@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.24

package/dist/platform/route-schemas.js

@@ -2,6 +2,7 @@ import { ADMIN_ROUTES } from "../admin/admin.schemas.js";
 import { ADMIN_ITEM_ROUTES } from "../admin/admin-items.schemas.js";
 import { AUDIT_ROUTES } from "../admin/audit.schemas.js";
 import { ADMIN_EXTENSION_ROUTES } from "../admin/extensions.schemas.js";
+import { OUTBOX_DEAD_ROUTES } from "../admin/outbox-dead.schemas.js";
 import { OVERVIEW_ROUTES } from "../admin/overview.schemas.js";
 import { AGENT_ROUTES } from "../agents/agents.schemas.js";
 import { AGENT_TEMPLATE_ROUTES } from "../agents/templates.schemas.js";
@@ -85,4 +86,6 @@ export const ROUTE_SCHEMAS = [
     // the admin overview and the platform-level audit log (admin overview spec §5.2)
     ...OVERVIEW_ROUTES,
     ...AUDIT_ROUTES,
+    // dead outbox rows (transactional outbox spec §3.4)
+    ...OUTBOX_DEAD_ROUTES,
 ];

package/dist/roles/worker.module.js

@@ -25,16 +25,18 @@ import { EvalWorkersModule } from "../evals/evals.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { PluginsReconcileJob } from "../extensions/lifecycle.js";
 import { InitialPasswordCleanupJob } from "../identity/initial-passwords.job.js";
+import { OutboxRelayModule } from "../infra/outbox/outbox-relay.module.js";
 import { KernelScheduleModule } from "../infra/schedule/schedule.module.js";
 import { DirectoryScanJob } from "../orgs/directory-sync.js";
 import { OffboardSweepJob } from "../orgs/offboarding.js";
 import { OrgLockModule } from "../orgs/org-lock.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { MaintenanceModule } from "../runtime/maintenance.js";
+import { RunJobsModule } from "../runtime/run-jobs.js";
+import { RunOrphanCheck } from "../runtime/run-orphan-check.job.js";
 import { RuntimeWorkersModule } from "../runtime/run-processors.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
-import { UsageReportModule, UsageSweepJob } from "../runtime/usage-report.js";
-import { WaitSweepJob } from "../runtime/waits.js";
+import { UsageReportModule } from "../runtime/usage-report.js";
 import { SandboxSweepJobs } from "../sandbox/jobs.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { ScheduledTaskFireModule } from "../schedules/fire.js";
@@ -58,6 +60,8 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
             module: WorkerModule_1,
             imports: [
                 KernelScheduleModule,
+                // the outbox relay (`@LockedInterval`): delivers what the fast path did not
+                OutboxRelayModule,
                 ClientModule,
                 // the queue consumers (their worker options come from the startup config)
                 RuntimeWorkersModule.forRoot(config),
@@ -67,6 +71,7 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 PluginScopeWorkersModule,
                 // the domains the fixed-period jobs call
                 RuntimeModule,
+                RunJobsModule,
                 UsageReportModule,
                 TitlesModule,
                 AttachmentsModule,
@@ -84,8 +89,8 @@ let WorkerModule = WorkerModule_1 = class WorkerModule {
                 ScheduledTaskFireModule,
             ],
             providers: [
-                WaitSweepJob,
-                UsageSweepJob,
+                // the one repair of a run nobody runs (transactional outbox spec §8.3)
+                RunOrphanCheck,
                 AttachmentCleanupJob,
                 StoragePurgeJob,
                 SandboxSweepJobs,

package/dist/runtime/langgraph-loop.js

@@ -94,7 +94,8 @@ export class LangGraphLoop {
         const config = {
             configurable: { thread_id: ctx.runId },
             // 每步最多 3 个超步（prepare、model、tools），再加 wrapUp 与余量。
-            recursionLimit: ctx.limits.maxSteps * 3 + 10,
+            // no step limit: no recursion limit either (the loop ends when the model stops calling tools)
+            recursionLimit: ctx.limits.maxSteps === undefined ? Number.MAX_SAFE_INTEGER : ctx.limits.maxSteps * 3 + 10,
             durability: "sync",
         };
         const existing = await this.saver.getTuple({ configurable: { thread_id: ctx.runId } });
@@ -125,7 +126,12 @@ export class LangGraphLoop {
             : { kind: outcome, consumedUpToSeq: final.consumedUpToSeq };
     }
     build(ctx) {
-        const timedOut = () => Date.now() >= ctx.limits.deadline;
+        // an absent limit is no limit (`runtime.maxSteps` / `runtime.maxRunSeconds` 0)
+        const { maxSteps } = ctx.limits;
+        const timedOut = () => {
+            const deadline = ctx.limits.deadline;
+            return deadline !== undefined && Date.now() >= deadline;
+        };
         // 本次运行的附件字节缓存：各步共用，运行结束即丢弃（只是优化，见 MediaCache）
         const mediaCache = new MediaCache(this.stepDeps.config.get().attachments.requestMediaBytes);
         const input = (step, absorbedUpToSeq) => ({
@@ -138,7 +144,7 @@ export class LangGraphLoop {
             signal: ctx.signal,
             sink: ctx.sink,
             absorbedUpToSeq,
-            maxSteps: ctx.limits.maxSteps,
+            ...(maxSteps !== undefined && { maxSteps }),
             mediaCache,
             agentId: ctx.agentId,
             accountId: ctx.triggerAccountId,
@@ -216,7 +222,7 @@ export class LangGraphLoop {
                 agent: ctx.agent,
                 accountId: ctx.triggerAccountId,
                 signal: ctx.signal,
-                deadline: ctx.limits.deadline,
+                ...(ctx.limits.deadline !== undefined && { deadline: ctx.limits.deadline }),
                 ...(ctx.conversationKind !== undefined && { conversationKind: ctx.conversationKind }),
                 ...(ctx.parent !== undefined && { parent: ctx.parent }),
             });
@@ -256,7 +262,9 @@ export class LangGraphLoop {
             // (aborted / completed: a fork invocation's run ended in its first prepare, phase D)
             if (s.outcome !== null)
                 return END;
-            return s.budgetWrapUp === true || s.step > ctx.limits.maxSteps ? "wrapUp" : "model";
+            return s.budgetWrapUp === true || (maxSteps !== undefined && s.step > maxSteps)
+                ? "wrapUp"
+                : "model";
         }, ["model", "wrapUp", END])
             .addConditionalEdges("model", (s) => (s.budgetWrapUp === true ? "wrapUp" : s.outcome === null ? "tools" : END), ["tools", "wrapUp", END])
             .addEdge("tools", "prepare")

package/dist/runtime/limits.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Run limits where 0 means "no limit" (`runtime.maxSteps`, `runtime.maxRunSeconds`, a sub-agent's
+ * logged `maxSteps`): like Claude Code, a run without limits goes on until the model stops calling
+ * tools or someone stops it.
+ */
+/**
+ * The tightest of the given limits, ignoring absent and non-positive ones (0 = no limit);
+ * `undefined` when none of them limits anything.
+ */
+export declare function tightestLimit(...limits: (number | undefined)[]): number | undefined;
+/**
+ * The run's deadline (epoch ms) for `runtime.maxRunSeconds` counted from `startMs`; `undefined`
+ * when the run has no duration limit (0).
+ */
+export declare function runDeadline(startMs: number, maxRunSeconds: number): number | undefined;

package/dist/runtime/limits.js

@@ -0,0 +1,25 @@
+/**
+ * Run limits where 0 means "no limit" (`runtime.maxSteps`, `runtime.maxRunSeconds`, a sub-agent's
+ * logged `maxSteps`): like Claude Code, a run without limits goes on until the model stops calling
+ * tools or someone stops it.
+ */
+/**
+ * The tightest of the given limits, ignoring absent and non-positive ones (0 = no limit);
+ * `undefined` when none of them limits anything.
+ */
+export function tightestLimit(...limits) {
+    let out;
+    for (const l of limits) {
+        if (l === undefined || !(l > 0))
+            continue;
+        out = out === undefined ? l : Math.min(out, l);
+    }
+    return out;
+}
+/**
+ * The run's deadline (epoch ms) for `runtime.maxRunSeconds` counted from `startMs`; `undefined`
+ * when the run has no duration limit (0).
+ */
+export function runDeadline(startMs, maxRunSeconds) {
+    return maxRunSeconds > 0 ? startMs + maxRunSeconds * 1000 : undefined;
+}

package/dist/runtime/loop.d.ts

@@ -27,9 +27,13 @@ export interface LoopContext {
      * 即 seq 也大于会话的 `consumed_seq`），按 seq 升序。loop 记录吸收到的最大 seq 作为 `consumedUpToSeq`。
      */
     pendingAbsorbable(afterSeq: number): Promise<AbsorbableEvent[]>;
+    /**
+     * The run's limits; an absent one is no limit (`runtime.maxSteps` / `runtime.maxRunSeconds` 0):
+     * `maxSteps` model steps before the final wrap-up, `deadline` in epoch ms.
+     */
     limits: {
-        maxSteps: number;
-        deadline: number;
+        maxSteps?: number;
+        deadline?: number;
     };
     /**
      * Kind of the conversation: plugin hooks fire for `chat` and `subagent` (F10, P-18, sub-agents
@@ -124,6 +128,7 @@ export interface AgentLoop {
 /**
  * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
  * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
+ * approval); the timeout is a safety net. Without a run duration limit (`runtime.maxRunSeconds` 0)
+ * it is the approval timeout plus 10 minutes.
  */
 export declare function subagentsWait(runId: string, step: number, config: Pick<KernelConfig, "tools" | "runtime">, now?: number): WaitingFor;

package/dist/runtime/loop.js

@@ -8,7 +8,8 @@ export const subagentsWaitId = (runId, step) => `sa-${runId}-${step}`;
 /**
  * The wait of a step whose sub-agents still run (spec §7.2): id `sa-<runId>-<step>`, expiring after
  * the approval timeout plus one run's duration plus 10 minutes (a child may itself wait for an
- * approval); the timeout is a safety net.
+ * approval); the timeout is a safety net. Without a run duration limit (`runtime.maxRunSeconds` 0)
+ * it is the approval timeout plus 10 minutes.
  */
 export function subagentsWait(runId, step, config, now = Date.now()) {
     const ms = config.tools.approvalTimeoutHours * 3_600_000 + config.runtime.maxRunSeconds * 1000 + 600_000;

package/dist/runtime/maintenance.d.ts

@@ -16,7 +16,9 @@ export declare const MAINTENANCE_CONCURRENCY = 5;
  * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` and
  * `sandbox-reset-files` → {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
- * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}, `owned-plugin-cleanup` →
+ * {@link DirectorySync}, `bg-wake` and `ensure-run` → {@link RunQueue.ensureRun}, `stop-tree` →
+ * {@link processStopTree} and `deliver-to-parent` → {@link processDeliverToParent} (both in
+ * runtime/subagents/tree-jobs.ts, over {@link Waits}), `owned-plugin-cleanup` →
  * {@link OwnedPluginCleanup}, `sched-fire` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
@@ -34,7 +36,7 @@ export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly scheduled;
     private readonly log;
     private readonly queue;
-    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduledTasks: Pick<ScheduledTaskFirer, "fire">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    constructor(waits: Pick<Waits, "processTimeout" | "childFinished" | "stopChildren" | "stopDescendantsOfStopped" | "stopTree">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduledTasks: Pick<ScheduledTaskFirer, "fire">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
     /**
      * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
      * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a

package/dist/runtime/maintenance.js

@@ -31,8 +31,9 @@ import { DRIFT_CONNECTOR_JOB } from "../tools/job-ids.js";
 import { ToolsModule } from "../tools/tools.module.js";
 import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 import { RETIRED_SCHEDULER_IDS } from "./retired-schedulers.js";
-import { RunQueue } from "./run-queue.js";
+import { ENSURE_RUN_JOB, RunQueue } from "./run-queue.js";
 import { RuntimeModule } from "./runtime.module.js";
+import { DELIVER_TO_PARENT_JOB, processDeliverToParent, processStopTree, STOP_TREE_JOB, } from "./subagents/tree-jobs.js";
 import { WAIT_TIMEOUT_JOB, Waits } from "./waits.js";
 export { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
 /** The maintenance worker's concurrency (as the hand-made worker had). */
@@ -41,7 +42,9 @@ export const MAINTENANCE_CONCURRENCY = 5;
  * The one consumer of `cap-kernel-maintenance` (decision R11 of the Nest kernel spec): dispatches
  * each one-off job by name to its domain (`wait-timeout` → {@link Waits}, `sandbox-destroy-for` and
  * `sandbox-reset-files` → {@link SandboxService}, `drift-connector` → {@link ToolDrift}, `directory-sync` →
- * {@link DirectorySync}, `bg-wake` → {@link RunQueue.ensureRun}, `owned-plugin-cleanup` →
+ * {@link DirectorySync}, `bg-wake` and `ensure-run` → {@link RunQueue.ensureRun}, `stop-tree` →
+ * {@link processStopTree} and `deliver-to-parent` → {@link processDeliverToParent} (both in
+ * runtime/subagents/tree-jobs.ts, over {@link Waits}), `owned-plugin-cleanup` →
  * {@link OwnedPluginCleanup}, `sched-fire` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
@@ -113,6 +116,18 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
                 await this.runs.ensureRun(conversationId, { wakeRetry: (retry ?? 0) + 1 });
                 return;
             }
+            // the ensure-run backstop of a message, wake or run end (transactional outbox spec §6)
+            case ENSURE_RUN_JOB:
+                await this.runs.ensureRun(job.data.conversationId);
+                return;
+            // the stops a run's end or a root's delete owes its sub-agent tree (outbox spec §6)
+            case STOP_TREE_JOB:
+                await processStopTree(this.waits, job.data);
+                return;
+            // a finished sub-agent run's delivery to its parent (transactional outbox spec §6)
+            case DELIVER_TO_PARENT_JOB:
+                await processDeliverToParent(this.waits, job.data);
+                return;
             // a removed org-owned plugin's extension (plugin scope phase 3, P3-20)
             case OWNED_PLUGIN_CLEANUP_JOB:
                 await this.ownedCleanup.run(job.data.itemId);

package/dist/runtime/model-call.d.ts

@@ -11,7 +11,6 @@ import type { SubagentParent } from "./loop.js";
 import { MediaCache } from "./media-cache.js";
 import { type BoundProvider, type ProviderRegistry } from "./providers.js";
 import type { StepLog } from "./step-log.js";
-import type { UsageReporter } from "./usage-report.js";
 /** 单轮收尾的尾部提醒（模型可见，英文；spec 6 轮次额度收尾）。 */
 export declare const WRAP_UP_REMINDER = "Step limit reached. Do not call tools. Summarize what you found and what remains for the user.";
 /**
@@ -48,8 +47,11 @@ export type StreamSink = (delta: {
 export interface ModelStepDeps {
     db: KernelSchemaDb;
     eventLog: EventLog;
-    /** The step's transactional writes (a model call with its tool specs, a denial with its audit row, a sub-agent's counted usage). */
-    stepLog: Pick<StepLog, "appendCounted" | "appendAudited" | "appendWithSpecs">;
+    /**
+     * The step's transactional writes (a model call with its tool specs, a denial with its audit row,
+     * usage events with their owed `usage.report` deliveries, a sub-agent's counted usage).
+     */
+    stepLog: Pick<StepLog, "appendCounted" | "appendReported" | "appendAudited" | "appendWithSpecs">;
     registry: Pick<ProviderRegistry, "resolve">;
     /** 工具注册表：每步开始时解析 agent 引用的工具（状态可能在步骤之间变化）。 */
     tools: Pick<ToolRegistry, "forAgent">;
@@ -67,11 +69,6 @@ export interface ModelStepDeps {
      * `conversationKind: "chat"` on the step input.
      */
     hooks?: HookRunner;
-    /**
-     * `usage.report` delivery (P-17): each written `usage` event is enqueued (chat runs and full-run eval
-     * replays, which both log usage). `enqueue` never throws and returns at once without handlers.
-     */
-    usageReport?: Pick<UsageReporter, "enqueue">;
 }
 /** 构建请求用到的附件来源。 */
 export interface MediaSourceDeps {
@@ -121,7 +118,8 @@ export interface ModelStepInput {
     parentRunId?: string;
     /**
      * The run's step limit (`LoopContext.limits.maxSteps`) for the turn-limit reminder; a child's
-     * may be below `runtime.maxSteps` (final review m4). Defaults to `runtime.maxSteps`.
+     * may be below `runtime.maxSteps` (final review m4). Absent: the run has no step limit, and no
+     * reminder is sent.
      */
     maxSteps?: number;
 }
@@ -176,15 +174,15 @@ export declare function runModelStep(deps: ModelStepDeps, input: ModelStepInput)
 export declare function runFinalWrapUp(deps: ModelStepDeps, input: ModelStepInput, reason?: WrapUpReason): Promise<ModelStepResult>;
 /**
  * Appends a model call's events (its reply or compaction outcome with its `usage`; also the usage
- * of a `WebFetch` extraction call, `tools/builtins/web/extract.ts`). For a
- * sub-agent's run (`input.parentRunId`) in one transaction that also adds the tokens of the usage
- * events it newly wrote to the budget run's `subagent_tokens_used` (sub-agents spec §8.3): a usage
- * event already in the log (an idempotent hit after a crash) adds nothing, so each call counts
- * exactly once.
+ * of a `WebFetch` extraction call, `tools/builtins/web/extract.ts`) in one transaction that also
+ * owes the `usage.report` delivery of the usage events it newly wrote (transactional outbox spec
+ * §8.1). For a sub-agent's run (`input.parentRunId`) that transaction also adds their tokens to the
+ * budget run's `subagent_tokens_used` (sub-agents spec §8.3): a usage event already in the log (an
+ * idempotent hit after a crash) adds nothing, so each call counts and is reported exactly once.
  */
 export declare function appendCounted(deps: {
-    eventLog: Pick<EventLog, "append" | "notify">;
-    stepLog: Pick<StepLog, "appendCounted">;
+    eventLog: Pick<EventLog, "notify">;
+    stepLog: Pick<StepLog, "appendCounted" | "appendReported">;
 }, input: {
     conversationId: string;
     parentRunId?: string | undefined;

package/dist/runtime/model-call.js

@@ -123,12 +123,6 @@ wrapUpReason) {
     const { conversationId, runId, step, signal, sink } = input;
     const existing = await findExisting(deps.eventLog, conversationId, runId, step);
     if (existing) {
-        // resumed after a crash between writing usage and enqueueing it: enqueue again (job id dedupes)
-        if (deps.usageReport && existing.usage !== null) {
-            const u = await deps.eventLog.findByIdem(conversationId, idem.usage(runId, step));
-            if (u)
-                void deps.usageReport.enqueue(conversationId, u.seq);
-        }
         // a crash between the assistant_message and clearing its draft leaves one behind
         sink({ kind: "step_end", runId, step });
         return existing;
@@ -230,8 +224,9 @@ wrapUpReason) {
             }
         }
         const { outcome, ref } = await ladder(deps, input, events, runtime, tools, wrapUpReason, streamed);
-        // assistant_message 与 usage 同一次 append = 同一事务。
-        const appended = await appendCounted(deps, input, [
+        // assistant_message and usage in one append = one transaction, which also owes the usage's
+        // usage.report delivery (transactional outbox spec §8.1)
+        await appendCounted(deps, input, [
             {
                 type: "assistant_message",
                 runId,
@@ -245,10 +240,6 @@ wrapUpReason) {
                 payload: { step, provider: ref.provider, model: ref.model, ...outcome.usage },
             },
         ]);
-        // usage.report metering (never awaited on the run's path; enqueue logs and swallows failures)
-        const usageEvent = appended.find((e) => e.type === "usage");
-        if (deps.usageReport && usageEvent)
-            void deps.usageReport.enqueue(conversationId, usageEvent.seq);
         sink({ kind: "step_end", runId, step });
         return {
             content: outcome.content,
@@ -277,18 +268,18 @@ wrapUpReason) {
 }
 /**
  * Appends a model call's events (its reply or compaction outcome with its `usage`; also the usage
- * of a `WebFetch` extraction call, `tools/builtins/web/extract.ts`). For a
- * sub-agent's run (`input.parentRunId`) in one transaction that also adds the tokens of the usage
- * events it newly wrote to the budget run's `subagent_tokens_used` (sub-agents spec §8.3): a usage
- * event already in the log (an idempotent hit after a crash) adds nothing, so each call counts
- * exactly once.
+ * of a `WebFetch` extraction call, `tools/builtins/web/extract.ts`) in one transaction that also
+ * owes the `usage.report` delivery of the usage events it newly wrote (transactional outbox spec
+ * §8.1). For a sub-agent's run (`input.parentRunId`) that transaction also adds their tokens to the
+ * budget run's `subagent_tokens_used` (sub-agents spec §8.3): a usage event already in the log (an
+ * idempotent hit after a crash) adds nothing, so each call counts and is reported exactly once.
  */
 export async function appendCounted(deps, input, events) {
     const { conversationId, parentRunId } = input;
-    if (parentRunId === undefined)
-        return deps.eventLog.append(conversationId, events);
     const budgetRunId = input.budgetRunId ?? input.parent?.budgetRunId;
-    const out = await deps.stepLog.appendCounted(conversationId, { parentRunId, ...(budgetRunId !== undefined && { budgetRunId }) }, events);
+    const out = parentRunId === undefined
+        ? await deps.stepLog.appendReported(conversationId, events)
+        : await deps.stepLog.appendCounted(conversationId, { parentRunId, ...(budgetRunId !== undefined && { budgetRunId }) }, events);
     if (out.toSeq !== null)
         await deps.eventLog.notify(conversationId, out.toSeq);
     return out.written;
@@ -691,9 +682,6 @@ async function maybeCompact(deps, input, events, runtime, tools) {
         });
     }
     const written = await appendCounted(deps, input, batch);
-    const usageEvent = written.find((e) => e.type === "usage");
-    if (deps.usageReport && usageEvent)
-        void deps.usageReport.enqueue(conversationId, usageEvent.seq);
     return mergeLocal(events, written);
 }
 /** Merges written events into the local list (idempotent hits already in it are not added twice). */
@@ -719,7 +707,9 @@ async function ladder(deps, input, events, runtime, tools, wrapUpReason, streame
         ? BUDGET_WRAP_UP_REMINDER
         : wrapUp
             ? WRAP_UP_REMINDER
-            : turnLimitReminder(step, input.maxSteps ?? runtime.maxSteps);
+            : input.maxSteps === undefined
+                ? null
+                : turnLimitReminder(step, input.maxSteps);
     let evs = events;
     const rungs = [
         { ref: agent.model, fallback: false },

package/dist/runtime/queue-lost-jobs.d.ts

@@ -0,0 +1,24 @@
+import type { Redis } from "ioredis";
+/** The Redis hash of the lost-jobs canary: `count` and `lastAt` (ISO). */
+export declare const QUEUE_LOST_JOBS_KEY = "capk:queue-lost-jobs";
+/** How long the canary stays after its last report (then the overview drops it). */
+export declare const QUEUE_LOST_JOBS_TTL_SECONDS: number;
+/** What the admin overview shows: how many run jobs the queue lost, and when it last did. */
+export interface QueueLostJobsSummary {
+    count: number;
+    lastAt: string;
+}
+/**
+ * The "queue lost jobs" canary (transactional outbox spec §8.3): the `run-orphan-check` found
+ * queued runs whose job is neither in BullMQ nor owed by the outbox, which the outbox makes
+ * impossible unless Redis lost data (its durability broke). Each report adds to a count in Redis
+ * that the admin overview shows as an attention item until a week after the last report.
+ */
+export declare class QueueLostJobs {
+    private readonly redis;
+    constructor(redis: Redis);
+    /** Adds `n` lost jobs to the canary (no-op for 0). */
+    report(n: number): Promise<void>;
+    /** The canary, or null when no job was lost in the last week. */
+    summary(): Promise<QueueLostJobsSummary | null>;
+}

package/dist/runtime/queue-lost-jobs.js

@@ -0,0 +1,51 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { REDIS } from "../infra/tokens.js";
+/** The Redis hash of the lost-jobs canary: `count` and `lastAt` (ISO). */
+export const QUEUE_LOST_JOBS_KEY = "capk:queue-lost-jobs";
+/** How long the canary stays after its last report (then the overview drops it). */
+export const QUEUE_LOST_JOBS_TTL_SECONDS = 7 * 24 * 3600;
+/**
+ * The "queue lost jobs" canary (transactional outbox spec §8.3): the `run-orphan-check` found
+ * queued runs whose job is neither in BullMQ nor owed by the outbox, which the outbox makes
+ * impossible unless Redis lost data (its durability broke). Each report adds to a count in Redis
+ * that the admin overview shows as an attention item until a week after the last report.
+ */
+let QueueLostJobs = class QueueLostJobs {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    /** Adds `n` lost jobs to the canary (no-op for 0). */
+    async report(n) {
+        if (n <= 0)
+            return;
+        await this.redis
+            .multi()
+            .hincrby(QUEUE_LOST_JOBS_KEY, "count", n)
+            .hset(QUEUE_LOST_JOBS_KEY, "lastAt", new Date().toISOString())
+            .expire(QUEUE_LOST_JOBS_KEY, QUEUE_LOST_JOBS_TTL_SECONDS)
+            .exec();
+    }
+    /** The canary, or null when no job was lost in the last week. */
+    async summary() {
+        const h = await this.redis.hgetall(QUEUE_LOST_JOBS_KEY);
+        const count = Number(h.count ?? 0);
+        if (!(count > 0) || h.lastAt === undefined)
+            return null;
+        return { count, lastAt: h.lastAt };
+    }
+};
+QueueLostJobs = __decorate([
+    Injectable(),
+    __param(0, Inject(REDIS))
+], QueueLostJobs);
+export { QueueLostJobs };

package/dist/runtime/run-control.d.ts

@@ -1,6 +1,7 @@
-import { KernelEvents } from "../infra/events/kernel-events.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
 import { RunAbort } from "./abort.js";
+import { type ResumeOutcome, RunResume } from "./run-jobs.js";
 import { RunQueue } from "./run-queue.js";
 import { Waits } from "./waits.js";
 /**
@@ -11,13 +12,49 @@ export declare class RunControl {
     private readonly queue;
     private readonly waits;
     private readonly abort;
-    private readonly events;
+    /** The resume of a waiting run in a decision's transaction (a reply's skips). */
+    private readonly resumes;
+    /** Owes a deleted root's tree stop in the delete's transaction. */
+    private readonly outbox;
     private readonly log;
-    constructor(queue: Pick<RunQueue, "ensureRun" | "abortIfOrphaned" | "wakeHeldTree">, waits: Pick<Waits, "abortWaiting" | "childFinished" | "stopChildren" | "stopTree">, abort: Pick<RunAbort, "request">, events: KernelEvents, log: Pick<KernelLogger, "error">);
+    constructor(queue: Pick<RunQueue, "ensureRun" | "oweEnsureRun" | "abortIfOrphaned" | "wakeHeldTree" | "oweHeldTreeIn">, waits: Pick<Waits, "abortWaiting" | "childFinished" | "stopChildren" | "stopTree">, abort: Pick<RunAbort, "request">, 
+    /** The resume of a waiting run in a decision's transaction (a reply's skips). */
+    resumes: Pick<RunResume, "resumeIn">, 
+    /** Owes a deleted root's tree stop in the delete's transaction. */
+    outbox: Pick<OutboxService, "add">, log: Pick<KernelLogger, "error">);
     /** 有未消费的消息且没有进行中的运行时投递一轮运行；返回 runId 或 null。 */
     ensureRun(conversationId: string): Promise<string | null>;
+    /**
+     * The direct `ensureRun` right after a commit that owes the ensure-run backstop (a message, a
+     * queue change): a failure (Redis unreachable) is logged and never thrown, since the committed
+     * write is not undone and the backstop starts the run later (transactional outbox spec §6).
+     */
+    ensureRunAfterCommit(conversationId: string): Promise<void>;
+    /**
+     * Owes the ensure-run backstop in the caller's transaction (transactional outbox spec §6): `seq`
+     * is the event it wrote (or the conversation's newest), `orgId` the conversation's.
+     */
+    oweEnsureRun(conversationId: string, seq: number | string, orgId: string): Promise<boolean>;
     /** After a root's queue was unpaused: the wakes it held for its tree ({@link RunQueue.wakeHeldTree}). */
     wakeHeldTree(rootId: string): Promise<void>;
+    /**
+     * Owes, in the transaction that may release a root's hold (an unpause, a "send now"), the
+     * ensure-run backstop of every sub-agent the hold kept waiting ({@link RunQueue.oweHeldTreeIn});
+     * the caller's {@link wakeHeldTree} after the commit is the direct call.
+     */
+    oweHeldTreeIn(rootId: string): Promise<void>;
+    /**
+     * In the caller's transaction, after it locked the decided rows (lock order: conversations,
+     * decided rows, runs): resumes the waiting run `runId` when it waits on nothing else
+     * ({@link RunResume.resumeIn}).
+     */
+    resumeIn(runId: string, waitId: string): Promise<ResumeOutcome>;
+    /**
+     * Owes, in a root's delete transaction, the stop of its whole sub-agent tree (`stop-tree`,
+     * transactional outbox spec §6); the caller's {@link stopTree} after the commit is the direct
+     * call.
+     */
+    oweStopDeletedTree(conversationId: string, byAccountId: string | null, orgId: string): Promise<boolean>;
     /**
      * 运行是孤儿（会话锁空闲、任务已不存在，没有 worker 会收到中止广播）时直接把它写成 aborted，返回 true；
      * 否则返回 false。A stopped sub-agent then reports to its parent at once, and a stopped parent
@@ -26,8 +63,8 @@ export declare class RunControl {
     abortIfOrphaned(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
     /**
      * 运行在等人处理（waiting）时直接中止：取消等待、写 `run_aborted`、删除 checkpoint，返回 true；
-     * 运行已不是 waiting（例如刚被续跑）→ false. Either way its approval / question cards may have
-     * changed: `run.wait-stopped` lets the channel outbound update them.
+     * 运行已不是 waiting（例如刚被续跑）→ false. The stop's transaction owes the IM delivery that
+     * updates its approval / question cards (its appends, transactional outbox spec §8.1).
      */
     abortWaiting(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
     /**