@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/catalog/cli.js

@@ -10,14 +10,14 @@ import { assertSecretsReachable } from "../extensions/host.js";
 import { importExtensionModule, matchesSection } from "../extensions/instance.js";
 import { packageRootOf, syncPackage } from "../extensions/sync.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
-import { addJobOnce } from "../infra/queue/add-job-once.js";
-import { REDIS } from "../infra/tokens.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { packagePath } from "../packages/tgz.js";
 import { PrefixedStorage } from "../storage/storage.service.js";
 import { CatalogImportModule } from "./catalog.module.js";
 import { CatalogService } from "./catalog.service.js";
 import { PluginImport } from "./plugin-import.js";
-import { PLUGIN_SCOPE_QUEUE, scopeItemJob } from "./scope-sync.js";
+import { oweScopeItem } from "./scope-jobs.js";
 /**
  * Sets up the deployment's object-store extension inside the CLI process. The CLI hosts no
  * extensions, so this runs only the provider's `setup` with a context that offers `config` and
@@ -183,7 +183,8 @@ export async function openCatalogCli(config, log, opts = {}) {
         cli.app.get(ClientBuilds).useCliStorage(storage);
         const catalog = cli.app.get(CatalogService);
         const db = cli.app.get(KernelDb);
-        const redis = cli.app.get(REDIS);
+        const txHost = cli.app.get(TransactionHost);
+        const outbox = cli.app.get(OutboxService);
         return {
             ...cli,
             catalog,
@@ -192,18 +193,12 @@ export async function openCatalogCli(config, log, opts = {}) {
                 if (item.scope === "optional")
                     return false;
                 try {
-                    const row = await db.db
-                        .selectFrom("catalog_items")
-                        .select("scope_version")
-                        .where("id", "=", item.id)
-                        .executeTakeFirst();
-                    if (!row)
-                        return false;
-                    await addJobOnce(redis, PLUGIN_SCOPE_QUEUE, scopeItemJob(item.id, row.scope_version));
+                    // owed in a transaction of its own after the deploy; a worker's relay delivers it
+                    await txHost.run(() => oweScopeItem(outbox, db.db, item.id));
                     return true;
                 }
                 catch (err) {
-                    log.warn("cannot enqueue the plugin scope sync; the next worker start converges the orgs", { itemId: item.id, err });
+                    log.warn("cannot owe the plugin scope sync; the import's backstop converges the orgs in a few minutes", { itemId: item.id, err });
                     return false;
                 }
             },

package/dist/catalog/job-ids.d.ts

@@ -1,4 +1,5 @@
-/** The catalog's periodic jobs (a leaf module: no imports). */
+import type { OutboxService } from "../infra/outbox/outbox.service.js";
+/** The catalog's job names and ids (a leaf module: type imports only). */
 /**
  * Periodic marketplace refresh (C26), every `marketplaces.refreshIntervalMinutes` (a
  * `@LockedInterval`, once per tick across replicas): refreshes each enabled marketplace in turn.
@@ -18,28 +19,15 @@ export declare const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-
  * P3-21; `OwnedPluginCleanup.run`), on `cap-kernel-maintenance`.
  */
 export declare const OWNED_PLUGIN_CLEANUP_JOB = "owned-plugin-cleanup";
-/** The daily `@LockedCron` repairing lost {@link OWNED_PLUGIN_CLEANUP_JOB} enqueues. */
-export declare const OWNED_PLUGIN_CLEANUP_SWEEP_JOB = "owned-plugin-cleanup-sweep";
 /** The data of an {@link OWNED_PLUGIN_CLEANUP_JOB}. */
 export interface OwnedPluginCleanupData {
     itemId: string;
 }
+/** The cleanup job id of one removed item (no `:`: item ids are UUIDs). */
+export declare const ownedPluginCleanupJobId: (itemId: string) => string;
 /**
- * The cleanup job of one removed item: id `owned-plugin-cleanup-<itemId>` (no `:`: item ids are
- * UUIDs), removed when done so a later enqueue of the same item is not swallowed; the job is
- * idempotent, so a few retries are safe.
+ * Owes the cleanup of removed item `itemId` in the transaction in context (transactional outbox
+ * spec §8.1): the removal and its cleanup commit together. Platform work (no org: the owner org
+ * may be the one being deleted). The job's options are its outbox registry entry's.
  */
-export declare function ownedPluginCleanupJob(itemId: string): {
-    name: string;
-    data: OwnedPluginCleanupData;
-    opts: {
-        jobId: string;
-        attempts: number;
-        backoff: {
-            type: "exponential";
-            delay: number;
-        };
-        removeOnComplete: true;
-        removeOnFail: true;
-    };
-};
+export declare function oweOwnedPluginCleanup(outbox: Pick<OutboxService, "add">, itemId: string): Promise<boolean>;

package/dist/catalog/job-ids.js

@@ -1,4 +1,4 @@
-/** The catalog's periodic jobs (a leaf module: no imports). */
+/** The catalog's job names and ids (a leaf module: type imports only). */
 /**
  * Periodic marketplace refresh (C26), every `marketplaces.refreshIntervalMinutes` (a
  * `@LockedInterval`, once per tick across replicas): refreshes each enabled marketplace in turn.
@@ -18,23 +18,18 @@ export const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";
  * P3-21; `OwnedPluginCleanup.run`), on `cap-kernel-maintenance`.
  */
 export const OWNED_PLUGIN_CLEANUP_JOB = "owned-plugin-cleanup";
-/** The daily `@LockedCron` repairing lost {@link OWNED_PLUGIN_CLEANUP_JOB} enqueues. */
-export const OWNED_PLUGIN_CLEANUP_SWEEP_JOB = "owned-plugin-cleanup-sweep";
+/** The cleanup job id of one removed item (no `:`: item ids are UUIDs). */
+export const ownedPluginCleanupJobId = (itemId) => `${OWNED_PLUGIN_CLEANUP_JOB}-${itemId}`;
 /**
- * The cleanup job of one removed item: id `owned-plugin-cleanup-<itemId>` (no `:`: item ids are
- * UUIDs), removed when done so a later enqueue of the same item is not swallowed; the job is
- * idempotent, so a few retries are safe.
+ * Owes the cleanup of removed item `itemId` in the transaction in context (transactional outbox
+ * spec §8.1): the removal and its cleanup commit together. Platform work (no org: the owner org
+ * may be the one being deleted). The job's options are its outbox registry entry's.
  */
-export function ownedPluginCleanupJob(itemId) {
-    return {
+export function oweOwnedPluginCleanup(outbox, itemId) {
+    return outbox.add({
+        queue: "cap-kernel-maintenance",
         name: OWNED_PLUGIN_CLEANUP_JOB,
+        jobId: ownedPluginCleanupJobId(itemId),
         data: { itemId },
-        opts: {
-            jobId: `${OWNED_PLUGIN_CLEANUP_JOB}-${itemId}`,
-            attempts: 3,
-            backoff: { type: "exponential", delay: 5_000 },
-            removeOnComplete: true,
-            removeOnFail: true,
-        },
-    };
+    });
 }

package/dist/catalog/marketplaces.service.d.ts

@@ -188,7 +188,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.18";
+    readonly sdk: "0.1.0-rc.20";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/catalog/org-plugin-uploads.d.ts

@@ -1,4 +1,5 @@
 import type { SingleProviderNote } from "../extensions/single-provider.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { ActorOpts, CatalogItemView } from "./catalog.service.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { PluginImport, type PluginReview } from "./plugin-import.js";
@@ -40,8 +41,8 @@ export declare function ownerUpdateHash(reviewHash: string, diffHash: string): s
  * An org admin's plugin upload (spec §14.1 item 1, rulings P3-7, P3-8, P3-12, P3-13 to P3-15'): a
  * `.tgz` prepared and confirmed through {@link PluginImport} in owner mode (the org's own staging,
  * its admin re-checked under the org row lock), owned by the org with scope `named: [owner]`. After
- * the confirm's commit the item's scope sync is enqueued here (as `CatalogScopeService.confirmImport`
- * does; `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
+ * the confirm the item's scope sync is owed here (as `CatalogScopeService.confirmImport` does;
+ * `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
  * owner org.
  *
  * A new version of the org's own plugin without an extension (P3-12, P3-12') is reviewed with the
@@ -55,16 +56,22 @@ export declare class OrgPluginUploads {
     private readonly pluginImport;
     private readonly scope;
     private readonly updater;
-    constructor(pluginImport: PluginImport, scope: CatalogScopeService, updater: PlatformPluginUpdater);
+    readonly txHost: TransactionHost;
+    constructor(pluginImport: PluginImport, scope: CatalogScopeService, updater: PlatformPluginUpdater, txHost: TransactionHost);
     /** Reads, checks and stages the uploaded tgz for the org (see `PluginImport.prepare`). */
     prepare(actor: string, orgId: string, bytes: Uint8Array, opts?: ActorOpts): Promise<OrgUploadReview>;
     /** The org's own staged upload; another org's or the platform's -> 404 `plugin.staging_not_found`. */
     staged(orgId: string, stagingId: string): Promise<OrgUploadReview>;
-    /** Confirms the org's staged upload (applying a new version), then enqueues the scope sync. */
+    /** Confirms the org's staged upload (applying a new version), then owes the scope sync. */
     confirm(actor: string, orgId: string, stagingId: string, input: {
         reviewHash: string;
         shareable?: boolean;
     }, opts?: ActorOpts): Promise<OrgUploadResult>;
+    /**
+     * Owes the confirmed item's scope sync in a transaction of its own: the confirm's writes span
+     * more than one transaction (`PluginImport.confirm`), and the sync follows the last of them.
+     */
+    private oweSync;
     /** The review with the update preview of a new version and the combined hash (P3-12). */
     private withUpdate;
 }

package/dist/catalog/org-plugin-uploads.js

@@ -10,6 +10,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { createHash } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
 import { canonicalJson } from "../tools/canonical-json.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { PluginImport } from "./plugin-import.js";
@@ -26,8 +28,8 @@ const reviewStale = (name, version) => new ApiError("plugin.review_stale", `The
  * An org admin's plugin upload (spec §14.1 item 1, rulings P3-7, P3-8, P3-12, P3-13 to P3-15'): a
  * `.tgz` prepared and confirmed through {@link PluginImport} in owner mode (the org's own staging,
  * its admin re-checked under the org row lock), owned by the org with scope `named: [owner]`. After
- * the confirm's commit the item's scope sync is enqueued here (as `CatalogScopeService.confirmImport`
- * does; `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
+ * the confirm the item's scope sync is owed here (as `CatalogScopeService.confirmImport` does;
+ * `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
  * owner org.
  *
  * A new version of the org's own plugin without an extension (P3-12, P3-12') is reviewed with the
@@ -41,10 +43,12 @@ let OrgPluginUploads = class OrgPluginUploads {
     pluginImport;
     scope;
     updater;
-    constructor(pluginImport, scope, updater) {
+    txHost;
+    constructor(pluginImport, scope, updater, txHost) {
         this.pluginImport = pluginImport;
         this.scope = scope;
         this.updater = updater;
+        this.txHost = txHost;
     }
     /** Reads, checks and stages the uploaded tgz for the org (see `PluginImport.prepare`). */
     async prepare(actor, orgId, bytes, opts = {}) {
@@ -56,7 +60,7 @@ let OrgPluginUploads = class OrgPluginUploads {
         const r = await this.pluginImport.staged(stagingId, { orgId });
         return this.withUpdate(orgId, r.stagingId, r.review);
     }
-    /** Confirms the org's staged upload (applying a new version), then enqueues the scope sync. */
+    /** Confirms the org's staged upload (applying a new version), then owes the scope sync. */
     async confirm(actor, orgId, stagingId, input, opts = {}) {
         const st = await this.pluginImport.stagedTarget(stagingId, { orgId });
         if (!appliesAtOnce(st)) {
@@ -67,7 +71,7 @@ let OrgPluginUploads = class OrgPluginUploads {
             // A version waiting for the super admin is synced by their confirmation (P3-10)
             if (r.pending)
                 return { item: r.item, outcome: "pending" };
-            await this.scope.enqueueSync(r.item.id);
+            await this.oweSync(r.item.id);
             return { item: r.item, outcome: r.firstVersion ? "installed" : "updated" };
         }
         // The one hash covers the review and the update (P3-12): both recomputed now
@@ -89,6 +93,13 @@ let OrgPluginUploads = class OrgPluginUploads {
             }),
         };
     }
+    /**
+     * Owes the confirmed item's scope sync in a transaction of its own: the confirm's writes span
+     * more than one transaction (`PluginImport.confirm`), and the sync follows the last of them.
+     */
+    async oweSync(itemId) {
+        await this.scope.enqueueSync(itemId);
+    }
     /** The review with the update preview of a new version and the combined hash (P3-12). */
     async withUpdate(orgId, stagingId, review) {
         const st = await this.pluginImport.stagedTarget(stagingId, { orgId });
@@ -102,11 +113,15 @@ let OrgPluginUploads = class OrgPluginUploads {
         };
     }
 };
+__decorate([
+    Transactional()
+], OrgPluginUploads.prototype, "oweSync", null);
 OrgPluginUploads = __decorate([
     Injectable(),
     __param(0, Inject(PluginImport)),
     __param(1, Inject(CatalogScopeService)),
-    __param(2, Inject(PlatformPluginUpdater))
+    __param(2, Inject(PlatformPluginUpdater)),
+    __param(3, Inject(TransactionHost))
 ], OrgPluginUploads);
 export { OrgPluginUploads };
 /**

package/dist/catalog/owned-items.d.ts

@@ -1,4 +1,3 @@
-import type { Queue } from "bullmq";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
@@ -45,17 +44,13 @@ export declare class OwnedItems {
     private readonly installer;
     /** The owner's org skill row, soft-deleted after its promoted platform row leaves it. */
     private readonly skills;
-    /** The removed plugin's cleanup job (`owned-plugin-cleanup-<itemId>`, P3-20). */
-    private readonly queue;
     private readonly log;
     readonly txHost: TransactionHost;
     constructor(kdb: KernelDb, orgLock: OrgLock, catalog: CatalogService, scope: CatalogScopeService, 
     /** The owner org's own uninstall of a removed plugin (ruling P3-41). */
     installer: PluginInstaller, 
     /** The owner's org skill row, soft-deleted after its promoted platform row leaves it. */
-    skills: SkillsService, 
-    /** The removed plugin's cleanup job (`owned-plugin-cleanup-<itemId>`, P3-20). */
-    queue: Pick<Queue, "add">, log: KernelLogger, txHost: TransactionHost);
+    skills: SkillsService, log: KernelLogger, txHost: TransactionHost);
     private get db();
     /**
      * The owner org's 可共享 flag of its item, written on the item and (a plugin) every component
@@ -137,10 +132,10 @@ export declare class OwnedItems {
      * it passed the share gate already, so every org could see it, and the former owner is then an
      * ordinary org that may switch it on again), written
      * directly rather than through the guarded scope writer (ruling P3-27); platform notice
-     * `ownership_transferred`, audit `catalog.ownership_transferred`, the scope sync enqueued after
-     * the commit (it uninstalls the former owner's install). Otherwise -> `removed`: the soft delete
-     * of `catalog.remove` ({@link CatalogService.removeIn}) and, after the commit, the cleanup job
-     * `owned-plugin-cleanup-<itemId>` that takes its extension out; an owner delete
+     * `ownership_transferred`, audit `catalog.ownership_transferred`, the scope sync owed with it
+     * (it uninstalls the former owner's install). Otherwise -> `removed`: the soft delete of
+     * `catalog.remove` ({@link CatalogService.removeIn}, which owes the cleanup job
+     * `owned-plugin-cleanup-<itemId>` that takes its extension out); an owner delete
      * (`owner_deleted`) also uninstalls it in the owner org through the normal uninstall, keeping the
      * connectors it created as the org's own (ruling P3-41). A first upload still waiting is never
      * transferred. A gone or platform item -> 404.
@@ -153,7 +148,7 @@ export declare class OwnedItems {
      * each goes through {@link transferOrRemove} with reason `org_deleted`. A first upload still
      * waiting is removed and its extension name released here (nothing is installed under it,
      * pre-flight F10); a pending new version of a transferred plugin is cleared; a removed plugin's
-     * extension is taken out by the cleanup job after the commit. The org's unpromoted rows (its own
+     * extension is taken out by the cleanup job the deletion owes. The org's unpromoted rows (its own
      * skills, copies, installs) are left: they go with the org as before. Must not inject
      * `OrgsService` (it calls this).
      */
@@ -180,8 +175,6 @@ export declare class OwnedItems {
      * still depends on, or one still installing, stays (logged).
      */
     private uninstallInOwner;
-    /** Enqueues the removed plugin's cleanup; a failure only warns (the daily sweep repairs it). */
-    enqueueCleanup(itemId: string): Promise<void>;
     private computeDelete;
     /** The org's own live plugin (`forUpdate`: row locked); another org's or a platform one -> 404. */
     private ownedRow;

package/dist/catalog/owned-items.js

@@ -14,27 +14,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 // since Task 8, the org's own skills and agent templates (promoted ones through their platform
 // rows, ruling P3-3).
 import { createHash } from "node:crypto";
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { loadTemplates, readOwnTemplate, softDeleteTemplateIn } from "../agents/templates.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { addPlatformNotice } from "../inbox/platform-notices.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { OrgLock } from "../orgs/org-lock.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { SkillsService } from "../skills/skills.service.js";
 import { assertNotPlatformDefault } from "../themes/theme-usage.js";
 import { CatalogService } from "./catalog.service.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { notOwnedError } from "./component-promotion.js";
 import { agentsUsing, COMPONENT_KINDS, componentOn, listedIn, loadComponents, loadScopeState, pluginFactsOf, switchOf, } from "./component-state.js";
-import { ownedPluginCleanupJob } from "./job-ids.js";
 import { orgsUsing } from "./ownership.js";
 import { PluginInstaller } from "./plugin-install.js";
 import { ScopeStillWanted } from "./scope-state.js";
@@ -79,23 +75,19 @@ let OwnedItems = class OwnedItems {
     scope;
     installer;
     skills;
-    queue;
     log;
     txHost;
     constructor(kdb, orgLock, catalog, scope, 
     /** The owner org's own uninstall of a removed plugin (ruling P3-41). */
     installer, 
     /** The owner's org skill row, soft-deleted after its promoted platform row leaves it. */
-    skills, 
-    /** The removed plugin's cleanup job (`owned-plugin-cleanup-<itemId>`, P3-20). */
-    queue, log, txHost) {
+    skills, log, txHost) {
         this.kdb = kdb;
         this.orgLock = orgLock;
         this.catalog = catalog;
         this.scope = scope;
         this.installer = installer;
         this.skills = skills;
-        this.queue = queue;
         this.log = log;
         this.txHost = txHost;
     }
@@ -377,10 +369,10 @@ let OwnedItems = class OwnedItems {
      * it passed the share gate already, so every org could see it, and the former owner is then an
      * ordinary org that may switch it on again), written
      * directly rather than through the guarded scope writer (ruling P3-27); platform notice
-     * `ownership_transferred`, audit `catalog.ownership_transferred`, the scope sync enqueued after
-     * the commit (it uninstalls the former owner's install). Otherwise -> `removed`: the soft delete
-     * of `catalog.remove` ({@link CatalogService.removeIn}) and, after the commit, the cleanup job
-     * `owned-plugin-cleanup-<itemId>` that takes its extension out; an owner delete
+     * `ownership_transferred`, audit `catalog.ownership_transferred`, the scope sync owed with it
+     * (it uninstalls the former owner's install). Otherwise -> `removed`: the soft delete of
+     * `catalog.remove` ({@link CatalogService.removeIn}, which owes the cleanup job
+     * `owned-plugin-cleanup-<itemId>` that takes its extension out); an owner delete
      * (`owner_deleted`) also uninstalls it in the owner org through the normal uninstall, keeping the
      * connectors it created as the org's own (ruling P3-41). A first upload still waiting is never
      * transferred. A gone or platform item -> 404.
@@ -402,9 +394,10 @@ let OwnedItems = class OwnedItems {
         const others = item.awaiting_confirmation ? [] : await orgsUsing(t, ref, { except: owner });
         if (others.length === 0) {
             await this.catalog.removeIn(actor, item.id, { ...opts, reason });
+            // removeIn owes the cleanup job of a confirmed plugin (a first upload still waiting has
+            // nothing installed: its name claim is released there)
             if (reason === "owner_deleted")
                 await this.uninstallInOwner(owner, actor, item.id, opts);
-            afterCommit(() => this.enqueueCleanup(item.id));
             return "removed";
         }
         // A transfer leaves none of its themes `all` (an `all` scope is narrowed, P3-39): refused
@@ -531,7 +524,7 @@ let OwnedItems = class OwnedItems {
                 ...opts.auditDetail,
             },
         });
-        afterCommit(() => this.scope.enqueueSync(item.id));
+        await this.scope.enqueueSync(item.id);
         return "transferred";
     }
     /**
@@ -541,7 +534,7 @@ let OwnedItems = class OwnedItems {
      * each goes through {@link transferOrRemove} with reason `org_deleted`. A first upload still
      * waiting is removed and its extension name released here (nothing is installed under it,
      * pre-flight F10); a pending new version of a transferred plugin is cleared; a removed plugin's
-     * extension is taken out by the cleanup job after the commit. The org's unpromoted rows (its own
+     * extension is taken out by the cleanup job the deletion owes. The org's unpromoted rows (its own
      * skills, copies, installs) are left: they go with the org as before. Must not inject
      * `OrgsService` (it calls this).
      */
@@ -730,16 +723,6 @@ let OwnedItems = class OwnedItems {
             });
         }
     }
-    /** Enqueues the removed plugin's cleanup; a failure only warns (the daily sweep repairs it). */
-    async enqueueCleanup(itemId) {
-        const job = ownedPluginCleanupJob(itemId);
-        try {
-            await this.queue.add(job.name, job.data, job.opts);
-        }
-        catch (err) {
-            this.log.warn("enqueueing the owned plugin cleanup failed", { itemId, err });
-        }
-    }
     async computeDelete(orgId, item) {
         const ref = { kind: "plugin", id: item.id };
         const orgs = item.awaiting_confirmation ? [] : await orgsUsing(this.db, ref, { except: orgId });
@@ -801,8 +784,7 @@ OwnedItems = __decorate([
     __param(3, Inject(CatalogScopeService)),
     __param(4, Inject(PluginInstaller)),
     __param(5, Inject(SkillsService)),
-    __param(6, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(7, Inject(KERNEL_LOGGER)),
-    __param(8, Inject(TransactionHost))
+    __param(6, Inject(KERNEL_LOGGER)),
+    __param(7, Inject(TransactionHost))
 ], OwnedItems);
 export { OwnedItems };

package/dist/catalog/owned-plugin-cleanup.d.ts

@@ -1,30 +1,27 @@
 import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
-import { LockService } from "../infra/lock/lock.service.js";
 import type { KernelLogger } from "../log.js";
 import { CatalogItemLock } from "./locks.js";
 /**
  * The cleanup of a removed org-owned plugin: {@link run} disables and uninstalls its extension (an
  * install of the item's name from the item's package) when no live catalog item uses it any more
- * ({@link OwnedPluginCleanup.referenced}), then releases the extension name claim, in one transaction under the import's item name lock
- * (pre-flight F10: the claim of an
- * installed extension is released here, never at the removal). Idempotent: a live item (a
- * transferred one), a platform item or nothing installed changes nothing but the claim. The
- * extension's data, secrets and configs stay, as with every uninstall. {@link sweep} runs it daily
- * for every removed org-owned item whose extension is still installed (a lost enqueue).
+ * ({@link OwnedPluginCleanup.referenced}), then releases the extension name claim, in one
+ * transaction under the import's item name lock (pre-flight F10: the claim of an installed
+ * extension is released here, never at the removal). Idempotent: a live item (a transferred one),
+ * a platform item or nothing installed changes nothing but the claim. The extension's data,
+ * secrets and configs stay, as with every uninstall.
  */
 export declare class OwnedPluginCleanup {
     private readonly kdb;
     private readonly ops;
     /** The import's item name lock (M5: no uninstall racing a re-import of the package). */
     private readonly itemLock;
-    readonly lockService: LockService;
-    readonly log: KernelLogger;
+    private readonly log;
     readonly txHost: TransactionHost;
     constructor(kdb: KernelDb, ops: ExtensionAdminOps, 
     /** The import's item name lock (M5: no uninstall racing a re-import of the package). */
-    itemLock: CatalogItemLock, lockService: LockService, log: KernelLogger, txHost: TransactionHost);
+    itemLock: CatalogItemLock, log: KernelLogger, txHost: TransactionHost);
     private get db();
     /** Takes out the extension of removed item `itemId` (see the class). */
     run(itemId: string): Promise<void>;
@@ -34,12 +31,6 @@ export declare class OwnedPluginCleanup {
      * is taken out) or waits until this commits, so a newly imported extension is never uninstalled.
      */
     private takeOut;
-    /**
-     * Daily: {@link run} for every removed org-owned item no live item {@link referenced} names
-     * whose extension is still installed, or whose name claim is still held (a lost enqueue, or a
-     * run that uninstalled and failed before releasing the claim).
-     */
-    sweep(): Promise<void>;
     /**
      * A live catalog item still uses the extension: one named like it (a plugin and its extension
      * share one name) from the same package whose owner is the removed item's owner (a re-upload)
@@ -50,7 +41,7 @@ export declare class OwnedPluginCleanup {
 }
 /**
  * {@link OwnedPluginCleanup}: imported only by `MaintenanceModule` (the job's dispatcher), which
- * only the worker role imports, so the sweep runs on worker replicas only.
+ * only the worker role imports.
  */
 export declare class OwnedPluginCleanupModule {
 }

package/dist/catalog/owned-plugin-cleanup.js

@@ -9,9 +9,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 // Taking out the extension of a removed org-owned plugin (plugin scope phase 3, spec §14, P3-20,
 // P3-21; pre-flight F9, F10): the one-off job `owned-plugin-cleanup-<itemId>` on
-// `cap-kernel-maintenance` (dispatched by `MaintenanceProcessor`) and its daily sweep. Worker-only:
-// `OwnedPluginCleanupModule` is imported only by `MaintenanceModule`, which only `WorkerModule`
-// imports.
+// `cap-kernel-maintenance` (dispatched by `MaintenanceProcessor`), owed in the outbox by the
+// removal's transaction (transactional outbox spec §8.1). Worker-only: `OwnedPluginCleanupModule`
+// is imported only by `MaintenanceModule`, which only `WorkerModule` imports.
 import { Inject, Injectable, Module } from "@nestjs/common";
 import { ApiError } from "../errors.js";
 import { ExtensionAdminOps } from "../extensions/admin-ops.js";
@@ -19,11 +19,8 @@ import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
-import { LockService } from "../infra/lock/lock.service.js";
-import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { CatalogImportModule } from "./catalog.module.js";
-import { OWNED_PLUGIN_CLEANUP_SWEEP_JOB } from "./job-ids.js";
 import { CatalogItemLock } from "./locks.js";
 import { releaseExtensionClaim } from "./ownership.js";
 /** Codes that mean another run (or the confirmation's own take-out) got there first. */
@@ -31,27 +28,24 @@ const GONE = new Set(["extension.not_found", "extension.not_disabled"]);
 /**
  * The cleanup of a removed org-owned plugin: {@link run} disables and uninstalls its extension (an
  * install of the item's name from the item's package) when no live catalog item uses it any more
- * ({@link OwnedPluginCleanup.referenced}), then releases the extension name claim, in one transaction under the import's item name lock
- * (pre-flight F10: the claim of an
- * installed extension is released here, never at the removal). Idempotent: a live item (a
- * transferred one), a platform item or nothing installed changes nothing but the claim. The
- * extension's data, secrets and configs stay, as with every uninstall. {@link sweep} runs it daily
- * for every removed org-owned item whose extension is still installed (a lost enqueue).
+ * ({@link OwnedPluginCleanup.referenced}), then releases the extension name claim, in one
+ * transaction under the import's item name lock (pre-flight F10: the claim of an installed
+ * extension is released here, never at the removal). Idempotent: a live item (a transferred one),
+ * a platform item or nothing installed changes nothing but the claim. The extension's data,
+ * secrets and configs stay, as with every uninstall.
  */
 let OwnedPluginCleanup = class OwnedPluginCleanup {
     kdb;
     ops;
     itemLock;
-    lockService;
     log;
     txHost;
     constructor(kdb, ops, 
     /** The import's item name lock (M5: no uninstall racing a re-import of the package). */
-    itemLock, lockService, log, txHost) {
+    itemLock, log, txHost) {
         this.kdb = kdb;
         this.ops = ops;
         this.itemLock = itemLock;
-        this.lockService = lockService;
         this.log = log;
         this.txHost = txHost;
     }
@@ -100,50 +94,6 @@ let OwnedPluginCleanup = class OwnedPluginCleanup {
         }
         await releaseExtensionClaim(this.db, name, pkg);
     }
-    /**
-     * Daily: {@link run} for every removed org-owned item no live item {@link referenced} names
-     * whose extension is still installed, or whose name claim is still held (a lost enqueue, or a
-     * run that uninstalled and failed before releasing the claim).
-     */
-    async sweep() {
-        const rows = await this.db
-            .selectFrom("catalog_items as ci")
-            .select("ci.id")
-            .where("ci.deleted_at", "is not", null)
-            .where("ci.owner_org_id", "is not", null)
-            .where("ci.package_name", "is not", null)
-            .where(({ and, or, not, exists, selectFrom }) => and([
-            not(exists(selectFrom("catalog_items as live")
-                .select("live.id")
-                .whereRef("live.name", "=", "ci.name")
-                .whereRef("live.package_name", "=", "ci.package_name")
-                .where("live.deleted_at", "is", null)
-                .where((eb) => eb.or([
-                eb("live.owner_org_id", "is", null),
-                eb("live.owner_org_id", "=", eb.ref("ci.owner_org_id")),
-            ])))),
-            or([
-                exists(selectFrom("extension_installs as x")
-                    .innerJoin("extension_packages as p", "p.sha256", "x.sha256")
-                    .select("x.name")
-                    .whereRef("x.name", "=", "ci.name")
-                    .whereRef("p.package_name", "=", "ci.package_name")),
-                exists(selectFrom("extension_name_owners as o")
-                    .select("o.name")
-                    .whereRef("o.name", "=", "ci.name")
-                    .whereRef("o.package_name", "=", "ci.package_name")),
-            ]),
-        ]))
-            .execute();
-        for (const r of rows) {
-            try {
-                await this.run(r.id);
-            }
-            catch (err) {
-                this.log.error("owned plugin cleanup failed", { itemId: r.id, err });
-            }
-        }
-    }
     /**
      * A live catalog item still uses the extension: one named like it (a plugin and its extension
      * share one name) from the same package whose owner is the removed item's owner (a re-upload)
@@ -165,22 +115,18 @@ let OwnedPluginCleanup = class OwnedPluginCleanup {
 __decorate([
     Transactional()
 ], OwnedPluginCleanup.prototype, "takeOut", null);
-__decorate([
-    LockedCron("40 3 * * *", { name: OWNED_PLUGIN_CLEANUP_SWEEP_JOB })
-], OwnedPluginCleanup.prototype, "sweep", null);
 OwnedPluginCleanup = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(ExtensionAdminOps)),
     __param(2, Inject(CatalogItemLock)),
-    __param(3, Inject(LockService)),
-    __param(4, Inject(KERNEL_LOGGER)),
-    __param(5, Inject(TransactionHost))
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Inject(TransactionHost))
 ], OwnedPluginCleanup);
 export { OwnedPluginCleanup };
 /**
  * {@link OwnedPluginCleanup}: imported only by `MaintenanceModule` (the job's dispatcher), which
- * only the worker role imports, so the sweep runs on worker replicas only.
+ * only the worker role imports.
  */
 let OwnedPluginCleanupModule = class OwnedPluginCleanupModule {
 };