@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.24

package/dist/identity/settings.js

@@ -11,10 +11,12 @@ import { EXTENSION_NAME_RE } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { applyPlatformTiersPatch, chosenPlatformDefault, PLATFORM_TIER_FIELDS, PLATFORM_TIERS_PATCH, PLATFORM_TIERS_SETTING, platformTiersWiden, readStoredPlatformTiers, resolvePlatformTiers, } from "../sandbox/platform-tiers.js";
 import { assertPlatformDefaultEligible, lockThemeShared } from "../themes/theme-state.js";
 import { mergeArrangement, UiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { audit } from "./audit.js";
@@ -153,6 +155,7 @@ export const DEPLOYMENT_SETTINGS = z.object({
     clientExtensions: ClientExtensionsSetting.default(clientExtensionsDefault),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
+const tierWidenRefused = () => new ApiError("deployment.sandbox_tier_not_allowed", "Raising the platform's sandbox level (sandboxTiers) needs a super admin in the admin console; an API token or the Platform tool may only lower it.");
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -198,6 +201,14 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
         message: "give enabled, disabled or both",
     })
         .optional(),
+    /**
+     * The platform's sandbox tiers (sandbox dev tiers spec §4.1): each given field replaces the
+     * stored one, null clears it (back to the default: max dev, default dev, unsandboxed allowed).
+     * A field set in the startup config is read-only (409 `deployment.setting_readonly`); the
+     * default may not be above the max; an API token or the Platform tool may only narrow (400
+     * `deployment.sandbox_tier_not_allowed`).
+     */
+    sandboxTiers: PLATFORM_TIERS_PATCH.optional(),
 })
     .strict();
 /**
@@ -350,11 +361,66 @@ let SettingsService = class SettingsService {
     txHost;
     adminLock;
     log;
-    constructor(db, txHost, adminLock, log) {
+    config;
+    constructor(db, txHost, adminLock, log, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config) {
         this.db = db;
         this.txHost = txHost;
         this.adminLock = adminLock;
         this.log = log;
+        this.config = config;
+    }
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    async view() {
+        const [settings, stored] = await Promise.all([
+            this.get(),
+            readStoredPlatformTiers(this.db.db, this.log),
+        ]);
+        return { ...settings, sandboxTiers: this.tiersView(stored) };
+    }
+    tiersView(stored) {
+        const config = this.config.get().sandbox.tiers;
+        const sources = Object.fromEntries(PLATFORM_TIER_FIELDS.map((f) => [
+            f,
+            this.config.fieldSource(`sandbox.tiers.${f}`) ??
+                (stored[f] !== undefined ? "db" : "default"),
+        ]));
+        return { ...resolvePlatformTiers(config, stored), sources };
+    }
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    async checkSandboxTiers(patch, opts = {}) {
+        const readonly = PLATFORM_TIER_FIELDS.filter((f) => patch[f] !== undefined && this.config.fieldSource(`sandbox.tiers.${f}`) !== undefined);
+        if (readonly.length > 0) {
+            throw new ApiError("deployment.setting_readonly", `These sandbox tier settings are set in the startup config (file, Nacos or environment) and are read-only here: ${readonly.map((f) => `sandbox.tiers.${f}`).join(", ")}`, readonly.map((f) => ({
+                path: `sandboxTiers.${f}`,
+                source: this.config.fieldSource(`sandbox.tiers.${f}`),
+            })));
+        }
+        const config = this.config.get().sandbox.tiers;
+        const stored = await readStoredPlatformTiers(this.db.db, this.log);
+        const next = applyPlatformTiersPatch(stored, patch);
+        const before = resolvePlatformTiers(config, stored);
+        const after = resolvePlatformTiers(config, next);
+        const chosen = chosenPlatformDefault(config, next);
+        if ((patch.max !== undefined || patch.default !== undefined) && chosen !== after.default) {
+            throw new ApiError("validation_failed", `The default sandbox tier (${chosen}) cannot be above the highest (${after.max}); lower sandboxTiers.default as well`, [{ path: "sandboxTiers.default", message: `must be at most ${after.max}` }]);
+        }
+        if (opts.onlyNarrows) {
+            const none = {};
+            if (platformTiersWiden(before, after) ||
+                platformTiersWiden(resolvePlatformTiers(none, stored), resolvePlatformTiers(none, next))) {
+                throw tierWidenRefused();
+            }
+        }
+        return { next, before, after };
     }
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
@@ -382,18 +448,21 @@ let SettingsService = class SettingsService {
         }
         return out;
     }
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     async update(patch, actorAccountId, actorTokenId, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail) {
+    auditDetail, opts = {}) {
         const check = DEPLOYMENT_SETTINGS_PATCH.safeParse(patch);
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid deployment settings", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        await this.write(check.data, actorAccountId, actorTokenId, auditDetail);
-        return this.get();
+        await this.write(check.data, actorAccountId, actorTokenId, auditDetail, opts);
+        return this.view();
     }
-    async write(patch, actorAccountId, actorTokenId, auditDetail) {
+    async write(patch, actorAccountId, actorTokenId, auditDetail, opts) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         // The super admin lock serializes every settings write: the current overrides are read
         // and merged under it, so no concurrent change is lost
@@ -452,7 +521,16 @@ let SettingsService = class SettingsService {
                 next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
             }
         }
-        for (const [key, value] of Object.entries(next)) {
+        // the platform's sandbox tiers: checked against the stored choice under the lock; lowering
+        // the max needs no org rewrite, the effective policy cuts every org's ceiling and default
+        let tiersChange;
+        const writes = Object.entries(next);
+        if (patch.sandboxTiers !== undefined) {
+            const r = await this.checkSandboxTiers(patch.sandboxTiers, opts);
+            tiersChange = { before: r.before, after: r.after };
+            writes.push([PLATFORM_TIERS_SETTING, r.next]);
+        }
+        for (const [key, value] of writes) {
             if (value === undefined)
                 continue;
             const json = JSON.stringify(value);
@@ -468,7 +546,11 @@ let SettingsService = class SettingsService {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
             action: "deployment.settings.updated",
-            detail: { ...patch, ...auditDetail },
+            detail: {
+                ...patch,
+                ...(tiersChange !== undefined && { sandboxTiersEffective: tiersChange }),
+                ...auditDetail,
+            },
         });
     }
 };
@@ -480,6 +562,7 @@ SettingsService = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(SuperAdminLock)),
-    __param(3, Inject(KERNEL_LOGGER))
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Inject(KernelConfigService))
 ], SettingsService);
 export { SettingsService };

package/dist/index.d.ts

@@ -70,6 +70,7 @@ export { ROUTE_SCHEMAS, type RouteSchemas } from "./platform/route-schemas.js";
 export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
 export type { AgentLoop, LoopContext, LoopOutcome } from "./runtime/loop.js";
 export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance-queue.js";
+export { type OrphanCandidate, queuedRunsWithoutJob } from "./runtime/run-orphan-check.job.js";
 export { runJobId } from "./runtime/run-queue.js";
 export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
 export { SANDBOX_LOCK_TTL_MS, SandboxService, type SandboxUseInfo, } from "./sandbox/sandbox.service.js";

package/dist/index.js

@@ -68,6 +68,7 @@ export { PlatformOperations } from "./platform/registry.js";
 export { ROUTE_SCHEMAS } from "./platform/route-schemas.js";
 export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
 export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance-queue.js";
+export { queuedRunsWithoutJob } from "./runtime/run-orphan-check.job.js";
 export { runJobId } from "./runtime/run-queue.js";
 export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
 export { SANDBOX_LOCK_TTL_MS, SandboxService, } from "./sandbox/sandbox.service.js";

package/dist/infra/cli/kernel-cli.module.js

@@ -21,6 +21,7 @@ import { KernelEventsModule } from "../events/kernel-events.js";
 import { GracefulShutdownModule } from "../lifecycle/graceful-shutdown.module.js";
 import { LockModule } from "../lock/lock.module.js";
 import { LoggingModule } from "../logging/logging.module.js";
+import { OutboxModule } from "../outbox/outbox.module.js";
 import { QueueModule } from "../queue/queue.module.js";
 import { KERNEL_BUS, KERNEL_LOGGER, REDIS, REDIS_SUBSCRIBER } from "../tokens.js";
 /** How long the CLI's Redis connection may take before a command fails (a publish only warns). */
@@ -110,6 +111,10 @@ let KernelCliModule = KernelCliModule_1 = class KernelCliModule {
                 ConfigModule.forRoot(config, opts.env !== undefined ? { env: opts.env } : {}),
                 GracefulShutdownModule,
                 DatabaseModule.forRoot(),
+                // owed jobs a command's domain writes carry (an extension's embed call owes its usage
+                // report); delivered by the fast path when the command's context has the queue, else by a
+                // worker's relay
+                OutboxModule,
                 // QueueModule's root gives the queues a command's modules register (the catalog's scope
                 // sync and maintenance queues) the configured Redis; without it BullMQ would connect to
                 // its default 127.0.0.1:6379

package/dist/infra/config/kernel-config.service.d.ts

@@ -15,6 +15,13 @@ export declare class KernelConfigService {
     private readonly listeners;
     constructor(input: KernelConfigInput, log: KernelLogger);
     get(): KernelConfig;
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path: string): "env" | "file" | "nacos" | undefined;
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener: ConfigChangeListener): () => void;
     /**

package/dist/infra/config/kernel-config.service.js

@@ -8,9 +8,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from "@nestjs/common";
+import { envOverrides } from "../../config/env.js";
 import { changedPaths, configFields, getPath, secretValues, setPath } from "../../config/fields.js";
 import { resolveConfig } from "../../config/load.js";
 import { KernelConfigSchema } from "../../config/schema.js";
+import { configSourceKind } from "../../config/sources.js";
 import { KERNEL_CONFIG_INPUT, KERNEL_LOGGER } from "../tokens.js";
 /**
  * Appliers of the hot-reloadable fields: the key is a dotted path marked `hot` in the schema. A
@@ -101,6 +103,24 @@ let KernelConfigService = class KernelConfigService {
     get() {
         return this.current;
     }
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path) {
+        if (getPath(this.current, path) === undefined)
+            return undefined;
+        let fromEnv = false;
+        try {
+            fromEnv = getPath(envOverrides(this.env), path) !== undefined;
+        }
+        catch {
+            // conflicting variables fail the start; a later change here only loses the label
+        }
+        return fromEnv ? "env" : configSourceKind(this.env);
+    }
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener) {
         this.listeners.add(listener);

package/dist/infra/events/kernel-events.d.ts

@@ -23,8 +23,9 @@ export interface KernelEventMap {
     };
     /**
      * A person decided a tool call approval (after the commit, exactly once: only the decision that
-     * changed it from pending). The run's waits resume it and its IM delivery is enqueued; a lost
-     * event is re-derived by the wait sweep (runs waiting on a decided approval are resumed).
+     * changed it from pending). The decision's transaction resumed the run and, for a conversation
+     * with a channel target, owed the IM delivery that updates the card (with its `approval_decided`
+     * append); the event itself is only the decision's announcement.
      */
     "approval.decided": {
         id: string;
@@ -36,8 +37,7 @@ export interface KernelEventMap {
     };
     /**
      * A person answered a tool call's input request, or skipped it with a message (after the commit,
-     * exactly once). Same
-     * consumers and the same re-derivation as `approval.decided`.
+     * exactly once). The same transaction contract as `approval.decided`.
      */
     "question.answered": {
         id: string;
@@ -47,38 +47,20 @@ export interface KernelEventMap {
         /** `skipped`: the run's starter sent a message instead (reply-while-question spec §6.3). */
         outcome: "answered" | "skipped";
     };
-    /**
-     * EventAppended: a conversation's event log advanced to `toSeq` (after the commit, from
-     * `EventLog.notify`, right after the bus publish). The channel outbound delivery enqueues a job
-     * for a conversation with an IM target; a lost event is re-derived by the next append's (and the
-     * finished delivery job re-checks the log for content it has not delivered).
-     */
-    "conversation.event-appended": {
-        conversationId: string;
-        toSeq: number;
-    };
     /**
      * A run started executing on this replica (its first start, a resume, or a takeover after a
      * stall), after it took the conversation lock and an org quota slot. The channel outbound
-     * enqueues the conversation's IM delivery; a lost event is re-derived by the run's next append.
+     * enqueues the conversation's IM delivery at once (a hint: the run's appends owe it, transactional
+     * outbox spec §8.1).
      */
     "run.started": {
         conversationId: string;
         runId: string;
     };
     /**
-     * A stop of a run waiting on a person was handled (`RunControl.abortWaiting`, whether or not it
-     * still waited): its approval and question cards change, so the channel outbound enqueues the
-     * conversation's IM delivery (re-derived by the next append when lost).
-     */
-    "run.wait-stopped": {
-        conversationId: string;
-        runId: string;
-    };
-    /**
-     * `ensureRun` marked an orphaned run failed (after the commit): the waits stop its active fork
-     * sub-agent at once (background sub-agents keep running, agent map spec §5.4). A lost event is
-     * repaired by the wait sweep (fork children of finished runs).
+     * The `run-orphan-check` failed an orphaned run (after the commit): the waits stop its active
+     * fork sub-agent at once (background sub-agents keep running, agent map spec §5.4). A lost event
+     * is repaired by the `stop-tree` job the run's terminal transaction owed.
      */
     "run.orphaned": {
         runId: string;
@@ -99,14 +81,6 @@ export interface KernelEventMap {
     "background_task.finished": {
         conversationId: string;
     };
-    /**
-     * An extension's `ctx.models.embed` call wrote a `model_usage` row (after the commit, spec B
-     * §5.4). The usage reporter enqueues its `usage.report` delivery; a lost event is re-derived by
-     * the usage sweep (rows whose `reported_at` is still null).
-     */
-    "model_usage.recorded": {
-        id: string;
-    };
 }
 type Handler<K extends keyof KernelEventMap> = (payload: KernelEventMap[K]) => Promise<void> | void;
 /** Typed in-process event emitter; handlers run in order, a failing one is logged and skipped. */

package/dist/infra/outbox/outbox-relay.module.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The outbox relay (`@LockedInterval`), imported only by `WorkerModule`. Its dispatcher comes from
+ * the global `OutboxModule`, which every role has (the fast path runs everywhere).
+ */
+export declare class OutboxRelayModule {
+}

package/dist/infra/outbox/outbox-relay.module.js

@@ -0,0 +1,18 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { OutboxRelay } from "./outbox.relay.js";
+/**
+ * The outbox relay (`@LockedInterval`), imported only by `WorkerModule`. Its dispatcher comes from
+ * the global `OutboxModule`, which every role has (the fast path runs everywhere).
+ */
+let OutboxRelayModule = class OutboxRelayModule {
+};
+OutboxRelayModule = __decorate([
+    Module({ providers: [OutboxRelay] })
+], OutboxRelayModule);
+export { OutboxRelayModule };

package/dist/infra/outbox/outbox.dispatcher.d.ts

@@ -0,0 +1,103 @@
+import { ModuleRef } from "@nestjs/core";
+import type { Queue } from "bullmq";
+import type { KernelLogger } from "../../log.js";
+import { KernelDb } from "../database/kernel-db.js";
+import { TransactionHost } from "../database/transaction-host.js";
+import { type KernelQueueName } from "../queue/queue-names.js";
+/**
+ * Retry schedule of a row whose add failed (spec §3.4): the next attempt waits
+ * `min(capMs, baseMs * 2^attempts)`, and the row is dead (kept, never retried) at `maxAttempts`.
+ */
+export declare const OUTBOX_BACKOFF: {
+    readonly baseMs: 1000;
+    readonly capMs: 300000;
+    readonly maxAttempts: 20;
+};
+/**
+ * How long the queue adds of one claim pass may take in all: the claim transaction holds its rows'
+ * locks and a pool connection for at most about this long.
+ */
+export declare const OUTBOX_REDIS_TIMEOUT_MS = 2000;
+/**
+ * Most fast-path passes running at once in one process; more are skipped and left to the relay,
+ * so a slow Redis cannot take the whole pool (a local resource bound, no shared state).
+ */
+export declare const OUTBOX_FAST_PATH_CONCURRENCY = 4;
+/**
+ * Test seam (`KernelOverride`): returns true to make the adds to the given queue fail (a Redis
+ * outage) without calling Redis. The kernel never provides it; the dispatcher defaults to "never
+ * fails".
+ */
+export declare const OUTBOX_DISPATCH_FAILS: unique symbol;
+/** What one pass did: rows delivered, rows whose add failed, and of those the rows now dead. */
+export interface DispatchResult {
+    sent: number;
+    failed: number;
+    dead: number;
+}
+/** The queue handle the dispatcher uses: adds, and the connection's state. */
+export type OutboxQueue = Pick<Queue, "addBulk" | "getBackend">;
+/**
+ * Delivers outbox rows to BullMQ (transactional outbox spec §3.3, §3.4). A pass claims rows
+ * `FOR UPDATE SKIP LOCKED` (so concurrent passes never take the same row), adds their jobs per
+ * queue with `addBulk` (the queue defaults overlaid by the registry's options of the job name, the
+ * row's job id, a future `run_at` as the remaining `delay`), and deletes
+ * the delivered rows in the same short transaction. A crash after the add and before the commit
+ * leaves the rows; the next pass adds again and BullMQ ignores the existing job id. A queue whose
+ * add fails keeps its rows, and a second short update records the attempt with exponential
+ * backoff, setting `dead_at` at the last one.
+ *
+ * The fast path never queues behind an outage: it skips the pass (the relay delivers the rows) when
+ * a queue's Redis connection is not ready or {@link OUTBOX_FAST_PATH_CONCURRENCY} passes already
+ * run. Within a pass, the first failed queue fails the queues after it without trying them.
+ *
+ * The queue handles are the instances the queues' owner modules registered (one per queue, no
+ * connection of the outbox's own), resolved by token at use time. A queue whose owner this
+ * process's roles do not load is not reachable here: no pass claims its rows, which stay for a
+ * process that has it.
+ */
+export declare class OutboxDispatcher {
+    readonly txHost: TransactionHost;
+    private readonly db;
+    private readonly log;
+    private readonly moduleRef;
+    private readonly dispatchFails;
+    /** The owners' queue instances resolved so far (a per-process handle cache). */
+    private readonly queues;
+    /** Fast-path passes running in this process (bounded by OUTBOX_FAST_PATH_CONCURRENCY). */
+    private fastPaths;
+    constructor(txHost: TransactionHost, db: KernelDb, log: KernelLogger, moduleRef: Pick<ModuleRef, "get">, dispatchFails?: (queue: KernelQueueName) => boolean);
+    /** The queue instance its owner module registered, or undefined when no loaded module has it. */
+    private queue;
+    /** The kernel queues this process can add to, with their handles. */
+    private reachable;
+    /**
+     * The fast path: delivers the given rows (a committed transaction's own) right away. Never
+     * throws: whatever it does not deliver stays for the relay, and a failure is logged.
+     */
+    dispatchOwn(ids: readonly string[]): Promise<void>;
+    /**
+     * Every reachable queue's connection is ready (they reach the same Redis; the fast path does not
+     * read its rows' queues before claiming them).
+     */
+    private redisReady;
+    /**
+     * The relay: delivers up to `limit` due rows (not dead, `next_attempt_at` reached), oldest
+     * first.
+     */
+    dispatchDue(limit: number): Promise<DispatchResult>;
+    private dispatch;
+    /**
+     * One claim transaction: locks the rows (skipping rows another pass holds), adds their jobs and
+     * deletes the delivered rows. The only Redis calls made while a PG transaction is open in the
+     * kernel (spec §3.3): the locks held are outbox rows only, and the pass's adds together are
+     * bounded by {@link OUTBOX_REDIS_TIMEOUT_MS}.
+     */
+    private claimAndSend;
+    /**
+     * Records a failed add on its rows (after the claim transaction, so the attempt is kept whatever
+     * that transaction did): one more attempt, the error, the next attempt by {@link OUTBOX_BACKOFF},
+     * and `dead_at` at the last attempt. Returns how many rows it made dead.
+     */
+    private recordFailure;
+}