G-catalog-B 7: a transfer dropped by hand is recorded through mesh-hand-acts first

registry_incoming, npm_incoming and go_incoming dropped a transfer by hand with only a log line. Each
drop now records its hand act through the seat mesh-hand-acts before anything goes, as nats_requests
does; an act not recorded leaves the transfer open. distribution's manifest invokes the seat.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/internal/holder/transfer.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/handacts"
 	"git.novox.be/novox/mesh-sdk/go/parts"
 )
 
@@ -164,6 +165,9 @@ type Holder struct {
 	Now       func() time.Time
 	// Cap reads incoming's cap from its binding (parts.BusCap); IncomingCap when nil or when the binding names none.
 	Cap func() (uint64, error)
+	// Record records a hand act through the seat mesh-hand-acts (handacts.Recorder); a drop by hand is refused
+	// without it.
+	Record func(handacts.Request) error
 	// Idle writes a transfer's idle key with its own time to live, once (parts.BusArm over IdleState); the receiver
 	// arms it on each open that leaves a transfer open. Nil arms nothing.
 	Idle func(id string, ttl time.Duration) error
@@ -288,6 +292,29 @@ func (h *Holder) eventOf(seat string, r PublishRequest, ref, reason string) Even
 // Drop drops a transfer by hand (registry_incoming) or because it was idle for TransferIdle: its chunks and its key.
 func (h *Holder) Drop(id string) (Transfer, error) { return h.receiver().Drop(id) }
 
+// DropByHand is registry_incoming's drop: by a person, with why, recorded as a hand act through mesh-hand-acts before
+// anything goes; an act not recorded leaves the transfer open.
+func (h *Holder) DropByHand(id, by, why string) (Transfer, error) {
+	if strings.TrimSpace(why) == "" {
+		return Transfer{}, errors.New("a drop is a hand act: say why")
+	}
+	if h.Record == nil {
+		return Transfer{}, errors.New("no hand act can be recorded here, so nothing is dropped")
+	}
+	t, found, err := h.Transfers.Get(id)
+	if err != nil {
+		return Transfer{}, fmt.Errorf("transfer %s cannot be read, so nothing is dropped: %w", id, err)
+	}
+	if !found {
+		return Transfer{}, fmt.Errorf("transfer %s is not open", id)
+	}
+	what := fmt.Sprintf("dropped the open transfer %s of incoming (%s@%s on %s, opened by %s, %d parts lacked), by %s", id, t.Shape.Name, t.Shape.Version, t.Shape.Seat, t.Opener, len(t.Lacks()), by)
+	if err := h.Record(handacts.Request{What: what, Why: why, Cause: "registry_incoming"}); err != nil {
+		return Transfer{}, fmt.Errorf("the hand act cannot be recorded, so transfer %s stays open: %w", id, err)
+	}
+	return h.Drop(id)
+}
+
 // DropIdle drops every transfer with no part for TransferIdle, answering them: registry_incoming's look, by hand. The
 // drop itself follows each transfer's idle key (Expired); the objects template keeps for good, so nothing else does.
 func (h *Holder) DropIdle() ([]string, error) { return h.receiver().DropIdle() }