omp-conductor 0.19.5 → 0.19.7

package/src/orchestrator-tick.ts

@@ -49,7 +49,13 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { availabilityPrompt, interruptDisposition } from "./availability.ts";
-import { findProject, loadConfig, resolveReleaseGrants, stateDir } from "./config.ts";
+import {
+  findProject,
+  loadConfig,
+  resolveReleaseGrants,
+  resolveSharedInstallAuthority,
+  stateDir,
+} from "./config.ts";
 import {
   bridgeTokenBound,
   hasBotToken,
@@ -4393,9 +4399,14 @@ export default function orchestratorTickExtension(
       let grants: ResolvedGrants = DENIED_RELEASE_GRANTS;
       let external = true;
       try {
-        const project = findProject(loadConfig(), configuredProject);
+        const config = loadConfig();
+        const project = findProject(config, configuredProject);
+        const installAuthority = resolveSharedInstallAuthority(config.projects);
         projectName = project.name;
-        grants = resolveReleaseGrants(project);
+        grants = {
+          ...resolveReleaseGrants(project),
+          install: installAuthority.holder ?? "human",
+        };
         external = project.escalation.orchestrator === "external";
       } catch (err) {
         // A missing/unreadable config cannot open a release gate. Log only when

package/src/setup-host.ts

@@ -780,11 +780,11 @@ export function renderHerdrUnit(runtime: ServiceRuntime): string {
  * recovery.
  */
 export function renderRecoverUnit(runtime: ServiceRuntime, projectName: string | undefined): string {
-  // `RECOVER_PROJECT` is how the playbook addresses the tier-2 escalation it
-  // enqueues. It is a host-global unit installed once for the whole box, so a
-  // static per-project value is only unambiguous on a single-project host — a
-  // multi-project host (or a no-project, host-global install) leaves it unset
-  // and reports without a `--project` rather than guessing one (#510/#530).
+  // `RECOVER_PROJECT` scopes the recovery action and optional re-arm. It is
+  // host-global and installed once, so a static action scope is legitimate
+  // only on a single-project host. With several projects it stays unset; the
+  // playbook independently derives one deterministic outbox owner from the
+  // live config and names every affected project in the report (#1027).
   return [
     "[Unit]",
     "Description=omp-conductor fleet recovery (OnFailure handler)",
@@ -1566,11 +1566,11 @@ export function planHostRuntime(
   const installedPath = join(unitDir, STAGED_SERVICE_NAME);
   const installedHerdr = join(unitDir, DEFAULT_HERDR_UNIT);
   const recoverUnitPath = join(stateDir(), RECOVER_SERVICE_NAME);
-  // The recovery unit is host-global: one shared unit, installed once. A
-  // static RECOVER_PROJECT is only legitimate when there is exactly one
-  // project to be unambiguous about — a multi-project host (or a no-project
-  // install) leaves it unset so the escalation reports without attributing a
-  // sibling's crash to one project (#510/#530).
+  // The recovery unit is host-global: one shared unit, installed once.
+  // `RECOVER_PROJECT` scopes recovery action/re-arm only and is therefore
+  // omitted on a multi-project host. Report ownership is a separate runtime
+  // decision: the playbook reads the configured project set, chooses its first
+  // project as outbox owner, and lists every project as affected (#1027).
   const recoverProject = project === undefined || multiProject ? undefined : project.name;
   const recoverUnitContent = renderRecoverUnit(runtime, recoverProject);
   const recoverUnit: PlannedWrite<string> = {

package/src/setup-wizard.ts

@@ -617,7 +617,7 @@ const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]
   // package floor's "nobody patches the running conductor" is this grant's
   // deny default.
   install:
-    "install — replace this host's installed conductor: the Bun-global CLI, omp plugin " +
+    "install — replace this host's installed conductor: the discovered CLI package, omp plugin " +
     "and Herdr plugin pinned to one published release, executed detached from the fleet",
 };
 

package/src/status-render.ts

@@ -1018,6 +1018,16 @@ function formatProjectBody(
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
+  const withdrawals = s.handoffWithdrawals ?? [];
+  if (withdrawals.length > 0) {
+    lines.push("handoff withdrawals");
+    for (const withdrawal of withdrawals) {
+      lines.push(
+        `  ${withdrawal.id}  ${withdrawal.target}  ${new Date(withdrawal.at).toISOString()}  ` +
+          `by ${withdrawal.actor} — ${withdrawal.reason}; ${withdrawal.summary}`,
+      );
+    }
+  }
   lines.push(...formatDigestBacklog(s.digestBacklog));
   // The mediated-verb ledger (#972). Absent from this renderer since the block
   // was written (#133) — it was wired into `daemon.ts`'s copy, which was

package/src/store.ts

@@ -53,6 +53,8 @@ import type {
   GroomingRecord,
   GroomingVerdict,
   HistoricalInfraCandidate,
+  HandoffWithdrawal,
+  HandoffWithdrawalResult,
   HeldNotice,
   InterruptCategory,
   HeldNoticeDraft,
@@ -430,6 +432,30 @@ interface ReportRow {
   sentParts: number;
   sentPartsHash: string | null;
   lastError: string | null;
+  withdrawnAt: number | null;
+  withdrawnBy: string | null;
+  withdrawReason: string | null;
+}
+
+interface HandoffWithdrawalRow {
+  id: string;
+  project: string;
+  target: string;
+  actor: string;
+  reason: string;
+  at: number;
+  summary: string;
+  detail: string;
+}
+
+interface HeldNoticeLifecycleRow {
+  id: string;
+  project: string;
+  summary: string;
+  detail: string;
+  digestedAt: number | null;
+  digestReportId: string | null;
+  withdrawnAt: number | null;
 }
 
 /** The `material_events` table exactly as SQLite hands it back (#274). */
@@ -940,13 +966,30 @@ CREATE TABLE IF NOT EXISTS reports (
   deliveredAt   INTEGER,
   sentParts     INTEGER NOT NULL DEFAULT 0,
   sentPartsHash TEXT,
-  lastError     TEXT
+  lastError     TEXT,
+  withdrawnAt   INTEGER,
+  withdrawnBy   TEXT,
+  withdrawReason TEXT
 );
 CREATE UNIQUE INDEX IF NOT EXISTS reports_dedupe
-  ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+  ON reports (project, dedupeKey)
+  WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
 CREATE INDEX IF NOT EXISTS reports_project_state
   ON reports (project, state, nextAttemptAt);
 
+CREATE TABLE IF NOT EXISTS handoff_withdrawals (
+  id      TEXT PRIMARY KEY,
+  project TEXT NOT NULL,
+  target  TEXT NOT NULL,
+  actor   TEXT NOT NULL,
+  reason  TEXT NOT NULL,
+  at      INTEGER NOT NULL,
+  summary TEXT NOT NULL,
+  detail  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS handoff_withdrawals_project_at
+  ON handoff_withdrawals (project, at DESC);
+
 -- Ordinary material outcomes awaiting authorship in a deferred digest (#274).
 -- Association happens when a digest is accepted into the outbox, not when the
 -- session happens to remember the event or when Telegram later delivers it.
@@ -979,7 +1022,10 @@ CREATE TABLE IF NOT EXISTS held_notices (
   releaseOnAvailable INTEGER NOT NULL DEFAULT 0,
   urgent             INTEGER NOT NULL DEFAULT 0,
   digestedAt         INTEGER,
-  digestReportId     TEXT    REFERENCES reports(id)
+  digestReportId     TEXT    REFERENCES reports(id),
+  withdrawnAt        INTEGER,
+  withdrawnBy        TEXT,
+  withdrawReason     TEXT
 );
 CREATE INDEX IF NOT EXISTS held_notices_project_undigested
   ON held_notices (project, digestedAt) WHERE digestedAt IS NULL;
@@ -1310,6 +1356,20 @@ CREATE TABLE IF NOT EXISTS orchestrator_incidents (
   diverted INTEGER NOT NULL DEFAULT 0
 );
 
+-- Conductor-owned Herdr worker workspaces (#1035 review). Herdr restores a
+-- session's workspaces and panes across a server restart but drops
+-- report-metadata tokens, so the live-only token cannot remain the only
+-- ownership authority: the restored surface would be invisible to discovery,
+-- a duplicate would be created beside it, and its stale panes could never be
+-- reconciled or removed. One row per workspace conductor created and still
+-- owns; forgotten when the workspace is removed or fails to create cleanly.
+CREATE TABLE IF NOT EXISTS herdr_worker_workspaces (
+  project      TEXT    NOT NULL,
+  workspace_id TEXT    NOT NULL,
+  created_at   INTEGER NOT NULL,
+  PRIMARY KEY (project, workspace_id)
+);
+
 -- Every stop/restart of the shared daemon, and who asked for it and why
 -- (#378). Deliberately NOT partitioned by project: the daemon serves every
 -- configured project, so a record written by one project's CLI must be
@@ -1562,9 +1622,25 @@ function toReport(row: ReportRow): ReportRecord {
   if (row.sentPartsHash !== null) record.sentPartsHash = row.sentPartsHash;
   if (row.deliveredAt !== null) record.deliveredAt = row.deliveredAt;
   if (row.lastError !== null) record.lastError = row.lastError;
+  if (row.withdrawnAt !== null) record.withdrawnAt = row.withdrawnAt;
+  if (row.withdrawnBy !== null) record.withdrawnBy = row.withdrawnBy;
+  if (row.withdrawReason !== null) record.withdrawReason = row.withdrawReason;
   return record;
 }
 
+function toHandoffWithdrawal(row: HandoffWithdrawalRow): HandoffWithdrawal {
+  return {
+    id: row.id,
+    project: row.project,
+    summary: row.summary,
+    detail: row.detail,
+    target: row.target as HandoffWithdrawal["target"],
+    actor: row.actor,
+    reason: row.reason,
+    at: row.at,
+  };
+}
+
 function toMaterialEvent(row: MaterialEventRow): MaterialEvent {
   return {
     id: row.id,
@@ -1905,20 +1981,20 @@ export function openStore(dbPath: string): Store {
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
   db.exec(SCHEMA);
-  // #274: a terminally failed digest did not count as sent, but the old unique
-  // index still blocked a replacement under the same daily key. Replace that
-  // one-time schema so owed ledger rows can be handed off again.
+  // Failed or explicitly withdrawn handoffs no longer own a digest dedupe key:
+  // both leave their underlying ledger rows owed for a replacement report.
   const reportDedupeIndex = db
     .query<{ sql: string | null }, []>(
       `SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'reports_dedupe'`,
     )
     .get();
-  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'failed'")) {
+  if (!(reportDedupeIndex?.sql ?? "").includes("state <> 'withdrawn'")) {
     db.exec(
       `BEGIN IMMEDIATE;
        DROP INDEX IF EXISTS reports_dedupe;
        CREATE UNIQUE INDEX reports_dedupe
-         ON reports (project, dedupeKey) WHERE dedupeKey IS NOT NULL AND state <> 'failed';
+         ON reports (project, dedupeKey)
+         WHERE dedupeKey IS NOT NULL AND state <> 'failed' AND state <> 'withdrawn';
        COMMIT;`,
     );
   }
@@ -2112,6 +2188,15 @@ export function openStore(dbPath: string): Store {
   }
   // Urgent recovery notices bypass category batching only; they still wait for
   // the configured availability window. Historical notices were not urgent.
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!heldNoticeColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE held_notices ADD COLUMN ${name} ${type}`);
+    }
+  }
   if (!heldNoticeColumns.some((column) => column.name === "urgent")) {
     db.exec("ALTER TABLE held_notices ADD COLUMN urgent INTEGER NOT NULL DEFAULT 0");
   }
@@ -2129,6 +2214,15 @@ export function openStore(dbPath: string): Store {
   if (!reportColumns.some((column) => column.name === "sentPartsHash")) {
     db.exec("ALTER TABLE reports ADD COLUMN sentPartsHash TEXT");
   }
+  for (const [name, type] of [
+    ["withdrawnAt", "INTEGER"],
+    ["withdrawnBy", "TEXT"],
+    ["withdrawReason", "TEXT"],
+  ] as const) {
+    if (!reportColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE reports ADD COLUMN ${name} ${type}`);
+    }
+  }
   // The kind split (#459): a row is either a question a human must answer or a
   // watch the orchestrator set for itself. Databases written before the split
   // never marked it, and every such row was a question — `watch` has no
@@ -2874,6 +2968,18 @@ export function openStore(dbPath: string): Store {
       WHERE project = ?
       RETURNING project, mode, cause, since, diverted`,
   );
+  // Worker-workspace ownership rows (#1035 review). See the table comment:
+  // the durable half of discovery, so a Herdr restart that drops metadata
+  // tokens cannot orphan the surface conductor created.
+  const selectHerdrWorkerWorkspaces = db.query<{ workspace_id: string }, [string]>(
+    `SELECT workspace_id FROM herdr_worker_workspaces WHERE project = ? ORDER BY created_at ASC, workspace_id ASC`,
+  );
+  const insertHerdrWorkerWorkspace = db.query<unknown, [string, string, number]>(
+    `INSERT OR IGNORE INTO herdr_worker_workspaces (project, workspace_id, created_at) VALUES (?, ?, ?)`,
+  );
+  const deleteHerdrWorkerWorkspace = db.query<unknown, [string, string]>(
+    `DELETE FROM herdr_worker_workspaces WHERE project = ? AND workspace_id = ?`,
+  );
   const upsertDispatch = db.query<unknown, [string, string]>(
     `INSERT INTO dispatch_summaries (project, summary) VALUES (?, ?)
      ON CONFLICT(project) DO UPDATE SET summary = excluded.summary`,
@@ -3012,7 +3118,7 @@ export function openStore(dbPath: string): Store {
   const selectReport = db.query<ReportRow, [string]>(`SELECT * FROM reports WHERE id = ?`);
   const selectReportByDedupe = db.query<ReportRow, [string, string]>(
     `SELECT * FROM reports
-      WHERE project = ? AND dedupeKey = ? AND state <> 'failed'
+      WHERE project = ? AND dedupeKey = ? AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC, rowid DESC LIMIT 1`,
   );
   const selectDueReports = db.query<ReportRow, [string, number, number]>(
@@ -3021,6 +3127,81 @@ export function openStore(dbPath: string): Store {
       ORDER BY createdAt ASC, rowid ASC
       LIMIT ?`,
   );
+  const withdrawPendingReportRow = db.query<
+    unknown,
+    [number, string, string, number, string, string]
+  >(
+    `UPDATE reports
+        SET state = 'withdrawn', withdrawnAt = ?, withdrawnBy = ?,
+            withdrawReason = ?, updatedAt = ?, attemptId = NULL
+      WHERE id = ? AND project = ? AND state = 'pending'`,
+  );
+  const selectReportNoticeIds = db.query<{ id: string }, [string, string]>(
+    `SELECT id FROM held_notices WHERE digestReportId = ? AND project = ?`,
+  );
+  const unassignReportMaterialEvents = db.query<unknown, [string, string]>(
+    `UPDATE material_events SET digestReportId = NULL
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportMaterialEventsPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE material_events
+        SET summary = CASE
+          WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+          ELSE summary
+        END
+      WHERE digestReportId = ? AND project = ?`,
+  );
+  const markReportHeldNoticesPossibleRepeat = db.query<unknown, [string, string, string]>(
+    `UPDATE held_notices
+        SET summary = CASE
+              WHEN summary NOT LIKE 'POSSIBLE REPEAT%' THEN 'POSSIBLE REPEAT of report ' || ? || ': ' || summary
+              ELSE summary
+            END,
+            detail = CASE
+              WHEN detail NOT LIKE 'This handoff may already%' THEN
+                'This handoff may already have reached Telegram before its outcome was lost.\n\n' || detail
+              ELSE detail
+            END
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const unassignReportHeldNotices = db.query<unknown, [string, string]>(
+    `UPDATE held_notices SET digestReportId = NULL, digestedAt = NULL
+      WHERE digestReportId = ? AND project = ? AND withdrawnAt IS NULL`,
+  );
+  const selectHeldNoticeLifecycle = db.query<HeldNoticeLifecycleRow, [string]>(
+    `SELECT id, project, summary, detail, digestedAt, digestReportId, withdrawnAt
+       FROM held_notices WHERE id = ?`,
+  );
+  const withdrawHeldNoticeRow = db.query<
+    unknown,
+    [number, string, string, string, string]
+  >(
+    `UPDATE held_notices
+        SET withdrawnAt = ?, withdrawnBy = ?, withdrawReason = ?
+      WHERE id = ? AND project = ? AND withdrawnAt IS NULL AND (
+        (digestReportId IS NULL AND digestedAt IS NULL)
+        OR EXISTS (
+          SELECT 1 FROM reports
+            WHERE reports.id = held_notices.digestReportId
+              AND reports.state IN ('failed', 'withdrawn')
+        )
+      )`,
+  );
+  const insertHandoffWithdrawal = db.query<
+    unknown,
+    [string, string, string, string, string, number, string, string]
+  >(
+    `INSERT INTO handoff_withdrawals
+       (id, project, target, actor, reason, at, summary, detail)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectHandoffWithdrawal = db.query<HandoffWithdrawalRow, [string]>(
+    `SELECT * FROM handoff_withdrawals WHERE id = ?`,
+  );
+  const selectHandoffWithdrawals = db.query<HandoffWithdrawalRow, [string, number]>(
+    `SELECT * FROM handoff_withdrawals
+      WHERE project = ? ORDER BY at DESC, rowid DESC LIMIT ?`,
+  );
   const deletePendingMaterialReport = db.query<unknown, [string, string]>(
     `DELETE FROM reports
       WHERE id = ? AND project = ? AND kind = 'material' AND state = 'pending'`,
@@ -3051,7 +3232,7 @@ export function openStore(dbPath: string): Store {
                 THEN 'POSSIBLE REPEAT of catch-up ' || ? || ': ' || summary
               ELSE summary
             END
-      WHERE project = ? AND digestReportId = ? AND EXISTS (
+      WHERE project = ? AND digestReportId = ? AND withdrawnAt IS NULL AND EXISTS (
         SELECT 1 FROM reports
           WHERE id = ? AND project = ? AND kind = 'digest' AND state = 'pending'
             AND dedupeKey LIKE 'availability/%'
@@ -3059,12 +3240,13 @@ export function openStore(dbPath: string): Store {
   );
   const selectAvailabilityReservationCandidate = db.query<{ id: string }, [string]>(
     `SELECT held_notices.id FROM held_notices
-      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1 AND (
+      WHERE held_notices.project = ? AND held_notices.releaseOnAvailable = 1
+        AND held_notices.withdrawnAt IS NULL AND (
         (held_notices.digestReportId IS NULL AND held_notices.digestedAt IS NULL)
         OR EXISTS (
           SELECT 1 FROM reports
             WHERE reports.id = held_notices.digestReportId AND (
-              reports.state = 'failed'
+              reports.state IN ('failed', 'withdrawn')
               OR (
                 reports.state = 'pending' AND reports.kind = 'digest'
                 AND reports.dedupeKey LIKE 'availability/%'
@@ -3180,9 +3362,9 @@ export function openStore(dbPath: string): Store {
     releaseOnAvailable: number;
     urgent: number;
   };
-  const undigestedNoticeWhere = `project = ? AND (
+  const undigestedNoticeWhere = `project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`;
   const selectUndigestedNotices = db.query<HeldNoticeRow, [string, number]>(
     `SELECT id, category, summary, detail, createdAt, releaseOnAvailable, urgent FROM held_notices
@@ -3212,16 +3394,16 @@ export function openStore(dbPath: string): Store {
             MIN(CASE WHEN releaseOnAvailable = 0 THEN createdAt END) AS digestOldestAt,
             MIN(CASE WHEN releaseOnAvailable = 1 THEN createdAt END) AS availabilityOldestAt
        FROM held_notices
-      WHERE project = ? AND (
+      WHERE project = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignHeldNoticeToDigest = db.query<unknown, [number, string, string, string]>(
     `UPDATE held_notices SET digestedAt = ?, digestReportId = ?
-      WHERE project = ? AND id = ? AND (
+      WHERE project = ? AND id = ? AND withdrawnAt IS NULL AND (
         (digestReportId IS NULL AND digestedAt IS NULL)
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = held_notices.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertMaterialEvent = db.query<unknown, SqlValue[]>(
@@ -3236,7 +3418,7 @@ export function openStore(dbPath: string): Store {
     `SELECT * FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )
       ORDER BY occurredAt ASC, recordedAt ASC, rowid ASC
       LIMIT ?`,
@@ -3245,14 +3427,14 @@ export function openStore(dbPath: string): Store {
     `SELECT COUNT(*) AS count, MIN(occurredAt) AS oldestAt FROM material_events
       WHERE project = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const assignMaterialEventToDigest = db.query<unknown, [string, string, string]>(
     `UPDATE material_events SET digestReportId = ?
       WHERE project = ? AND id = ? AND (
         digestReportId IS NULL
-        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state = 'failed')
+        OR EXISTS (SELECT 1 FROM reports WHERE reports.id = material_events.digestReportId AND reports.state IN ('failed', 'withdrawn'))
       )`,
   );
   const insertIntake = db.query<unknown, SqlValue[]>(
@@ -3278,7 +3460,7 @@ export function openStore(dbPath: string): Store {
   // today's key under `digestDue` (#229).
   const selectLastDigestKey = db.query<{ key: string | null }, [string]>(
     `SELECT dedupeKey AS key FROM reports
-      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state <> 'failed'
+      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state NOT IN ('failed', 'withdrawn')
       ORDER BY createdAt DESC LIMIT 1`,
   );
   const claimReportRow = db.query<unknown, [string, number, string, number]>(
@@ -3404,6 +3586,109 @@ export function openStore(dbPath: string): Store {
     }
     return enqueued;
   };
+
+  const withdrawHandoffTx = db.transaction(
+    (
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult => {
+      const report = selectReport.get(id);
+      if (report !== null) {
+        if (report.project !== project) return { kind: "not-found" };
+        if (report.state !== "pending") {
+          return { kind: "refused", target: "report", state: report.state };
+        }
+        const noticeIds = selectReportNoticeIds.all(id, project).map((row) => row.id);
+        if (withdrawPendingReportRow.run(at, actor, reason, at, id, project).changes !== 1) {
+          const current = selectReport.get(id);
+          return {
+            kind: "refused",
+            target: "report",
+            state: current?.state ?? "not-found",
+          };
+        }
+        if (report.ambiguous !== 0) {
+          markReportMaterialEventsPossibleRepeat.run(id, id, project);
+          markReportHeldNoticesPossibleRepeat.run(id, id, project);
+        }
+        unassignReportMaterialEvents.run(id, project);
+        unassignReportHeldNotices.run(id, project);
+        for (const noticeId of noticeIds) {
+          deleteAvailabilityReservationForNotice.run(project, noticeId);
+        }
+        const summary = report.body.split("\n", 1)[0]!.slice(0, 240);
+        const withdrawal: HandoffWithdrawal = {
+          id,
+          project,
+          target: "report",
+          actor,
+          reason,
+          at,
+          summary,
+          detail: report.body,
+        };
+        insertHandoffWithdrawal.run(
+          id,
+          project,
+          "report",
+          actor,
+          reason,
+          at,
+          summary,
+          report.body,
+        );
+        return { kind: "withdrawn", withdrawal };
+      }
+
+      const prior = selectHandoffWithdrawal.get(id);
+      if (prior !== null) {
+        return prior.project === project
+          ? { kind: "refused", target: prior.target as HandoffWithdrawal["target"], state: "withdrawn" }
+          : { kind: "not-found" };
+      }
+      const notice = selectHeldNoticeLifecycle.get(id);
+      if (notice === null || notice.project !== project) return { kind: "not-found" };
+      if (notice.withdrawnAt !== null) {
+        return { kind: "refused", target: "notice", state: "withdrawn" };
+      }
+      if (notice.digestReportId !== null) {
+        const owner = selectReport.get(notice.digestReportId);
+        if (owner === null || (owner.state !== "failed" && owner.state !== "withdrawn")) {
+          return { kind: "refused", target: "notice", state: "assigned" };
+        }
+      } else if (notice.digestedAt !== null) {
+        return { kind: "refused", target: "notice", state: "digested" };
+      }
+      if (withdrawHeldNoticeRow.run(at, actor, reason, id, project).changes !== 1) {
+        return { kind: "refused", target: "notice", state: "changed" };
+      }
+      deleteAvailabilityReservationForNotice.run(project, id);
+      const withdrawal: HandoffWithdrawal = {
+        id,
+        project,
+        target: "notice",
+        actor,
+        reason,
+        at,
+        summary: notice.summary,
+        detail: notice.detail,
+      };
+      insertHandoffWithdrawal.run(
+        id,
+        project,
+        "notice",
+        actor,
+        reason,
+        at,
+        notice.summary,
+        notice.detail,
+      );
+      return { kind: "withdrawn", withdrawal };
+    },
+  );
   const enqueueDigestReportTx = db.transaction(enqueueDigestReportRecord);
   const enqueueAvailabilityReportTx = db.transaction(
     (draft: ReportDraft, heldNoticeIds: readonly string[]): ReportEnqueue | undefined => {
@@ -4590,6 +4875,22 @@ export function openStore(dbPath: string): Store {
       bumpOrchestratorIncident.run(by, project);
     },
 
+    /** The workspace ids conductor recorded as its own worker surface for
+     *  this project, oldest first (#1035 review). Durable across daemon AND
+     *  Herdr restarts, which is the point: Herdr restores workspaces without
+     *  their metadata tokens, so discovery needs a second authority. */
+    workerWorkspaceIds(project: string): string[] {
+      return selectHerdrWorkerWorkspaces.all(project).map((row) => row.workspace_id);
+    },
+
+    rememberWorkerWorkspace(project: string, workspaceId: string): void {
+      insertHerdrWorkerWorkspace.run(project, workspaceId, Date.now());
+    },
+
+    forgetWorkerWorkspace(project: string, workspaceId: string): void {
+      deleteHerdrWorkerWorkspace.run(project, workspaceId);
+    },
+
     closeOrchestratorIncident(project: string, _at: number): OrchestratorIncident | undefined {
       const row = deleteOrchestratorIncident.get(project);
       return row === null ? undefined : toOrchestratorIncident(row);
@@ -4870,6 +5171,21 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : toReport(row);
     },
 
+    withdrawHandoff(
+      id: string,
+      project: string,
+      actor: string,
+      reason: string,
+      at: number,
+    ): HandoffWithdrawalResult {
+      return withdrawHandoffTx.immediate(id, project, actor, reason, at);
+    },
+
+    handoffWithdrawals(project: string, limit = 5): HandoffWithdrawal[] {
+      return selectHandoffWithdrawals.all(project, limit).map(toHandoffWithdrawal);
+    },
+
+
     deferPendingReportToNotice(id: string, notice: HeldNoticeDraft): boolean {
       return deferPendingReportToNoticeTx(id, notice);
     },