R-1182: a finished off-site abandonment closes on the hub's abandon_purge_done (hub v0.163.0 keeps other copies' packages); unreleased

controller/internal/report/escrow_confirm.go

@@ -36,6 +36,11 @@ type EscrowStatus struct {
 	// package" and simply keeps today's message: an older hub cannot make the screen say anything new.
 	SupersededPresent bool   `json:"superseded_present"`
 	SupersededAt      string `json:"superseded_at"`
+	// AbandonPurgeDone (R-1182, hub v0.163.0) — the hub answers THIS box's abandonment declaration: the packages that
+	// open the deleted set-aside copy are gone. The hub now keeps the packages of OTHER stored copies, so
+	// SupersededPresent can stay true for good after a finished abandonment; this field is what closes the
+	// declaration then. Absent on an older hub → false → the old rule (SupersededPresent=false) still closes it.
+	AbandonPurgeDone bool `json:"abandon_purge_done"`
 }
 
 // EscrowAutoConfirmer runs the auto-confirm check on each report ACK. Long-lived (one per process) so
@@ -70,6 +75,10 @@ type EscrowAutoConfirmer struct {
 	// immediately, so the one fact that distinguishes a REBUILT box from a box that never had
 	// off-site backups was thrown away on every cycle. nil → not recorded (older wiring, tests).
 	RecordPresence func(present bool) error
+	// AbandonPurgeDone is called when the ACK says the hub finished THIS box's abandonment purge (R-1182) — the box
+	// closes its declaration. Wired at the same point as RecordPresence, for the reason given there. nil → the
+	// declaration closes only on SupersededPresent=false (the pre-R-1182 rule).
+	AbandonPurgeDone func()
 	// RecordSuperseded persists the ACK's `superseded_present` / `superseded_at` (v0.201.0, R-222) —
 	// whether the hub is ALSO keeping an EARLIER sealed package for this box. Wired here for the same
 	// reason as RecordPresence: this is the one place the ACK's escrow object already arrives, and a
@@ -157,6 +166,10 @@ func (c *EscrowAutoConfirmer) Reconcile(es *EscrowStatus) {
 			c.logf("[WARN] [escrow-confirm] could not record the hub's superseded-package state (present=%v): %v", es.SupersededPresent, err)
 		}
 	}
+	// R-1182: the hub confirmed this box's abandonment purge. Same place and discipline as the two recorders above.
+	if es.AbandonPurgeDone && c.AbandonPurgeDone != nil {
+		c.AbandonPurgeDone()
+	}
 	// R-241: persist the hash the hub's package covers, with the moment we heard it. Same discipline,
 	// same place, same reason as the two above — and this one is the fact the recovery screen has been
 	// unable to see. A record failure is logged, never swallowed, and never blocks the auto-confirm.