding digest-pending rows,
+   *  then one user's pending rows (created_at order — the day's story). */
+  notifyDigestPendingUsers(): Promise<string[]>
+  notifyDigestPendingForUser(userId: string): Promise<NotifyDelivery[]>
+  /** THE RETRY SWEEP's read: the failed immediate rows, oldest first
+   *  (bounded — the sweep re-attempts per run, the mailer's rate limits
+   *  stand per attempt). */
+  notifyFailedDeliveries(limit?: number): Promise<NotifyDelivery[]>
+  /** The terminal/pending mark: the status + the stamp (email_at sets on
+   *  the terminal marks — sent/failed/rate_limited/unavailable/
+   *  digest_sent/digest_failed/digest_dropped — and CLEARS back to NULL
+   *  when a row re-enters digest_pending, so a retry's re-queue is
+   *  honest). */
+  markNotifyDelivery(id: string, status: NotifyDeliveryStatus): Promise<void>
+
   // ── provisioning / dev support ──
   /** The mutable workflow stores emptied (the dev-reset + demo reseed
    *  leg): entities, entity_changes, evidence_records, events, and