fix(plg): preserve V2 re-detected OUTDATED suggestion grants

V2 re-detected OUTDATED rows (previousDeployment stamp present in
recommendations[0]) represent actionable work — PLG customers must
be able to re-deploy them. The grant revocation predicate previously
treated all OUTDATED as stale, revoking the token grant and causing
a 403 on re-deploy.

Only revoke OUTDATED grants that lack the previousDeployment stamp
(V1 legacy windowing rows), which are genuinely stale book-keeping.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: FentPams

src/support/grant-suggestions-handler.js

@@ -217,8 +217,19 @@ const STALE_STATUSES = new Set([
   SuggestionModel.STATUSES.PENDING_VALIDATION,
 ]);
 
-const isRevocable = (status) => STALE_STATUSES.has(status)
-  || status === SuggestionModel.STATUSES.NEW;
+// V2 re-detected OUTDATED rows have a previousDeployment stamp and represent
+// actionable work — their grants must stay live so PLG customers can re-deploy.
+// V1 legacy OUTDATED rows (no stamp) are stale book-keeping and should be revoked.
+const isRevocable = (suggestion) => {
+  const status = suggestion.getStatus();
+  if (status === SuggestionModel.STATUSES.OUTDATED) {
+    const recs = suggestion.getData?.()?.recommendations;
+    const isV2Redetected = Array.isArray(recs) && recs.length > 0
+      && Boolean(recs[0]?.previousDeployment);
+    return !isV2Redetected;
+  }
+  return STALE_STATUSES.has(status) || status === SuggestionModel.STATUSES.NEW;
+};
 
 /**
  * Handles a new token cycle: creates the token and migrates
@@ -290,7 +301,7 @@ async function handleExistingTokenCycle(
     tokenGrants
       .filter((g) => {
         const s = grantedSuggestions.find((gs) => gs?.getId() === g.getSuggestionId());
-        return s && isRevocable(s.getStatus());
+        return s && isRevocable(s);
       })
       .map((g) => g.getGrantId()),
   )];
@@ -328,9 +339,10 @@ async function fillRemainingCapacity(
  *
  * **When a token already exists (current cycle):**
  * Fetches all grants for the current token. If any granted
- * suggestion is in a revocable state (OUTDATED, REJECTED,
+ * suggestion is in a revocable state (V1 OUTDATED, REJECTED,
  * PENDING_VALIDATION, NEW), revokes only those grants, leaving
- * permanent states (e.g. APPROVED) untouched. Fills remaining
+ * permanent states (e.g. APPROVED) and V2 re-detected OUTDATED
+ * (with previousDeployment stamp) untouched. Fills remaining
  * capacity from NEW ungranted suggestions.
  *
  * **When no token exists (new cycle):**

test/support/grant-suggestions-handler.test.js

@@ -721,6 +721,112 @@ describe('grant-suggestions-handler', () => {
         expect(SuggestionGrant.grantSuggestions).to.have.been.calledOnce;
       });
 
+      it('does not revoke V2 re-detected OUTDATED grant (has previousDeployment stamp)', async () => {
+        const s1 = {
+          getId: () => 'sugg-1', getRank: () => 1, getStatus: () => 'NEW',
+        };
+
+        const existingToken = { getId: () => 'tok-1', getRemaining: () => 1 };
+
+        // V2 re-detected OUTDATED: has previousDeployment stamp in data
+        const sugg2V2Outdated = {
+          getId: () => 'sugg-2',
+          getRank: () => 2,
+          getStatus: () => 'OUTDATED',
+          getData: () => ({
+            recommendations: [{ previousDeployment: { altText: 'old text', deployedAt: '2026-05-01' } }],
+          }),
+        };
+
+        const Suggestion = {
+          allByOpportunityIdAndStatus: sandbox.stub().resolves([s1]),
+          batchGetByKeys: sandbox.stub().resolves({
+            data: [sugg2V2Outdated],
+            unprocessed: [],
+          }),
+        };
+
+        const SuggestionGrant = {
+          splitSuggestionsByGrantStatus: sandbox.stub().resolves({
+            grantedIds: [],
+            grantIds: [],
+            notGrantedIds: ['sugg-1'],
+          }),
+          allByIndexKeys: sandbox.stub().resolves([
+            mkGrant('sugg-2', 'g2'),
+          ]),
+          grantSuggestions: sandbox.stub().resolves({ success: true }),
+          revokeSuggestionGrant: sandbox.stub(),
+        };
+
+        const Token = {
+          findBySiteIdAndTokenType: sandbox.stub().resolves(existingToken),
+        };
+
+        const dataAccess = { Suggestion, SuggestionGrant, Token };
+
+        await grantSuggestionsForOpportunity(dataAccess, site, opportunity);
+
+        // V2 OUTDATED grant must NOT be revoked — it's actionable work for PLG re-deploy
+        expect(SuggestionGrant.revokeSuggestionGrant).to.not.have.been.called;
+        // Token had remaining=1, fill with the ungranted NEW suggestion
+        expect(SuggestionGrant.grantSuggestions).to.have.been.calledOnce;
+      });
+
+      it('revokes V1 legacy OUTDATED grant (no previousDeployment stamp)', async () => {
+        const s1 = {
+          getId: () => 'sugg-1', getRank: () => 1, getStatus: () => 'NEW',
+        };
+
+        const existingToken = { getId: () => 'tok-1', getRemaining: () => 0 };
+        const tokenAfterRevoke = { getId: () => 'tok-1', getRemaining: () => 1 };
+
+        // V1 legacy OUTDATED: getData returns no previousDeployment stamp
+        const sugg2V1Outdated = {
+          getId: () => 'sugg-2',
+          getRank: () => 2,
+          getStatus: () => 'OUTDATED',
+          getData: () => ({ recommendations: [{ altText: 'some text' }] }),
+        };
+
+        const Suggestion = {
+          allByOpportunityIdAndStatus: sandbox.stub().resolves([s1]),
+          batchGetByKeys: sandbox.stub().resolves({
+            data: [sugg2V1Outdated],
+            unprocessed: [],
+          }),
+        };
+
+        const SuggestionGrant = {
+          splitSuggestionsByGrantStatus: sandbox.stub().resolves({
+            grantedIds: [],
+            grantIds: [],
+            notGrantedIds: ['sugg-1'],
+          }),
+          allByIndexKeys: sandbox.stub().resolves([
+            mkGrant('sugg-2', 'g2'),
+          ]),
+          grantSuggestions: sandbox.stub().resolves({ success: true }),
+          revokeSuggestionGrant: sandbox.stub().resolves({ success: true }),
+        };
+
+        const Token = {
+          findBySiteIdAndTokenType: sandbox.stub(),
+        };
+        Token.findBySiteIdAndTokenType
+          .onFirstCall().resolves(existingToken)
+          .onSecondCall().resolves(tokenAfterRevoke);
+
+        const dataAccess = { Suggestion, SuggestionGrant, Token };
+
+        await grantSuggestionsForOpportunity(dataAccess, site, opportunity);
+
+        // V1 OUTDATED grant must be revoked (stale, no re-detection stamp)
+        expect(SuggestionGrant.revokeSuggestionGrant).to.have.been.calledOnce;
+        expect(SuggestionGrant.revokeSuggestionGrant).to.have.been.calledWith('g2');
+        expect(SuggestionGrant.grantSuggestions).to.have.been.calledOnce;
+      });
+
       it('revokes grants with PENDING_VALIDATION status as stale', async () => {
         const s1 = {
           getId: () => 'sugg-1', getRank: () => 1, getStatus: () => 'NEW',