omp-conductor 0.19.5 → 0.19.6

package/src/fleet.ts

@@ -223,6 +223,46 @@ export function armState(projectName?: string): { path: string; armed: boolean }
   return { path, armed: resolveArmState(path, named).armed };
 }
 
+export type WatchMonitoring =
+  | { monitored: true }
+  | { monitored: false; reason: string };
+
+/** Whether a durable watch can be observed and wake an orchestrator tick (#1024). */
+export function watchMonitoringState(
+  layers: Pick<FleetLayers, "daemon" | "ticks">,
+): WatchMonitoring {
+  if (!layers.daemon.running) return { monitored: false, reason: "daemon not running" };
+  if (layers.ticks === "armed" || layers.ticks === "ungated") return { monitored: true };
+  if (layers.ticks === "disarmed") {
+    return {
+      monitored: false,
+      reason: "ticks disarmed — conditions may still be checked, but no tick can be woken",
+    };
+  }
+  return { monitored: false, reason: `ticks ${layers.ticks}` };
+}
+
+/** Cheap watch liveness read: no Herdr, Telegram, healthz, or systemd probes. */
+export function watchMonitoringForProject(projectName: string): WatchMonitoring {
+  const daemon = livingDaemon();
+  if (daemon === undefined) return { monitored: false, reason: "daemon not running" };
+  if (daemon.project !== undefined && daemon.project !== projectName) {
+    return { monitored: false, reason: `daemon serves ${daemon.project}, not ${projectName}` };
+  }
+  const tick = resolveTickConfig(projectName);
+  const ticks: TicksLayer =
+    tick.kind === "absent"
+      ? "no-heartbeat-config"
+      : tick.kind === "invalid"
+        ? "invalid-heartbeat-config"
+        : tick.config.armedFile === undefined
+          ? "ungated"
+          : armState(projectName).armed
+            ? "armed"
+            : "disarmed";
+  return watchMonitoringState({ daemon: { running: true }, ticks });
+}
+
 /**
  * Clears the arm gate for this project — and `wasArmed` is the gate the
  * heartbeat reads, not merely one file's presence.
@@ -2174,7 +2214,7 @@ export async function collectFleetStatus(projectName?: string): Promise<FleetSta
     telegram,
     codeGraph,
     brief: briefStatusLine(project),
-    decisions: decisionStatusLine(project.name),
+    decisions: decisionStatusLine(project.name, layers),
     failureClasses: failureClassBlock(project.name),
     workerPhases,
     intake: intakeStatusLine(project.name),
@@ -2307,7 +2347,10 @@ function failureClassBlock(projectName: string): string | undefined {
  * watches behind GitHub's checks is not a fleet waiting on its operator, and
  * lumping them in made `decisions 3 open` read as three unanswered questions.
  */
-export function decisionStatusLine(projectName: string): string | undefined {
+export function decisionStatusLine(
+  projectName: string,
+  layers: Pick<FleetLayers, "daemon" | "ticks">,
+): string | undefined {
   const path = dbPath();
   if (!existsSync(path)) return undefined;
   let store: Store | undefined;
@@ -2325,7 +2368,12 @@ export function decisionStatusLine(projectName: string): string | undefined {
       const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
       line = `decisions ${questions.length} open (oldest ${hours}h)`;
     }
-    if (watches.length > 0) line += ` · watches ${watches.length}`;
+    if (watches.length > 0) {
+      const monitoring = watchMonitoringState(layers);
+      line += monitoring.monitored
+        ? ` · watches ${watches.length} monitored`
+        : ` · watches ${watches.length} durable, unmonitored (${monitoring.reason})`;
+    }
     return line;
   } catch {
     return undefined;

package/src/orchestrator-tick.ts

@@ -49,7 +49,13 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { availabilityPrompt, interruptDisposition } from "./availability.ts";
-import { findProject, loadConfig, resolveReleaseGrants, stateDir } from "./config.ts";
+import {
+  findProject,
+  loadConfig,
+  resolveReleaseGrants,
+  resolveSharedInstallAuthority,
+  stateDir,
+} from "./config.ts";
 import {
   bridgeTokenBound,
   hasBotToken,
@@ -4393,9 +4399,14 @@ export default function orchestratorTickExtension(
       let grants: ResolvedGrants = DENIED_RELEASE_GRANTS;
       let external = true;
       try {
-        const project = findProject(loadConfig(), configuredProject);
+        const config = loadConfig();
+        const project = findProject(config, configuredProject);
+        const installAuthority = resolveSharedInstallAuthority(config.projects);
         projectName = project.name;
-        grants = resolveReleaseGrants(project);
+        grants = {
+          ...resolveReleaseGrants(project),
+          install: installAuthority.holder ?? "human",
+        };
         external = project.escalation.orchestrator === "external";
       } catch (err) {
         // A missing/unreadable config cannot open a release gate. Log only when

package/src/setup-host.ts

@@ -780,11 +780,11 @@ export function renderHerdrUnit(runtime: ServiceRuntime): string {
  * recovery.
  */
 export function renderRecoverUnit(runtime: ServiceRuntime, projectName: string | undefined): string {
-  // `RECOVER_PROJECT` is how the playbook addresses the tier-2 escalation it
-  // enqueues. It is a host-global unit installed once for the whole box, so a
-  // static per-project value is only unambiguous on a single-project host — a
-  // multi-project host (or a no-project, host-global install) leaves it unset
-  // and reports without a `--project` rather than guessing one (#510/#530).
+  // `RECOVER_PROJECT` scopes the recovery action and optional re-arm. It is
+  // host-global and installed once, so a static action scope is legitimate
+  // only on a single-project host. With several projects it stays unset; the
+  // playbook independently derives one deterministic outbox owner from the
+  // live config and names every affected project in the report (#1027).
   return [
     "[Unit]",
     "Description=omp-conductor fleet recovery (OnFailure handler)",
@@ -1566,11 +1566,11 @@ export function planHostRuntime(
   const installedPath = join(unitDir, STAGED_SERVICE_NAME);
   const installedHerdr = join(unitDir, DEFAULT_HERDR_UNIT);
   const recoverUnitPath = join(stateDir(), RECOVER_SERVICE_NAME);
-  // The recovery unit is host-global: one shared unit, installed once. A
-  // static RECOVER_PROJECT is only legitimate when there is exactly one
-  // project to be unambiguous about — a multi-project host (or a no-project
-  // install) leaves it unset so the escalation reports without attributing a
-  // sibling's crash to one project (#510/#530).
+  // The recovery unit is host-global: one shared unit, installed once.
+  // `RECOVER_PROJECT` scopes recovery action/re-arm only and is therefore
+  // omitted on a multi-project host. Report ownership is a separate runtime
+  // decision: the playbook reads the configured project set, chooses its first
+  // project as outbox owner, and lists every project as affected (#1027).
   const recoverProject = project === undefined || multiProject ? undefined : project.name;
   const recoverUnitContent = renderRecoverUnit(runtime, recoverProject);
   const recoverUnit: PlannedWrite<string> = {

package/src/setup-wizard.ts

@@ -617,7 +617,7 @@ const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]
   // package floor's "nobody patches the running conductor" is this grant's
   // deny default.
   install:
-    "install — replace this host's installed conductor: the Bun-global CLI, omp plugin " +
+    "install — replace this host's installed conductor: the discovered CLI package, omp plugin " +
     "and Herdr plugin pinned to one published release, executed detached from the fleet",
 };
 

package/src/status-render.ts

@@ -1018,6 +1018,16 @@ function formatProjectBody(
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
+  const withdrawals = s.handoffWithdrawals ?? [];
+  if (withdrawals.length > 0) {
+    lines.push("handoff withdrawals");
+    for (const withdrawal of withdrawals) {
+      lines.push(
+        `  ${withdrawal.id}  ${withdrawal.target}  ${new Date(withdrawal.at).toISOString()}  ` +
+          `by ${withdrawal.actor} — ${withdrawal.reason}; ${withdrawal.summary}`,
+      );
+    }
+  }
   lines.push(...formatDigestBacklog(s.digestBacklog));
   // The mediated-verb ledger (#972). Absent from this renderer since the block
   // was written (#133) — it was wired into `daemon.ts`'s copy, which was

package/src/store.ts

@@ -53,6 +53,8 @@ import type {
   GroomingRecord,
   GroomingVerdict,
   HistoricalInfraCandidate,
+  HandoffWithdrawal,
+  HandoffWithdrawalResult,
   HeldNotice,
   InterruptCategory,
   HeldNoticeDraft,
@@ -430,6 +432,30 @@ interface ReportRow {
   sentParts: number;
   sentPartsHash: string | null;
   lastError: string | null;
+  withdrawnAt: number | null;
+  withdrawnBy: string | null;
+  withdrawReason: string | null;
+}
+
+interface HandoffWithdrawalRow {
+  id: string;
+  project: string;
+  target: string;
+  actor: string;
+  reason: string;
+  at: number;
+  summary: string;
+  detail: string;
+}
+
+interface HeldNoticeLifecycleRow {
+  id: string;
+  project: string;
+  summary: string;
+  detail: string;
+  digestedAt: number | null;
+  digestReportId: string | null;
+  withdrawnAt: number | null;
 }
 
 /** The `material_events` table exactly as SQLite hands it back (#274). */
@@ -940,13 +966,30 @@ CREATE TABLE IF NOT EXISTS reports (
   deliveredAt   INTEGER,
   sentParts     INTEGER NOT NULL DEFAULT 0,
   sentPartsHash TEXT,
-  lastError     TEXT
+  lastError     TEXT,
+  withdrawnAt   INTEGER,
+  withdrawnBy   TEXT,
+  withdrawReason TEXT
 );
 CREATE UNIQUE INDEX IF NOT EXISTS reports_dedupe
-  ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+  ON reports (project, dedupeKey)
+  WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
 CREATE INDEX IF NOT EXISTS reports_project_state
   ON reports (project, state, nextAttemptAt);
 
+CREATE TABLE IF NOT EXISTS handoff_withdrawals (
+  id      TEXT PRIMARY KEY,
+  project TEXT NOT NULL,
+  target  TEXT NOT NULL,
+  actor   TEXT NOT NULL,
+  reason  TEXT NOT NULL,
+  at      INTEGER NOT NULL,
+  summary TEXT NOT NULL,
+  detail  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS handoff_withdrawals_project_at
+  ON handoff_withdrawals (project, at DESC);
+
 -- Ordinary material outcomes awaiting authorship in a deferred digest (#274).
 -- Association happens when a digest is accepted into the outbox, not when the
 -- session happens to remember the event or when Telegram later delivers it.
@@ -979,7 +1022,10 @@ CREATE TABLE IF NOT EXISTS held_notices (
   releaseOnAvailable INTEGER NOT NULL DEFAULT 0,
   urgent             INTEGER NOT NULL DEFAULT 0,
   digestedAt         INTEGER,
-  digestReportId     TEXT    REFERENCES reports(id)
+  digestReportId     TEXT    REFERENCES reports(id),
+  withdrawnAt        INTEGER,
+  withdrawnBy        TEXT,
+  withdrawReason     TEXT
 );
 CREATE INDEX IF NOT EXISTS held_notices_project_undigested
   ON held_notices (project, digestedAt) WHERE digestedAt IS NULL;
@@ -1562,9 +1608,25 @@ function toReport(row: ReportRow): ReportRecord {
   if (row.sentPartsHash !== null) record.sentPartsHash = row.sentPartsHash;
   if (row.deliveredAt !== null) record.deliveredAt = row.deliveredAt;
   if (row.lastError !== null) record.lastError = row.lastError;
+  if (row.withdrawnAt !== null) record.withdrawnAt = row.withdrawnAt;
+  if (row.withdrawnBy !== null) record.withdrawnBy = row.withdrawnBy;
+  if (row.withdrawReason !== null) record.withdrawReason = row.withdrawReason;
   return record;
 }
 
+function toHandoffWithdrawal(row: HandoffWithdrawalRow): HandoffWithdrawal {
+  return {
+    id: row.id,
+    project: row.project,
+    summary: row.summary,
+    detail: row.detail,
+    target: row.target as HandoffWithdrawal["target"],
+    actor: row.actor,
+    reason: row.reason,
+    at: row.at,
+  };
+}
+
 function toMaterialEvent(row: MaterialEventRow): MaterialEvent {
   return {
     id: row.id,
@@ -1905,20 +1967,20 @@ export function openStore(dbPath: string): Store {
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
   db.exec(SCHEMA);
-  // #274: a terminally failed digest did not count as sent, but the old unique
-  // index still blocked a replacement under the same daily key. Replace that
-  // one-time schema so owed ledger rows can be handed off again.
+  // Failed or explicitly withdrawn handoffs no longer own a digest dedupe key:
+  // both leave their underlying ledger rows owed for a replacement report.
   const reportDedupeIndex = db
     .query<{ sql: string | null }, []>(
       `SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'reports_dedupe'`,
     )
     .get();
-  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'failed'")) {
+  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'withdrawn'")) {
     db.exec(
       `BEGIN IMMEDIATE;
        DROP INDEX IF EXISTS reports_dedupe;
        CREATE UNIQUE INDEX reports_dedupe
-         ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+         ON reports (project, dedupeKey)
+         WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
        COMMIT;`,
     );
   }
@@ -2112,6 +2174,15 @@ export function openStore(dbPath: string): Store {
   }
   // Urgent recovery notices bypass category batching only; they still wait for
   // the configured availability window. Historical notices were not urgent.
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!heldNoticeColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE held_notices ADD COLUMN ${name} ${type}`);
+    }
+  }
   if (!heldNoticeColumns.some((column) => column.name === "urgent")) {
     db.exec("ALTER TABLE held_notices ADD COLUMN urgent INTEGER NOT NULL DEFAULT 0");
   }
@@ -2129,6 +2200,15 @@ export function openStore(dbPath: string): Store {
   if (!reportColumns.some((column) => column.name === "sentPartsHash")) {
     db.exec("ALTER TABLE reports ADD COLUMN sentPartsHash TEXT");
   }
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!reportColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE reports ADD COLUMN ${name} ${type}`);
+    }
+  }
   // The kind split (#459): a row is either a question a human must answer or a
   // watch the orchestrator set for itself. Databases written before the split
   // never marked it, and every such row was a question — `watch` has no
@@ -3012,7 +3092,7 @@ export function openStore(dbPath: string): Store {
   const selectReport = db.query<ReportRow, [string]>(`SELECT * FROM reports WHERE id = ?`);
   const selectReportByDedupe = db.query<ReportRow, [string, string]>(
     `SELECT * FROM reports
-      WHERE project = ? AND dedupeKey = ? AND state <> 'failed'
+      WHERE project = ? AND dedupeKey = ? AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC, rowid DESC LIMIT 1`,
   );
   const selectDueReports = db.query<ReportRow, [string, number, number]>(
@@ -3021,6 +3101,81 @@ export function openStore(dbPath: string): Store {
       ORDER BY createdAt ASC, rowid ASC
       LIMIT ?`,
   );
+  const withdrawPendingReportRow = db.query<
+    unknown,
+    [number, string, string, number, string, string]
+  >(
+    `UPDATE reports
+        SET state = 'withdrawn', withdrawnAt = ?, withdrawnBy = ?,
+            withdrawReason = ?, updatedAt = ?, attemptId = NULL
+      WHERE id = ? AND project = ? AND state = 'pending'`,
+  );
+  const selectReportNoticeIds = db.query<{ id: string }, [string, string]>(
+    `SELECT id FROM held_notices WHERE digestReportId = ? AND project = ?`,
+  );
+  const unassignReportMaterialEvents = db.query<unknown, [string, string]>(
+    `UPDATE material_events SET digestReportId = NULL
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportMaterialEventsPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE material_events
+        SET summary = CASE
+          WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+          ELSE summary
+        END
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportHeldNoticesPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE held_notices
+        SET summary = CASE
+              WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+              ELSE summary
+            END,
+            detail = CASE
+              WHEN detail NOT LIKE 'This handoff may already%' THEN
+                'This handoff may already have reached Telegram before its outcome was lost.\n\n' || detail
+              ELSE detail
+            END
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const unassignReportHeldNotices = db.query<unknown, [string, string]>(
+    `UPDATE held_notices SET digestReportId = NULL, digestedAt = NULL
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const selectHeldNoticeLifecycle = db.query<HeldNoticeLifecycleRow, [string]>(
+    `SELECT id, project, summary, detail, digestedAt, digestReportId, withdrawnAt
+       FROM held_notices WHERE id = ?`,
+  );
+  const withdrawHeldNoticeRow = db.query<
+    unknown,
+    [number, string, string, string, string]
+  >(
+    `UPDATE held_notices
+        SET withdrawnAt = ?, withdrawnBy = ?, withdrawReason = ?
+      WHERE id = ? AND project = ? AND withdrawnAt IS NULL AND (
+        (digestReportId IS NULL AND digestedAt IS NULL)
+        OR EXISTS (
+          SELECT 1 FROM reports
+            WHERE reports.id = held_notices.digestReportId
+              AND reports.state IN ('failed', 'withdrawn')
+        )
+      )`,
+  );
+  const insertHandoffWithdrawal = db.query<
+    unknown,
+    [string, string, string, string, string, number, string, string]
+  >(
+    `INSERT INTO handoff_withdrawals
+       (id, project, target, actor, reason, at, summary, detail)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectHandoffWithdrawal = db.query<HandoffWithdrawalRow, [string]>(
+    `SELECT * FROM handoff_withdrawals WHERE id = ?`,
+  );
+  const selectHandoffWithdrawals = db.query<HandoffWithdrawalRow, [string, number]>(
+    `SELECT * FROM handoff_withdrawals
+      WHERE project = ? ORDER BY at DESC, rowid DESC LIMIT ?`,
+  );
   const deletePendingMaterialReport = db.query<unknown, [string, string]>(
     `DELETE FROM reports
       WHERE id = ? AND project = ? AND kind = 'material' AND state = 'pending'`,
@@ -3051,7 +3206,7 @@ export function openStore(dbPath: string): Store {
                 THEN 'POSSIBLE REPEAT of catch-up ' || ? || ': ' || summary
               ELSE summary
             END
-      WHERE project = ? AND digestReportId = ? AND EXISTS (
+      WHERE project = ? AND digestReportId = ? AND withdrawnAt IS NULL AND EXISTS (
         SELECT 1 FROM reports
           WHERE id = ? AND project = ? AND kind = 'digest' AND state = 'pending'
             AND dedupeKey LIKE 'availability/%'
@@ -3059,12 +3214,13 @@ export function openStore(dbPath: string): Store {
   );
   const selectAvailabilityReservationCandidate = db.query<{ id: string }, [string]>(
     `SELECT held_notices.id FROM held_notices
-      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1 AND (
+      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1
+        AND held_notices.withdrawnAt IS NULL AND (
         (held_notices.digestReportId IS NULL AND held_notices.digestedAt IS NULL)
         OR EXISTS (
           SELECT 1 FROM reports
             WHERE reports.id = held_notices.digestReportId AND (
-              reports.state = 'failed'
+              reports.state IN ('failed', 'withdrawn')
               OR (
                 reports.state = 'pending' AND reports.kind = 'digest'
                 AND reports.dedupeKey LIKE 'availability/%'
@@ -3180,9 +3336,9 @@ export function openStore(dbPath: string): Store {
     releaseOnAvailable: number;
     urgent: number;
   };
-  const undigestedNoticeWhere = `project = ? AND (
+  const undigestedNoticeWhere = `project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`;
   const selectUndigestedNotices = db.query<HeldNoticeRow, [string, number]>(
     `SELECT id, category, summary, detail, createdAt, releaseOnAvailable, urgent FROM held_notices
@@ -3212,16 +3368,16 @@ export function openStore(dbPath: string): Store {
             MIN(CASE WHEN releaseOnAvailable = 0 THEN createdAt END) AS digestOldestAt,
             MIN(CASE WHEN releaseOnAvailable = 1 THEN createdAt END) AS availabilityOldestAt
        FROM held_notices
-      WHERE project = ? AND (
+      WHERE project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignHeldNoticeToDigest = db.query<unknown, [number, string, string, string]>(
     `UPDATE held_notices SET digestedAt = ?, digestReportId = ?
-      WHERE project = ? AND id = ? AND (
+      WHERE project = ? AND id = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertMaterialEvent = db.query<unknown, SqlValue[]>(
@@ -3236,7 +3392,7 @@ export function openStore(dbPath: string): Store {
     `SELECT * FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )
       ORDER BY occurredAt ASC, recordedAt ASC, rowid ASC
       LIMIT ?`,
@@ -3245,14 +3401,14 @@ export function openStore(dbPath: string): Store {
     `SELECT COUNT(*) AS count, MIN(occurredAt) AS oldestAt FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignMaterialEventToDigest = db.query<unknown, [string, string, string]>(
     `UPDATE material_events SET digestReportId = ?
       WHERE project = ? AND id = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertIntake = db.query<unknown, SqlValue[]>(
@@ -3278,7 +3434,7 @@ export function openStore(dbPath: string): Store {
   // today's key under `digestDue` (#229).
   const selectLastDigestKey = db.query<{ key: string | null }, [string]>(
     `SELECT dedupeKey AS key FROM reports
-      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state <> 'failed'
+      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC LIMIT 1`,
   );
   const claimReportRow = db.query<unknown, [string, number, string, number]>(
@@ -3404,6 +3560,109 @@ export function openStore(dbPath: string): Store {
     }
     return enqueued;
   };
+
+  const withdrawHandoffTx = db.transaction(
+    (
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult => {
+      const report = selectReport.get(id);
+      if (report !== null) {
+        if (report.project !== project) return { kind: "not-found" };
+        if (report.state !== "pending") {
+          return { kind: "refused", target: "report", state: report.state };
+        }
+        const noticeIds = selectReportNoticeIds.all(id, project).map((row) => row.id);
+        if (withdrawPendingReportRow.run(at, actor, reason, at, id, project).changes !== 1) {
+          const current = selectReport.get(id);
+          return {
+            kind: "refused",
+            target: "report",
+            state: current?.state ?? "not-found",
+          };
+        }
+        if (report.ambiguous !== 0) {
+          markReportMaterialEventsPossibleRepeat.run(id, id, project);
+          markReportHeldNoticesPossibleRepeat.run(id, id, project);
+        }
+        unassignReportMaterialEvents.run(id, project);
+        unassignReportHeldNotices.run(id, project);
+        for (const noticeId of noticeIds) {
+          deleteAvailabilityReservationForNotice.run(project, noticeId);
+        }
+        const summary = report.body.split("\n", 1)[0]!.slice(0, 240);
+        const withdrawal: HandoffWithdrawal = {
+          id,
+          project,
+          target: "report",
+          actor,
+          reason,
+          at,
+          summary,
+          detail: report.body,
+        };
+        insertHandoffWithdrawal.run(
+          id,
+          project,
+          "report",
+          actor,
+          reason,
+          at,
+          summary,
+          report.body,
+        );
+        return { kind: "withdrawn", withdrawal };
+      }
+
+      const prior = selectHandoffWithdrawal.get(id);
+      if (prior !== null) {
+        return prior.project === project
+          ? { kind: "refused", target: prior.target as HandoffWithdrawal["target"], state: "withdrawn" }
+          : { kind: "not-found" };
+      }
+      const notice = selectHeldNoticeLifecycle.get(id);
+      if (notice === null || notice.project !== project) return { kind: "not-found" };
+      if (notice.withdrawnAt !== null) {
+        return { kind: "refused", target: "notice", state: "withdrawn" };
+      }
+      if (notice.digestReportId !== null) {
+        const owner = selectReport.get(notice.digestReportId);
+        if (owner === null || (owner.state !== "failed" && owner.state !== "withdrawn")) {
+          return { kind: "refused", target: "notice", state: "assigned" };
+        }
+      } else if (notice.digestedAt !== null) {
+        return { kind: "refused", target: "notice", state: "digested" };
+      }
+      if (withdrawHeldNoticeRow.run(at, actor, reason, id, project).changes !== 1) {
+        return { kind: "refused", target: "notice", state: "changed" };
+      }
+      deleteAvailabilityReservationForNotice.run(project, id);
+      const withdrawal: HandoffWithdrawal = {
+        id,
+        project,
+        target: "notice",
+        actor,
+        reason,
+        at,
+        summary: notice.summary,
+        detail: notice.detail,
+      };
+      insertHandoffWithdrawal.run(
+        id,
+        project,
+        "notice",
+        actor,
+        reason,
+        at,
+        notice.summary,
+        notice.detail,
+      );
+      return { kind: "withdrawn", withdrawal };
+    },
+  );
   const enqueueDigestReportTx = db.transaction(enqueueDigestReportRecord);
   const enqueueAvailabilityReportTx = db.transaction(
     (draft: ReportDraft, heldNoticeIds: readonly string[]): ReportEnqueue | undefined => {
@@ -4870,6 +5129,21 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : toReport(row);
     },
 
+    withdrawHandoff(
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult {
+      return withdrawHandoffTx.immediate(id, project, actor, reason, at);
+    },
+
+    handoffWithdrawals(project: string, limit = 5): HandoffWithdrawal[] {
+      return selectHandoffWithdrawals.all(project, limit).map(toHandoffWithdrawal);
+    },
+
+
     deferPendingReportToNotice(id: string, notice: HeldNoticeDraft): boolean {
       return deferPendingReportToNoticeTx(id, notice);
     },