@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/conversations/events.js

@@ -1,4 +1,4 @@
-import { DOCUMENT_MEDIA_TYPES, hasControlChars, IMAGE_MEDIA_TYPES, isAttachmentId, isSkillName, MEDIA_NAME_MAX_CHARS, } from "@capybara-hq/plugin-sdk";
+import { CONTEXT_LIMITS, DOCUMENT_MEDIA_TYPES, hasControlChars, IMAGE_MEDIA_TYPES, isAttachmentId, isSkillName, MEDIA_NAME_MAX_CHARS, } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
 import { AgentDefinitionSchema, DisabledSkillRef, DisabledToolRef, ModelRef, } from "../agents/definition.js";
 import { ORG_ROLES } from "../orgs/roles.js";
@@ -228,6 +228,22 @@ export const RunContextSchema = z.object({
         .optional(),
 });
 const ev = (type, payload) => z.object({ type: z.literal(type), payload });
+/**
+ * The most UTF-8 bytes a `plugin_context` event's text may hold (memory spec §6.1): the providers'
+ * limit, so the log takes every text a provider may return.
+ */
+export const PLUGIN_CONTEXT_MAX_BYTES = CONTEXT_LIMITS.maxBytes;
+/**
+ * `plugin_context` (memory spec §6.1): the text a `context@1` provider added at a run start. Empty
+ * text means the provider has nothing (any more); `hash` is the sha256 (hex) of `text`.
+ */
+export const PluginContextSchema = z.object({
+    plugin: z.string().min(1).max(64),
+    text: z.string().refine((t) => Buffer.byteLength(t, "utf8") <= PLUGIN_CONTEXT_MAX_BYTES, {
+        message: `at most ${PLUGIN_CONTEXT_MAX_BYTES} UTF-8 bytes`,
+    }),
+    hash: z.string().regex(/^[0-9a-f]{64}$/),
+});
 /**
  * An agent definition frozen into a log (`subagent_started`): the current schema, with the
  * selected and pinned skills of older logs still accepted (skills default-on spec §4: history
@@ -485,6 +501,13 @@ export const ConversationEventSchema = z.discriminatedUnion("type", [
      * system message (`runContextText`); a summary covering it restores the current values.
      */
     ev("run_context", RunContextSchema),
+    /**
+     * Text a `context@1` provider added at a run start (memory spec §6.1), written only when its
+     * hash differs from the plugin's previous one in the conversation. **Model-visible**: rendered
+     * at its position as a system message (`pluginContextText`, nothing for empty text); a summary
+     * covering it is followed by the latest non-empty one per plugin again.
+     */
+    ev("plugin_context", PluginContextSchema),
     /**
      * The step's resolved tool set differs from the one the conversation's previous model request
      * offered (`toolSetChange`): tool names as the model sees them, sorted. Written before that
@@ -599,6 +622,12 @@ export const ConversationEventSchema = z.discriminatedUnion("type", [
          */
         reason: z.string().max(APPROVAL_DENY_REASON_MAX_CHARS).optional(),
     })),
+    /**
+     * A still-pending approval changed without a decision: a network ask's 「这台设备一直允许」 whose
+     * device change was not applied or not confirmed (`detail.attempt`, transactional outbox spec
+     * §7). Display only, never model-visible: the page reads the approval again.
+     */
+    ev("approval_updated", z.object({ approvalId: z.string(), callId: z.string() })),
     /**
      * 工具调用需要用户输入（`AskUserQuestion`、插件工具的 `input_required`、MCP elicitation）：输入请求已建，
      * run 暂停等待回答。界面据此显示表单卡片（不进模型请求）。

package/dist/conversations/source.d.ts

@@ -0,0 +1,10 @@
+import type { ConversationSource } from "@capybara-hq/plugin-sdk";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+/**
+ * Where a conversation comes from (memory plugin spec §6.2), stored on its row at creation
+ * (`conversations.source`, migration 0124) and never changed. A missing conversation throws
+ * rather than guessing a source (a guess could offer a group chat what only a DM may see).
+ */
+export declare function conversationSourceOf(db: Pick<KernelSchemaDb, "selectFrom">, conversationId: string): Promise<ConversationSource>;
+/** The source of a conversation created for a channel chat of `chatType`. */
+export declare const channelSource: (chatType: "dm" | "group") => ConversationSource;

package/dist/conversations/source.js

@@ -0,0 +1,17 @@
+/**
+ * Where a conversation comes from (memory plugin spec §6.2), stored on its row at creation
+ * (`conversations.source`, migration 0124) and never changed. A missing conversation throws
+ * rather than guessing a source (a guess could offer a group chat what only a DM may see).
+ */
+export async function conversationSourceOf(db, conversationId) {
+    const row = await db
+        .selectFrom("conversations")
+        .select("source")
+        .where("id", "=", conversationId)
+        .executeTakeFirst();
+    if (row === undefined)
+        throw new Error(`conversation ${conversationId} not found`);
+    return row.source;
+}
+/** The source of a conversation created for a channel chat of `chatType`. */
+export const channelSource = (chatType) => chatType === "dm" ? "channel_dm" : "channel_group";

package/dist/conversations/tree.d.ts

@@ -15,3 +15,13 @@ export declare function conversationTree(db: KernelSchemaDb, conversationId: str
  * `conversations.parent_conversation_id`. Empty for a root or an unknown id.
  */
 export declare function conversationAncestors(db: KernelSchemaDb, conversationId: string): Promise<string[]>;
+/**
+ * Locks the conversations `ids` and every ancestor of theirs (`FOR NO KEY UPDATE`, in the caller's
+ * transaction) tree by tree, root first: the trees in root id order, within a tree by level below
+ * the root, then id. A reply locks its root conversation and only then the sub-agents' below it
+ * (`ConversationsService.skipWaitsIn`), and a dispatch locks a parent before its child; a locker
+ * of conversations in plain id order could take a child before its root and wait for the root
+ * while such a path holds the root and waits for the child (40P01). Returns the ids locked (the
+ * requested ones and their ancestors); an unknown id is skipped.
+ */
+export declare function lockConversationTrees(db: KernelSchemaDb, ids: readonly string[]): Promise<string[]>;

package/dist/conversations/tree.js

@@ -40,3 +40,38 @@ export async function conversationAncestors(db, conversationId) {
     SELECT id FROM up WHERE level > 0 ORDER BY level`.execute(db);
     return r.rows.map((row) => row.id);
 }
+/**
+ * Locks the conversations `ids` and every ancestor of theirs (`FOR NO KEY UPDATE`, in the caller's
+ * transaction) tree by tree, root first: the trees in root id order, within a tree by level below
+ * the root, then id. A reply locks its root conversation and only then the sub-agents' below it
+ * (`ConversationsService.skipWaitsIn`), and a dispatch locks a parent before its child; a locker
+ * of conversations in plain id order could take a child before its root and wait for the root
+ * while such a path holds the root and waits for the child (40P01). Returns the ids locked (the
+ * requested ones and their ancestors); an unknown id is skipped.
+ */
+export async function lockConversationTrees(db, ids) {
+    const wanted = [...new Set(ids)];
+    if (wanted.length === 0)
+        return [];
+    const r = await sql `
+    WITH RECURSIVE up(start, id, parent, level) AS (
+      SELECT c.id, c.id, c.parent_conversation_id, 0 FROM capybara.conversations c
+      WHERE c.id = ANY(${wanted}::text[])
+      UNION ALL
+      SELECT up.start, c.id, c.parent_conversation_id, up.level + 1
+      FROM capybara.conversations c JOIN up ON c.id = up.parent
+      WHERE up.level < ${TREE_MAX_LEVELS}
+    ),
+    tops AS (
+      SELECT DISTINCT ON (start) start, id AS root, level AS height
+      FROM up ORDER BY start, level DESC
+    ),
+    nodes AS (
+      SELECT DISTINCT up.id, tops.root, tops.height - up.level AS depth
+      FROM up JOIN tops ON tops.start = up.start
+    )
+    SELECT c.id FROM capybara.conversations c JOIN nodes n ON n.id = c.id
+    ORDER BY n.root, n.depth, n.id
+    FOR NO KEY UPDATE OF c`.execute(db);
+    return r.rows.map((row) => row.id);
+}

package/dist/db/kernel-schema.d.ts

@@ -1,4 +1,4 @@
-import type { FileSystemHandle, ParsedTheme, SandboxTier, SkillInvocation } from "@capybara-hq/plugin-sdk";
+import type { ConversationSource, FileSystemHandle, ParsedTheme, SandboxTier, SkillInvocation } from "@capybara-hq/plugin-sdk";
 import type { ColumnType, Generated, Kysely } from "kysely";
 import type { ModelRef } from "../agents/definition.js";
 import type { ScheduleChat, ScheduleMarker, ScheduleMode, SchedulePauseReason, ScheduleStatus, ScheduleTrigger, TaskRunSkipReason, TaskRunStatus } from "../schedules/types.js";
@@ -263,6 +263,16 @@ export interface ConversationsTable {
     device_id: ColumnType<string | null, string | null | undefined, string | null>;
     /** 0113: the scheduled task that created it (`new` mode); null otherwise. */
     scheduled_task_id: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * 0124: where the conversation comes from, set at creation and never changed. Required on insert
+     * (the column's `web` default is not relied on: a forgotten source must not read as web).
+     */
+    source: ColumnType<ConversationSource, ConversationSource, never>;
+    /**
+     * 0125: when a person stopped this root conversation and its sub-agent tree; cleared when the
+     * root next starts a run. While set the tree's wakes are held (agent map spec §6).
+     */
+    tree_stopped_at: ColumnType<Date | null, Date | string | null | undefined, Date | string | null>;
 }
 /** 0060: an org's order of file-preview@1 previewers (UI refresh B Task 11). */
 export interface FilePreviewersTable {
@@ -340,7 +350,11 @@ export interface RunsTable {
     waiting_since: TsNullable;
     /** 0012：累计等待时长（毫秒），不计入运行时长。 */
     waited_ms: Int8;
-    /** 0012：续跑任务的 jobId；为空表示按触发消息生成的 jobId。 */
+    /**
+     * 0012: the run's job id when it is not the trigger's `runJobId`: a resume's
+     * (`resumeJobId`), or `<runJobId>-<n>` for a later run of the same trigger (R34); null: the
+     * trigger's first run, under `runJobId`.
+     */
     job_id: string | null;
     /** 0012：最近一次（续跑）回到 queued 的时刻。 */
     queued_at: TsNullable;
@@ -1224,8 +1238,6 @@ export interface ScheduledTaskRunsTable {
     skip_reason: ColumnType<TaskRunSkipReason | null, TaskRunSkipReason | null | undefined, TaskRunSkipReason | null>;
     error: NullableText;
     missing_grants: ColumnType<string[], string | undefined, string>;
-    /** When the scanner's repair last found this started run still in flight. */
-    rechecked_at: NullableTs;
 }
 /** 0113: a scheduled task's remembered grants (same shape as `conversation_tool_grants`). */
 export interface ScheduledTaskGrantsTable {
@@ -1333,7 +1345,6 @@ export interface KernelDatabase {
     plugin_install_components: PluginInstallComponentsTable;
     extension_catalog_sources: ExtensionCatalogSourcesTable;
     bootstrap_runs: BootstrapRunsTable;
-    platform_migration_runs: PlatformMigrationRunsTable;
     org_notices: OrgNoticesTable;
     platform_notices: PlatformNoticesTable;
     plugin_scope_sync_failures: PluginScopeSyncFailuresTable;
@@ -1397,21 +1408,14 @@ export interface ExtensionClientReportsTable {
     last_at: Ts;
     last_message: string;
 }
-/** 0082: one run of the platform components migration job (`catalog/platform-migration.ts`). */
-export interface PlatformMigrationRunsTable {
-    id: string;
-    started_at: Ts;
-    finished_at: TsNullable;
-    stats: Json<Record<string, unknown>>;
-}
-/** 0082: the kinds of {@link OrgNoticesTable}. */
-export type OrgNoticeKind = "skill_renamed" | "item_shared" | "shared_item_updated" | "upload_confirmed" | "upload_rejected";
+/** 0084 (0121 dropped `skill_renamed`): the kinds of {@link OrgNoticesTable}. */
+export type OrgNoticeKind = "item_shared" | "shared_item_updated" | "upload_confirmed" | "upload_rejected";
 /** 0082: a notice for an org's admins (an inbox item), until one of them dismisses it. */
 export interface OrgNoticesTable {
     id: string;
     org_id: string;
     kind: OrgNoticeKind;
-    /** `skill_renamed`: `{ skillId, from, to, platformSkillId, plugin }`. */
+    /** The kind's shape (`OrgNoticeDetails` in `inbox/org-notices.ts`). */
     detail: Json<Record<string, unknown>>;
     created_at: Ts;
     dismissed_at: TsNullable;

package/dist/devices/devices.service.d.ts

@@ -4,9 +4,9 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { LockService } from "../infra/lock/lock.service.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import { MachinesService } from "../local-devices/machines.js";
-import type { KernelLogger } from "../log.js";
 import type { DeviceSandboxLevel } from "../runtime/context/device-paths.js";
 import { SandboxJobs } from "../sandbox/jobs.js";
 import { SandboxProviders } from "../sandbox/providers.js";
@@ -112,7 +112,8 @@ export declare const RECENT_POLICY_CHANGES = 10;
 /**
  * One sandbox change of a device, as its owner sees it on the device page (§10.4):
  * - `policy` (`device.policy_changed`): a local policy change sent to the machine (`web`, `im`),
- *   or made on the machine by its owner (`device`, `capybara-device policy ...`);
+ *   or made on the machine by its owner (`device`, `capybara-device policy ...`); one sent whose
+ *   answer never came (`device.policy_unknown`) or that failed (`device.policy_failed`) too;
  * - `tier` (`device.tier_changed`): a cloud device's tier set by its owner;
  * - `isolation` (`device.isolation_reported`): the machine reported running without a sandbox,
  *   or with one again.
@@ -141,8 +142,14 @@ export interface DeviceSandboxChangeView {
     by: string | null;
     /** `device`: made or reported on the machine itself (a `policy` change, an `isolation`). */
     via: "web" | "im" | "device";
-    /** The machine answered with the policy as written (false: the answer never came). */
-    confirmed: boolean;
+    /**
+     * What became of a `policy` change sent to the machine: `applied` (also every change made or
+     * reported on the machine, and every tier / isolation row); `unknown`, its answer never came
+     * (`device.policy_unknown`: an `applied` row follows when the machine reports it); `failed`,
+     * the machine refused it, never received it or stopped while applying it
+     * (`device.policy_failed`).
+     */
+    outcome: "applied" | "unknown" | "failed";
 }
 /** A change of a local device's policy by its owner (`POST /devices/:id/policy`). */
 export interface DevicePolicyChange {
@@ -181,8 +188,8 @@ export interface DeviceList {
  * Personal devices (spec 2026-11-07-environments-design §4.2 items 7, 12, 13; §6; §9):
  * cloud ones on the deployment's sandbox provider and `device` ones on a connected machine; a
  * person's devices in an org, visible and usable only by their owner (anyone else gets
- * `device.not_found`). Deleting one soft-deletes it and destroys its instance and files in a
- * `sandbox-destroy-for` job after the commit.
+ * `device.not_found`). Deleting one soft-deletes it and owes the destruction of its instance and
+ * files (a `sandbox-destroy-for` job) in the same transaction.
  */
 export declare class DevicesService {
     private readonly db;
@@ -191,14 +198,17 @@ export declare class DevicesService {
     private readonly providers;
     private readonly sandbox;
     private readonly sandboxJobs;
+    /** Owes a deleted device's destruction in the delete's transaction. */
+    private readonly outbox;
     private readonly access;
     private readonly displayNames;
-    private readonly log;
     /** Reads the device relay's lease (`online`). */
     private readonly locks;
     private readonly machines;
     private readonly policies;
-    constructor(db: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, providers: Pick<SandboxProviders, "cloud" | "forName">, sandbox: Pick<SandboxService, "deviceLimits" | "limitsState">, sandboxJobs: Pick<SandboxJobs, "destroy" | "resetFiles">, access: Pick<DeviceAccess, "usable">, displayNames: Pick<ExtensionDisplayNames, "many">, log: Pick<KernelLogger, "warn">, 
+    constructor(db: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, providers: Pick<SandboxProviders, "cloud" | "forName">, sandbox: Pick<SandboxService, "deviceLimits" | "limitsState">, sandboxJobs: Pick<SandboxJobs, "resetFiles">, 
+    /** Owes a deleted device's destruction in the delete's transaction. */
+    outbox: Pick<OutboxService, "add">, access: Pick<DeviceAccess, "usable">, displayNames: Pick<ExtensionDisplayNames, "many">, 
     /** Reads the device relay's lease (`online`). */
     locks: Pick<LockService, "holderOf">, machines: Pick<MachinesService, "revoke" | "revokeActive">, policies: Pick<DevicePolicyService, "apply" | "summary">);
     /**
@@ -284,9 +294,9 @@ export declare class DevicesService {
     /** Renames the device locked by {@link lockOwn} (`before`); see {@link rename}. */
     private renameLocked;
     /**
-     * Deletes one of the person's live devices: soft delete, its IM default row cleared, and
-     * after the commit a `sandbox-destroy-for` job (the worker waits for running commands, then
-     * destroys the instance and the files). Conversations bound to it keep pointing at it; their
+     * Deletes one of the person's live devices: soft delete, its IM default row cleared, and a
+     * `sandbox-destroy-for` job owed in the same transaction (`device-destroy-<deviceId>`; the
+     * worker waits for running commands, then destroys the instance and the files). Conversations bound to it keep pointing at it; their
      * sandbox tools then fail with `device.not_found`. A local device's machine is
      * revoked in the same transaction; after the commit it is told `stop { reason: "deleted" }`
      * (while connected) and its connection is closed.
@@ -306,7 +316,7 @@ export declare class DevicesService {
      * refused up front with `device.policy_refused` when the machine last reported
      * `remoteGrants: "off"` (otherwise the machine decides); narrowing is always sent, and
      * `isolation` is only ever `sandbox`. The machine offline → `device.offline`; a cloud device or a
-     * program without the `policyOp` feature → `device.policy_unsupported`; the machine's refusal →
+     * program without the `policyOpId` feature → `device.policy_unsupported`; the machine's refusal →
      * `device.policy_refused` with its message. Callers are human sessions only (no personal access
      * token, no service token, no Platform op).
      */
@@ -391,8 +401,9 @@ export declare class DevicesService {
     private views;
     /**
      * The last {@link RECENT_POLICY_CHANGES} sandbox changes of each device in the org (audit rows
-     * `device.policy_changed`, `device.tier_changed`, `device.isolation_reported`), newest first,
-     * with the deciding account's display name.
+     * `device.policy_changed`, `device.policy_unknown`, `device.policy_failed`,
+     * `device.tier_changed`, `device.isolation_reported`), newest first, with the deciding account's
+     * display name.
      */
     private recentSandboxChanges;
     /**

package/dist/devices/devices.service.js

@@ -15,18 +15,17 @@ import { ApiError } from "../errors.js";
 import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { audit } from "../identity/audit.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { LockService } from "../infra/lock/lock.service.js";
-import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import { deviceLeaseKey } from "../local-devices/keys.js";
 import { MachinesService } from "../local-devices/machines.js";
 import { deviceFeaturesOf, localPolicyOf } from "../local-devices/policy-summary.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
-import { SandboxJobs } from "../sandbox/jobs.js";
+import { oweDeviceDestroy, SandboxJobs } from "../sandbox/jobs.js";
 import { isInternalProvider, LOCAL_PROVIDER, SandboxProviders } from "../sandbox/providers.js";
 import { deviceNotFound, SandboxService } from "../sandbox/sandbox.service.js";
 import { effectiveSandboxPolicy, readDeploymentSandboxPolicy, } from "../sandbox/tiers.js";
@@ -43,8 +42,8 @@ const nameTaken = () => new ApiError("device.name_taken", "You already have a de
  * Personal devices (spec 2026-11-07-environments-design §4.2 items 7, 12, 13; §6; §9):
  * cloud ones on the deployment's sandbox provider and `device` ones on a connected machine; a
  * person's devices in an org, visible and usable only by their owner (anyone else gets
- * `device.not_found`). Deleting one soft-deletes it and destroys its instance and files in a
- * `sandbox-destroy-for` job after the commit.
+ * `device.not_found`). Deleting one soft-deletes it and owes the destruction of its instance and
+ * files (a `sandbox-destroy-for` job) in the same transaction.
  */
 let DevicesService = class DevicesService {
     db;
@@ -53,13 +52,15 @@ let DevicesService = class DevicesService {
     providers;
     sandbox;
     sandboxJobs;
+    outbox;
     access;
     displayNames;
-    log;
     locks;
     machines;
     policies;
-    constructor(db, txHost, config, providers, sandbox, sandboxJobs, access, displayNames, log, 
+    constructor(db, txHost, config, providers, sandbox, sandboxJobs, 
+    /** Owes a deleted device's destruction in the delete's transaction. */
+    outbox, access, displayNames, 
     /** Reads the device relay's lease (`online`). */
     locks, machines, policies) {
         this.db = db;
@@ -68,9 +69,9 @@ let DevicesService = class DevicesService {
         this.providers = providers;
         this.sandbox = sandbox;
         this.sandboxJobs = sandboxJobs;
+        this.outbox = outbox;
         this.access = access;
         this.displayNames = displayNames;
-        this.log = log;
         this.locks = locks;
         this.machines = machines;
         this.policies = policies;
@@ -388,9 +389,9 @@ let DevicesService = class DevicesService {
         });
     }
     /**
-     * Deletes one of the person's live devices: soft delete, its IM default row cleared, and
-     * after the commit a `sandbox-destroy-for` job (the worker waits for running commands, then
-     * destroys the instance and the files). Conversations bound to it keep pointing at it; their
+     * Deletes one of the person's live devices: soft delete, its IM default row cleared, and a
+     * `sandbox-destroy-for` job owed in the same transaction (`device-destroy-<deviceId>`; the
+     * worker waits for running commands, then destroys the instance and the files). Conversations bound to it keep pointing at it; their
      * sandbox tools then fail with `device.not_found`. A local device's machine is
      * revoked in the same transaction; after the commit it is told `stop { reason: "deleted" }`
      * (while connected) and its connection is closed.
@@ -417,15 +418,7 @@ let DevicesService = class DevicesService {
             target: id,
             detail: { name: before.name, isDefault: before.is_default, ...auditDetail },
         });
-        afterCommit(async () => {
-            try {
-                await this.sandboxJobs.destroy([id]);
-            }
-            catch (err) {
-                // the hourly destruction sweep destroys deleted devices too
-                this.log.warn("cannot schedule device destruction", { deviceId: id, err });
-            }
-        });
+        await oweDeviceDestroy(this.outbox, id, orgId);
     }
     /**
      * Disconnects the machine of one of the person's own local devices (it must sign in
@@ -443,7 +436,7 @@ let DevicesService = class DevicesService {
      * refused up front with `device.policy_refused` when the machine last reported
      * `remoteGrants: "off"` (otherwise the machine decides); narrowing is always sent, and
      * `isolation` is only ever `sandbox`. The machine offline → `device.offline`; a cloud device or a
-     * program without the `policyOp` feature → `device.policy_unsupported`; the machine's refusal →
+     * program without the `policyOpId` feature → `device.policy_unsupported`; the machine's refusal →
      * `device.policy_refused` with its message. Callers are human sessions only (no personal access
      * token, no service token, no Platform op).
      */
@@ -459,7 +452,7 @@ let DevicesService = class DevicesService {
         const widens = (change.add?.length ?? 0) > 0 || (known !== null && tierWidens(known.tier, change.tier));
         // only a known "off" is refused here; an unknown summary, a machine that cannot take the op
         // or none at all are left to apply (the machine decides, or unsupported / offline)
-        const canApply = summary?.features.includes("policyOp") === true;
+        const canApply = summary?.features.includes("policyOpId") === true;
         if (widens && canApply && known?.remoteGrants === "off") {
             throw new ApiError("device.policy_refused", remoteGrantsOffMessage(change));
         }
@@ -900,8 +893,9 @@ let DevicesService = class DevicesService {
     }
     /**
      * The last {@link RECENT_POLICY_CHANGES} sandbox changes of each device in the org (audit rows
-     * `device.policy_changed`, `device.tier_changed`, `device.isolation_reported`), newest first,
-     * with the deciding account's display name.
+     * `device.policy_changed`, `device.policy_unknown`, `device.policy_failed`,
+     * `device.tier_changed`, `device.isolation_reported`), newest first, with the deciding account's
+     * display name.
      */
     async recentSandboxChanges(orgId, deviceIds) {
         const out = new Map();
@@ -1021,9 +1015,9 @@ DevicesService = __decorate([
     __param(3, Inject(SandboxProviders)),
     __param(4, Inject(SandboxService)),
     __param(5, Inject(SandboxJobs)),
-    __param(6, Inject(DeviceAccess)),
-    __param(7, Inject(ExtensionDisplayNames)),
-    __param(8, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(OutboxService)),
+    __param(7, Inject(DeviceAccess)),
+    __param(8, Inject(ExtensionDisplayNames)),
     __param(9, Inject(LockService)),
     __param(10, Inject(MachinesService)),
     __param(11, Inject(DevicePolicyService))
@@ -1047,6 +1041,8 @@ const limitsView = (l) => ({
 /** The audit actions a device's recent sandbox changes list. */
 const SANDBOX_CHANGE_ACTIONS = [
     "device.policy_changed",
+    "device.policy_unknown",
+    "device.policy_failed",
     "device.tier_changed",
     "device.isolation_reported",
 ];
@@ -1066,10 +1062,16 @@ function sandboxChangeOf(action, at, d, by) {
         by,
     };
     if (action === "device.tier_changed") {
-        return { ...base, kind: "tier", tier: { to: tierOrNull(d.to) }, via: "web", confirmed: true };
+        return {
+            ...base,
+            kind: "tier",
+            tier: { to: tierOrNull(d.to) },
+            via: "web",
+            outcome: "applied",
+        };
     }
     if (action === "device.isolation_reported") {
-        return { ...base, kind: "isolation", isolation, via: "device", confirmed: true };
+        return { ...base, kind: "isolation", isolation, via: "device", outcome: "applied" };
     }
     return {
         ...base,
@@ -1086,7 +1088,11 @@ function sandboxChangeOf(action, at, d, by) {
             : null,
         remoteGrants: d.remoteGrants === "owner" || d.remoteGrants === "off" ? d.remoteGrants : null,
         via: d.via === "im" ? "im" : d.via === "device" ? "device" : "web",
-        confirmed: d.confirmed === true,
+        outcome: action === "device.policy_unknown"
+            ? "unknown"
+            : action === "device.policy_failed"
+                ? "failed"
+                : "applied",
     };
 }
 /**

package/dist/evals/evals.module.js

@@ -21,7 +21,7 @@ import { OrgLockModule } from "../orgs/org-lock.js";
 import { ProvidersModule } from "../runtime/providers.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
 import { EvalBudgetModule } from "./budget.js";
-import { EVAL_QUEUE_NAME, EvalJobs } from "./jobs.js";
+import { EVAL_CASE_JOB, EVAL_QUEUE_NAME, EvalJobs } from "./jobs.js";
 import { EvalReplaySeeder } from "./run-replay.js";
 import { EvalRunsService } from "./runs.service.js";
 import { EvalSetsService } from "./sets.service.js";
@@ -66,6 +66,10 @@ let EvalsProcessor = class EvalsProcessor extends WorkerHost {
         this.evals = evals;
     }
     process(job, token) {
+        // the queue's one job name, owed by an eval run's start
+        if (job.name !== EVAL_CASE_JOB) {
+            return Promise.reject(new Error(`unknown eval job "${job.name}"`));
+        }
         return runJob(EVAL_QUEUE_NAME, job, () => this.evals.process(job, token));
     }
     failed(job, err) {

package/dist/evals/jobs.d.ts

@@ -1,6 +1,8 @@
-import type { Queue } from "bullmq";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /** 评测队列的 BullMQ 队列名（不含 `:`，C7）。 */
 export declare const EVAL_QUEUE_NAME = "cap-kernel-evals";
+/** The one job name on {@link EVAL_QUEUE_NAME}: one case of an eval run. */
+export declare const EVAL_CASE_JOB = "eval-case";
 /** 每个用例一个任务（C7；不含 `:`）。 */
 export declare const evalJobId: (runId: string, caseId: string) => string;
 /** 评测任务的数据。 */
@@ -10,11 +12,17 @@ export interface EvalJobData {
     orgId: string;
 }
 /**
- * The producer of `cap-kernel-evals` (one job per case, {@link evalJobId}); the eval worker
- * consumes it on the worker role. A leaf module: the runs service and the worker import it.
+ * The producer of `cap-kernel-evals`: owes one {@link EVAL_CASE_JOB} per case (under
+ * {@link evalJobId}) in the transaction that writes the run and its pending results (transactional
+ * outbox spec §3), so a run never waits for jobs that were never added. The eval worker consumes
+ * them on the worker role. A leaf module: the runs service and the worker import it.
  */
 export declare class EvalJobs {
-    private readonly queue;
-    constructor(queue: Pick<Queue, "addBulk">);
-    enqueue(jobs: EvalJobData[]): Promise<void>;
+    private readonly outbox;
+    constructor(outbox: Pick<OutboxService, "addMany">);
+    /**
+     * Owes the case jobs in the caller's transaction (throws outside one), in one insert: a set has
+     * up to `evals.maxCasesPerSet` cases, written while the start holds the org lock.
+     */
+    owe(jobs: readonly EvalJobData[]): Promise<void>;
 }

package/dist/evals/jobs.js

@@ -7,39 +7,41 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /** 评测队列的 BullMQ 队列名（不含 `:`，C7）。 */
 export const EVAL_QUEUE_NAME = "cap-kernel-evals";
+/** The one job name on {@link EVAL_QUEUE_NAME}: one case of an eval run. */
+export const EVAL_CASE_JOB = "eval-case";
 /** 每个用例一个任务（C7；不含 `:`）。 */
 export const evalJobId = (runId, caseId) => `eval-${runId}-${caseId}`;
 /**
- * The producer of `cap-kernel-evals` (one job per case, {@link evalJobId}); the eval worker
- * consumes it on the worker role. A leaf module: the runs service and the worker import it.
+ * The producer of `cap-kernel-evals`: owes one {@link EVAL_CASE_JOB} per case (under
+ * {@link evalJobId}) in the transaction that writes the run and its pending results (transactional
+ * outbox spec §3), so a run never waits for jobs that were never added. The eval worker consumes
+ * them on the worker role. A leaf module: the runs service and the worker import it.
  */
 let EvalJobs = class EvalJobs {
-    queue;
-    constructor(queue) {
-        this.queue = queue;
+    outbox;
+    constructor(outbox) {
+        this.outbox = outbox;
     }
-    async enqueue(jobs) {
-        await this.queue.addBulk(jobs.map((data) => ({
-            name: "case",
+    /**
+     * Owes the case jobs in the caller's transaction (throws outside one), in one insert: a set has
+     * up to `evals.maxCasesPerSet` cases, written while the start holds the org lock.
+     */
+    async owe(jobs) {
+        await this.outbox.addMany(jobs.map((data) => ({
+            queue: EVAL_QUEUE_NAME,
+            name: EVAL_CASE_JOB,
+            jobId: evalJobId(data.runId, data.caseId),
             data,
-            opts: {
-                jobId: evalJobId(data.runId, data.caseId),
-                // 处理函数外的暂时故障（PG / Redis）：指数退避重试，不让整个用例一次失败。
-                // 结果按认领号写入，重做不会重复写结果
-                attempts: 3,
-                backoff: { type: "exponential", delay: 1000 },
-                removeOnComplete: true,
-                removeOnFail: 1000,
-            },
+            orgId: data.orgId,
         })));
     }
 };
 EvalJobs = __decorate([
     Injectable(),
-    __param(0, Inject(getQueueToken(EVAL_QUEUE_NAME)))
+    __param(0, Inject(OutboxService))
 ], EvalJobs);
 export { EvalJobs };

package/dist/evals/run-replay.d.ts

@@ -1,4 +1,4 @@
-import { type ContentBlock, type Logger, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
+import { type ContentBlock, type ConversationSource, type Logger, type ModelUsage, type StopReason } from "@capybara-hq/plugin-sdk";
 import { type ModelRef } from "../agents/definition.js";
 import { EventLog } from "../conversations/event-log.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
@@ -98,6 +98,8 @@ export interface ReplaySeed {
     evalRunId: string;
     orgId: string;
     agentId: string;
+    /** The original conversation's source: the replay offers the tools of this source. */
+    source: ConversationSource;
     accountId: string;
     conversationId: string;
     runId: string;
@@ -121,11 +123,20 @@ export interface ReplaySeed {
     runContext: {
         payload: unknown;
     } | undefined;
+    /**
+     * The original run's `plugin_context` events (memory spec §6.1), in log order, copied as is:
+     * replays never call context providers.
+     */
+    pluginContexts: {
+        payload: {
+            plugin: string;
+        };
+    }[];
 }
 /**
  * The seed of a full-run replay (C6): the `kind = 'eval'` conversation with the events before the
  * original run at their original seqs, the run row and its `run_started` (and the original
- * `skills_catalog`), in one transaction of its own.
+ * `skills_catalog`, `run_context` and `plugin_context` events), in one transaction of its own.
  */
 export declare class EvalReplaySeeder {
     private readonly db;