@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/local-devices/machines.js

@@ -16,11 +16,14 @@ import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { LOCAL_PROVIDER } from "../sandbox/providers.js";
 import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceRevokedTopic } from "./keys.js";
-import { deviceFeaturesOf, isolationOf, localPolicyDiff, localPolicyOf, opExplains, pendingPolicyOpsOf, } from "./policy-summary.js";
+import { DEVICE_OP_RESOLVE_JOB, deviceOpReportedJobId } from "./policy-op-jobs.js";
+import { deviceFeaturesOf, isolationOf, localPolicyDiff, localPolicyOf, opExplains, opVisibleIn, pendingPolicyOpsOf, } from "./policy-summary.js";
 import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
@@ -42,12 +45,14 @@ let MachinesService = class MachinesService {
     txHost;
     relay;
     bus;
+    outbox;
     log;
-    constructor(db, txHost, relay, bus, log) {
+    constructor(db, txHost, relay, bus, outbox, log) {
         this.db = db;
         this.txHost = txHost;
         this.relay = relay;
         this.bus = bus;
+        this.outbox = outbox;
         this.log = log;
     }
     /**
@@ -164,7 +169,8 @@ let MachinesService = class MachinesService {
      * isolation that differs from the stored one (none stored counts as `sandbox`) is audited
      * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change; a change of what
      * the owner sets, made on the machine while it was away, is audited `device.policy_changed`
-     * ({@link reportedPolicy}).
+     * ({@link reportedPolicy}). The outcomes of its recent policy ops (`recentOps`) backfill the
+     * platform's ops still pending on the row ({@link backfillOps}).
      */
     async recordHello(machineId, hello, rawPolicy = hello.policy) {
         const self = await this.db
@@ -227,6 +233,61 @@ let MachinesService = class MachinesService {
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
             .execute();
+        if (hello.recentOps !== undefined) {
+            await this.backfillOps(machineId, self, hello.recentOps, localPolicyOf(hello.policy));
+        }
+    }
+    /**
+     * Hello backfill (transactional outbox spec §7): a pending op of the platform's whose outcome
+     * the hello reports (`applied`, `refused`), or that it does not list although the op can no
+     * longer reach the machine (`absent`: past its `resolveAt`), is marked `reported` and owes a
+     * `device-op-resolve` job (`device-op-reported-<opId>`) that records the outcome. An op the
+     * machine logged only as `started` (it stopped between the log and the answer) is judged once
+     * past its `resolveAt` by the policy the hello reports: its change there → `applied`, else
+     * `interrupted` (within the window, or with no readable policy, it is left). An expired entry
+     * (past `until`) is skipped: the machine's reports are no longer the op's. Runs in the caller's
+     * transaction, with the machine's row locked; an op already reported is not owed again.
+     */
+    async backfillOps(machineId, self, recentOps, policy) {
+        const outcomes = new Map(recentOps.map((r) => [r.opId, r.outcome]));
+        const now = Date.now();
+        const reported = new Map();
+        for (const op of pendingPolicyOpsOf(self.pending_policy_ops)) {
+            if (op.reported !== undefined || op.until <= now)
+                continue;
+            const outcome = outcomes.get(op.id);
+            if (outcome === "applied" || outcome === "refused")
+                reported.set(op.id, { outcome });
+            else if (now < op.resolveAt)
+                continue;
+            else if (outcome === undefined)
+                reported.set(op.id, { outcome: "absent" });
+            else if (policy !== null) {
+                reported.set(op.id, { outcome: opVisibleIn(op, policy) ? "applied" : "interrupted" });
+            }
+        }
+        if (reported.size === 0)
+            return;
+        const ops = Array.isArray(self.pending_policy_ops) ? self.pending_policy_ops : [];
+        const next = ops.map((e) => {
+            const id = e?.id;
+            const r = typeof id === "string" ? reported.get(id) : undefined;
+            return r === undefined ? e : { ...e, reported: r };
+        });
+        await this.db
+            .updateTable("device_machines")
+            .set({ pending_policy_ops: JSON.stringify(next) })
+            .where("id", "=", machineId)
+            .execute();
+        for (const opId of reported.keys()) {
+            await this.outbox.add({
+                queue: MAINTENANCE_QUEUE_NAME,
+                name: DEVICE_OP_RESOLVE_JOB,
+                jobId: deviceOpReportedJobId(opId),
+                data: { machineId, opId },
+                orgId: self.org_id,
+            });
+        }
     }
     /**
      * Stores the local policy summary a connected program pushed after its hello (a `policy` frame:
@@ -292,7 +353,6 @@ let MachinesService = class MachinesService {
                     via: "device",
                     machineId,
                     approvalId: null,
-                    confirmed: true,
                 },
             });
             return summary;
@@ -470,7 +530,8 @@ MachinesService = __decorate([
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(LocalDeviceRelay)),
     __param(3, Inject(KERNEL_BUS)),
-    __param(4, Inject(KERNEL_LOGGER))
+    __param(4, Inject(OutboxService)),
+    __param(5, Inject(KERNEL_LOGGER))
 ], MachinesService);
 export { MachinesService };
 const jsonOrNull = (v) => (v === null ? null : JSON.stringify(v));

package/dist/local-devices/policy-op-jobs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Settles a device policy op whose outcome was not recorded (transactional outbox spec §7): owed
+ * by the op's intent transaction for when the op can no longer reach the machine, and by a hello
+ * that reported its outcome. Consumed by `DeviceOpResolver` on the maintenance queue.
+ */
+export declare const DEVICE_OP_RESOLVE_JOB = "device-op-resolve";
+/** The `device-op-resolve` job's data. */
+export interface DeviceOpResolveData {
+    machineId: string;
+    opId: string;
+}
+/** The job id of the resolve job owed with an op's intent. */
+export declare const deviceOpResolveJobId: (opId: string) => string;
+/** The job id of the resolve job owed by a hello that reported the op's outcome. */
+export declare const deviceOpReportedJobId: (opId: string) => string;

package/dist/local-devices/policy-op-jobs.js

@@ -0,0 +1,12 @@
+// The device policy op jobs' names and ids: a leaf module (no service imports), read by the
+// producers (DevicePolicyService, MachinesService) and the maintenance processor.
+/**
+ * Settles a device policy op whose outcome was not recorded (transactional outbox spec §7): owed
+ * by the op's intent transaction for when the op can no longer reach the machine, and by a hello
+ * that reported its outcome. Consumed by `DeviceOpResolver` on the maintenance queue.
+ */
+export const DEVICE_OP_RESOLVE_JOB = "device-op-resolve";
+/** The job id of the resolve job owed with an op's intent. */
+export const deviceOpResolveJobId = (opId) => `device-op-resolve-${opId}`;
+/** The job id of the resolve job owed by a hello that reported the op's outcome. */
+export const deviceOpReportedJobId = (opId) => `device-op-reported-${opId}`;

package/dist/local-devices/policy-summary.d.ts

@@ -38,10 +38,28 @@ export interface LocalPolicyDiff {
 }
 /** The {@link LocalPolicyDiff} from `prev` to `next`; null when nothing the owner sets changed. */
 export declare function localPolicyDiff(prev: DeviceLocalPolicySummary, next: DeviceLocalPolicySummary): LocalPolicyDiff | null;
+/** Who asked for a `policy` op: the deciding account, where, and the network ask it answers. */
+export interface PolicyOpSource {
+    accountId: string;
+    via: "web" | "im";
+    approvalId: string | null;
+}
+/** What the machine reported of an op after its answer was lost (its hello's `recentOps`). */
+export interface ReportedPolicyOp {
+    /**
+     * `absent`: not in the hello's outcomes although the op can no longer reach the machine;
+     * `interrupted`: logged `started` only, and its change is not in the policy the hello reports
+     * (one whose change is there is `applied`).
+     */
+    outcome: "applied" | "refused" | "absent" | "interrupted";
+}
 /**
- * A `policy` op the platform sent to a machine whose answer may not be recorded yet (kept on the
- * machine's row, `pending_policy_ops`): the change asked for, and until when (epoch ms) a summary
- * the machine reports by itself may still be that op's.
+ * The intent of a `policy` op the platform sends to a machine (transactional outbox spec §7), kept
+ * on the machine's row (`pending_policy_ops`) from before the op is sent until its outcome is
+ * recorded: the change asked for, who asked, and until when (epoch ms) a summary the machine
+ * reports by itself may still be that op's. `sent`: on its way or in flight, the
+ * `device-op-resolve` job owed for `resolveAt`; `unknown`: no answer came, and only the machine's
+ * next hello (`recentOps`) or a later `policyStatus` can tell what became of it.
  */
 export interface PendingPolicyOp {
     id: string;
@@ -50,10 +68,25 @@ export interface PendingPolicyOp {
     /** Present when the op set the tier (null: follow the org's default). */
     tier?: SandboxTier | null;
     isolation?: "sandbox";
+    source: PolicyOpSource;
+    actorTokenId?: string;
+    status: "sent" | "unknown";
+    /** When the intent was written (epoch ms). */
+    sentAt: number;
+    /** From when the op can no longer reach the machine (epoch ms): the resolve job's `runAt`. */
+    resolveAt: number;
     until: number;
+    /** Set by a hello that reported the op's outcome (or its absence) before the op was resolved. */
+    reported?: ReportedPolicyOp;
 }
 /** The pending ops stored on a machine row (malformed entries dropped). */
 export declare function pendingPolicyOpsOf(v: unknown): PendingPolicyOp[];
+/**
+ * Whether the change of `op` is in `policy`: its hosts added and removed, its tier and isolation
+ * set. Tells an op the machine logged only as `started` (it stopped between the log and the
+ * answer) that was written from one that was not.
+ */
+export declare function opVisibleIn(op: PendingPolicyOp, policy: DeviceLocalPolicySummary): boolean;
 /**
  * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
  * before the answer was recorded): hosts within the op's, the tier the op set, and only what a

package/dist/local-devices/policy-summary.js

@@ -1,5 +1,10 @@
 import { isSandboxTier, } from "@capybara-hq/plugin-sdk";
-const KNOWN_FEATURES = ["networkReport", "policyOp", "tiers"];
+const KNOWN_FEATURES = [
+    "networkReport",
+    "policyOp",
+    "policyOpId",
+    "tiers",
+];
 /**
  * The known features in `v` (a hello's `features` or the stored column), in a fixed order and
  * deduped; anything else (unknown names, a non-array) is dropped.
@@ -99,17 +104,58 @@ export function pendingPolicyOpsOf(v) {
         const o = e;
         if (typeof o.id !== "string" || typeof o.until !== "number")
             continue;
+        if (typeof o.sentAt !== "number" || typeof o.resolveAt !== "number")
+            continue;
+        if (o.status !== "sent" && o.status !== "unknown")
+            continue;
+        const src = o.source;
+        if (typeof src !== "object" || src === null || typeof src.accountId !== "string")
+            continue;
+        if (src.via !== "web" && src.via !== "im")
+            continue;
+        const rep = o.reported;
+        const outcome = typeof rep === "object" && rep !== null ? rep.outcome : undefined;
+        const reported = outcome === "applied" ||
+            outcome === "refused" ||
+            outcome === "absent" ||
+            outcome === "interrupted"
+            ? { outcome }
+            : undefined;
         out.push({
             id: o.id,
             add: hosts(o.add),
             remove: hosts(o.remove),
             ...("tier" in o && { tier: isSandboxTier(o.tier) ? o.tier : null }),
             ...(o.isolation === "sandbox" && { isolation: "sandbox" }),
+            source: {
+                accountId: src.accountId,
+                via: src.via,
+                approvalId: typeof src.approvalId === "string" ? src.approvalId : null,
+            },
+            ...(typeof o.actorTokenId === "string" && { actorTokenId: o.actorTokenId }),
+            status: o.status,
+            sentAt: o.sentAt,
+            resolveAt: o.resolveAt,
             until: o.until,
+            ...(reported !== undefined && { reported }),
         });
     }
     return out;
 }
+/**
+ * Whether the change of `op` is in `policy`: its hosts added and removed, its tier and isolation
+ * set. Tells an op the machine logged only as `started` (it stopped between the log and the
+ * answer) that was written from one that was not.
+ */
+export function opVisibleIn(op, policy) {
+    if (!op.add.every((h) => policy.allowedDomains.includes(h)))
+        return false;
+    if (op.remove.some((h) => policy.allowedDomains.includes(h)))
+        return false;
+    if (op.tier !== undefined && (policy.tier ?? null) !== op.tier)
+        return false;
+    return op.isolation === undefined || policy.isolation === op.isolation;
+}
 /**
  * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
  * before the answer was recorded): hosts within the op's, the tier the op set, and only what a

package/dist/orgs/directory-sync.js

@@ -611,7 +611,7 @@ let DirectorySync = class DirectorySync {
         if (row?.source !== source)
             return undefined;
         const result = await this.offboarding.offboard(orgId, accountId, "directory");
-        // the markers, events and run stops follow the root commit (none after a rollback)
+        // the revocation markers and events follow the root commit (hints; none after a rollback)
         afterCommit(() => this.offboarding.afterOffboard(result));
         return result;
     }

package/dist/orgs/members.service.js

@@ -151,7 +151,7 @@ let MembersService = class MembersService {
         }
         const actor = { actorAccountId, ...(actorTokenId !== undefined && { actorTokenId }) };
         const res = await this.offboarding.offboard(orgId, targetId, "removed", actor);
-        // the markers, events and run stops follow the root commit (none after a rollback)
+        // the revocation markers and events follow the root commit (hints; none after a rollback)
         afterCommit(() => this.offboarding.afterOffboard(res));
         await audit(this.db.db, {
             ...actor,

package/dist/orgs/offboarding.d.ts

@@ -1,12 +1,11 @@
-import type { Redis } from "ioredis";
 import { EventLog } from "../conversations/event-log.js";
+import { LifecycleHooks } from "../extensions/lifecycle-hooks.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { SessionService } from "../identity/sessions.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
-import { LockService } from "../infra/lock/lock.service.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
-import { SandboxJobs } from "../sandbox/jobs.js";
 import { ApprovalsService } from "../tools/approvals.service.js";
 import { Credentials } from "../tools/credentials.js";
 import { QuestionsService } from "../tools/questions.service.js";
@@ -26,11 +25,11 @@ export interface OffboardResult {
     revokedSessionIds: string[];
     /** 写了 cancelled 事件的会话 → 最大 seq（提交后发布）。 */
     notify: Map<string, number>;
-    /** 此人在该组织进行中的运行（queued / running / waiting），提交后中止。 */
+    /** The person's active runs in the org (queued / running / waiting): a `run-stop` job each is owed. */
     runs: InFlightRun[];
     /** 负责的 agent 转交给的所有者；没有转交时为 null。 */
     newOwnerId: string | null;
-    /** The person's devices in the org, soft-deleted here; destroyed by a job after commit. */
+    /** The person's devices in the org, soft-deleted here; a destroy job each is owed. */
     devices: string[];
     /** Conversations whose queued messages were deleted (`changed: queue` after commit). */
     queueConversations: string[];
@@ -39,21 +38,28 @@ export interface OffboardResult {
 export interface OffboardingRunControl {
     abortWaiting(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
     abortIfOrphaned(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
+    abortQueued(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
     requestAbort(runId: string, byAccountId: string | null): Promise<void>;
 }
-/** The safety-net sweep: cron job name (no `:`), every 10 minutes, and the rows per page. */
-export declare const OFFBOARD_SWEEP_JOB = "offboard-sweep";
-export declare const OFFBOARD_SWEEP_BATCH = 500;
-/** 一次兜底扫描最多翻的页数（每页 {@link OFFBOARD_SWEEP_BATCH} 条），防止单次任务无限长。 */
-export declare const OFFBOARD_SWEEP_MAX_PAGES = 20;
-/** 已经广播中止的运行的标记保留时长（秒），长于扫描周期：期间扫描不再重复广播。 */
-export declare const OFFBOARD_ABORT_MARK_TTL_SECONDS = 1800;
-/** 「已请求中止」标记（Redis 键）。 */
-export declare const offboardAbortKey: (runId: string) => string;
+/**
+ * The stop of a departed member's run (transactional outbox spec §8.1), owed by the offboard
+ * transaction on the maintenance queue under {@link runStopJobId}; `MaintenanceProcessor` runs
+ * {@link Offboarding.stopRun}.
+ */
+export declare const RUN_STOP_JOB = "run-stop";
+/** The `run-stop` job's data. */
+export interface RunStopJobData {
+    conversationId: string;
+    runId: string;
+}
+/** The `run-stop` job id: a run is stopped once (no `:`). */
+export declare const runStopJobId: (runId: string) => string;
 /**
  * 成员离职（spec 3.3）：管理员移出、本人离开与通讯录同步共用这一条路径，全部写入在调用方的同一个事务内，
- * 要么都生效要么都不生效。Redis 吊销标记、事件发布与中止进行中的运行是提交后的尽力而为（{@link afterOffboard}），
- * 漏掉的运行由兜底扫描（{@link sweep}：发起人已不是该组织成员的进行中运行）中止。框架无关。
+ * 要么都生效要么都不生效。The stops of the person's runs and the destruction of their devices are owed
+ * in that transaction (outbox jobs, transactional outbox spec §8.1); the Redis revocation markers
+ * and the event publishes after the commit are hints ({@link afterOffboard}: `revoked_at` in PG is
+ * the authority).
  *
  * 已接受的窄窗口：离职提交时正在进行的 OAuth token 刷新（`Credentials` 刷新锁内）可能在提交之后把此人的
  * 个人凭据重新写回（upsert）。凭据只在此人以成员身份调用工具时使用，而其运行已被中止、成员关系已删除，
@@ -63,22 +69,25 @@ export declare class Offboarding {
     private readonly db;
     readonly txHost: TransactionHost;
     private readonly sessions;
-    private readonly redis;
     private readonly registry;
     private readonly eventLog;
-    /** The departed member's devices: one-off maintenance jobs, destroyed by a worker. */
-    private readonly sandboxJobs;
-    /** Stops the departed member's runs (`by: null`, a system action). */
+    /** Owes the run stops and device destroys in the offboard transaction. */
+    private readonly outbox;
+    /** Stops the departed member's runs (`by: null`, a system action) in the `run-stop` job. */
     private readonly runs;
     private readonly credentials;
     private readonly approvals;
     private readonly questions;
+    /** Owes `org.member_removed` to the subscribing plugins, in the offboard transaction. */
+    private readonly lifecycle;
     readonly log: KernelLogger;
-    constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, redis: Pick<Redis, "set" | "exists">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
-    /** The departed member's devices: one-off maintenance jobs, destroyed by a worker. */
-    sandboxJobs: Pick<SandboxJobs, "destroy">, 
-    /** Stops the departed member's runs (`by: null`, a system action). */
-    runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "cancelPendingFor">, questions: Pick<QuestionsService, "cancelPendingFor">, log: KernelLogger);
+    constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
+    /** Owes the run stops and device destroys in the offboard transaction. */
+    outbox: Pick<OutboxService, "add">, 
+    /** Stops the departed member's runs (`by: null`, a system action) in the `run-stop` job. */
+    runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "pendingConversationsFor" | "cancelPendingFor">, questions: Pick<QuestionsService, "pendingConversationsFor" | "cancelPendingFor">, 
+    /** Owes `org.member_removed` to the subscribing plugins, in the offboard transaction. */
+    lifecycle: Pick<LifecycleHooks, "recordIn">, log: KernelLogger);
     /**
      * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
      * membership, and did the "last owner" checks)：
@@ -87,7 +96,8 @@ export declare class Offboarding {
      *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
      *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
-     * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
+     * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件）; owes a `run-stop` job for each of the
+     *    person's active runs in the org;
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；
      * 6. 归档其在该组织各渠道连接上的 IM 话题行（重新加入后在 IM 里开始新的对话，不接着旧会话），
      *    删除其在该组织的「以后都允许」工具授权（`tool_grants`）；
@@ -95,9 +105,10 @@ export declare class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. Soft-deletes the person's devices in the org and clears their default row (the
-     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
-     *    any left).
+     * 9. Soft-deletes the person's devices in the org and clears their default row, and owes the
+     *    destruction of each (instance and files, `device-destroy-<deviceId>`);
+     * 10. Owes the `org.member_removed` lifecycle hook deliveries (outbox jobs, one per subscribing
+     *    plugin).
      */
     offboard(orgId: string, accountId: string, reason: OffboardReason, actor?: {
         actorAccountId?: string;
@@ -107,36 +118,18 @@ export declare class Offboarding {
     private exclusionPlugins;
     /**
      * After the commit (callers register it with the infra `afterCommit` inside their transaction):
-     * writes the session revocation markers, publishes the cancelled events, stops the person's
-     * runs in the org and schedules destroying their devices. A failing step only logs a
-     * warning.
+     * writes the session revocation markers and publishes the cancelled events and queue changes,
+     * all hints (the run stops and device destroys were owed in the transaction). A failing step
+     * only logs a warning.
      */
     afterOffboard(r: OffboardResult): Promise<void>;
     /**
-     * 中止一个运行，顺序同会话中止接口：waiting → 直接取消等待并写终态；孤儿 → 直接写终态；
-     * 否则经 Redis 广播中止（运行所在副本收到后结束；尚未开始的运行开始时补查中止标记）。失败只记 warn。
-     * 不像会话中止那样随后起新一轮运行：离职者的待处理消息不再处理。
+     * The `run-stop` job (`MaintenanceProcessor`): stops a departed member's run the way the
+     * conversation's stop does (`POST .../abort`), by no account: a waiting run is aborted directly,
+     * a queued run is ended in PG (ruling R27: it never starts later, however long it was held), an
+     * orphan is finished directly, a running run is asked to stop through Redis (its replica ends it). A finished run is left alone. No
+     * new run follows, as after a person's stop: the departed member's queued messages were deleted.
+     * A failure throws (the job is retried).
      */
-    private stopRun;
-    /**
-     * 兜底扫描（维护队列每 10 分钟）：进行中、且发起人已不是该会话所属组织成员的运行 → 中止
-     * （提交后的中止没做成时，如进程崩溃）。按 `(runs.created_at, runs.id)` 键集分页翻完（每页 500 条，
-     * 至多 20 页）：经广播中止、尚未真正结束的运行仍是进行中，若只取前 500 条，超过 500 条卡住的运行会
-     * 一直占满这一页，后面的永远轮不到。已广播中止、仍带 `capk:offboard-abort:<runId>` 标记（30 分钟）的运行跳过，
-     * 不每轮重复广播；标记过期仍未结束的再处理一次。返回本次处理（未跳过）的运行数。
-     * 现任成员（含匿名访客这样的 guest 成员）发起的运行不受影响。
-     */
-    sweep(batch?: number): Promise<number>;
-    private recentlyAborted;
-}
-/**
- * The offboarding safety-net sweep ({@link Offboarding.sweep}) every 10 minutes, once per tick
- * across replicas; a worker-role job (`WorkerModule`).
- */
-export declare class OffboardSweepJob {
-    private readonly offboarding;
-    readonly lockService: LockService;
-    readonly log: KernelLogger;
-    constructor(offboarding: Pick<Offboarding, "sweep">, lockService: LockService, log: KernelLogger);
-    run(): Promise<void>;
+    stopRun(data: RunStopJobData): Promise<void>;
 }