@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.24

package/bootstrap.json

@@ -3,103 +3,103 @@
   "schemaVersion": 1,
   "marketplace": {
     "url": "https://github.com/capybara-hq/plugins.git",
-    "commit": "050de1403662d2ba04cb96839b742aaa0166c00e"
+    "commit": "4bfd588739e5cec6f2177d4e8f72e43a4dae50f3"
   },
   "plugins": [
     {
       "name": "openai-compatible",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai-compatible",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-EVsWj0bJns6DirtzTXIbXrrktoiJbZi+8NeLzYpZ53Gwo4hNoNAaIhnfHge9RBhSgZ0xMTKEAP/PlyQ6uasAVA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-IDINuU0r2JONeoEneACLhqnIeDCHX0AICaUJd8TeVmCbzsjMPlchTXngFQin66UN3jqi92yhFDGMKixLsArVCA==",
       "required": true
     },
     {
       "name": "object-store-s3",
       "source": "npm",
       "npm": "@capybara-hq/plugin-object-store-s3",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-zoJ0DDzeZ1WHxZZyHL/D855FTI2Mdjb0Z5RCqWu745eHA4+5DbboBiHsxSwyzQHp7LixyVQLoWxjFgdXCOkcFw==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-7HHh45e2CiMxQVfMEKexdRkT7k2iUqznNWMEVazzd+rhT4tguLVY8TkWClv4EK246fqVXvnj48rmmL6Dd6oTvw==",
       "required": true
     },
     {
       "name": "anthropic",
       "source": "npm",
       "npm": "@capybara-hq/plugin-anthropic",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-x3/vR09Rlcw+kikk9ztmD4fqG0ThscAjAP+R2IOfQxqMNLfcppF0S6zGAWibof3qJ0LG/dr3o0yyH3j20TGlRg==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-yjUyDqJppihZmhgLVomFbhf1Iek31xyJ4W4+It4Dy3K4wsyZV9khhWrm9x1xxtcb1RvDIGgUxRmvLgoTIeUTYQ==",
       "required": false
     },
     {
       "name": "openai",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-67wjrPJd8/CUzTLOxK+rw1dBL2iCzQ5nj9Zg4R6M6K046i/yp8RGLJiYfFags8SFk3yHCBdQIigBWRsFF7HOfg==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-n8IRL9u+yxmtd/aEntgSdTswjTDdhn2tjXTN9FWARGI+dTQnsbkX9108P4T31kmOBVcuwPYzNB09NG+im2LQIg==",
       "required": false
     },
     {
       "name": "deepseek",
       "source": "npm",
       "npm": "@capybara-hq/plugin-deepseek",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-MO04BQm08JexZ+Pns/I8x6zWG5lSlXuADM2tZaE6/61hA3L1qKnZly9vmE8H6tt+JgbPZda+lMrINhbQ4biv2A==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-f0kYjYzvwxPtT2bnpf7fYkggMHvlLTJX7bacaWnIoR1cHeTxiNKuvOv8ptkztpkgTmKadjKqllI5b9AOhhILRg==",
       "required": false
     },
     {
       "name": "bailian",
       "source": "npm",
       "npm": "@capybara-hq/plugin-bailian",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-dqj7fnUkjs5PnsJsqolkZMZ/a+MWz2yMSORiecyRPoM5hNNgc1LY0jtoTLTOFxG6b5sMJJ0iqyISDrZeV4ScyQ==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-VqTq6mjzka+iEW5BdcZspBdkWSQ1mLsLueg/XABaZzNDEAE/a6ErDE10GadzOTzorqAttXebTLJDjJebgLmtwA==",
       "required": false
     },
     {
       "name": "ark",
       "source": "npm",
       "npm": "@capybara-hq/plugin-ark",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-VamP4U4zU6d9uvSAIo9KLxqh0Vt05EnexOF+78W3oY35YrNRXevk/ABFGMVwGEflq9LiJYJ6xisl38t3Aq5fDA==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-Ml/HS3w3fD4x0gh/Yh0jbz8Riv8x7Jkd5phPZUsKDtuE4pvr+hllRYOxs9p0/Lax11BDvbUK9EFzRkCa+xAQeQ==",
       "required": false
     },
     {
       "name": "connector-mcp",
       "source": "npm",
       "npm": "@capybara-hq/plugin-connector-mcp",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-p8YmmutRTdj5auF5Ua5ox77S1tht+2URguehopjFaK8Cl34rURM4hY0f7WSJ5Xj884156HBua4AmsBTaDMiasQ==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-hJlW+u1iLt/mKJ9iPBbGT6tbpGevPVTS+8dvLtPbpf2fFRhM2eLrQy6+zuKUhuVQCcJYBrpz4vu5vh1ZBkqNZg==",
       "required": false
     },
     {
       "name": "connector-openapi",
       "source": "npm",
       "npm": "@capybara-hq/plugin-connector-openapi",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-hcLe9Ay6ho6C1dFXtVk7VU6kL9NYmjjbh2+7dXl4BJYglGwrGbfVr0FN7TNRQ+Bsy2ni4BuSsJSGv6BYOp6/EA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-2WU6sU0yAeWDy10DZ2I45uv2I6Q1FQDKvok2W0r6dfIO11G9iTsRNIMbtNsdVO2OUWY8nhAgh95BXBrpUELELQ==",
       "required": false
     },
     {
       "name": "jina",
       "source": "npm",
       "npm": "@capybara-hq/plugin-jina",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-ViVwzmq4Ic4iJ7vnwYFSRHm3ON96npVDvcLQH7CqIkpUAKabt8GNBVuD5yAeadKmXY3Gn76VkfjjfmHzJgbOMw==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-rpr59xbQJg+DuzhnAjn7Ql0rW9Cw9gKWHpER9nKvILvEYjEurmhniJkkqeHMnMlPba8lNUeQRGzmxdmLfKA10g==",
       "required": false
     },
     {
       "name": "sandbox-docker",
       "source": "npm",
       "npm": "@capybara-hq/plugin-sandbox-docker",
-      "version": "0.1.0-rc.10",
-      "integrity": "sha512-nDdaWCgrGoAfOiaKMVGheCLTlbFtSo10+8sgPSmJCO4z2LJW0qDMuN7rPwd3QnFsBReNeBwDB5fT6eHscNWDqw==",
+      "version": "0.1.0-rc.12",
+      "integrity": "sha512-c1iTAu/ifkwfnvVOsxEDfxEJNU7HDVewDtX4vdibwpodIhBvxz8tGjGYJ0HXDL3ipGEodiiIgJsVpabnMQ6cBQ==",
       "required": false
     },
     {
       "name": "todo",
       "source": "npm",
       "npm": "@capybara-hq/plugin-todo",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-AOKLpoaBfOQUWnP9nszg9DQWR+6z5gl+ZHoTlHysA9LAeC2h/zipjGE9hY69HF9rueSHzM2kGESJLvXIuQODAA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-xNdzvAmOQmBaDj29hsvbhMJINy2xe+ILTqG+cQhUfsyar7gUJaVOehseufvIq+cVbTjkI2tW7XlwGrtP3E3NtA==",
       "required": false
     },
     {

package/dist/admin/admin.module.d.ts

@@ -1,6 +1,7 @@
 /**
  * Deployment administration: the setup wizard, the platform-level audit log and the admin overview
- * with its health read and seven-day usage aggregate (its controllers are the api role's, `ApiModule`).
+ * with its health read, seven-day usage aggregate and dead outbox rows (its controllers are the api
+ * role's, `ApiModule`).
  */
 export declare class AdminModule {
 }

package/dist/admin/admin.module.js

@@ -16,8 +16,9 @@ import { ModelsModule } from "../models/models.module.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { ProvidersModule } from "../runtime/providers.js";
 import { RunJobsModule } from "../runtime/run-jobs.js";
-import { UsageReportJobsModule } from "../runtime/usage-report-jobs.js";
+import { UsageReportModule } from "../runtime/usage-report.js";
 import { AdminHealthService } from "./health.service.js";
+import { OutboxDeadService } from "./outbox-dead.service.js";
 import { AdminOverviewService } from "./overview.service.js";
 import { PlatformAuditService } from "./platform-audit.service.js";
 import { SetupService } from "./setup.service.js";
@@ -25,7 +26,8 @@ import { SetupLockModule } from "./setup-lock.js";
 import { AdminUsageService } from "./usage.service.js";
 /**
  * Deployment administration: the setup wizard, the platform-level audit log and the admin overview
- * with its health read and seven-day usage aggregate (its controllers are the api role's, `ApiModule`).
+ * with its health read, seven-day usage aggregate and dead outbox rows (its controllers are the api
+ * role's, `ApiModule`).
  */
 let AdminModule = class AdminModule {
 };
@@ -44,7 +46,7 @@ AdminModule = __decorate([
             RunJobsModule,
             ChannelsModule,
             TitlesModule,
-            UsageReportJobsModule,
+            UsageReportModule,
             EvalsModule,
             // the price table of the usage aggregate
             ModelsModule,
@@ -55,6 +57,7 @@ AdminModule = __decorate([
             AdminOverviewService,
             AdminHealthService,
             AdminUsageService,
+            OutboxDeadService,
         ],
         exports: [
             SetupService,
@@ -62,6 +65,7 @@ AdminModule = __decorate([
             AdminOverviewService,
             AdminHealthService,
             AdminUsageService,
+            OutboxDeadService,
         ],
     })
 ], AdminModule);

package/dist/admin/outbox-dead.controller.d.ts

@@ -0,0 +1,23 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { OutboxDeadParams } from "./outbox-dead.schemas.js";
+import { type OutboxDeadRow, OutboxDeadService, type OutboxRetryOutcome } from "./outbox-dead.service.js";
+/**
+ * Dead outbox rows (`/api/v1/admin/outbox/dead*`, transactional outbox spec §3.4): background work
+ * the kernel could not queue after its last attempt. Super admins only; service tokens 403. Retry
+ * and discard are audited (`outbox.retried`, `outbox.discarded`); the list is not (decision D5).
+ */
+export declare class OutboxDeadController {
+    private readonly dead;
+    constructor(dead: OutboxDeadService);
+    /** The dead rows, oldest first (at most 200). */
+    list(): Promise<{
+        items: OutboxDeadRow[];
+    }>;
+    /** Makes the row due again, or discards it when the same job is owed already (`already_owed`). */
+    retry(principal: Principal, { id }: z.infer<typeof OutboxDeadParams>): Promise<{
+        outcome: OutboxRetryOutcome;
+    }>;
+    /** Deletes the row: its job is never delivered. */
+    discard(principal: Principal, { id }: z.infer<typeof OutboxDeadParams>): Promise<void>;
+}

package/dist/admin/outbox-dead.controller.js

@@ -0,0 +1,62 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Delete, Get, HttpCode, Inject, Post } from "@nestjs/common";
+import { CurrentPrincipal, SuperAdmin } from "../identity/principal.js";
+import { writeActorOf } from "../identity/write-actor.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZParam } from "../infra/validation/zod-params.js";
+import { OutboxDeadParams } from "./outbox-dead.schemas.js";
+import { OutboxDeadService, } from "./outbox-dead.service.js";
+class OutboxDeadParamsDto extends createZodDto(OutboxDeadParams, "OutboxDeadParams") {
+}
+/**
+ * Dead outbox rows (`/api/v1/admin/outbox/dead*`, transactional outbox spec §3.4): background work
+ * the kernel could not queue after its last attempt. Super admins only; service tokens 403. Retry
+ * and discard are audited (`outbox.retried`, `outbox.discarded`); the list is not (decision D5).
+ */
+let OutboxDeadController = class OutboxDeadController {
+    dead;
+    constructor(dead) {
+        this.dead = dead;
+    }
+    /** The dead rows, oldest first (at most 200). */
+    list() {
+        return this.dead.list();
+    }
+    /** Makes the row due again, or discards it when the same job is owed already (`already_owed`). */
+    retry(principal, { id }) {
+        return this.dead.retry(id, writeActorOf(principal));
+    }
+    /** Deletes the row: its job is never delivered. */
+    async discard(principal, { id }) {
+        await this.dead.discard(id, writeActorOf(principal));
+    }
+};
+__decorate([
+    Get()
+], OutboxDeadController.prototype, "list", null);
+__decorate([
+    Post(":id/retry"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(OutboxDeadParamsDto))
+], OutboxDeadController.prototype, "retry", null);
+__decorate([
+    Delete(":id"),
+    HttpCode(204),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(OutboxDeadParamsDto))
+], OutboxDeadController.prototype, "discard", null);
+OutboxDeadController = __decorate([
+    Controller("api/v1/admin/outbox/dead"),
+    SuperAdmin(),
+    __param(0, Inject(OutboxDeadService))
+], OutboxDeadController);
+export { OutboxDeadController };

package/dist/admin/outbox-dead.schemas.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** A dead outbox row by id (`bigint` identity, read as a string; 400 when not digits). */
+export declare const OutboxDeadParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+/** The super admin's dead outbox rows (transactional outbox spec §3.4). */
+export declare const OUTBOX_DEAD_ROUTES: readonly RouteSchemas[];

package/dist/admin/outbox-dead.schemas.js

@@ -0,0 +1,18 @@
+import { z } from "zod";
+/** The largest `bigint` id; a larger one would make PG refuse the comparison. */
+const MAX_BIGINT = 9223372036854775807n;
+/** A dead outbox row by id (`bigint` identity, read as a string; 400 when not digits). */
+export const OutboxDeadParams = z.object({
+    id: z
+        .string()
+        .regex(/^\d{1,19}$/, "id must be an outbox row id (digits)")
+        // checks do not abort: only digits reach BigInt
+        .refine((v) => !/^\d{1,19}$/.test(v) || BigInt(v) <= MAX_BIGINT, "id must be an outbox row id")
+        .describe("The dead row's id, as admin.outbox-list-dead lists it."),
+});
+/** The super admin's dead outbox rows (transactional outbox spec §3.4). */
+export const OUTBOX_DEAD_ROUTES = [
+    { route: "GET /api/v1/admin/outbox/dead" },
+    { route: "POST /api/v1/admin/outbox/dead/:id/retry", params: OutboxDeadParams },
+    { route: "DELETE /api/v1/admin/outbox/dead/:id", params: OutboxDeadParams },
+];

package/dist/admin/outbox-dead.service.d.ts

@@ -0,0 +1,66 @@
+import type { WriteActor } from "../identity/write-actor.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { type OutboxFastPath } from "../infra/outbox/outbox.service.js";
+/** The most dead rows `GET /api/v1/admin/outbox/dead` returns, oldest first. */
+export declare const OUTBOX_DEAD_LIST_MAX = 200;
+/** A dead outbox row as the super admin sees it (transactional outbox spec §3.4). */
+export interface OutboxDeadRow {
+    id: string;
+    queue: string;
+    jobName: string;
+    jobId: string;
+    /** The org the work belongs to; null for platform work (or an org deleted since). */
+    orgId: string | null;
+    attempts: number;
+    lastError: string | null;
+    deadAt: string;
+    createdAt: string;
+}
+/** Dead rows in all: how many and since when (the overview's `outbox_dead` attention item). */
+export interface OutboxDeadSummary {
+    count: number;
+    oldestAt: Date | null;
+}
+/**
+ * What a retry did: `retried` (the row is due again, the relay delivers it) or `already_owed`
+ * (the same job is owed by a pending row already, so the dead copy was discarded: ruling R8).
+ */
+export type OutboxRetryOutcome = "retried" | "already_owed";
+/**
+ * The super admin's dead outbox rows (transactional outbox spec §3.4): the rows the dispatcher
+ * gave up on after its last attempt. Nothing is dropped silently: a row stays until a super admin
+ * retries it (it is due again with fresh attempts) or discards it, each audited at platform level
+ * (`outbox.retried`, `outbox.discarded`). A retry does not look at what the job is about: every
+ * job name added through the outbox is harmless when its work is gone or done (spec §3.5).
+ */
+export declare class OutboxDeadService {
+    readonly txHost: TransactionHost;
+    private readonly db;
+    private readonly fastPath;
+    constructor(txHost: TransactionHost, db: KernelDb, fastPath: OutboxFastPath);
+    /** The dead rows, oldest first, at most {@link OUTBOX_DEAD_LIST_MAX}. */
+    list(): Promise<{
+        items: OutboxDeadRow[];
+    }>;
+    /** How many rows are dead, and the oldest one's `dead_at`. */
+    summary(): Promise<OutboxDeadSummary>;
+    /**
+     * Makes a dead row due again (`dead_at` cleared, no attempts, next attempt now) and hands it to
+     * the fast path after the commit; the relay delivers it otherwise. When the same (queue, job id)
+     * is owed by a pending row already, the dead row is deleted instead (`already_owed`). A pending
+     * row added between the check and the update fails the update on the unique index: the retry
+     * then runs once more and takes the `already_owed` branch. `outbox.not_found` (404) when no dead
+     * row has the id.
+     */
+    retry(id: string, actor: WriteActor, detail?: Record<string, unknown>): Promise<{
+        outcome: OutboxRetryOutcome;
+    }>;
+    private retryOnce;
+    /** Deletes a dead row: its job is never delivered. `outbox.not_found` (404) when none. */
+    discard(id: string, actor: WriteActor, detail?: Record<string, unknown>): Promise<void>;
+    /** The dead row `id`, locked for the transaction; `outbox.not_found` when it is not dead. */
+    private lockDead;
+    /** A platform-level audit event (no org: the outbox is the deployment's), naming the job. */
+    private audit;
+}

package/dist/admin/outbox-dead.service.js

@@ -0,0 +1,179 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OUTBOX_FAST_PATH } from "../infra/outbox/outbox.service.js";
+/** The most dead rows `GET /api/v1/admin/outbox/dead` returns, oldest first. */
+export const OUTBOX_DEAD_LIST_MAX = 200;
+/** The unique index of pending rows (0119): one pending row per (queue, job_id). */
+const PENDING_UNIQUE = "outbox_job_uniq";
+const isPendingConflict = (e) => typeof e === "object" &&
+    e !== null &&
+    e.code === "23505" &&
+    e.constraint === PENDING_UNIQUE;
+const notFound = (id) => new ApiError("outbox.not_found", `No dead outbox row ${id}; list them with GET /api/v1/admin/outbox/dead`);
+/**
+ * The super admin's dead outbox rows (transactional outbox spec §3.4): the rows the dispatcher
+ * gave up on after its last attempt. Nothing is dropped silently: a row stays until a super admin
+ * retries it (it is due again with fresh attempts) or discards it, each audited at platform level
+ * (`outbox.retried`, `outbox.discarded`). A retry does not look at what the job is about: every
+ * job name added through the outbox is harmless when its work is gone or done (spec §3.5).
+ */
+let OutboxDeadService = class OutboxDeadService {
+    txHost;
+    db;
+    fastPath;
+    constructor(txHost, db, fastPath) {
+        this.txHost = txHost;
+        this.db = db;
+        this.fastPath = fastPath;
+    }
+    /** The dead rows, oldest first, at most {@link OUTBOX_DEAD_LIST_MAX}. */
+    async list() {
+        const rows = await this.db.db
+            .selectFrom("outbox")
+            .select([
+            "id",
+            "queue",
+            "job_name",
+            "job_id",
+            "org_id",
+            "attempts",
+            "last_error",
+            "dead_at",
+            "created_at",
+        ])
+            .where("dead_at", "is not", null)
+            .orderBy("dead_at")
+            .orderBy("id")
+            .limit(OUTBOX_DEAD_LIST_MAX)
+            .execute();
+        return {
+            items: rows.map((r) => ({
+                id: String(r.id),
+                queue: r.queue,
+                jobName: r.job_name,
+                jobId: r.job_id,
+                orgId: r.org_id,
+                attempts: r.attempts,
+                lastError: r.last_error,
+                deadAt: r.dead_at.toISOString(),
+                createdAt: r.created_at.toISOString(),
+            })),
+        };
+    }
+    /** How many rows are dead, and the oldest one's `dead_at`. */
+    async summary() {
+        const row = await this.db.db
+            .selectFrom("outbox")
+            .select([sql `count(*)`.as("count"), sql `min(dead_at)`.as("oldest")])
+            .where("dead_at", "is not", null)
+            .executeTakeFirstOrThrow();
+        return { count: Number(row.count), oldestAt: row.oldest };
+    }
+    /**
+     * Makes a dead row due again (`dead_at` cleared, no attempts, next attempt now) and hands it to
+     * the fast path after the commit; the relay delivers it otherwise. When the same (queue, job id)
+     * is owed by a pending row already, the dead row is deleted instead (`already_owed`). A pending
+     * row added between the check and the update fails the update on the unique index: the retry
+     * then runs once more and takes the `already_owed` branch. `outbox.not_found` (404) when no dead
+     * row has the id.
+     */
+    async retry(id, actor, detail = {}) {
+        try {
+            return await this.retryOnce(id, actor, detail);
+        }
+        catch (e) {
+            if (!isPendingConflict(e))
+                throw e;
+            return this.retryOnce(id, actor, detail);
+        }
+    }
+    async retryOnce(id, actor, detail) {
+        const row = await this.lockDead(id);
+        const owed = await this.db.db
+            .selectFrom("outbox")
+            .select("id")
+            .where("queue", "=", row.queue)
+            .where("job_id", "=", row.job_id)
+            .where("dead_at", "is", null)
+            .executeTakeFirst();
+        let outcome;
+        if (owed) {
+            await this.db.db.deleteFrom("outbox").where("id", "=", id).execute();
+            outcome = "already_owed";
+        }
+        else {
+            await this.db.db
+                .updateTable("outbox")
+                .set({ dead_at: null, attempts: 0, next_attempt_at: sql `now()` })
+                .where("id", "=", id)
+                .execute();
+            outcome = "retried";
+            afterCommit(() => this.fastPath([id]));
+        }
+        await this.audit("outbox.retried", id, row, actor, { outcome, ...detail });
+        return { outcome };
+    }
+    /** Deletes a dead row: its job is never delivered. `outbox.not_found` (404) when none. */
+    async discard(id, actor, detail = {}) {
+        const row = await this.lockDead(id);
+        await this.db.db.deleteFrom("outbox").where("id", "=", id).execute();
+        await this.audit("outbox.discarded", id, row, actor, detail);
+    }
+    /** The dead row `id`, locked for the transaction; `outbox.not_found` when it is not dead. */
+    async lockDead(id) {
+        const row = await this.db.db
+            .selectFrom("outbox")
+            .select(["queue", "job_name", "job_id", "org_id", "attempts", "last_error"])
+            .where("id", "=", id)
+            .where("dead_at", "is not", null)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row)
+            throw notFound(id);
+        return row;
+    }
+    /** A platform-level audit event (no org: the outbox is the deployment's), naming the job. */
+    audit(action, id, row, actor, detail) {
+        return audit(this.db.db, {
+            actorAccountId: actor.accountId,
+            ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+            action,
+            target: id,
+            detail: {
+                queue: row.queue,
+                jobName: row.job_name,
+                jobId: row.job_id,
+                ...(row.org_id !== null && { orgId: row.org_id }),
+                ...detail,
+            },
+        });
+    }
+};
+__decorate([
+    Transactional()
+], OutboxDeadService.prototype, "retryOnce", null);
+__decorate([
+    Transactional()
+], OutboxDeadService.prototype, "discard", null);
+OutboxDeadService = __decorate([
+    Injectable(),
+    __param(0, Inject(TransactionHost)),
+    __param(1, Inject(KernelDb)),
+    __param(2, Inject(OUTBOX_FAST_PATH))
+], OutboxDeadService);
+export { OutboxDeadService };

package/dist/admin/overview.service.d.ts

@@ -9,6 +9,8 @@ import { AccountsService } from "../identity/accounts.js";
 import { PlatformInboxService } from "../inbox/platform-inbox.service.js";
 import { OrgsService } from "../orgs/orgs.service.js";
 import { ProviderRegistry, type ProviderStatus } from "../runtime/providers.js";
+import { QueueLostJobs } from "../runtime/queue-lost-jobs.js";
+import { OutboxDeadService } from "./outbox-dead.service.js";
 /** The most rows each attention list returns; the rest are counted in `more`. */
 export declare const ATTENTION_LIST_MAX = 20;
 /** The admin overview's numbers (`GET /api/v1/admin/overview`): counts only. */
@@ -17,7 +19,8 @@ export interface AdminOverviewStats {
     accounts: number;
     /**
      * What waits for a super admin: the platform inbox total plus the extensions, plugin updates and
-     * model providers of {@link AdminAttention} (each counted in full, not capped).
+     * model providers of {@link AdminAttention} (each counted in full, not capped), every dead
+     * outbox row and the run queue's lost-jobs item.
      */
     attentionTotal: number;
     /** An attention source could not be read: `attentionTotal` leaves its items out. */
@@ -33,7 +36,7 @@ export type AttentionExtensionReason = "config" | "load_failed" | "approval" | "
 /** What is wrong with a model provider: its model list failed, or it lists no usable chat model. */
 export type AttentionProviderProblem = "list_failed" | "no_chat_model";
 /** An attention list a source failed to read (it is then empty, the others intact). */
-export type AttentionSource = "extensions" | "updates" | "providers";
+export type AttentionSource = "extensions" | "updates" | "providers" | "outbox" | "queue";
 export interface AttentionExtension {
     name: string;
     displayName: LocalizedName | null;
@@ -61,6 +64,27 @@ export interface AttentionProvider {
     icon: string | null;
     problem: AttentionProviderProblem;
 }
+/**
+ * Background work the kernel could not queue (transactional outbox spec §3.4): how many outbox
+ * rows are dead and the oldest one's `dead_at`. One item for all of them; the rows themselves are
+ * `GET /api/v1/admin/outbox/dead`.
+ */
+export interface AttentionOutboxDead {
+    kind: "outbox_dead";
+    count: number;
+    oldestAt: string;
+}
+/**
+ * The run queue lost background jobs (transactional outbox spec §8.3): the `run-orphan-check`
+ * found queued runs whose job was neither in the queue nor owed, which only Redis losing data
+ * explains. Their jobs were added again; the item says Redis durability needs a look, how many
+ * jobs were lost and when last (it stays a week after the last loss).
+ */
+export interface AttentionQueueLostJobs {
+    kind: "queue_lost_jobs";
+    count: number;
+    lastAt: string;
+}
 /**
  * `GET /api/v1/admin/overview/attention` (spec §5.2, §9): what needs a super admin besides the
  * inbox, each list at most {@link ATTENTION_LIST_MAX} rows with the rest counted in `more`, and
@@ -71,6 +95,10 @@ export interface AdminAttention {
     extensions: AttentionExtension[];
     updates: AttentionUpdate[];
     providers: AttentionProvider[];
+    /** System items: at most one, `outbox_dead`, when some outbox rows are dead. */
+    outbox: AttentionOutboxDead[];
+    /** System items: at most one, `queue_lost_jobs`, when the run queue lost jobs this week. */
+    queue: AttentionQueueLostJobs[];
     more: Record<AttentionSource, number>;
     unavailable: AttentionSource[];
 }
@@ -81,8 +109,9 @@ export declare function providerProblem(p: ProviderStatus): AttentionProviderPro
 /**
  * The admin overview (spec §4.1, §5.2): its numbers and the 待处理 lists, read live from the
  * sources the admin pages read (`ExtensionAdmin`, the catalog, the provider registry's cached
- * lists). Each source is read on its own: a failing one is reported in `unavailable`. Reads are not
- * audited (decision D5) and not cached further (every source is PG or already Redis-cached).
+ * lists, the dead outbox rows, the run queue's lost-jobs canary). Each source is read on its own: a failing one is reported in
+ * `unavailable`. Reads are not audited (decision D5) and not cached further (every source is PG
+ * or already Redis-cached).
  */
 export declare class AdminOverviewService {
     private readonly extensions;
@@ -94,10 +123,16 @@ export declare class AdminOverviewService {
     private readonly orgs;
     private readonly accounts;
     private readonly marketplaces;
+    private readonly outboxDead;
+    private readonly lostJobs;
     private readonly log;
-    constructor(extensions: ExtensionAdmin, catalog: CatalogService, registry: ProviderRegistry, displayNames: ExtensionDisplayNames, icons: PluginIcons, inbox: PlatformInboxService, orgs: OrgsService, accounts: AccountsService, marketplaces: MarketplacesService, log: Logger);
+    constructor(extensions: ExtensionAdmin, catalog: CatalogService, registry: ProviderRegistry, displayNames: ExtensionDisplayNames, icons: PluginIcons, inbox: PlatformInboxService, orgs: OrgsService, accounts: AccountsService, marketplaces: MarketplacesService, outboxDead: OutboxDeadService, lostJobs: Pick<QueueLostJobs, "summary">, log: Logger);
     stats(): Promise<AdminOverviewStats>;
     attention(): Promise<AdminAttention>;
+    /** The `queue_lost_jobs` item when the run queue lost jobs this week, else none. */
+    private queueRows;
+    /** The `outbox_dead` item when some outbox rows are dead, else none. */
+    private outboxRows;
     /**
      * The extensions needing a look, but not one pending approval whose plugin waits in the platform
      * inbox (a permission confirmation or an org upload: the inbox already lists and counts it). A