@capybara-hq/kernel 0.1.0-rc.25 → 0.1.0-rc.27

package/dist/channels/outbound.d.ts

@@ -97,7 +97,7 @@ export declare class ChannelOutbound {
     /** The conversation lock provider; delivery takes it under its own key prefix. */
     lock: Pick<ConversationLock, "scoped">, connections: Pick<ChannelConnections, "outbound">, approvals: Pick<ApprovalsService, "describe">, questions: Pick<QuestionsService, "forCall">, registry: Pick<ToolRegistry, "builtinSpecs" | "extensionToolSpecs">, 
     /** 入站任务的处理（worker 上执行 `ChannelInbound.handle`）；失败抛错由 BullMQ 重试。 */
-    inbound: Pick<ChannelInbound, "handle">, jobs: Pick<ChannelJobs, "enqueue">, config: Pick<KernelConfigService, "get">, log: Pick<Logger, "error" | "warn" | "info">, txHost: TransactionHost, 
+    inbound: Pick<ChannelInbound, "handle">, jobs: Pick<ChannelJobs, "enqueue" | "resumeConnection">, config: Pick<KernelConfigService, "get">, log: Pick<Logger, "error" | "warn" | "info">, txHost: TransactionHost, 
     /** Pauses the task of a scheduled run whose chat is gone (scheduled tasks spec §8). */
     schedules: Pick<ScheduledTasksService, "pauseFor">);
     /**
@@ -112,7 +112,10 @@ export declare class ChannelOutbound {
     /** Stops: the jobs in flight are handed back at their next checkpoint, the worker closes. */
     close(): Promise<void>;
     private requeue;
-    /** One job of the channel queue (the `@Processor` calls it): a delivery or an inbound event. */
+    /**
+     * One job of the channel queue (the `@Processor` calls it): a delivery, an inbound event or a
+     * connection's catch-up.
+     */
     process(job: Job<ChannelJobData>, token: string | undefined): Promise<void>;
     /** 本副本没有加载连接的插件：推迟重试（不消耗重试次数），排队超过上限才放弃。 */
     private pluginPending;

package/dist/channels/outbound.js

@@ -28,7 +28,7 @@ import { ToolRegistry } from "../tools/registry.js";
 import { approvalCard, cardMessage, connectUrl, conversationUrl, questionCard, webBase, } from "./cards.js";
 import { ChannelConnections } from "./connections.service.js";
 import { ChannelInbound } from "./inbound.js";
-import { ChannelJobs, INBOUND_JOB, idempotencyKey, } from "./jobs.js";
+import { ChannelJobs, INBOUND_JOB, idempotencyKey, RESUME_JOB, } from "./jobs.js";
 import { phrase } from "./phrases.js";
 import { insertThread } from "./threads.js";
 // The queue, job names, ids and priorities live with the producer (jobs.ts)
@@ -233,12 +233,19 @@ let ChannelOutbound = class ChannelOutbound {
         await job.moveToDelayed(Date.now() + delayMs, token);
         throw new DelayedError();
     }
-    /** One job of the channel queue (the `@Processor` calls it): a delivery or an inbound event. */
+    /**
+     * One job of the channel queue (the `@Processor` calls it): a delivery, an inbound event or a
+     * connection's catch-up.
+     */
     async process(job, token) {
         if (this.stopping.signal.aborted)
             return this.requeue(job, token, 0);
         if (job.name === INBOUND_JOB)
             return this.processInbound(job, token);
+        // a connection's catch-up: a failed add fails the job, which BullMQ retries
+        if (job.name === RESUME_JOB) {
+            return this.jobs.resumeConnection(job.data.connectionId);
+        }
         return this.deliver(job, token);
     }
     /** 本副本没有加载连接的插件：推迟重试（不消耗重试次数），排队超过上限才放弃。 */

package/dist/conversations/conversations.controller.d.ts

@@ -312,8 +312,10 @@ export declare class ConversationsController {
     }>;
     /**
      * Stops the current run (the conversation's owner): 202 `{ runId }`; nothing active → 409
-     * `run.not_active`. On a root conversation `runId` is the stopped run, and its background
-     * sub-agents keep working. On a sub-agent's conversation (the root's owner, at any depth) the
+     * `run.not_active`. On a root conversation every active sub-agent of its tree stops with its
+     * run, and nothing they deliver starts the root again until its next run (agent map spec §6,
+     * changed in acceptance 2026-11-13); `runId` is the stopped run (the latest when only sub-agents
+     * ran). On a sub-agent's conversation (the root's owner, at any depth) the
      * sub-agent stops with every sub-agent below it, and `runId` is the sub-agent's latest run,
      * which may already be finished when only its descendants were working (agent map spec §6).
      */

package/dist/conversations/conversations.controller.js

@@ -456,8 +456,10 @@ let ConversationsController = class ConversationsController {
     }
     /**
      * Stops the current run (the conversation's owner): 202 `{ runId }`; nothing active → 409
-     * `run.not_active`. On a root conversation `runId` is the stopped run, and its background
-     * sub-agents keep working. On a sub-agent's conversation (the root's owner, at any depth) the
+     * `run.not_active`. On a root conversation every active sub-agent of its tree stops with its
+     * run, and nothing they deliver starts the root again until its next run (agent map spec §6,
+     * changed in acceptance 2026-11-13); `runId` is the stopped run (the latest when only sub-agents
+     * ran). On a sub-agent's conversation (the root's owner, at any depth) the
      * sub-agent stops with every sub-agent below it, and `runId` is the sub-agent's latest run,
      * which may already be finished when only its descendants were working (agent map spec §6).
      */

package/dist/conversations/conversations.service.d.ts

@@ -537,10 +537,43 @@ export declare class ConversationsService {
      * 等人处理的运行没有 worker：直接取消等待并写终态。其余经 Redis 广播，运行所在的任意副本都会收到；
      * 运行已是孤儿（没有任何 worker 在执行）时直接写终态。
      *
-     * A root conversation's stop stops only its own run: its background sub-agents keep working
-     * (agent map spec §6). A sub-agent's conversation (its owner, from the agent map) stops that
-     * sub-agent with every descendant (`RunControl.stopTree`); `run.not_active` when nothing in that
-     * subtree runs, else the sub-agent's latest run id.
+     * A root conversation's stop stops everything below it too (agent map spec §6, changed in
+     * acceptance 2026-11-13: after a person stops, the conversation stays stopped). In order:
+     * 1. `tree_stopped_at` is set on the root under its row lock: by the stopped run's terminal
+     *    transaction (a waiting, queued or orphaned run), before the stop is asked for (a run a
+     *    worker holds, which is active until then), or on its own (nothing of the root ran). From
+     *    then on no sub-agent delivery wakes the root (`wakeDecisionIn`) and no
+     *    sub-agent of the tree starts a run by a wake or a parent's message (`RunQueue.childWakeIn`),
+     *    until the root next starts a run (a person's message, the queue, a background Bash task's
+     *    finish), which clears it. A child that finishes just before or after the stop, `completed`
+     *    or `aborted`, thus never wakes the root; its delivery stays in the log and reaches the
+     *    model with the next run;
+     * 2. (with 1) the root's own active run stops as before ({@link abortRootRun});
+     * 3. every active sub-agent run of the tree stops (`RunControl.stopTree`, as the agent map's stop
+     *    and the deletion do), with the background tasks of every sub-agent. A sub-agent the root's
+     *    run dispatched after that read is stopped when the root run ends
+     *    (`Waits.stopDescendantsOfStopped`).
+     * The root's own background Bash tasks keep running: they are the conversation's tasks, stopped
+     * with `TaskStop` or the task list. `run.not_active` when neither the root nor its tree had an
+     * active run (the stop still holds the tree's wakes); else the root's run id (its latest when only
+     * sub-agents ran).
+     *
+     * A sub-agent's conversation (its owner, from the agent map) stops that sub-agent with every
+     * descendant (`RunControl.stopTree`); `run.not_active` when nothing in that subtree runs, else
+     * the sub-agent's latest run id. Its `aborted` finish never wakes its parent.
      */
     abort(orgId: string, conversationId: string, accountId: string): Promise<string>;
+    /**
+     * Marks a person's stop of the root's tree (`tree_stopped_at`, see {@link abort}); committed
+     * before any stop, so every wake decided after it (under the root's row lock) sees it.
+     */
+    private holdTree;
+    /**
+     * Stops a root conversation's own active run (queued / running / waiting) and returns its id;
+     * null when none is active. Its sub-agents are the caller's. The tree's hold
+     * (`tree_stopped_at`) is written by the stopped run's terminal transaction (`RunFinish.finishIn`
+     * for a run a person stopped), in the lock order every stop and decision takes (conversation,
+     * decided row, run); a run a worker holds is marked before its stop is asked for as well.
+     */
+    private abortRootRun;
 }

package/dist/conversations/conversations.service.js

@@ -342,13 +342,11 @@ let ConversationsService = class ConversationsService {
      * log, runs and trajectory stay (super admins still see them).
      */
     async remove(orgId, conversationId, accountId) {
-        await this.writable(orgId, conversationId, accountId);
-        try {
-            await this.abort(orgId, conversationId, accountId);
-        }
-        catch (e) {
-            if (!(e instanceof ApiError && e.code === "run.not_active"))
-                throw e;
+        const conv = await this.writable(orgId, conversationId, accountId);
+        // the root's own run only: the tree stops below, after the mark (a sub-agent's conversation
+        // is read-only, so `writable` refused it)
+        if (conv.parentConversationId === null) {
+            await this.abortRootRun(conversationId, accountId);
         }
         await this.markDeleted(orgId, conversationId, accountId);
         // after the mark, so no finish or delivery of the stops below can start a run on the deleted
@@ -981,25 +979,77 @@ let ConversationsService = class ConversationsService {
      * 等人处理的运行没有 worker：直接取消等待并写终态。其余经 Redis 广播，运行所在的任意副本都会收到；
      * 运行已是孤儿（没有任何 worker 在执行）时直接写终态。
      *
-     * A root conversation's stop stops only its own run: its background sub-agents keep working
-     * (agent map spec §6). A sub-agent's conversation (its owner, from the agent map) stops that
-     * sub-agent with every descendant (`RunControl.stopTree`); `run.not_active` when nothing in that
-     * subtree runs, else the sub-agent's latest run id.
+     * A root conversation's stop stops everything below it too (agent map spec §6, changed in
+     * acceptance 2026-11-13: after a person stops, the conversation stays stopped). In order:
+     * 1. `tree_stopped_at` is set on the root under its row lock: by the stopped run's terminal
+     *    transaction (a waiting, queued or orphaned run), before the stop is asked for (a run a
+     *    worker holds, which is active until then), or on its own (nothing of the root ran). From
+     *    then on no sub-agent delivery wakes the root (`wakeDecisionIn`) and no
+     *    sub-agent of the tree starts a run by a wake or a parent's message (`RunQueue.childWakeIn`),
+     *    until the root next starts a run (a person's message, the queue, a background Bash task's
+     *    finish), which clears it. A child that finishes just before or after the stop, `completed`
+     *    or `aborted`, thus never wakes the root; its delivery stays in the log and reaches the
+     *    model with the next run;
+     * 2. (with 1) the root's own active run stops as before ({@link abortRootRun});
+     * 3. every active sub-agent run of the tree stops (`RunControl.stopTree`, as the agent map's stop
+     *    and the deletion do), with the background tasks of every sub-agent. A sub-agent the root's
+     *    run dispatched after that read is stopped when the root run ends
+     *    (`Waits.stopDescendantsOfStopped`).
+     * The root's own background Bash tasks keep running: they are the conversation's tasks, stopped
+     * with `TaskStop` or the task list. `run.not_active` when neither the root nor its tree had an
+     * active run (the stop still holds the tree's wakes); else the root's run id (its latest when only
+     * sub-agents ran).
+     *
+     * A sub-agent's conversation (its owner, from the agent map) stops that sub-agent with every
+     * descendant (`RunControl.stopTree`); `run.not_active` when nothing in that subtree runs, else
+     * the sub-agent's latest run id. Its `aborted` finish never wakes its parent.
      */
     async abort(orgId, conversationId, accountId) {
         const conv = await this.get(orgId, conversationId, accountId);
+        const latest = () => this.db
+            .selectFrom("runs")
+            .select("id")
+            .where("conversation_id", "=", conversationId)
+            .orderBy("created_at", "desc")
+            .executeTakeFirst();
         if (conv.parentConversationId !== null) {
-            const latest = await this.db
-                .selectFrom("runs")
-                .select("id")
-                .where("conversation_id", "=", conversationId)
-                .orderBy("created_at", "desc")
-                .executeTakeFirst();
+            const last = await latest();
             const n = await this.runs.stopTree(conversationId, accountId);
-            if (n === 0 || !latest)
+            if (n === 0 || !last)
                 throw new ApiError("run.not_active", "No active run to abort");
-            return latest.id;
+            return last.id;
         }
+        const stopped = await this.abortRootRun(conversationId, accountId);
+        // nothing of the root's ran: the hold is the stop's own write
+        if (stopped === null)
+            await this.holdTree(conversationId);
+        const n = await this.runs.stopTree(conversationId, accountId, { includeSelf: false });
+        if (stopped !== null)
+            return stopped;
+        const last = await latest();
+        if (n === 0 || !last)
+            throw new ApiError("run.not_active", "No active run to abort");
+        return last.id;
+    }
+    /**
+     * Marks a person's stop of the root's tree (`tree_stopped_at`, see {@link abort}); committed
+     * before any stop, so every wake decided after it (under the root's row lock) sees it.
+     */
+    async holdTree(conversationId) {
+        await this.db
+            .updateTable("conversations")
+            .set({ tree_stopped_at: sql `now()` })
+            .where("id", "=", conversationId)
+            .execute();
+    }
+    /**
+     * Stops a root conversation's own active run (queued / running / waiting) and returns its id;
+     * null when none is active. Its sub-agents are the caller's. The tree's hold
+     * (`tree_stopped_at`) is written by the stopped run's terminal transaction (`RunFinish.finishIn`
+     * for a run a person stopped), in the lock order every stop and decision takes (conversation,
+     * decided row, run); a run a worker holds is marked before its stop is asked for as well.
+     */
+    async abortRootRun(conversationId, accountId) {
         const run = await this.db
             .selectFrom("runs")
             .select(["id", "status"])
@@ -1008,7 +1058,7 @@ let ConversationsService = class ConversationsService {
             .orderBy("created_at", "desc")
             .executeTakeFirst();
         if (!run)
-            throw new ApiError("run.not_active", "No active run to abort");
+            return null;
         const runs = this.runs;
         // 等待中：直接结束；没成功（刚被续跑、已回到 queued）则按下面的常规路径中止。
         // the stop's terminal transaction owed the ensure-run backstop; the direct call starts what
@@ -1031,6 +1081,10 @@ let ConversationsService = class ConversationsService {
             await runs.ensureRunAfterCommit(conversationId);
             return run.id;
         }
+        // a run a worker holds ends later: the hold is written now, before the stop is asked for,
+        // while the run is still active (no wake can start the root before it), and again by its
+        // terminal transaction
+        await this.holdTree(conversationId);
         await runs.requestAbort(run.id, accountId);
         return run.id;
     }
@@ -1053,6 +1107,9 @@ __decorate([
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], ConversationsService.prototype, "bindIn", null);
+__decorate([
+    Transactional()
+], ConversationsService.prototype, "holdTree", null);
 ConversationsService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),

package/dist/conversations/events.d.ts

@@ -737,6 +737,12 @@ export declare const ConversationEventSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         byAccountId: z.ZodNullable<z.ZodString>;
         reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"approval_updated">;
+    payload: z.ZodObject<{
+        approvalId: z.ZodString;
+        callId: z.ZodString;
+    }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"question_asked">;
     payload: z.ZodObject<{

package/dist/conversations/events.js

@@ -622,6 +622,12 @@ export const ConversationEventSchema = z.discriminatedUnion("type", [
          */
         reason: z.string().max(APPROVAL_DENY_REASON_MAX_CHARS).optional(),
     })),
+    /**
+     * A still-pending approval changed without a decision: a network ask's 「这台设备一直允许」 whose
+     * device change was not applied or not confirmed (`detail.attempt`, transactional outbox spec
+     * §7). Display only, never model-visible: the page reads the approval again.
+     */
+    ev("approval_updated", z.object({ approvalId: z.string(), callId: z.string() })),
     /**
      * 工具调用需要用户输入（`AskUserQuestion`、插件工具的 `input_required`、MCP elicitation）：输入请求已建，
      * run 暂停等待回答。界面据此显示表单卡片（不进模型请求）。

package/dist/db/kernel-schema.d.ts

@@ -268,6 +268,11 @@ export interface ConversationsTable {
      * (the column's `web` default is not relied on: a forgotten source must not read as web).
      */
     source: ColumnType<ConversationSource, ConversationSource, never>;
+    /**
+     * 0125: when a person stopped this root conversation and its sub-agent tree; cleared when the
+     * root next starts a run. While set the tree's wakes are held (agent map spec §6).
+     */
+    tree_stopped_at: ColumnType<Date | null, Date | string | null | undefined, Date | string | null>;
 }
 /** 0060: an org's order of file-preview@1 previewers (UI refresh B Task 11). */
 export interface FilePreviewersTable {
@@ -345,7 +350,11 @@ export interface RunsTable {
     waiting_since: TsNullable;
     /** 0012：累计等待时长（毫秒），不计入运行时长。 */
     waited_ms: Int8;
-    /** 0012：续跑任务的 jobId；为空表示按触发消息生成的 jobId。 */
+    /**
+     * 0012: the run's job id when it is not the trigger's `runJobId`: a resume's
+     * (`resumeJobId`), or `<runJobId>-<n>` for a later run of the same trigger (R34); null: the
+     * trigger's first run, under `runJobId`.
+     */
     job_id: string | null;
     /** 0012：最近一次（续跑）回到 queued 的时刻。 */
     queued_at: TsNullable;

package/dist/devices/devices.service.d.ts

@@ -112,7 +112,8 @@ export declare const RECENT_POLICY_CHANGES = 10;
 /**
  * One sandbox change of a device, as its owner sees it on the device page (§10.4):
  * - `policy` (`device.policy_changed`): a local policy change sent to the machine (`web`, `im`),
- *   or made on the machine by its owner (`device`, `capybara-device policy ...`);
+ *   or made on the machine by its owner (`device`, `capybara-device policy ...`); one sent whose
+ *   answer never came (`device.policy_unknown`) or that failed (`device.policy_failed`) too;
  * - `tier` (`device.tier_changed`): a cloud device's tier set by its owner;
  * - `isolation` (`device.isolation_reported`): the machine reported running without a sandbox,
  *   or with one again.
@@ -141,8 +142,14 @@ export interface DeviceSandboxChangeView {
     by: string | null;
     /** `device`: made or reported on the machine itself (a `policy` change, an `isolation`). */
     via: "web" | "im" | "device";
-    /** The machine answered with the policy as written (false: the answer never came). */
-    confirmed: boolean;
+    /**
+     * What became of a `policy` change sent to the machine: `applied` (also every change made or
+     * reported on the machine, and every tier / isolation row); `unknown`, its answer never came
+     * (`device.policy_unknown`: an `applied` row follows when the machine reports it); `failed`,
+     * the machine refused it, never received it or stopped while applying it
+     * (`device.policy_failed`).
+     */
+    outcome: "applied" | "unknown" | "failed";
 }
 /** A change of a local device's policy by its owner (`POST /devices/:id/policy`). */
 export interface DevicePolicyChange {
@@ -309,7 +316,7 @@ export declare class DevicesService {
      * refused up front with `device.policy_refused` when the machine last reported
      * `remoteGrants: "off"` (otherwise the machine decides); narrowing is always sent, and
      * `isolation` is only ever `sandbox`. The machine offline → `device.offline`; a cloud device or a
-     * program without the `policyOp` feature → `device.policy_unsupported`; the machine's refusal →
+     * program without the `policyOpId` feature → `device.policy_unsupported`; the machine's refusal →
      * `device.policy_refused` with its message. Callers are human sessions only (no personal access
      * token, no service token, no Platform op).
      */
@@ -394,8 +401,9 @@ export declare class DevicesService {
     private views;
     /**
      * The last {@link RECENT_POLICY_CHANGES} sandbox changes of each device in the org (audit rows
-     * `device.policy_changed`, `device.tier_changed`, `device.isolation_reported`), newest first,
-     * with the deciding account's display name.
+     * `device.policy_changed`, `device.policy_unknown`, `device.policy_failed`,
+     * `device.tier_changed`, `device.isolation_reported`), newest first, with the deciding account's
+     * display name.
      */
     private recentSandboxChanges;
     /**

package/dist/devices/devices.service.js

@@ -436,7 +436,7 @@ let DevicesService = class DevicesService {
      * refused up front with `device.policy_refused` when the machine last reported
      * `remoteGrants: "off"` (otherwise the machine decides); narrowing is always sent, and
      * `isolation` is only ever `sandbox`. The machine offline → `device.offline`; a cloud device or a
-     * program without the `policyOp` feature → `device.policy_unsupported`; the machine's refusal →
+     * program without the `policyOpId` feature → `device.policy_unsupported`; the machine's refusal →
      * `device.policy_refused` with its message. Callers are human sessions only (no personal access
      * token, no service token, no Platform op).
      */
@@ -452,7 +452,7 @@ let DevicesService = class DevicesService {
         const widens = (change.add?.length ?? 0) > 0 || (known !== null && tierWidens(known.tier, change.tier));
         // only a known "off" is refused here; an unknown summary, a machine that cannot take the op
         // or none at all are left to apply (the machine decides, or unsupported / offline)
-        const canApply = summary?.features.includes("policyOp") === true;
+        const canApply = summary?.features.includes("policyOpId") === true;
         if (widens && canApply && known?.remoteGrants === "off") {
             throw new ApiError("device.policy_refused", remoteGrantsOffMessage(change));
         }
@@ -893,8 +893,9 @@ let DevicesService = class DevicesService {
     }
     /**
      * The last {@link RECENT_POLICY_CHANGES} sandbox changes of each device in the org (audit rows
-     * `device.policy_changed`, `device.tier_changed`, `device.isolation_reported`), newest first,
-     * with the deciding account's display name.
+     * `device.policy_changed`, `device.policy_unknown`, `device.policy_failed`,
+     * `device.tier_changed`, `device.isolation_reported`), newest first, with the deciding account's
+     * display name.
      */
     async recentSandboxChanges(orgId, deviceIds) {
         const out = new Map();
@@ -1040,6 +1041,8 @@ const limitsView = (l) => ({
 /** The audit actions a device's recent sandbox changes list. */
 const SANDBOX_CHANGE_ACTIONS = [
     "device.policy_changed",
+    "device.policy_unknown",
+    "device.policy_failed",
     "device.tier_changed",
     "device.isolation_reported",
 ];
@@ -1059,10 +1062,16 @@ function sandboxChangeOf(action, at, d, by) {
         by,
     };
     if (action === "device.tier_changed") {
-        return { ...base, kind: "tier", tier: { to: tierOrNull(d.to) }, via: "web", confirmed: true };
+        return {
+            ...base,
+            kind: "tier",
+            tier: { to: tierOrNull(d.to) },
+            via: "web",
+            outcome: "applied",
+        };
     }
     if (action === "device.isolation_reported") {
-        return { ...base, kind: "isolation", isolation, via: "device", confirmed: true };
+        return { ...base, kind: "isolation", isolation, via: "device", outcome: "applied" };
     }
     return {
         ...base,
@@ -1079,7 +1088,11 @@ function sandboxChangeOf(action, at, d, by) {
             : null,
         remoteGrants: d.remoteGrants === "owner" || d.remoteGrants === "off" ? d.remoteGrants : null,
         via: d.via === "im" ? "im" : d.via === "device" ? "device" : "web",
-        confirmed: d.confirmed === true,
+        outcome: action === "device.policy_unknown"
+            ? "unknown"
+            : action === "device.policy_failed"
+                ? "failed"
+                : "applied",
     };
 }
 /**

package/dist/evals/evals.module.js

@@ -21,7 +21,7 @@ import { OrgLockModule } from "../orgs/org-lock.js";
 import { ProvidersModule } from "../runtime/providers.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
 import { EvalBudgetModule } from "./budget.js";
-import { EVAL_QUEUE_NAME, EvalJobs } from "./jobs.js";
+import { EVAL_CASE_JOB, EVAL_QUEUE_NAME, EvalJobs } from "./jobs.js";
 import { EvalReplaySeeder } from "./run-replay.js";
 import { EvalRunsService } from "./runs.service.js";
 import { EvalSetsService } from "./sets.service.js";
@@ -66,6 +66,10 @@ let EvalsProcessor = class EvalsProcessor extends WorkerHost {
         this.evals = evals;
     }
     process(job, token) {
+        // the queue's one job name, owed by an eval run's start
+        if (job.name !== EVAL_CASE_JOB) {
+            return Promise.reject(new Error(`unknown eval job "${job.name}"`));
+        }
         return runJob(EVAL_QUEUE_NAME, job, () => this.evals.process(job, token));
     }
     failed(job, err) {

package/dist/evals/jobs.d.ts

@@ -1,6 +1,8 @@
-import type { Queue } from "bullmq";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /** 评测队列的 BullMQ 队列名（不含 `:`，C7）。 */
 export declare const EVAL_QUEUE_NAME = "cap-kernel-evals";
+/** The one job name on {@link EVAL_QUEUE_NAME}: one case of an eval run. */
+export declare const EVAL_CASE_JOB = "eval-case";
 /** 每个用例一个任务（C7；不含 `:`）。 */
 export declare const evalJobId: (runId: string, caseId: string) => string;
 /** 评测任务的数据。 */
@@ -10,11 +12,17 @@ export interface EvalJobData {
     orgId: string;
 }
 /**
- * The producer of `cap-kernel-evals` (one job per case, {@link evalJobId}); the eval worker
- * consumes it on the worker role. A leaf module: the runs service and the worker import it.
+ * The producer of `cap-kernel-evals`: owes one {@link EVAL_CASE_JOB} per case (under
+ * {@link evalJobId}) in the transaction that writes the run and its pending results (transactional
+ * outbox spec §3), so a run never waits for jobs that were never added. The eval worker consumes
+ * them on the worker role. A leaf module: the runs service and the worker import it.
  */
 export declare class EvalJobs {
-    private readonly queue;
-    constructor(queue: Pick<Queue, "addBulk">);
-    enqueue(jobs: EvalJobData[]): Promise<void>;
+    private readonly outbox;
+    constructor(outbox: Pick<OutboxService, "addMany">);
+    /**
+     * Owes the case jobs in the caller's transaction (throws outside one), in one insert: a set has
+     * up to `evals.maxCasesPerSet` cases, written while the start holds the org lock.
+     */
+    owe(jobs: readonly EvalJobData[]): Promise<void>;
 }

package/dist/evals/jobs.js

@@ -7,39 +7,41 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /** 评测队列的 BullMQ 队列名（不含 `:`，C7）。 */
 export const EVAL_QUEUE_NAME = "cap-kernel-evals";
+/** The one job name on {@link EVAL_QUEUE_NAME}: one case of an eval run. */
+export const EVAL_CASE_JOB = "eval-case";
 /** 每个用例一个任务（C7；不含 `:`）。 */
 export const evalJobId = (runId, caseId) => `eval-${runId}-${caseId}`;
 /**
- * The producer of `cap-kernel-evals` (one job per case, {@link evalJobId}); the eval worker
- * consumes it on the worker role. A leaf module: the runs service and the worker import it.
+ * The producer of `cap-kernel-evals`: owes one {@link EVAL_CASE_JOB} per case (under
+ * {@link evalJobId}) in the transaction that writes the run and its pending results (transactional
+ * outbox spec §3), so a run never waits for jobs that were never added. The eval worker consumes
+ * them on the worker role. A leaf module: the runs service and the worker import it.
  */
 let EvalJobs = class EvalJobs {
-    queue;
-    constructor(queue) {
-        this.queue = queue;
+    outbox;
+    constructor(outbox) {
+        this.outbox = outbox;
     }
-    async enqueue(jobs) {
-        await this.queue.addBulk(jobs.map((data) => ({
-            name: "case",
+    /**
+     * Owes the case jobs in the caller's transaction (throws outside one), in one insert: a set has
+     * up to `evals.maxCasesPerSet` cases, written while the start holds the org lock.
+     */
+    async owe(jobs) {
+        await this.outbox.addMany(jobs.map((data) => ({
+            queue: EVAL_QUEUE_NAME,
+            name: EVAL_CASE_JOB,
+            jobId: evalJobId(data.runId, data.caseId),
             data,
-            opts: {
-                jobId: evalJobId(data.runId, data.caseId),
-                // 处理函数外的暂时故障（PG / Redis）：指数退避重试，不让整个用例一次失败。
-                // 结果按认领号写入，重做不会重复写结果
-                attempts: 3,
-                backoff: { type: "exponential", delay: 1000 },
-                removeOnComplete: true,
-                removeOnFail: 1000,
-            },
+            orgId: data.orgId,
         })));
     }
 };
 EvalJobs = __decorate([
     Injectable(),
-    __param(0, Inject(getQueueToken(EVAL_QUEUE_NAME)))
+    __param(0, Inject(OutboxService))
 ], EvalJobs);
 export { EvalJobs };

package/dist/evals/runs.service.d.ts

@@ -145,7 +145,7 @@ export declare const RESULTS_ASOF_OVERLAP_MS = 15000;
 export declare class EvalRunsService {
     readonly txHost: TransactionHost;
     private readonly d;
-    constructor(kdb: KernelDb, orgLock: OrgLock, locks: LockService, config: KernelConfigService, registry: ProviderRegistry, prices: PricesService, settings: SettingsService, queue: EvalJobs, budget: EvalBudget, purposes: ModelPurposesService, txHost: TransactionHost);
+    constructor(kdb: KernelDb, orgLock: OrgLock, locks: LockService, config: KernelConfigService, registry: ProviderRegistry, prices: PricesService, settings: SettingsService, jobs: EvalJobs, budget: EvalBudget, purposes: ModelPurposesService, txHost: TransactionHost);
     private liveSet;
     /**
      * 解析模型；不存在 / 不可用 → `eval.candidate_invalid`（供应商列表暂时失败照常抛出）。
@@ -187,8 +187,9 @@ export declare class EvalRunsService {
     private tokenCaps;
     /**
      * 启动：校验 token 上限（[1, `evals.maxTokenCap`]，缺省 `evals.defaultTokenCap`）、候选、评委用途；
-     * 没有可回放的 → `eval.nothing_to_replay`。事务内建运行行、预建 pending 结果，提交后每个用例入队一个任务；
-     * 入队失败 → 运行标 failed、结果 skipped，错误照常抛出。
+     * 没有可回放的 → `eval.nothing_to_replay`。One transaction writes the run row and its pending
+     * results and owes one case job per valid case (transactional outbox spec §3): the outbox adds
+     * them after the commit, so a run never waits for a job that was never added.
      */
     start(orgId: string, actor: string, setId: string, input: {
         mode: "step" | "run";
@@ -196,10 +197,8 @@ export declare class EvalRunsService {
         judge: boolean;
         tokenCap?: number;
     }, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<EvalRunView>;
-    /** The run row and its pending results, in a transaction of their own (enqueued after the commit). */
+    /** The run row, its pending results and its owed case jobs, in a transaction of their own. */
     private startIn;
-    /** The enqueue failed: the run is `failed`, its pending results `skipped`. */
-    private failStartIn;
     /** 各运行的汇总（只算已结束的）。 */
     private summaries;
     private static toView;