Failure action slots, resolve transition, and the bell that renders them (Review Flow PR 5a) (#7761)

Review Flow PR 5a — the first half of #7479, which stays open for
reference until both halves land. This PR is the ranking and the
bookkeeping; #7762 adds the retry handlers. Merging both reproduces
#7479's diff byte-for-byte.

## What's added

**The action slot model (backend).** `FailureActionSlot` ranks each of a
kind's offers as its `RESOLUTION`, `SECONDARY` or `OVERFLOW`.
`FailureKind` now declares placement per offer — the password-protected
kind names `DECRYPT_AND_RETRY` as its resolution, `UNKNOWN` leads with a
plain `RETRY` — and `FailureActionId` gains those two ids. The
declarations are data; their client handlers arrive in the follow-up, so
this build withholds them with a reason rather than rendering unwired
buttons (the same forward-compatibility #7478 relied on).

**A resolve transition.** `POST /api/v1/notifications/{id}/resolved`
lets a client report a failure fixed. `NotificationSource.parse` turns a
qualified notification id back into the source that owns it, and
`FileRunEventService` folds the resolution into the incident rather than
deleting it.

**`viewerReviewsTeam` on the list response.** A member sees only rows
whose document this browser holds — they can neither open nor fix
anything else — while a team reviewer keeps every row.

**The bell renders the ranking** (`promoteActions`): one primary button,
at most one secondary, the rest in an overflow menu beside **Copy log**.
The row's body is the kind's own sentence; the raw failure message moves
into the menu.

**Read state is a timestamp, not a row id.** `readThroughAt` replaces
`lastSeenId`: when a resolved or dismissed row leaves the list, the rows
below it stay read instead of re-lighting the badge.

## How to test

Needs a proprietary or SaaS build with login enabled (`task dev:all`,
sign in).

1. **Create a failure.** Add a password-protected PDF to the editor and
choose **Skip for now**; the upload's policy run fails on it.
2. **Open the bell.** The row reads the kind's sentence, not a stack
trace. Its primary button is **View file** — the server offers Decrypt
and retry as the resolution, but this build withholds it (handler lands
in the follow-up), so the best renderable offer is promoted instead.
3. **Open the row's ⋯ menu.** View in processor and Dismiss sit there,
along with **Copy log**, which copies the raw message.
4. **Check the read marker survives a departure.** With two failures,
open the bell (badge clears), dismiss the newer row, and refresh: the
badge stays dark. On main, the marker held the departed row's id and the
older row re-read as unread.
5. **Member visibility.** As a plain member, a failure recorded from
another browser does not appear in the bell; as a team reviewer it does.
6. **Resolve endpoint.** `POST
/api/v1/notifications/failure-{eventId}/resolved` as the owner removes
the row on the next poll; `NotificationResolveTest` pins refusal for a
non-owner, an unknown id, and a foreign prefix.

## Migration

None.

Author: EthanHealy01

app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureActionId.java

@@ -18,6 +18,19 @@ public enum FailureActionId {
 
     DISMISS(Execution.SERVER, "Dismiss"),
 
+    /**
+     * Open the failed operation in the client with its document, for the owner to run again
+     * themselves. Not a re-run: the settings are theirs to check first.
+     */
+    OPEN_IN_TOOL(Execution.CLIENT, "Retry"),
+
+    /**
+     * Ask the owner for the password and unlock the document in their client. Re-running is implied
+     * rather than named: an id says what a caller must supply, and a {@link
+     * FailureActionSlot#RESOLUTION} runs the failed work again once it has it.
+     */
+    DECRYPT(Execution.CLIENT, "Decrypt and retry"),
+
     /** Open the document behind the incident, in whichever client can resolve its id. */
     VIEW_FILE(Execution.CLIENT, "View file"),
 

app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureActionSlot.java

@@ -0,0 +1,14 @@
+package stirling.software.proprietary.failure;
+
+/** Placement intent, not layout: the client promotes, knowing what it can actually run. */
+public enum FailureActionSlot {
+
+    /** The action that resolves the failure. At most one per kind. */
+    RESOLUTION,
+
+    /** Offered alongside the resolution, for a caller the resolution is not aimed at. */
+    SECONDARY,
+
+    /** Available but folded away: correct, rarely what anyone wants to press next. */
+    OVERFLOW
+}

app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureKind.java

@@ -1,8 +1,12 @@
 package stirling.software.proprietary.failure;
 
+import static stirling.software.proprietary.failure.FailureActionId.DECRYPT;
 import static stirling.software.proprietary.failure.FailureActionId.DISMISS;
+import static stirling.software.proprietary.failure.FailureActionId.OPEN_IN_TOOL;
 import static stirling.software.proprietary.failure.FailureActionId.VIEW_FILE;
 import static stirling.software.proprietary.failure.FailureActionId.VIEW_IN_PROCESSOR;
+import static stirling.software.proprietary.failure.FailureActionSlot.OVERFLOW;
+import static stirling.software.proprietary.failure.FailureActionSlot.SECONDARY;
 import static stirling.software.proprietary.failure.FailureAudience.ANYONE_WHO_SEES;
 import static stirling.software.proprietary.failure.FailureAudience.OWNER;
 import static stirling.software.proprietary.failure.FailureAudience.TEAM_REVIEWER;
@@ -21,11 +25,8 @@
 import lombok.Getter;
 
 /**
- * The registry of failure kinds, described as data: a stable id, i18n keys and an English fallback
- * like {@code ExceptionUtils.ErrorCode}, plus the facets a review surface needs.
- *
- * <p>A new kind ships as a registry entry plus copy. Each offer also says who it is for, since one
- * incident is read both by whoever hit it and by whoever reviews after them.
+ * The registry of failure kinds as data: id, i18n keys, English fallback, plus the facets a review
+ * surface needs. A new kind ships as an entry plus copy; each offer says who it is for and where.
  */
 @Getter
 public enum FailureKind {
@@ -36,9 +37,12 @@ public enum FailureKind {
             FailureScope.FILE,
             errorCodes("E004"),
             fallback("This document is password-protected, so the pipeline could not read it."),
-            offer(VIEW_FILE, OWNER),
-            offer(VIEW_IN_PROCESSOR, TEAM_REVIEWER),
-            offer(DISMISS, ANYONE_WHO_SEES)),
+            // The password is the fix; the owner's own document is the runner-up.
+            resolution(DECRYPT, OWNER),
+            global(VIEW_FILE, OWNER, SECONDARY),
+            global(VIEW_IN_PROCESSOR, TEAM_REVIEWER, OVERFLOW),
+            global(OPEN_IN_TOOL, OWNER, OVERFLOW),
+            global(DISMISS, ANYONE_WHO_SEES, OVERFLOW)),
 
     UNKNOWN(
             FailureStage.INTERNAL,
@@ -47,11 +51,11 @@ public enum FailureKind {
             FailureScope.RUN,
             noErrorCodes(),
             fallback("This run failed for a reason Stirling does not yet recognise."),
-            // Same order as every other kind: declaration order is display order, so the document
-            // leads wherever it is offered rather than moving between failures.
-            offer(VIEW_FILE, OWNER),
-            offer(VIEW_IN_PROCESSOR, TEAM_REVIEWER),
-            offer(DISMISS, ANYONE_WHO_SEES));
+            // No known fix to declare, so a plain retry leads: these are often one-offs.
+            global(OPEN_IN_TOOL, OWNER, SECONDARY),
+            global(VIEW_FILE, OWNER, SECONDARY),
+            global(VIEW_IN_PROCESSOR, TEAM_REVIEWER, OVERFLOW),
+            global(DISMISS, ANYONE_WHO_SEES, OVERFLOW));
 
     private static final String KEY_PREFIX = "portal.failures.kind.";
     private static final String ACTION_KEY_PREFIX = "portal.failures.action.";
@@ -98,27 +102,37 @@ public enum FailureKind {
         this.offers = List.of(offers);
     }
 
-    /**
-     * One ordered list rather than ids plus parallel maps of audiences and labels, which could
-     * disagree with each other.
-     *
-     * @param labelKeySuffix key under {@code portal.failures.action.}, or null for the generic
-     *     label
-     */
-    private record Offer(FailureActionId id, FailureAudience audience, String labelKeySuffix) {}
+    /** One ordered list, not parallel maps of audiences, slots and labels that could disagree. */
+    private record Offer(
+            FailureActionId id,
+            FailureAudience audience,
+            FailureActionSlot slot,
+            String labelKeySuffix) {}
 
-    /** Declaration order is display order. */
-    private static Offer offer(FailureActionId id, FailureAudience audience) {
-        return new Offer(id, audience, null);
+    /** The action that fixes this kind. One per kind: needing two would make it two kinds. */
+    private static Offer resolution(FailureActionId id, FailureAudience audience) {
+        return new Offer(id, audience, FailureActionSlot.RESOLUTION, null);
     }
 
-    /**
-     * As {@link #offer(FailureActionId, FailureAudience)}, but labelled by this kind's own wording
-     * where the shared one reads badly.
-     */
-    private static Offer offer(
+    /** As {@link #resolution(FailureActionId, FailureAudience)}, with this kind's own wording. */
+    private static Offer resolution(
             FailureActionId id, FailureAudience audience, String labelKeySuffix) {
-        return new Offer(id, audience, labelKeySuffix);
+        return new Offer(id, audience, FailureActionSlot.RESOLUTION, labelKeySuffix);
+    }
+
+    /** Not this kind's fix: an offer any kind can make, with the shared wording. */
+    private static Offer global(
+            FailureActionId id, FailureAudience audience, FailureActionSlot slot) {
+        return new Offer(id, audience, slot, null);
+    }
+
+    /** As above, with this kind's own wording where the shared one reads badly. */
+    private static Offer global(
+            FailureActionId id,
+            FailureAudience audience,
+            FailureActionSlot slot,
+            String labelKeySuffix) {
+        return new Offer(id, audience, slot, labelKeySuffix);
     }
 
     /**
@@ -157,21 +171,25 @@ public List<FailureActionId> getActions() {
         return offers.stream().map(Offer::id).toList();
     }
 
-    /**
-     * What this kind offers, in declaration order, each with its label resolved. What a review
-     * surface reads, so it never has to ask two separate questions about one offer.
-     */
+    /** What this kind offers, in declaration order, each with label and placement resolved. */
     public List<OfferedAction> getOfferedActions() {
         return offers.stream()
                 .map(
                         offer ->
                                 new OfferedAction(
-                                        offer.id(), labelKeyFor(offer.id()), offer.audience()))
+                                        offer.id(),
+                                        labelKeyFor(offer.id()),
+                                        offer.audience(),
+                                        offer.slot()))
                 .toList();
     }
 
-    /** One action as a kind declares it: what to call it and who it is for. */
-    public record OfferedAction(FailureActionId id, String labelKey, FailureAudience audience) {}
+    /** One action as a kind declares it: what to call it, who it is for, where it wants to sit. */
+    public record OfferedAction(
+            FailureActionId id,
+            String labelKey,
+            FailureAudience audience,
+            FailureActionSlot slot) {}
 
     /** Whether this kind offers {@code action}. The dispatch guard: see {@code FailureActionId}. */
     public boolean declares(FailureActionId action) {

app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventRepository.java

@@ -64,16 +64,17 @@ List<FileRunEventEntity> findByTeamAndStatus(
     int fold(@Param("id") String id, @Param("now") Instant now, @Param("detail") String detail);
 
     /**
-     * Reopen a resolved incident whose failure has recurred. Guarded on the current status so only
-     * {@code RESOLVED} flips; a concurrent dismiss is never overwritten back to {@code NEW}.
+     * A recurrence reopens {@code RESOLVED} (the fix did not hold) and {@code FILE_REMOVED} (the
+     * document is back). Guarded, so a reviewer's {@code DISMISSED} is never overwritten.
      */
     @Modifying(clearAutomatically = true)
     @Transactional
     @Query(
             "update FileRunEventEntity e set"
                     + " e.status = stirling.software.proprietary.failure.FileRunEventStatus.NEW,"
-                    + " e.statusActor = null, e.statusAt = null where e.id = :id and e.status ="
-                    + " stirling.software.proprietary.failure.FileRunEventStatus.RESOLVED")
+                    + " e.statusActor = null, e.statusAt = null where e.id = :id and e.status in"
+                    + " (stirling.software.proprietary.failure.FileRunEventStatus.RESOLVED,"
+                    + " stirling.software.proprietary.failure.FileRunEventStatus.FILE_REMOVED)")
     int reopenIfResolved(@Param("id") String id);
 
     /**

app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventService.java

@@ -1,5 +1,9 @@
 package stirling.software.proprietary.failure;
 
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
 import java.util.List;
 import java.util.Map;
 
@@ -171,6 +175,18 @@ public FileRunEvent dispatch(String eventId, String actionId, Map<String, String
         return action.execute(event, inputs == null ? Map.of() : inputs, currentActor());
     }
 
+    /** Mark an incident resolved after a client's own retry worked. Idempotent. */
+    public FileRunEvent resolve(String eventId) {
+        FileRunEvent event = requireVisible(eventId);
+        // No terminal pre-check: the store's guarded UPDATE decides, rather than racing a read.
+        return store.applyStatusOnce(
+                event.id(),
+                event.teamId(),
+                FileRunEventStatus.RESOLVED,
+                currentActor(),
+                FileRunEventStatus.open());
+    }
+
     /** "No such event" rather than a refusal, so trying does not confirm a colleague's exists. */
     private FileRunEvent requireVisible(String eventId) {
         ReadScope scope = readScope();
@@ -222,7 +238,8 @@ private static AvailableAction availability(
             boolean unattended,
             boolean documentless) {
         String reason = disabledReasonFor(offer.audience(), closed, unattended, documentless);
-        return new AvailableAction(offer.id(), offer.labelKey(), reason == null, reason);
+        return new AvailableAction(
+                offer.id(), offer.labelKey(), offer.slot(), reason == null, reason);
     }
 
     /** Closed wins over everything, then the owner-only reasons, most specific first. */
@@ -251,11 +268,38 @@ private static boolean offeredTo(
         };
     }
 
-    /** Login disabled has no roles, so its one operator triages everything. */
-    private boolean reviewsTeam() {
+    /** Whether the caller triages the team's incidents, not only their own. Login disabled: all. */
+    public boolean reviewsTeam() {
         return !enforced() || policyManagementAuthority.canEditPolicies();
     }
 
+    /**
+     * An opaque, stable discriminator for the calling viewer, for a client scoping per-browser read
+     * state. Hashed rather than the username itself: a client only needs to tell one viewer from
+     * another, and the value ends up in that browser's own storage.
+     *
+     * <p>{@code "anonymous"} with login disabled, where the one operator is every viewer.
+     */
+    public String viewerKey() {
+        String actor = currentActor();
+        return actor == null || actor.isBlank() ? "anonymous" : sha256Prefix(actor);
+    }
+
+    /** First 8 bytes of SHA-256 as hex: stable, one-way, and collision-safe enough to key on. */
+    private static String sha256Prefix(String value) {
+        try {
+            byte[] digest =
+                    MessageDigest.getInstance("SHA-256")
+                            .digest(value.getBytes(StandardCharsets.UTF_8));
+            return HexFormat.of().formatHex(digest, 0, 8);
+        } catch (NoSuchAlgorithmException e) {
+            // Every JVM ships SHA-256; a constant here would silently merge two viewers' read
+            // state, so the caller gets no key and the client falls back to showing everything.
+            log.warn("SHA-256 unavailable, so notifications cannot be scoped to a viewer", e);
+            return "";
+        }
+    }
+
     private FailureActionId parseActionId(String actionId) {
         for (FailureActionId candidate : FailureActionId.values()) {
             if (candidate.name().equals(actionId)) {
@@ -326,6 +370,11 @@ private boolean enforced() {
         return applicationProperties.getSecurity().isEnableLogin();
     }
 
+    /** One action offered to one caller, availability resolved. */
     public record AvailableAction(
-            FailureActionId id, String labelKey, boolean enabled, String disabledReasonKey) {}
+            FailureActionId id,
+            String labelKey,
+            FailureActionSlot slot,
+            boolean enabled,
+            String disabledReasonKey) {}
 }

app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStatus.java

@@ -3,20 +3,16 @@
 import java.util.Arrays;
 import java.util.List;
 
-/**
- * Disposition of one recorded failure. {@code RESOLVED} is declared but not set yet (it becomes
- * system-set later); the rollup already defines what a repeat means for it, which is to reopen.
- */
+/** Disposition of one recorded failure. {@code RESOLVED} is system-set; a repeat reopens it. */
 public enum FileRunEventStatus {
     NEW(false),
     ACKNOWLEDGED(false),
     DISMISSED(true),
     RESOLVED(true),
 
     /**
-     * The document this incident was about was deleted from its owner's editor, so there is nothing
-     * left to act on. Distinct from {@code DISMISSED}, which is a reviewer's decision, and from
-     * {@code RESOLVED}, which reopens on recurrence: this one cannot recur, the file is gone.
+     * The document was deleted, so there is nothing left to act on. A recurrence reopens it like
+     * {@code RESOLVED}: a fresh failure is proof the document is back.
      */
     FILE_REMOVED(true);
 

app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventView.java

@@ -61,14 +61,15 @@ public static FileRunEventView of(
     }
 
     /**
-     * {@code defaultLabel} and {@code execution} let a client render and route an action it was
-     * never built with. Declaration order is display order.
+     * {@code defaultLabel} and {@code execution} let a client render an action it was never built
+     * with; {@code slot} is placement intent. See {@link FailureActionSlot}.
      */
     public record ActionView(
             String id,
             String labelKey,
             String defaultLabel,
             FailureActionId.Execution execution,
+            FailureActionSlot slot,
             boolean enabled,
             String disabledReasonKey) {
 
@@ -78,6 +79,7 @@ public static ActionView of(FileRunEventService.AvailableAction action) {
                     action.labelKey(),
                     action.id().getDefaultLabel(),
                     action.id().getExecution(),
+                    action.slot(),
                     action.enabled(),
                     action.disabledReasonKey());
         }