@reventlessdev/reventless-core 3.0.0-alpha.245 → 3.0.0-alpha.247

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.247 (2026-08-22)
+
+* feat(core)!: a slice that has given up says so ([f5559ab](https://github.com/ReventlessDev/reventless-core/commit/f5559abede3a9cf2c9a48aadc69a666c46cc75bf))
+
+### BREAKING CHANGES
+
+* `onExhausted` is required on the Translation and Automation
+module types. ReScript has no optional module-type fields, so the alternative
+was a PPX-injected default — and defaulting this one to silence is the bug.
+A slice now states what abandonment means for its domain, `None` included.
+GeocodeCustomerAddress answers with MarkAddressUnresolvable; the others say
+nothing, on purpose.
+
+
+
+# 3.0.0-alpha.246 (2026-08-21)
+
+### Bug Fixes
+
+* **core:** make @resolves/[@resolves](https://github.com/resolves)Many work end to end ([4c52957](https://github.com/ReventlessDev/reventless-core/commit/4c5295759dcb4b3eda4f0f4f2c1bc387fed88fcb))
+* **deps:** update sury to 11.0.0-rc.2 to fix unreachable union constructors ([fa5744f](https://github.com/ReventlessDev/reventless-core/commit/fa5744fed8de975e2f14725c856c6e5ce7d04a74))
+
+
 # 3.0.0-alpha.245 (2026-08-20)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.245",
+  "version": "3.0.0-alpha.247",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -26,7 +26,7 @@
     }
   },
   "dependencies": {
-    "sury": "11.0.0-rc.1",
+    "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
@@ -36,13 +36,13 @@
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.148",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.120",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.32"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.150",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.122"
   },
   "devDependencies": {
     "rescript": "12.3.0",
-    "sury-ppx": "11.0.0-rc.1",
+    "sury-ppx": "11.0.0-rc.2",
     "@reventlessdev/reventless-ppx": "1.0.0-alpha.72"
   },
   "peerDependencies": {

package/src/components/Api/Api_Naming.res

@@ -128,6 +128,64 @@ let queryFieldNamesForReadModel = (~plugin: string, ~name: string, ~connectionSp
   }
 }
 
+// The GraphQL type a queryable is exposed as, from its spec name alone. Both
+// `queryFieldNamesFor*` above name it this way, so a `@resolves` target reached
+// by spec name lands on the same type whichever kind declares it.
+let returnTypeNameFor = (~plugin: string, ~name: string) =>
+  `${plugin}_${singularize(stripViewSuffix(name))}`
+
+/**
+The cross-table fields `@resolves` / `@resolvesMany` add to a queryable's object
+type, named for the SDL. `plugin` owns the declaring view.
+
+A target in another plugin is refused rather than emitted: under merged-API
+composition each plugin's document must be valid standalone, so a field
+returning a type the plugin does not define fails the merge — and on AWS the
+target table's `dynamodb:*` grant is attached to the *declaring* plugin's API
+role, so even a schema that merged would be refused at read time.
+*/
+let resolvedFieldsOfConfig = (
+  ~plugin: string,
+  config: Reventless.ReadModel.config,
+): array<ReventlessInfra.Api.resolvedFieldEntry> => {
+  let assertSamePlugin = (~pluginName: option<string>, ~tableName: string, ~fieldName: string) =>
+    switch pluginName {
+    | Some(p) if p != plugin =>
+      JsError.throwWithMessage(
+        `Field \`${fieldName}\` resolves to "${tableName}" in plugin "${p}", but cross-plugin ` ++
+        `resolvers are not supported: a plugin's GraphQL document must be valid standalone, and ` ++
+        `"${p}"'s table is not readable by "${plugin}"'s API role. Query the other view directly, ` ++
+        `or project the fields you need into this one.`,
+      )
+    | _ => ()
+    }
+  let single = config.idResolvers->Array.map(({source, target}) => {
+    let (fieldName, multi) = switch source.resolvedField {
+    | Single(f) => (f, false)
+    | Multi(f) => (f, true)
+    }
+    assertSamePlugin(~pluginName=target.pluginName, ~tableName=target.tableName, ~fieldName)
+    {
+      ReventlessInfra.Api.fieldName,
+      typeName: returnTypeNameFor(~plugin, ~name=target.tableName),
+      multi,
+    }
+  })
+  let many = config.idsResolvers->Array.map(({source, target}) => {
+    assertSamePlugin(
+      ~pluginName=target.pluginName,
+      ~tableName=target.tableName,
+      ~fieldName=source.resolvedField,
+    )
+    {
+      ReventlessInfra.Api.fieldName: source.resolvedField,
+      typeName: returnTypeNameFor(~plugin, ~name=target.tableName),
+      multi: true,
+    }
+  })
+  Array.concat(single, many)
+}
+
 let queryFieldNamesForStateView = (~plugin: string, ~viewName: string, ~connectionSpec: bool=true): queryNames => {
   let entity = stripViewSuffix(viewName)
   let singular = singularize(entity)

package/src/components/Api/Api_Naming.res.mjs

@@ -101,6 +101,48 @@ function queryFieldNamesForReadModel(plugin, name, connectionSpecOpt) {
   };
 }
 
+function returnTypeNameFor(plugin, name) {
+  return plugin + `_` + singularize(stripViewSuffix(name));
+}
+
+function resolvedFieldsOfConfig(plugin, config) {
+  let assertSamePlugin = (pluginName, tableName, fieldName) => {
+    if (pluginName !== undefined && pluginName !== plugin) {
+      return Stdlib_JsError.throwWithMessage(`Field \`` + fieldName + `\` resolves to "` + tableName + `" in plugin "` + pluginName + `", but cross-plugin resolvers are not supported: a plugin's GraphQL document must be valid standalone, and ` + (`"` + pluginName + `"'s table is not readable by "` + plugin + `"'s API role. Query the other view directly, `) + `or project the fields you need into this one.`);
+    }
+  };
+  let single = config.idResolvers.map(param => {
+    let target = param.target;
+    let f = param.source.resolvedField;
+    let match;
+    match = f.TAG === "Single" ? [
+        f._0,
+        false
+      ] : [
+        f._0,
+        true
+      ];
+    let fieldName = match[0];
+    assertSamePlugin(target.pluginName, target.tableName, fieldName);
+    return {
+      fieldName: fieldName,
+      typeName: returnTypeNameFor(plugin, target.tableName),
+      multi: match[1]
+    };
+  });
+  let many = config.idsResolvers.map(param => {
+    let target = param.target;
+    let source = param.source;
+    assertSamePlugin(target.pluginName, target.tableName, source.resolvedField);
+    return {
+      fieldName: source.resolvedField,
+      typeName: returnTypeNameFor(plugin, target.tableName),
+      multi: true
+    };
+  });
+  return single.concat(many);
+}
+
 function queryFieldNamesForStateView(plugin, viewName, connectionSpecOpt) {
   let connectionSpec = connectionSpecOpt !== undefined ? connectionSpecOpt : true;
   let entity = stripViewSuffix(viewName);
@@ -147,6 +189,8 @@ export {
   sliceMutationFieldFor,
   canonicalPlural,
   queryFieldNamesForReadModel,
+  returnTypeNameFor,
+  resolvedFieldsOfConfig,
   queryFieldNamesForStateView,
   queryFieldNamesForSliceQueryDb,
   adminField,

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -170,10 +170,18 @@ let reportUnclassifiedUnions = (~typeName: string, schema: S.t<unknown>): unit =
     )
   )
 
+// The SDL line for one `@resolves` / `@resolvesMany` field. Both forms are
+// nullable: the single form has no row when the foreign key names one that was
+// never written, and the batch form drops missing ids rather than padding with
+// nulls, so the list is shorter — never null inside.
+let resolvedFieldSdl = ({fieldName, typeName, multi}: resolvedFieldEntry): string =>
+  multi ? `  ${fieldName}: [${typeName}!]` : `  ${fieldName}: ${typeName}`
+
 let deriveObjectTypeWithNested = (
   ~typeName: string,
   ~excludeFields: array<string>=[],
   ~includeIdParam: bool=true,
+  ~resolvedFields: array<resolvedFieldEntry>=[],
   schema: S.t<unknown>,
 ): array<string> => {
   reportUnclassifiedUnions(~typeName, schema)
@@ -219,7 +227,24 @@ let deriveObjectTypeWithNested = (
     } else {
       mainType
     }
-    Array.concat(collectedTypes, [mainTypeWithId])
+    // A cross-table field shares the type with the state record's own fields, so
+    // a name already taken would emit the field twice and fail the whole document
+    // — for every plugin in the merge, not just this one. Refuse at build time,
+    // naming both halves.
+    resolvedFields->Array.forEach(({fieldName}) =>
+      if filteredFields->Dict.get(fieldName)->Option.isSome || (includeIdParam && fieldName == "id") {
+        JsError.throwWithMessage(
+          `${typeName}.${fieldName} is declared by @resolves/@resolvesMany and is already a field of the state record. Name the resolved field something the state does not use.`,
+        )
+      }
+    )
+    let mainTypeComplete = if resolvedFields->Array.length == 0 {
+      mainTypeWithId
+    } else {
+      let body = mainTypeWithId->String.slice(~start=0, ~end=mainTypeWithId->String.length - 1)
+      body ++ resolvedFields->Array.map(resolvedFieldSdl)->Array.join("\n") ++ "\n}"
+    }
+    Array.concat(collectedTypes, [mainTypeComplete])
   | None => []
   }
 }
@@ -763,6 +788,40 @@ let generate = (
     }
   })
 
+  // Two things a cross-table field has to satisfy, both checked before anything
+  // is emitted so the report names the declaration rather than the merge:
+  //
+  // The type it returns has to be one this fragment defines. A plugin's document
+  // is validated standalone before it is merged, and a field returning a name
+  // nothing declares fails the whole document rather than just the field.
+  //
+  // And the target has to be guarded the way the parent is. A nested field is
+  // reached through its parent, so it answers under the parent's authorization —
+  // a target that guards itself differently would be handed over by the wider
+  // door, which is the kind of hole nothing downstream can see. Equal rules pass,
+  // and so does a target open to everyone, which can only narrow.
+  let permissionOf = (entry: querySchemaEntry) =>
+    entry.permission->Option.getOr(Reventless.Authorization.AllowAuthenticated)
+  queryEntries->Array.forEach(entry =>
+    entry.resolvedFields
+    ->Option.getOr([])
+    ->Array.forEach(({fieldName, typeName}) =>
+      switch queryEntries->Array.find(e => e.returnTypeName == typeName) {
+      | None =>
+        JsError.throwWithMessage(
+          `${entry.returnTypeName}.${fieldName} is declared by @resolves/@resolvesMany and resolves to "${typeName}", which this plugin does not expose as a queryable. The target must be a ReadModel or StateViewSlice of the same plugin, named by its spec name.`,
+        )
+      | Some(target) =>
+        let targetPermission = permissionOf(target)
+        if targetPermission != permissionOf(entry) && targetPermission != AllowAnonymous {
+          JsError.throwWithMessage(
+            `${entry.returnTypeName}.${fieldName} resolves to "${typeName}", which declares a different authorization. A cross-table field is read through its parent and would answer under ${entry.returnTypeName}'s rule, handing over rows ${typeName}'s own door withholds. Give the two views the same authorization, or query ${typeName} directly.`,
+          )
+        }
+      }
+    )
+  )
+
   queryEntries->Array.forEach(entry => {
     let includeIdParam = entry.includeIdParam->Option.getOr(true)
     let connectionSpec = entry.connectionSpec->Option.getOr(true)
@@ -776,6 +835,7 @@ let generate = (
         ~typeName=entry.returnTypeName,
         ~excludeFields,
         ~includeIdParam,
+        ~resolvedFields=entry.resolvedFields->Option.getOr([]),
         entry.stateSchema,
       )
       nestedTypes->Array.forEach(t => {

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -3,6 +3,8 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as Api_Naming$ReventlessCore from "./Api_Naming.res.mjs";
 import * as SchemaType$ReventlessCore from "./SchemaType.res.mjs";
@@ -129,9 +131,20 @@ function reportUnclassifiedUnions(typeName, schema) {
   SchemaType$ReventlessCore.unclassifiedUnions(schema).forEach(param => log.warn("GraphQL_FragmentGenerator", undefined, typeName + `.` + param.path + ` is emitted as String: ` + param.reason));
 }
 
-function deriveObjectTypeWithNested(typeName, excludeFieldsOpt, includeIdParamOpt, schema) {
+function resolvedFieldSdl(param) {
+  let typeName = param.typeName;
+  let fieldName = param.fieldName;
+  if (param.multi) {
+    return `  ` + fieldName + `: [` + typeName + `!]`;
+  } else {
+    return `  ` + fieldName + `: ` + typeName;
+  }
+}
+
+function deriveObjectTypeWithNested(typeName, excludeFieldsOpt, includeIdParamOpt, resolvedFieldsOpt, schema) {
   let excludeFields = excludeFieldsOpt !== undefined ? excludeFieldsOpt : [];
   let includeIdParam = includeIdParamOpt !== undefined ? includeIdParamOpt : true;
+  let resolvedFields = resolvedFieldsOpt !== undefined ? resolvedFieldsOpt : [];
   reportUnclassifiedUnions(typeName, schema);
   let fields = SchemaType$ReventlessCore.fromSuryObject(typeName, schema);
   if (fields === undefined) {
@@ -158,7 +171,20 @@ function deriveObjectTypeWithNested(typeName, excludeFieldsOpt, includeIdParamOp
   seenTypes.add(typeName);
   let mainType = objectRefToGraphQL(undefined, typeName, filteredFields, collectedTypes, seenTypes);
   let mainTypeWithId = includeIdParam ? mainType.replace(`type ` + typeName + ` {\n`, `type ` + typeName + ` implements Node {\n  id: ID!\n`) : mainType;
-  return collectedTypes.concat([mainTypeWithId]);
+  resolvedFields.forEach(param => {
+    let fieldName = param.fieldName;
+    if (Stdlib_Option.isSome(filteredFields[fieldName]) || includeIdParam && fieldName === "id") {
+      return Stdlib_JsError.throwWithMessage(typeName + `.` + fieldName + ` is declared by @resolves/@resolvesMany and is already a field of the state record. Name the resolved field something the state does not use.`);
+    }
+  });
+  let mainTypeComplete;
+  if (resolvedFields.length === 0) {
+    mainTypeComplete = mainTypeWithId;
+  } else {
+    let body = mainTypeWithId.slice(0, mainTypeWithId.length - 1 | 0);
+    mainTypeComplete = body + resolvedFields.map(resolvedFieldSdl).join("\n") + "\n}";
+  }
+  return collectedTypes.concat([mainTypeComplete]);
 }
 
 function derivePluralWrapperType(pluralTypeName, singularTypeName) {
@@ -504,6 +530,20 @@ function generate(mutationEntries, queryEntries) {
         return;
     }
   });
+  queryEntries.forEach(entry => {
+    Stdlib_Option.getOr(entry.resolvedFields, []).forEach(param => {
+      let typeName = param.typeName;
+      let fieldName = param.fieldName;
+      let target = queryEntries.find(e => e.returnTypeName === typeName);
+      if (target === undefined) {
+        return Stdlib_JsError.throwWithMessage(entry.returnTypeName + `.` + fieldName + ` is declared by @resolves/@resolvesMany and resolves to "` + typeName + `", which this plugin does not expose as a queryable. The target must be a ReadModel or StateViewSlice of the same plugin, named by its spec name.`);
+      }
+      let targetPermission = Stdlib_Option.getOr(target.permission, "AllowAuthenticated");
+      if (Primitive_object.notequal(targetPermission, Stdlib_Option.getOr(entry.permission, "AllowAuthenticated")) && targetPermission !== "AllowAnonymous") {
+        return Stdlib_JsError.throwWithMessage(entry.returnTypeName + `.` + fieldName + ` resolves to "` + typeName + `", which declares a different authorization. A cross-table field is read through its parent and would answer under ` + entry.returnTypeName + `'s rule, handing over rows ` + typeName + `'s own door withholds. Give the two views the same authorization, or query ` + typeName + ` directly.`);
+      }
+    });
+  });
   queryEntries.forEach(entry => {
     let includeIdParam = Stdlib_Option.getOr(entry.includeIdParam, true);
     let connectionSpec = Stdlib_Option.getOr(entry.connectionSpec, true);
@@ -511,7 +551,7 @@ function generate(mutationEntries, queryEntries) {
       seenTypes.add(entry.returnTypeName);
       let fields = entry.excludeFields;
       let excludeFields = fields !== undefined ? fields : [];
-      let nestedTypes = deriveObjectTypeWithNested(entry.returnTypeName, excludeFields, includeIdParam, entry.stateSchema);
+      let nestedTypes = deriveObjectTypeWithNested(entry.returnTypeName, excludeFields, includeIdParam, Stdlib_Option.getOr(entry.resolvedFields, []), entry.stateSchema);
       nestedTypes.forEach(t => {
         types.push(t);
       });
@@ -606,6 +646,7 @@ export {
   objectRefToGraphQL,
   deriveFieldType,
   reportUnclassifiedUnions,
+  resolvedFieldSdl,
   deriveObjectTypeWithNested,
   derivePluralWrapperType,
   deriveConnectionTypes,

package/src/components/Api/GraphQL_SchemaInspector.res.mjs

@@ -13,7 +13,7 @@ function inspectScalar(schema) {
 }
 
 function inspectObjectType(typeName, schema) {
-  let types = GraphQL_FragmentGenerator$ReventlessCore.deriveObjectTypeWithNested(typeName, undefined, undefined, schema);
+  let types = GraphQL_FragmentGenerator$ReventlessCore.deriveObjectTypeWithNested(typeName, undefined, undefined, undefined, schema);
   return types[types.length - 1 | 0];
 }
 
@@ -42,7 +42,7 @@ function inspectMutationFields(fieldPrefix, commandSchema) {
 }
 
 function inspectQueryFields(name, typeName, stateSchema) {
-  let types = GraphQL_FragmentGenerator$ReventlessCore.deriveObjectTypeWithNested(typeName, undefined, undefined, stateSchema);
+  let types = GraphQL_FragmentGenerator$ReventlessCore.deriveObjectTypeWithNested(typeName, undefined, undefined, undefined, stateSchema);
   let typeDef = types[types.length - 1 | 0];
   let singleQuery = GraphQL_FragmentGenerator$ReventlessCore.deriveObjectQueryField(name, typeName, undefined, undefined);
   let pluralName = name + "s";

package/src/components/AutomationSlice/AutomationSlice_Callback.res

@@ -18,7 +18,12 @@ type todoStatus =
   | Pending
   | Processing
   | Completed
+  /** Failed and will be tried again. */
   | Failed
+  /** Failed for the last time — the retry budget is spent and no pass will pick
+      this row up again. Distinct from `Failed` because the two are opposite
+      instructions to whoever is reading: wait, or intervene. */
+  | Abandoned
 
 @schema
 type todoRow = {
@@ -28,6 +33,11 @@ type todoRow = {
   processedAt?: string,
   completedAt?: string,
   retryCount: int,
+  /** The ceiling `retryCount` is racing, copied from the Spec when the row is
+      created. Optional because rows written before this field existed are
+      rehydrated through `S.parseOrThrow`, and a required field would fail that
+      decode — silently, since the restore swallows it per row. */
+  maxRetries?: int,
 }
 
 /** The item schema seen through the `JSON.t` the row actually stores.
@@ -58,6 +68,7 @@ let todoRowSchemaFor = (itemSchema: S.t<'item>): S.t<todoRow> =>
     processedAt: ?s.matches(S.option(S.string)),
     completedAt: ?s.matches(S.option(S.string)),
     retryCount: s.matches(S.int),
+    maxRetries: ?s.matches(S.option(S.int)),
   })
 
 /**
@@ -122,6 +133,39 @@ module Make = (
   // the slice here makes the target's own events unmatchable, silently.
   let makeMeta = (): Reventless.Message.meta => Message.generateMeta(~service=Spec.targetName)
 
+  /** Record a failed attempt. The row is marked `Abandoned` at the moment the
+      budget runs out rather than being left to fall out of the next pass's
+      filter, so a reader never has to compare `retryCount` against a constant
+      that lives only in this Spec. */
+  let afterFailedAttempt = (row: todoRow): todoRow => {
+    let retryCount = row.retryCount + 1
+    {...row, status: retryCount >= Spec.maxRetries ? Abandoned : Failed, retryCount}
+  }
+
+  /** The command a slice wants published now that this item will never be
+      processed again, if it wants one. The row is `Abandoned` either way. */
+  let abandonmentCommand = (~id: string, ~row: todoRow): option<Reventless.Message.commandJson> =>
+    switch row.item->Reventless.Util_Sury.fromJson(Spec.todoItemSchema) {
+    | item =>
+      Automation.onExhausted(id, item)->Option.flatMap(((targetId, command)) =>
+        switch command->Reventless.Util_Sury.toJson(Spec.commandSchema) {
+        | commandJson => Some({Reventless.Message.id: targetId, meta: makeMeta(), commandJson})
+        | exception _ =>
+          EffectLogger.logError(
+            ~comp=`AutomationSlice(${Spec.name})`,
+            `retries exhausted for ${id}, and the abandonment command could not be encoded`,
+          )->Effect.runSync
+          None
+        }
+      )
+    | exception _ =>
+      EffectLogger.logError(
+        ~comp=`AutomationSlice(${Spec.name})`,
+        `retries exhausted for ${id}, and its item could not be decoded to announce it`,
+      )->Effect.runSync
+      None
+    }
+
   // Per-source erased dispatch — pre-compile decoders once at module init.
   type dispatch = {
     sourceName: string,
@@ -146,6 +190,7 @@ module Make = (
               status: Pending,
               createdAt: now(),
               retryCount: 0,
+              maxRetries: Spec.maxRetries,
             }
             todoItems->Dict.set(id, row)
           }
@@ -187,6 +232,20 @@ module Make = (
   }
 
   let phase2 = async (publishJsons: ReventlessInfra.CommandTopic.publishJsons) => {
+    // A `Failed` row at or past the ceiling is one an older build left stranded,
+    // or one whose Spec lowered `maxRetries` under it. Either way it is abandoned
+    // in fact, so say so rather than letting it sit in a status that promises a
+    // retry no pass will make.
+    let newlyAbandoned: array<string> = []
+    todoItems
+    ->Dict.toArray
+    ->Array.forEach(((id, row)) =>
+      if row.status == Failed && row.retryCount >= Spec.maxRetries {
+        todoItems->Dict.set(id, {...row, status: Abandoned})
+        newlyAbandoned->Array.push(id)
+      }
+    )
+
     let pending =
       todoItems
       ->Dict.toArray
@@ -222,10 +281,11 @@ module Make = (
               ~comp=`AutomationSlice(${Spec.name})`,
               `failed to encode command: ${errMsg}`,
             )->Effect.runSync
-            todoItems->Dict.set(
-              id,
-              {...row, status: Failed, retryCount: row.retryCount + 1},
-            )
+            let updated = row->afterFailedAttempt
+            todoItems->Dict.set(id, updated)
+            if updated.status == Abandoned {
+              newlyAbandoned->Array.push(id)
+            }
             None
           }
           commandJson->Option.forEach(
@@ -256,14 +316,34 @@ module Make = (
         pending->Array.forEach(((id, row)) => {
           switch todoItems->Dict.get(id) {
           | Some(current) if current.status == Processing =>
-            todoItems->Dict.set(
-              id,
-              {...row, status: Failed, retryCount: row.retryCount + 1},
-            )
+            let updated = row->afterFailedAttempt
+            todoItems->Dict.set(id, updated)
+            if updated.status == Abandoned {
+              newlyAbandoned->Array.push(id)
+            }
           | _ => ()
           }
         })
       }
     }
+
+    // Announced after the batch, so a publish failure above has already had its
+    // say on which rows ran out of budget. A failure here cannot mark anything for
+    // retry — the budget is what ran out — so the rows stay `Abandoned` regardless.
+    let abandonmentCommands =
+      newlyAbandoned->Array.filterMap(id =>
+        todoItems->Dict.get(id)->Option.flatMap(row => abandonmentCommand(~id, ~row))
+      )
+    if abandonmentCommands->Array.length > 0 {
+      try await publishJsons(abandonmentCommands) catch {
+      | exn =>
+        let errMsg =
+          exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
+        EffectLogger.logError(
+          ~comp=`AutomationSlice(${Spec.name})`,
+          `failed to publish abandonment commands: ${errMsg}`,
+        )->Effect.runSync
+      }
+    }
   }
 }