omp-conductor 0.19.4 → 0.19.6

package/src/store.ts

@@ -53,6 +53,8 @@ import type {
   GroomingRecord,
   GroomingVerdict,
   HistoricalInfraCandidate,
+  HandoffWithdrawal,
+  HandoffWithdrawalResult,
   HeldNotice,
   InterruptCategory,
   HeldNoticeDraft,
@@ -430,6 +432,30 @@ interface ReportRow {
   sentParts: number;
   sentPartsHash: string | null;
   lastError: string | null;
+  withdrawnAt: number | null;
+  withdrawnBy: string | null;
+  withdrawReason: string | null;
+}
+
+interface HandoffWithdrawalRow {
+  id: string;
+  project: string;
+  target: string;
+  actor: string;
+  reason: string;
+  at: number;
+  summary: string;
+  detail: string;
+}
+
+interface HeldNoticeLifecycleRow {
+  id: string;
+  project: string;
+  summary: string;
+  detail: string;
+  digestedAt: number | null;
+  digestReportId: string | null;
+  withdrawnAt: number | null;
 }
 
 /** The `material_events` table exactly as SQLite hands it back (#274). */
@@ -940,13 +966,30 @@ CREATE TABLE IF NOT EXISTS reports (
   deliveredAt   INTEGER,
   sentParts     INTEGER NOT NULL DEFAULT 0,
   sentPartsHash TEXT,
-  lastError     TEXT
+  lastError     TEXT,
+  withdrawnAt   INTEGER,
+  withdrawnBy   TEXT,
+  withdrawReason TEXT
 );
 CREATE UNIQUE INDEX IF NOT EXISTS reports_dedupe
-  ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+  ON reports (project, dedupeKey)
+  WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
 CREATE INDEX IF NOT EXISTS reports_project_state
   ON reports (project, state, nextAttemptAt);
 
+CREATE TABLE IF NOT EXISTS handoff_withdrawals (
+  id      TEXT PRIMARY KEY,
+  project TEXT NOT NULL,
+  target  TEXT NOT NULL,
+  actor   TEXT NOT NULL,
+  reason  TEXT NOT NULL,
+  at      INTEGER NOT NULL,
+  summary TEXT NOT NULL,
+  detail  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS handoff_withdrawals_project_at
+  ON handoff_withdrawals (project, at DESC);
+
 -- Ordinary material outcomes awaiting authorship in a deferred digest (#274).
 -- Association happens when a digest is accepted into the outbox, not when the
 -- session happens to remember the event or when Telegram later delivers it.
@@ -979,7 +1022,10 @@ CREATE TABLE IF NOT EXISTS held_notices (
   releaseOnAvailable INTEGER NOT NULL DEFAULT 0,
   urgent             INTEGER NOT NULL DEFAULT 0,
   digestedAt         INTEGER,
-  digestReportId     TEXT    REFERENCES reports(id)
+  digestReportId     TEXT    REFERENCES reports(id),
+  withdrawnAt        INTEGER,
+  withdrawnBy        TEXT,
+  withdrawReason     TEXT
 );
 CREATE INDEX IF NOT EXISTS held_notices_project_undigested
   ON held_notices (project, digestedAt) WHERE digestedAt IS NULL;
@@ -1562,9 +1608,25 @@ function toReport(row: ReportRow): ReportRecord {
   if (row.sentPartsHash !== null) record.sentPartsHash = row.sentPartsHash;
   if (row.deliveredAt !== null) record.deliveredAt = row.deliveredAt;
   if (row.lastError !== null) record.lastError = row.lastError;
+  if (row.withdrawnAt !== null) record.withdrawnAt = row.withdrawnAt;
+  if (row.withdrawnBy !== null) record.withdrawnBy = row.withdrawnBy;
+  if (row.withdrawReason !== null) record.withdrawReason = row.withdrawReason;
   return record;
 }
 
+function toHandoffWithdrawal(row: HandoffWithdrawalRow): HandoffWithdrawal {
+  return {
+    id: row.id,
+    project: row.project,
+    summary: row.summary,
+    detail: row.detail,
+    target: row.target as HandoffWithdrawal["target"],
+    actor: row.actor,
+    reason: row.reason,
+    at: row.at,
+  };
+}
+
 function toMaterialEvent(row: MaterialEventRow): MaterialEvent {
   return {
     id: row.id,
@@ -1905,20 +1967,20 @@ export function openStore(dbPath: string): Store {
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
   db.exec(SCHEMA);
-  // #274: a terminally failed digest did not count as sent, but the old unique
-  // index still blocked a replacement under the same daily key. Replace that
-  // one-time schema so owed ledger rows can be handed off again.
+  // Failed or explicitly withdrawn handoffs no longer own a digest dedupe key:
+  // both leave their underlying ledger rows owed for a replacement report.
   const reportDedupeIndex = db
     .query<{ sql: string | null }, []>(
       `SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'reports_dedupe'`,
     )
     .get();
-  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'failed'")) {
+  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'withdrawn'")) {
     db.exec(
       `BEGIN IMMEDIATE;
        DROP INDEX IF EXISTS reports_dedupe;
        CREATE UNIQUE INDEX reports_dedupe
-         ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+         ON reports (project, dedupeKey)
+         WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
        COMMIT;`,
     );
   }
@@ -2112,6 +2174,15 @@ export function openStore(dbPath: string): Store {
   }
   // Urgent recovery notices bypass category batching only; they still wait for
   // the configured availability window. Historical notices were not urgent.
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!heldNoticeColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE held_notices ADD COLUMN ${name} ${type}`);
+    }
+  }
   if (!heldNoticeColumns.some((column) => column.name === "urgent")) {
     db.exec("ALTER TABLE held_notices ADD COLUMN urgent INTEGER NOT NULL DEFAULT 0");
   }
@@ -2129,6 +2200,15 @@ export function openStore(dbPath: string): Store {
   if (!reportColumns.some((column) => column.name === "sentPartsHash")) {
     db.exec("ALTER TABLE reports ADD COLUMN sentPartsHash TEXT");
   }
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!reportColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE reports ADD COLUMN ${name} ${type}`);
+    }
+  }
   // The kind split (#459): a row is either a question a human must answer or a
   // watch the orchestrator set for itself. Databases written before the split
   // never marked it, and every such row was a question — `watch` has no
@@ -3012,7 +3092,7 @@ export function openStore(dbPath: string): Store {
   const selectReport = db.query<ReportRow, [string]>(`SELECT * FROM reports WHERE id = ?`);
   const selectReportByDedupe = db.query<ReportRow, [string, string]>(
     `SELECT * FROM reports
-      WHERE project = ? AND dedupeKey = ? AND state <> 'failed'
+      WHERE project = ? AND dedupeKey = ? AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC, rowid DESC LIMIT 1`,
   );
   const selectDueReports = db.query<ReportRow, [string, number, number]>(
@@ -3021,6 +3101,81 @@ export function openStore(dbPath: string): Store {
       ORDER BY createdAt ASC, rowid ASC
       LIMIT ?`,
   );
+  const withdrawPendingReportRow = db.query<
+    unknown,
+    [number, string, string, number, string, string]
+  >(
+    `UPDATE reports
+        SET state = 'withdrawn', withdrawnAt = ?, withdrawnBy = ?,
+            withdrawReason = ?, updatedAt = ?, attemptId = NULL
+      WHERE id = ? AND project = ? AND state = 'pending'`,
+  );
+  const selectReportNoticeIds = db.query<{ id: string }, [string, string]>(
+    `SELECT id FROM held_notices WHERE digestReportId = ? AND project = ?`,
+  );
+  const unassignReportMaterialEvents = db.query<unknown, [string, string]>(
+    `UPDATE material_events SET digestReportId = NULL
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportMaterialEventsPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE material_events
+        SET summary = CASE
+          WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+          ELSE summary
+        END
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportHeldNoticesPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE held_notices
+        SET summary = CASE
+              WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+              ELSE summary
+            END,
+            detail = CASE
+              WHEN detail NOT LIKE 'This handoff may already%' THEN
+                'This handoff may already have reached Telegram before its outcome was lost.\n\n' || detail
+              ELSE detail
+            END
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const unassignReportHeldNotices = db.query<unknown, [string, string]>(
+    `UPDATE held_notices SET digestReportId = NULL, digestedAt = NULL
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const selectHeldNoticeLifecycle = db.query<HeldNoticeLifecycleRow, [string]>(
+    `SELECT id, project, summary, detail, digestedAt, digestReportId, withdrawnAt
+       FROM held_notices WHERE id = ?`,
+  );
+  const withdrawHeldNoticeRow = db.query<
+    unknown,
+    [number, string, string, string, string]
+  >(
+    `UPDATE held_notices
+        SET withdrawnAt = ?, withdrawnBy = ?, withdrawReason = ?
+      WHERE id = ? AND project = ? AND withdrawnAt IS NULL AND (
+        (digestReportId IS NULL AND digestedAt IS NULL)
+        OR EXISTS (
+          SELECT 1 FROM reports
+            WHERE reports.id = held_notices.digestReportId
+              AND reports.state IN ('failed', 'withdrawn')
+        )
+      )`,
+  );
+  const insertHandoffWithdrawal = db.query<
+    unknown,
+    [string, string, string, string, string, number, string, string]
+  >(
+    `INSERT INTO handoff_withdrawals
+       (id, project, target, actor, reason, at, summary, detail)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectHandoffWithdrawal = db.query<HandoffWithdrawalRow, [string]>(
+    `SELECT * FROM handoff_withdrawals WHERE id = ?`,
+  );
+  const selectHandoffWithdrawals = db.query<HandoffWithdrawalRow, [string, number]>(
+    `SELECT * FROM handoff_withdrawals
+      WHERE project = ? ORDER BY at DESC, rowid DESC LIMIT ?`,
+  );
   const deletePendingMaterialReport = db.query<unknown, [string, string]>(
     `DELETE FROM reports
       WHERE id = ? AND project = ? AND kind = 'material' AND state = 'pending'`,
@@ -3051,7 +3206,7 @@ export function openStore(dbPath: string): Store {
                 THEN 'POSSIBLE REPEAT of catch-up ' || ? || ': ' || summary
               ELSE summary
             END
-      WHERE project = ? AND digestReportId = ? AND EXISTS (
+      WHERE project = ? AND digestReportId = ? AND withdrawnAt IS NULL AND EXISTS (
         SELECT 1 FROM reports
           WHERE id = ? AND project = ? AND kind = 'digest' AND state = 'pending'
             AND dedupeKey LIKE 'availability/%'
@@ -3059,12 +3214,13 @@ export function openStore(dbPath: string): Store {
   );
   const selectAvailabilityReservationCandidate = db.query<{ id: string }, [string]>(
     `SELECT held_notices.id FROM held_notices
-      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1 AND (
+      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1
+        AND held_notices.withdrawnAt IS NULL AND (
         (held_notices.digestReportId IS NULL AND held_notices.digestedAt IS NULL)
         OR EXISTS (
           SELECT 1 FROM reports
             WHERE reports.id = held_notices.digestReportId AND (
-              reports.state = 'failed'
+              reports.state IN ('failed', 'withdrawn')
               OR (
                 reports.state = 'pending' AND reports.kind = 'digest'
                 AND reports.dedupeKey LIKE 'availability/%'
@@ -3180,9 +3336,9 @@ export function openStore(dbPath: string): Store {
     releaseOnAvailable: number;
     urgent: number;
   };
-  const undigestedNoticeWhere = `project = ? AND (
+  const undigestedNoticeWhere = `project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`;
   const selectUndigestedNotices = db.query<HeldNoticeRow, [string, number]>(
     `SELECT id, category, summary, detail, createdAt, releaseOnAvailable, urgent FROM held_notices
@@ -3212,16 +3368,16 @@ export function openStore(dbPath: string): Store {
             MIN(CASE WHEN releaseOnAvailable = 0 THEN createdAt END) AS digestOldestAt,
             MIN(CASE WHEN releaseOnAvailable = 1 THEN createdAt END) AS availabilityOldestAt
        FROM held_notices
-      WHERE project = ? AND (
+      WHERE project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignHeldNoticeToDigest = db.query<unknown, [number, string, string, string]>(
     `UPDATE held_notices SET digestedAt = ?, digestReportId = ?
-      WHERE project = ? AND id = ? AND (
+      WHERE project = ? AND id = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertMaterialEvent = db.query<unknown, SqlValue[]>(
@@ -3236,7 +3392,7 @@ export function openStore(dbPath: string): Store {
     `SELECT * FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )
       ORDER BY occurredAt ASC, recordedAt ASC, rowid ASC
       LIMIT ?`,
@@ -3245,14 +3401,14 @@ export function openStore(dbPath: string): Store {
     `SELECT COUNT(*) AS count, MIN(occurredAt) AS oldestAt FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignMaterialEventToDigest = db.query<unknown, [string, string, string]>(
     `UPDATE material_events SET digestReportId = ?
       WHERE project = ? AND id = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertIntake = db.query<unknown, SqlValue[]>(
@@ -3278,7 +3434,7 @@ export function openStore(dbPath: string): Store {
   // today's key under `digestDue` (#229).
   const selectLastDigestKey = db.query<{ key: string | null }, [string]>(
     `SELECT dedupeKey AS key FROM reports
-      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state <> 'failed'
+      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC LIMIT 1`,
   );
   const claimReportRow = db.query<unknown, [string, number, string, number]>(
@@ -3404,6 +3560,109 @@ export function openStore(dbPath: string): Store {
     }
     return enqueued;
   };
+
+  const withdrawHandoffTx = db.transaction(
+    (
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult => {
+      const report = selectReport.get(id);
+      if (report !== null) {
+        if (report.project !== project) return { kind: "not-found" };
+        if (report.state !== "pending") {
+          return { kind: "refused", target: "report", state: report.state };
+        }
+        const noticeIds = selectReportNoticeIds.all(id, project).map((row) => row.id);
+        if (withdrawPendingReportRow.run(at, actor, reason, at, id, project).changes !== 1) {
+          const current = selectReport.get(id);
+          return {
+            kind: "refused",
+            target: "report",
+            state: current?.state ?? "not-found",
+          };
+        }
+        if (report.ambiguous !== 0) {
+          markReportMaterialEventsPossibleRepeat.run(id, id, project);
+          markReportHeldNoticesPossibleRepeat.run(id, id, project);
+        }
+        unassignReportMaterialEvents.run(id, project);
+        unassignReportHeldNotices.run(id, project);
+        for (const noticeId of noticeIds) {
+          deleteAvailabilityReservationForNotice.run(project, noticeId);
+        }
+        const summary = report.body.split("\n", 1)[0]!.slice(0, 240);
+        const withdrawal: HandoffWithdrawal = {
+          id,
+          project,
+          target: "report",
+          actor,
+          reason,
+          at,
+          summary,
+          detail: report.body,
+        };
+        insertHandoffWithdrawal.run(
+          id,
+          project,
+          "report",
+          actor,
+          reason,
+          at,
+          summary,
+          report.body,
+        );
+        return { kind: "withdrawn", withdrawal };
+      }
+
+      const prior = selectHandoffWithdrawal.get(id);
+      if (prior !== null) {
+        return prior.project === project
+          ? { kind: "refused", target: prior.target as HandoffWithdrawal["target"], state: "withdrawn" }
+          : { kind: "not-found" };
+      }
+      const notice = selectHeldNoticeLifecycle.get(id);
+      if (notice === null || notice.project !== project) return { kind: "not-found" };
+      if (notice.withdrawnAt !== null) {
+        return { kind: "refused", target: "notice", state: "withdrawn" };
+      }
+      if (notice.digestReportId !== null) {
+        const owner = selectReport.get(notice.digestReportId);
+        if (owner === null || (owner.state !== "failed" && owner.state !== "withdrawn")) {
+          return { kind: "refused", target: "notice", state: "assigned" };
+        }
+      } else if (notice.digestedAt !== null) {
+        return { kind: "refused", target: "notice", state: "digested" };
+      }
+      if (withdrawHeldNoticeRow.run(at, actor, reason, id, project).changes !== 1) {
+        return { kind: "refused", target: "notice", state: "changed" };
+      }
+      deleteAvailabilityReservationForNotice.run(project, id);
+      const withdrawal: HandoffWithdrawal = {
+        id,
+        project,
+        target: "notice",
+        actor,
+        reason,
+        at,
+        summary: notice.summary,
+        detail: notice.detail,
+      };
+      insertHandoffWithdrawal.run(
+        id,
+        project,
+        "notice",
+        actor,
+        reason,
+        at,
+        notice.summary,
+        notice.detail,
+      );
+      return { kind: "withdrawn", withdrawal };
+    },
+  );
   const enqueueDigestReportTx = db.transaction(enqueueDigestReportRecord);
   const enqueueAvailabilityReportTx = db.transaction(
     (draft: ReportDraft, heldNoticeIds: readonly string[]): ReportEnqueue | undefined => {
@@ -4870,6 +5129,21 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : toReport(row);
     },
 
+    withdrawHandoff(
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult {
+      return withdrawHandoffTx.immediate(id, project, actor, reason, at);
+    },
+
+    handoffWithdrawals(project: string, limit = 5): HandoffWithdrawal[] {
+      return selectHandoffWithdrawals.all(project, limit).map(toHandoffWithdrawal);
+    },
+
+
     deferPendingReportToNotice(id: string, notice: HeldNoticeDraft): boolean {
       return deferPendingReportToNoticeTx(id, notice);
     },

package/src/types.ts

@@ -275,8 +275,8 @@ export const RELEASE_SHAPES = [
   "github-release",
   "deploy",
   /**
-   * Replace the running conductor itself: the Bun-global CLI, the omp plugin
-   * and the Herdr plugin, pinned to one published release and executed
+   * Replace the running conductor itself: the discovered CLI package, the omp
+   * plugin and the Herdr plugin, pinned to one published release and executed
    * detached. This is the "nobody patches the running conductor" boundary
    * moved deliberately, not worked around — a session that may cut a release
    * still cannot install one until an operator grants this shape too.
@@ -2354,7 +2354,7 @@ export type ReportKind = (typeof REPORT_KINDS)[number];
  * `failed` is the bounded retry budget running out, and is itself news: a
  * report nobody can deliver escalates as tier 2 in its own right.
  */
-export const REPORT_DELIVERY_STATES = ["pending", "sending", "delivered", "failed"] as const;
+export const REPORT_DELIVERY_STATES = ["pending", "sending", "delivered", "failed", "withdrawn"] as const;
 
 export type ReportDeliveryState = (typeof REPORT_DELIVERY_STATES)[number];
 
@@ -2411,6 +2411,9 @@ export interface ReportRecord {
   deliveredAt?: number;
   /** Bounded text of the last known failure, surfaced verbatim by `status`. */
   lastError?: string;
+  withdrawnAt?: number;
+  withdrawnBy?: string;
+  withdrawReason?: string;
 }
 
 /** What a caller hands over. The store owns identity, state and every timestamp. */
@@ -2431,6 +2434,22 @@ export interface ReportEnqueue {
   deduped: boolean;
 }
 
+export interface HandoffWithdrawal {
+  id: string;
+  project: string;
+  target: "report" | "notice";
+  actor: string;
+  reason: string;
+  at: number;
+  summary: string;
+  detail: string;
+}
+
+export type HandoffWithdrawalResult =
+  | { kind: "withdrawn"; withdrawal: HandoffWithdrawal }
+  | { kind: "not-found" }
+  | { kind: "refused"; target: "report" | "notice"; state: string };
+
 /** Maximum ledger rows of each kind placed in one digest prompt. Older rows
  * stay first, so a busy day drains deterministically over later digests. */
 export const DIGEST_BACKLOG_LIMIT = 20;
@@ -3076,6 +3095,16 @@ export interface Store {
     categories?: readonly InterruptCategory[],
     urgent?: boolean,
   ): HeldNotice[];
+  /** Withdraw one unsent report or unassigned held notice, preserving an audit row. */
+  withdrawHandoff(
+    id: string,
+    project: string,
+    actor: string,
+    reason: string,
+    at: number,
+  ): HandoffWithdrawalResult;
+  /** Recent successful withdrawals, newest first, for status/audit. */
+  handoffWithdrawals(project: string, limit?: number): HandoffWithdrawal[];
   /** Record the install identities this host carried on this pass (#919).
    *  One row, replaced: the question is "what is installed now", and a history
    *  of installs is what the upgrade journal already keeps. */

package/src/upgrade-journal.ts

@@ -22,6 +22,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { stateDir } from "./config.ts";
+import type { ResolvedGrants } from "./types.ts";
 
 /**
  * Where the fleet's upgrade journal lives: one JSONL file per host, because
@@ -74,19 +75,43 @@ export interface UpgradeJournalEntry {
   pauseKey?: string;
   /** Whether dispatch was already paused when the request began. */
   initialPaused?: boolean;
+  /** Creation instant of the exact pause sentinel this transaction acquired. */
+  pauseSince?: number;
   /** The fleet layers the install began under, for delta verification. */
   initial?: JournalFleetState;
   /** The projects the install covers, in the form the upgrade engine uses. */
   selectors?: readonly (string | null)[];
+  /** Host-global install authority resolved before the detached unit started. */
+  installHolder?: ResolvedGrants["install"];
+  /** Every configured project affected by the host-global install, report-only. */
+  installProjects?: readonly string[];
   /** Verification evidence when the post-restart tick closes the transaction. */
   checks?: readonly UpgradeCheck[];
 }
 
+/** Paths and roots discovered before the first install mutation (#1019). */
+export interface InstallSnapshotManagement {
+  cli: {
+    executable: string;
+    target: string;
+    root: string;
+  };
+  omp: {
+    root: string;
+    lock: string;
+  };
+  herdr: {
+    root?: string;
+    installRoot: string;
+  };
+}
+
 /** The installed identities a rollback must restore, verbatim. */
 export interface InstallSnapshotSurfaces {
   cliVersion: string;
   ompVersion?: string;
   herdrSource?: string;
+  management?: InstallSnapshotManagement;
 }
 
 export function upgradeJournalPath(root = stateDir()): string {
@@ -165,7 +190,12 @@ export type UnitSpawnResult = { code: number; stdout: string; stderr: string };
 export type UnitSpawnFn = (argv: readonly string[]) => Promise<UnitSpawnResult>;
 
 export type UnitCommand =
-  | { kind: "install"; version: string }
+  | {
+      kind: "install";
+      version: string;
+      holder?: ResolvedGrants["install"];
+      projects?: readonly string[];
+    }
   | { kind: "rollback"; version: string };
 
 export interface LaunchedUnit {
@@ -197,6 +227,12 @@ export async function launchTransientUnit(
   const setenv = [`PATH=${executorPath(env)}`, `OMP_CONDUCTOR_UNIT=${unit}`];
   const session = env["HERDR_SESSION"];
   if (session !== undefined && session.length > 0) setenv.push(`HERDR_SESSION=${session}`);
+  if (command.kind === "install" && command.holder !== undefined) {
+    setenv.push(`OMP_CONDUCTOR_INSTALL_HOLDER=${command.holder}`);
+  }
+  if (command.kind === "install" && command.projects !== undefined) {
+    setenv.push(`OMP_CONDUCTOR_INSTALL_PROJECTS=${command.projects.join(",")}`);
+  }
   const argv = [
     "systemd-run",
     `--unit=${unit}`,