@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/dist/catalog/plugin-upgrade.d.ts

@@ -178,14 +178,14 @@ export type UpdateTarget = VersionRow;
  *   the extension first (`ExtensionAdminOps.install`, enabled when the update installs it; added
  *   permissions wait for the admin's approval as for any extension upgrade), then one transaction
  *   under the item name's lock that recomputes the diff (`plugin.upgrade_stale` on a difference)
- *   and writes the platform versions (`PlatformComponents.syncFromVersion`, which records
+ *   and writes the platform versions (`PlatformComponents.applySyncIn`, which records
  *   `platform_synced_version`), the removals (a component no agent uses is soft-deleted, so
  *   unpinned linked copies go with it; pinned copies keep their own version; a removed connector
  *   template leaves its connectors as the orgs' own), clears the pins of linked copies, fans
  *   changed templates out to every connector made from them (`applyTemplateIn`, under each org's
  *   row lock, credentials cleared only for a changed credential shape), moves every org install to the version and audits
- *   `plugin.platform_updated`; the scope sync of the item and its dependencies is enqueued after
- *   the commit (orgs get new dependencies by rule 9). A failure rolls the transaction back and
+ *   `plugin.platform_updated`; the scope sync of the item and its dependencies is owed in that
+ *   transaction (orgs get new dependencies by rule 9). A failure rolls the transaction back and
  *   puts the extension back where it was (audit `plugin.platform_update_failed`, 502
  *   `plugin.upgrade_failed`); files copied to `deployment/platform/` stay unreferenced.
  * Storage is never read or written inside the transaction: the target's contents (and the
@@ -230,6 +230,13 @@ export declare class PlatformPluginUpdater {
     private get db();
     /** The update preview (see the class comment); writes nothing. */
     preview(itemId: string, version: string): Promise<PlatformUpdatePreview>;
+    /**
+     * The update preview of a version staged for import, not imported yet (the platform's import and
+     * update, `PlatformImportUpdate`): the same diff as {@link preview}, with the target read from the
+     * staging (`target`, whose files are where the import's version row will point), so the
+     * `diffHash` is the one {@link updateHeld} recomputes after the import. Writes nothing.
+     */
+    previewStaged(itemId: string, version: string, target: UpdateTarget): Promise<PlatformUpdatePreview>;
     /** The preview of a diff with the template guides it changes. */
     private withGuideChanges;
     /**
@@ -292,6 +299,17 @@ export declare class PlatformPluginUpdater {
      * upload runs every step under it (ruling P3-35).
      */
     withItemLock<T>(itemId: string, f: () => Promise<T>): Promise<T>;
+    /**
+     * {@link update} for a caller already holding the item's update lock ({@link withItemLock}):
+     * the platform's import and update runs its import and this update under one hold.
+     */
+    updateHeld(actor: string, itemId: string, input: {
+        version: string;
+        diffHash: string;
+    }, opts?: {
+        actorTokenId?: string;
+        auditDetail?: Record<string, unknown>;
+    }): Promise<PlatformUpdateResult>;
     /**
      * Runs an update confirmed with the preview's `diffHash` (see the class comment). A version an
      * org upload waits with, or an item whose first version waits, -> 409 `catalog.item_pending`
@@ -345,7 +363,7 @@ export declare class PlatformPluginUpdater {
     /**
      * Other platform plugins depending on this one must accept the target (their platform version's
      * dependency range); returns the catalog items of the target's own dependencies (their scope
-     * sync is enqueued after the update: rule 9).
+     * sync is owed with the update: rule 9).
      */
     private checkDependents;
     /** The plugin's live platform components with their current versions. */

package/dist/catalog/plugin-upgrade.js

@@ -26,7 +26,6 @@ import { audit } from "../identity/audit.js";
 import { SuperAdminLock } from "../identity/super-admin.js";
 import { addOrgNotice, itemDisplayName, notifySharedUpdate } from "../inbox/org-notices.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -105,14 +104,14 @@ const filesDigest = (row) => skillFilesDigest(row.files.map((f) => ({ path: f.pa
  *   the extension first (`ExtensionAdminOps.install`, enabled when the update installs it; added
  *   permissions wait for the admin's approval as for any extension upgrade), then one transaction
  *   under the item name's lock that recomputes the diff (`plugin.upgrade_stale` on a difference)
- *   and writes the platform versions (`PlatformComponents.syncFromVersion`, which records
+ *   and writes the platform versions (`PlatformComponents.applySyncIn`, which records
  *   `platform_synced_version`), the removals (a component no agent uses is soft-deleted, so
  *   unpinned linked copies go with it; pinned copies keep their own version; a removed connector
  *   template leaves its connectors as the orgs' own), clears the pins of linked copies, fans
  *   changed templates out to every connector made from them (`applyTemplateIn`, under each org's
  *   row lock, credentials cleared only for a changed credential shape), moves every org install to the version and audits
- *   `plugin.platform_updated`; the scope sync of the item and its dependencies is enqueued after
- *   the commit (orgs get new dependencies by rule 9). A failure rolls the transaction back and
+ *   `plugin.platform_updated`; the scope sync of the item and its dependencies is owed in that
+ *   transaction (orgs get new dependencies by rule 9). A failure rolls the transaction back and
  *   puts the extension back where it was (audit `plugin.platform_update_failed`, 502
  *   `plugin.upgrade_failed`); files copied to `deployment/platform/` stay unreferenced.
  * Storage is never read or written inside the transaction: the target's contents (and the
@@ -176,6 +175,18 @@ let PlatformPluginUpdater = class PlatformPluginUpdater {
     async preview(itemId, version) {
         return this.withGuideChanges(await this.diff(itemId, version));
     }
+    /**
+     * The update preview of a version staged for import, not imported yet (the platform's import and
+     * update, `PlatformImportUpdate`): the same diff as {@link preview}, with the target read from the
+     * staging (`target`, whose files are where the import's version row will point), so the
+     * `diffHash` is the one {@link updateHeld} recomputes after the import. Writes nothing.
+     */
+    async previewStaged(itemId, version, target) {
+        if (target.version !== version) {
+            throw new Error(`internal: previewStaged got the staged target of version ${target.version} for version ${version}`);
+        }
+        return this.withGuideChanges(await this.diff(itemId, version, { target }));
+    }
     /** The preview of a diff with the template guides it changes. */
     async withGuideChanges(d) {
         return {
@@ -335,6 +346,13 @@ let PlatformPluginUpdater = class PlatformPluginUpdater {
             throw itemNotFound();
         return this.locked(itemId, f);
     }
+    /**
+     * {@link update} for a caller already holding the item's update lock ({@link withItemLock}):
+     * the platform's import and update runs its import and this update under one hold.
+     */
+    async updateHeld(actor, itemId, input, opts = {}) {
+        return this.updateLocked(actor, itemId, input, opts);
+    }
     /**
      * Runs an update confirmed with the preview's `diffHash` (see the class comment). A version an
      * org upload waits with, or an item whose first version waits, -> 409 `catalog.item_pending`
@@ -650,20 +668,9 @@ let PlatformPluginUpdater = class PlatformPluginUpdater {
                 ...opts.auditDetail,
             },
         });
-        const enqueue = [itemId, ...diff.dependencies];
-        afterCommit(async () => {
-            for (const id of enqueue) {
-                try {
-                    await this.sync.enqueueItem(id);
-                }
-                catch (err) {
-                    this.log.warn("enqueueing the scope sync after a platform update failed", {
-                        itemId: id,
-                        err,
-                    });
-                }
-            }
-        });
+        // The scope sync of the item and its dependencies is owed with the update (outbox spec §8.1)
+        for (const id of [itemId, ...diff.dependencies])
+            await this.sync.enqueueItem(id);
         return diff;
     }
     /**
@@ -1321,7 +1328,7 @@ let PlatformPluginUpdater = class PlatformPluginUpdater {
     /**
      * Other platform plugins depending on this one must accept the target (their platform version's
      * dependency range); returns the catalog items of the target's own dependencies (their scope
-     * sync is enqueued after the update: rule 9).
+     * sync is owed with the update: rule 9).
      */
     async checkDependents(name, to) {
         const rows = await this.db

package/dist/catalog/scope-jobs.d.ts

@@ -0,0 +1,59 @@
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import type { OutboxService } from "../infra/outbox/outbox.service.js";
+/**
+ * The plugin scope sync's jobs as the outbox owes them (transactional outbox spec §8.1): a leaf
+ * module (type imports only), so the import confirm (`PluginImport`, below the scope service) and
+ * the CLI owe them without the sync. `scope-sync.ts` (the consumer side) re-exports these names.
+ */
+/** The scope sync queue (no `:` in the name). */
+export declare const PLUGIN_SCOPE_QUEUE = "cap-kernel-plugin-scope";
+/** The job converging one item in every org. */
+export declare const SCOPE_ITEM_JOB = "scope-item";
+/** The job converging every item in one org. */
+export declare const SCOPE_ORG_JOB = "scope-org";
+/**
+ * The delayed backstop of an item job owed by a confirmation's commit (ruling R24): it converges
+ * the item as {@link SCOPE_ITEM_JOB} does once the extension is deployed, and fails (BullMQ
+ * retries it with its backoff) while the extension is not enabled on the deployment yet.
+ */
+export declare const SCOPE_BACKSTOP_JOB = "scope-item-backstop";
+/** How long after the confirmation's commit the backstop runs (the deploy has finished by then). */
+export declare const SCOPE_BACKSTOP_DELAY_MS: number;
+/**
+ * Optional provider (a test seam): the backstop's delay (ms) instead of
+ * {@link SCOPE_BACKSTOP_DELAY_MS}, so a long test file never has a backstop fire in a later test.
+ */
+export declare const SCOPE_BACKSTOP_DELAY: unique symbol;
+/** One item job per scope version (no `:`: item ids are UUIDs). */
+export declare const scopeItemJobId: (itemId: string, version: number) => string;
+/** The backstop of the item job of a scope version (distinct from the immediate one). */
+export declare const scopeBackstopJobId: (itemId: string, version: number) => string;
+/** One org job at a time per org. */
+export declare const scopeOrgJobId: (orgId: string) => string;
+/**
+ * The delayed retry `n` of an item job whose extension this replica had not loaded yet (ruling
+ * P3-38); deterministic, so replicas deferring the same item add it once.
+ */
+export declare const scopeRetryJobId: (itemId: string, version: number, n: number) => string;
+/**
+ * The job's data. `retry`: the item job's delayed retry number (P3-38). `backstop`: a
+ * {@link SCOPE_BACKSTOP_JOB}.
+ */
+export type ScopeJob = {
+    kind: "item";
+    itemId: string;
+    retry?: number;
+    backstop?: true;
+} | {
+    kind: "org";
+    orgId: string;
+};
+/**
+ * Owes the item's scope sync in the transaction in context, once per scope version (read in that
+ * transaction, so after its own bump); `backstop` owes the delayed backstop instead, due
+ * `backstopDelayMs` later (default {@link SCOPE_BACKSTOP_DELAY_MS}). A missing item owes nothing.
+ */
+export declare function oweScopeItem(outbox: Pick<OutboxService, "add">, db: KernelSchemaDb, itemId: string, opts?: {
+    backstop?: boolean;
+    backstopDelayMs?: number;
+}): Promise<void>;

package/dist/catalog/scope-jobs.js

@@ -0,0 +1,65 @@
+/**
+ * The plugin scope sync's jobs as the outbox owes them (transactional outbox spec §8.1): a leaf
+ * module (type imports only), so the import confirm (`PluginImport`, below the scope service) and
+ * the CLI owe them without the sync. `scope-sync.ts` (the consumer side) re-exports these names.
+ */
+/** The scope sync queue (no `:` in the name). */
+export const PLUGIN_SCOPE_QUEUE = "cap-kernel-plugin-scope";
+/** The job converging one item in every org. */
+export const SCOPE_ITEM_JOB = "scope-item";
+/** The job converging every item in one org. */
+export const SCOPE_ORG_JOB = "scope-org";
+/**
+ * The delayed backstop of an item job owed by a confirmation's commit (ruling R24): it converges
+ * the item as {@link SCOPE_ITEM_JOB} does once the extension is deployed, and fails (BullMQ
+ * retries it with its backoff) while the extension is not enabled on the deployment yet.
+ */
+export const SCOPE_BACKSTOP_JOB = "scope-item-backstop";
+/** How long after the confirmation's commit the backstop runs (the deploy has finished by then). */
+export const SCOPE_BACKSTOP_DELAY_MS = 5 * 60_000;
+/**
+ * Optional provider (a test seam): the backstop's delay (ms) instead of
+ * {@link SCOPE_BACKSTOP_DELAY_MS}, so a long test file never has a backstop fire in a later test.
+ */
+export const SCOPE_BACKSTOP_DELAY = Symbol("SCOPE_BACKSTOP_DELAY");
+/** One item job per scope version (no `:`: item ids are UUIDs). */
+export const scopeItemJobId = (itemId, version) => `scope-item-${itemId}-${version}`;
+/** The backstop of the item job of a scope version (distinct from the immediate one). */
+export const scopeBackstopJobId = (itemId, version) => `${scopeItemJobId(itemId, version)}-backstop`;
+/** One org job at a time per org. */
+export const scopeOrgJobId = (orgId) => `scope-org-${orgId}`;
+/**
+ * The delayed retry `n` of an item job whose extension this replica had not loaded yet (ruling
+ * P3-38); deterministic, so replicas deferring the same item add it once.
+ */
+export const scopeRetryJobId = (itemId, version, n) => `scope-item-${itemId}-${version}-r${n}`;
+/**
+ * Owes the item's scope sync in the transaction in context, once per scope version (read in that
+ * transaction, so after its own bump); `backstop` owes the delayed backstop instead, due
+ * `backstopDelayMs` later (default {@link SCOPE_BACKSTOP_DELAY_MS}). A missing item owes nothing.
+ */
+export async function oweScopeItem(outbox, db, itemId, opts = {}) {
+    const row = await db
+        .selectFrom("catalog_items")
+        .select("scope_version")
+        .where("id", "=", itemId)
+        .executeTakeFirst();
+    if (!row)
+        return;
+    if (opts.backstop === true) {
+        await outbox.add({
+            queue: PLUGIN_SCOPE_QUEUE,
+            name: SCOPE_BACKSTOP_JOB,
+            jobId: scopeBackstopJobId(itemId, row.scope_version),
+            data: { kind: "item", itemId, backstop: true },
+            runAt: new Date(Date.now() + (opts.backstopDelayMs ?? SCOPE_BACKSTOP_DELAY_MS)),
+        });
+        return;
+    }
+    await outbox.add({
+        queue: PLUGIN_SCOPE_QUEUE,
+        name: SCOPE_ITEM_JOB,
+        jobId: scopeItemJobId(itemId, row.scope_version),
+        data: { kind: "item", itemId },
+    });
+}

package/dist/catalog/scope-sync-workers.d.ts

@@ -1,3 +1,25 @@
+import { WorkerHost } from "@nestjs/bullmq";
+import type { Job, Worker } from "bullmq";
+import type { KernelLogger } from "../log.js";
+import { PluginScopeSync, type ScopeJob } from "./scope-sync.js";
+/**
+ * The consumer of {@link PLUGIN_SCOPE_QUEUE}: {@link PluginScopeSync} runs the `scope-item`,
+ * `scope-item-backstop` and `scope-org` jobs the outbox delivers (any other name fails the job; a
+ * backstop whose extension is not deployed yet throws, so BullMQ retries it).
+ */
+export declare class PluginScopeSyncProcessor extends WorkerHost<Worker<ScopeJob>> {
+    private readonly sync;
+    private readonly log;
+    private readonly stopping;
+    constructor(sync: PluginScopeSync, log: Pick<KernelLogger, "error">);
+    process(job: Job<ScopeJob>): Promise<void>;
+    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
+    start(): void;
+    /** Stops between pairs and closes the worker. */
+    close(): Promise<void>;
+    failed(job: Job<ScopeJob> | undefined, err: Error): void;
+    error(err: Error): void;
+}
 /**
  * The plugin scope queue's consumer: {@link PluginScopeSyncProcessor}. Imported only by the worker
  * role (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by

package/dist/catalog/scope-sync-workers.js

@@ -4,10 +4,66 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { Module } from "@nestjs/common";
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
+import { Inject, Injectable, Module } from "@nestjs/common";
 import { configuredProcessor } from "../infra/queue/configured-processor.js";
+import { runJob } from "../infra/queue/run-job.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { CatalogModule } from "./catalog.module.js";
-import { PLUGIN_SCOPE_CONCURRENCY, PLUGIN_SCOPE_QUEUE, PluginScopeSyncProcessor, } from "./scope-sync.js";
+import { PLUGIN_SCOPE_CONCURRENCY, PLUGIN_SCOPE_QUEUE, PluginScopeSync, SCOPE_BACKSTOP_JOB, SCOPE_ITEM_JOB, SCOPE_ORG_JOB, } from "./scope-sync.js";
+/**
+ * The consumer of {@link PLUGIN_SCOPE_QUEUE}: {@link PluginScopeSync} runs the `scope-item`,
+ * `scope-item-backstop` and `scope-org` jobs the outbox delivers (any other name fails the job; a
+ * backstop whose extension is not deployed yet throws, so BullMQ retries it).
+ */
+let PluginScopeSyncProcessor = class PluginScopeSyncProcessor extends WorkerHost {
+    sync;
+    log;
+    stopping = new AbortController();
+    constructor(sync, log) {
+        super();
+        this.sync = sync;
+        this.log = log;
+    }
+    process(job) {
+        return runJob(PLUGIN_SCOPE_QUEUE, job, () => {
+            if (![SCOPE_ITEM_JOB, SCOPE_BACKSTOP_JOB, SCOPE_ORG_JOB].includes(job.name)) {
+                throw new Error(`unknown plugin scope job ${job.name}`);
+            }
+            return this.sync.process(job.data, this.stopping.signal);
+        });
+    }
+    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
+    start() {
+        void this.worker.run().catch((err) => this.error(err));
+    }
+    /** Stops between pairs and closes the worker. */
+    async close() {
+        this.stopping.abort();
+        await this.worker.close();
+    }
+    failed(job, err) {
+        this.log.error("plugin scope job failed", { name: job?.name, jobId: job?.id, err });
+    }
+    error(err) {
+        this.log.error("plugin scope worker error", { err });
+    }
+};
+__decorate([
+    OnWorkerEvent("failed")
+], PluginScopeSyncProcessor.prototype, "failed", null);
+__decorate([
+    OnWorkerEvent("error")
+], PluginScopeSyncProcessor.prototype, "error", null);
+PluginScopeSyncProcessor = __decorate([
+    Injectable(),
+    __param(0, Inject(PluginScopeSync)),
+    __param(1, Inject(KERNEL_LOGGER))
+], PluginScopeSyncProcessor);
+export { PluginScopeSyncProcessor };
 /**
  * The plugin scope queue's consumer: {@link PluginScopeSyncProcessor}. Imported only by the worker
  * role (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by

package/dist/catalog/scope-sync.d.ts

@@ -1,13 +1,12 @@
-import { WorkerHost } from "@nestjs/bullmq";
-import type { Job, Queue, Worker } from "bullmq";
 import { ExtensionLifecycle } from "../extensions/lifecycle.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { LockService } from "../infra/lock/lock.service.js";
-import type { OneJob } from "../infra/queue/add-job-once.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
 import { PluginInstaller } from "./plugin-install.js";
+import { type ScopeJob } from "./scope-jobs.js";
 /**
  * The plugin scope sync (plugin and component management spec §5, phase 1): converges every org
  * to each platform plugin's scope. In phase 1 "on in an org" is the org's plugin install, so for
@@ -30,55 +29,29 @@ import { PluginInstaller } from "./plugin-install.js";
  * super admin's inbox, until a later sync of the pair does not fail) and not retried until the next
  * enqueue. An error outside those steps (a read, the failure write itself) ends the attempt without
  * touching the pair's row, so an older failure stays open.
- * Every worker start enqueues every live item once ({@link PluginScopeSync.enqueueAll}), which
- * also catches a lost enqueue.
  *
  * Jobs (queue {@link PLUGIN_SCOPE_QUEUE}): one per item and scope version
  * (`scope-item-<itemId>-<scope_version>`, every org), one per org (`scope-org-<orgId>`, every item,
- * enqueued after the org is created). Both are removed when done, so the next enqueue with the same
+ * owed by the org's creation). Both are owed in the outbox by the transaction that changes what
+ * they converge to (transactional outbox spec §8.1), so none is lost; a migration that changes a
+ * scope inserts its outbox rows itself. A confirmation (import, permissions, org upload) owes the
+ * immediate item job after its deploy and, in its commit, a backstop `scope-item-backstop` due
+ * five minutes later (ruling R24) that waits, retrying, for the extension to be enabled. Both are removed when done, so the next add with the same
  * id is not swallowed. Pairs of one org are serialized across replicas by a Redis lock per org; the
  * installer's org row lock and its one-live-install rule are the backstop.
  */
-/** The scope sync queue (no `:` in the name). */
-export declare const PLUGIN_SCOPE_QUEUE = "cap-kernel-plugin-scope";
-/** The job converging one item in every org. */
-export declare const SCOPE_ITEM_JOB = "scope-item";
-/** The job converging every item in one org. */
-export declare const SCOPE_ORG_JOB = "scope-org";
-/** One item job per scope version (no `:`: item ids are UUIDs). */
-export declare const scopeItemJobId: (itemId: string, version: number) => string;
-/** One org job at a time per org. */
-export declare const scopeOrgJobId: (orgId: string) => string;
-/**
- * The delayed retry `n` of an item job whose extension this replica had not loaded yet (ruling
- * P3-38); deterministic, so replicas deferring the same item add it once.
- */
-export declare const scopeRetryJobId: (itemId: string, version: number, n: number) => string;
+export { PLUGIN_SCOPE_QUEUE, SCOPE_BACKSTOP_DELAY, SCOPE_BACKSTOP_DELAY_MS, SCOPE_BACKSTOP_JOB, SCOPE_ITEM_JOB, SCOPE_ORG_JOB, type ScopeJob, scopeBackstopJobId, scopeItemJobId, scopeOrgJobId, scopeRetryJobId, } from "./scope-jobs.js";
 /** How many delayed retries an item job gets while its extension is not loaded here (P3-38). */
 export declare const SCOPE_LOAD_RETRIES = 6;
 /** The delay of each such retry. */
 export declare const SCOPE_LOAD_RETRY_DELAY_MS = 5000;
 /** How long a pair waits for this replica's reconcile before deferring (P3-38). */
 export declare const SCOPE_RECONCILE_WAIT_MS = 10000;
-/**
- * The job's data. `retry`: the item job's delayed retry number (P3-38); at
- * {@link SCOPE_LOAD_RETRIES} an extension still not loaded is a failure as before.
- */
-export type ScopeJob = {
-    kind: "item";
-    itemId: string;
-    retry?: number;
-} | {
-    kind: "org";
-    orgId: string;
-};
 /**
  * Awaits this replica's extension reconcile for at most `ms` (a slower one carries on in the
  * background); a failure only warns.
  */
 export declare function reconcileWithin(lifecycle: Pick<ExtensionLifecycle, "reconcile">, reason: string, ms: number, log: Pick<KernelLogger, "warn">): Promise<void>;
-/** The item job of a scope version (what {@link PluginScopeSync.enqueueItem} adds). */
-export declare function scopeItemJob(itemId: string, version: number): OneJob<ScopeJob>;
 /**
  * What a sync of one (item, org) did. `deferred`: the plugin's extension is enabled on the
  * deployment but not loaded on this replica yet (P3-38); the item job retries later.
@@ -88,7 +61,7 @@ export type ScopeSyncResult = "installed" | "removed" | "needs_config" | "unchan
 export declare const PLUGIN_SCOPE_CONCURRENCY = 2;
 export declare class PluginScopeSync {
     private readonly kdb;
-    private readonly queue;
+    private readonly outbox;
     private readonly installer;
     private readonly registry;
     /** This replica's reconcile, awaited (bounded) before deferring an install (P3-38). */
@@ -96,23 +69,44 @@ export declare class PluginScopeSync {
     private readonly locks;
     private readonly log;
     readonly txHost: TransactionHost;
-    constructor(kdb: KernelDb, queue: Queue<ScopeJob>, installer: PluginInstaller, registry: ExtensionRegistry, 
+    /** The backstop's delay (a test seam; default {@link SCOPE_BACKSTOP_DELAY_MS}). */
+    private readonly backstopDelayMs;
+    constructor(kdb: KernelDb, outbox: Pick<OutboxService, "add">, installer: PluginInstaller, registry: ExtensionRegistry, 
     /** This replica's reconcile, awaited (bounded) before deferring an install (P3-38). */
-    lifecycle: ExtensionLifecycle, locks: LockService, log: KernelLogger, txHost: TransactionHost);
+    lifecycle: ExtensionLifecycle, locks: LockService, log: KernelLogger, txHost: TransactionHost, 
+    /** The backstop's delay (a test seam; default {@link SCOPE_BACKSTOP_DELAY_MS}). */
+    backstopDelayMs?: number);
     private get db();
-    /** Enqueues the sync of an item in every org, once per scope version. Call after the commit. */
+    /**
+     * Owes the sync of an item in every org, once per scope version (the version read in the
+     * caller's transaction, so after its own bump), in the transaction that changes the scope.
+     */
     enqueueItem(itemId: string): Promise<void>;
     /**
-     * Enqueues the sync of every live, not builtin item (a worker start): retries what failed or was
-     * never enqueued (a lost `afterCommit` enqueue, a migrated scope). The job ids are the items'
-     * scope versions, so replicas starting together add each one once.
+     * Owes the delayed backstop of the item's sync (ruling R24) in the transaction in context: a
+     * confirmation owes it before (or with) its deploy, so a crash before its post-deploy add still
+     * converges the orgs.
      */
-    enqueueAll(): Promise<void>;
-    /** Enqueues the sync of every item in an org (a new org). Call after the commit. */
+    enqueueBackstop(itemId: string): Promise<void>;
+    /** Owes the sync of every item in an org, in the transaction that creates the org. */
     enqueueOrg(orgId: string): Promise<void>;
-    /** One job: every org of an item, or every item of an org; `signal` stops between pairs. */
+    /**
+     * One job: every org of an item, or every item of an org; `signal` stops between pairs. A
+     * backstop job first checks the item's extension is deployed ({@link assertDeployed}).
+     */
     process(data: ScopeJob, signal?: AbortSignal): Promise<void>;
-    /** The delayed retry `n` of an item job (deterministic id, P3-38). */
+    /**
+     * A backstop job (ruling R24) runs only once the item's extension is loaded here or enabled on
+     * the deployment; otherwise it throws, so BullMQ retries it with its backoff (bounded by its
+     * attempts) and no pair records a `catalog.not_deployed` failure that nothing would retry. An item without an
+     * extension, or one no longer live (deleted, disabled, still waiting, builtin), passes: its pairs
+     * converge (or change nothing) as for an immediate job.
+     */
+    private assertDeployed;
+    /**
+     * Owes the delayed retry `n` of an item job (deterministic id, P3-38) in a transaction of its
+     * own: the job's own follow-up, delivered by the relay once due.
+     */
     private enqueueRetry;
     /**
      * Whether the install of the item's `version` may go ahead on this replica (P3-38): its
@@ -155,22 +149,3 @@ export declare class PluginScopeSync {
     private failed;
     private recordFailure;
 }
-/** The consumer of {@link PLUGIN_SCOPE_QUEUE}: {@link PluginScopeSync}. */
-export declare class PluginScopeSyncProcessor extends WorkerHost<Worker<ScopeJob>> {
-    private readonly sync;
-    private readonly log;
-    private readonly stopping;
-    constructor(sync: PluginScopeSync, log: Pick<KernelLogger, "error">);
-    process(job: Job<ScopeJob>): Promise<void>;
-    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
-    start(): void;
-    /**
-     * Enqueues every live item's sync once (the worker role, after the start gate opened), in the
-     * background; a failure is only logged (the next worker start, or the next change, enqueues).
-     */
-    resync(): void;
-    /** Stops between pairs and closes the worker. */
-    close(): Promise<void>;
-    failed(job: Job<ScopeJob> | undefined, err: Error): void;
-    error(err: Error): void;
-}