postgres: a withdrawn consumer keeps its database; retiring renames, never drops (hq issue 241)

modules/postgres/client.ts

@@ -145,14 +145,43 @@ export class PostgresClient {
     }
   }
 
-  /** Drop a database and its owning role, idempotently, after evicting live connections. */
-  async dropDatabaseAndRole(database: string, role: string): Promise<void> {
+  /**
+   * Withdraw a consumer without destroying anything (novox/hq issue 241): its login can no longer log
+   * in and its open connections are ended, and its database stays exactly as it was, under its own
+   * name. A consumer that comes back is given the same database — create sets LOGIN again — which is
+   * what a provider must do when "no longer asked for" turns out to be a moment's misreading.
+   */
+  async lockRole(role: string): Promise<void> {
+    const roles = await this.query("SELECT 1 FROM pg_roles WHERE rolname = " + literal(role));
+    if (roles.rows.length === 0) return;
+    await this.query(`ALTER ROLE ${ident(role)} NOLOGIN`);
+    await this.query(
+      "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE usename = " +
+        literal(role) + " AND pid <> pg_backend_pid()",
+    );
+  }
+
+  /**
+   * Take a database out of service on purpose: rename it aside to `<name>_deleted_<date>` and lock
+   * its owner. Never a drop — the data stays on the server under the new name until a person
+   * removes it by hand. Returns the name it now has.
+   */
+  async retireDatabase(database: string, now: Date = new Date()): Promise<string> {
+    const found = await this.query(
+      "SELECT pg_get_userbyid(datdba) AS owner FROM pg_database WHERE datname = " + literal(database),
+    );
+    if (found.rows.length === 0) throw new Error(`no database named ${database}`);
+    const owner = String((found.rows[0] as Record<string, unknown>).owner ?? "");
+    const aside = retiredName(database, now);
+    const taken = await this.query("SELECT 1 FROM pg_database WHERE datname = " + literal(aside));
+    if (taken.rows.length > 0) throw new Error(`${aside} already exists; retire it by hand first`);
+    if (owner && owner !== "postgres") await this.query(`ALTER ROLE ${ident(owner)} NOLOGIN`);
     await this.query(
       "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = " +
         literal(database) + " AND pid <> pg_backend_pid()",
     );
-    await this.query(`DROP DATABASE IF EXISTS ${ident(database)}`);
-    await this.query(`DROP ROLE IF EXISTS ${ident(role)}`);
+    await this.query(`ALTER DATABASE ${ident(database)} RENAME TO ${ident(aside)}`);
+    return aside;
   }
 
   /** List the non-template databases, with size, for the postgres_list_databases tool. */
@@ -301,3 +330,10 @@ function parseCsv(text: string): string[][] {
   endRecord();
   return records;
 }
+
+/** The name a retired database is renamed to: `<name>_deleted_<yyyymmdd>`, within postgres's 63 bytes. */
+export function retiredName(database: string, now: Date = new Date()): string {
+  const stamp = now.toISOString().slice(0, 10).replace(/-/g, "");
+  const suffix = `_deleted_${stamp}`;
+  return database.slice(0, 63 - suffix.length) + suffix;
+}

modules/postgres/provisioner/index.ts

@@ -41,9 +41,13 @@ runProvisioner("postgres-database", {
     });
   },
 
+  // **Withdrawn, never dropped** (novox/hq issue 241). The login is locked and the database kept
+  // under its own name: on 2026-10-04 a misread contributions file withdrew every consumer at once,
+  // and dropping made that a loss of seven databases. Taking a database out of service is a person's
+  // act — the postgres_retire_database tool — and even that renames rather than drops.
   async remove(p: { as: string }): Promise<void> {
-    await postgres.dropDatabaseAndRole(p.as, p.as);
-    await announce("database.deprovisioned", { database: p.as });
+    await postgres.lockRole(p.as);
+    await announce("database.deprovisioned", { database: p.as, kept: "true" });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).

modules/postgres/test/withdraw.test.ts

@@ -0,0 +1,69 @@
+// A withdrawn consumer keeps its database, and retiring one renames it — nothing here ever drops
+// (novox/hq issue 241). psql is a fake on PATH that records every statement and answers the lookups
+// these acts make; that the server keeps the data is proven against a real server, not here.
+// Run against the compiled module (npm test builds first), the way the runtime loads it.
+
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { PostgresClient, retiredName } from "../dist/client.js";
+
+let dir: string;
+let log: string;
+const originalPath = process.env.PATH;
+
+before(async () => {
+  dir = await mkdtemp(join(tmpdir(), "postgres-withdraw-"));
+  log = join(dir, "calls.jsonl");
+  await writeFile(join(dir, "psql"), `#!/usr/bin/env node
+const fs = require("node:fs");
+const args = process.argv.slice(2);
+const sql = args[args.indexOf("-c") + 1];
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ sql }) + "\\n");
+if (/FROM pg_roles/.test(sql)) process.stdout.write("?column?\\n1\\n");
+else if (/pg_get_userbyid/.test(sql)) process.stdout.write("owner\\nmesh_anchor_mail\\n");
+else if (/FROM pg_database WHERE datname = '.*_deleted_/.test(sql)) process.stdout.write("?column?\\n");
+else process.stdout.write("");
+`);
+  await chmod(join(dir, "psql"), 0o755);
+  process.env.PATH = `${dir}:${originalPath}`;
+});
+
+after(async () => {
+  process.env.PATH = originalPath;
+  await rm(dir, { recursive: true, force: true });
+});
+
+const statements = async (): Promise<string[]> =>
+  (await readFile(log, "utf8")).trim().split("\n").map((l) => (JSON.parse(l) as { sql: string }).sql);
+
+const client = (): PostgresClient =>
+  new PostgresClient({ host: "127.0.0.1", port: 5432, user: "postgres", password: "admin-secret" });
+
+test("withdrawing a consumer locks its login and keeps its database", async () => {
+  await writeFile(log, "");
+  await client().lockRole("mesh_anchor_mail");
+  const sql = await statements();
+  assert.ok(sql.some((s) => /ALTER ROLE "mesh_anchor_mail" NOLOGIN/.test(s)), sql.join("\n"));
+  assert.ok(!sql.some((s) => /\bDROP\b/i.test(s)), `a withdrawal dropped something:\n${sql.join("\n")}`);
+});
+
+test("retiring a database renames it aside and locks its owner, and drops nothing", async () => {
+  await writeFile(log, "");
+  const now = new Date("2026-10-05T09:00:00Z");
+  const aside = await client().retireDatabase("mesh_anchor_mail", now);
+  assert.equal(aside, "mesh_anchor_mail_deleted_20261005");
+  const sql = await statements();
+  assert.ok(sql.some((s) => /ALTER DATABASE "mesh_anchor_mail" RENAME TO "mesh_anchor_mail_deleted_20261005"/.test(s)), sql.join("\n"));
+  assert.ok(sql.some((s) => /ALTER ROLE "mesh_anchor_mail" NOLOGIN/.test(s)));
+  assert.ok(!sql.some((s) => /\bDROP\b/i.test(s)), `retiring dropped something:\n${sql.join("\n")}`);
+});
+
+test("a retired name fits postgres's 63 bytes", () => {
+  const long = "x".repeat(70);
+  const name = retiredName(long, new Date("2026-10-05T00:00:00Z"));
+  assert.ok(name.length <= 63 && name.endsWith("_deleted_20261005"), name);
+});

modules/postgres/tools/index.ts

@@ -30,6 +30,23 @@ export function getPostgresTools(postgres: PostgresClient): ToolDefinition[] {
         return { database, command: result.command, rows: result.rows };
       },
     },
+    {
+      name: "postgres_retire_database",
+      description:
+        "Take one database out of service on purpose: rename it to <name>_deleted_<date> and lock its owner's login. Nothing is dropped — the data stays on the server under the new name until a person removes it by hand. Repeat the database's name in confirm.",
+      input: {
+        database: { type: "string", description: "the database to retire" },
+        confirm: { type: "string", description: "the same name again, to say this is meant" },
+      },
+      run: async (args) => {
+        const database = String(args.database ?? "");
+        if (!database) throw new Error("postgres_retire_database: database is required");
+        if (String(args.confirm ?? "") !== database) {
+          throw new Error("postgres_retire_database: confirm must repeat the database's name");
+        }
+        return { database, renamedTo: await postgres.retireDatabase(database), dropped: false };
+      },
+    },
   ];
 }