@capybara-hq/kernel 0.1.0-rc.25 → 0.1.0-rc.27

package/dist/local-devices/machines.js

@@ -16,11 +16,14 @@ import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { LOCAL_PROVIDER } from "../sandbox/providers.js";
 import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceRevokedTopic } from "./keys.js";
-import { deviceFeaturesOf, isolationOf, localPolicyDiff, localPolicyOf, opExplains, pendingPolicyOpsOf, } from "./policy-summary.js";
+import { DEVICE_OP_RESOLVE_JOB, deviceOpReportedJobId } from "./policy-op-jobs.js";
+import { deviceFeaturesOf, isolationOf, localPolicyDiff, localPolicyOf, opExplains, opVisibleIn, pendingPolicyOpsOf, } from "./policy-summary.js";
 import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
@@ -42,12 +45,14 @@ let MachinesService = class MachinesService {
     txHost;
     relay;
     bus;
+    outbox;
     log;
-    constructor(db, txHost, relay, bus, log) {
+    constructor(db, txHost, relay, bus, outbox, log) {
         this.db = db;
         this.txHost = txHost;
         this.relay = relay;
         this.bus = bus;
+        this.outbox = outbox;
         this.log = log;
     }
     /**
@@ -164,7 +169,8 @@ let MachinesService = class MachinesService {
      * isolation that differs from the stored one (none stored counts as `sandbox`) is audited
      * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change; a change of what
      * the owner sets, made on the machine while it was away, is audited `device.policy_changed`
-     * ({@link reportedPolicy}).
+     * ({@link reportedPolicy}). The outcomes of its recent policy ops (`recentOps`) backfill the
+     * platform's ops still pending on the row ({@link backfillOps}).
      */
     async recordHello(machineId, hello, rawPolicy = hello.policy) {
         const self = await this.db
@@ -227,6 +233,61 @@ let MachinesService = class MachinesService {
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
             .execute();
+        if (hello.recentOps !== undefined) {
+            await this.backfillOps(machineId, self, hello.recentOps, localPolicyOf(hello.policy));
+        }
+    }
+    /**
+     * Hello backfill (transactional outbox spec §7): a pending op of the platform's whose outcome
+     * the hello reports (`applied`, `refused`), or that it does not list although the op can no
+     * longer reach the machine (`absent`: past its `resolveAt`), is marked `reported` and owes a
+     * `device-op-resolve` job (`device-op-reported-<opId>`) that records the outcome. An op the
+     * machine logged only as `started` (it stopped between the log and the answer) is judged once
+     * past its `resolveAt` by the policy the hello reports: its change there → `applied`, else
+     * `interrupted` (within the window, or with no readable policy, it is left). An expired entry
+     * (past `until`) is skipped: the machine's reports are no longer the op's. Runs in the caller's
+     * transaction, with the machine's row locked; an op already reported is not owed again.
+     */
+    async backfillOps(machineId, self, recentOps, policy) {
+        const outcomes = new Map(recentOps.map((r) => [r.opId, r.outcome]));
+        const now = Date.now();
+        const reported = new Map();
+        for (const op of pendingPolicyOpsOf(self.pending_policy_ops)) {
+            if (op.reported !== undefined || op.until <= now)
+                continue;
+            const outcome = outcomes.get(op.id);
+            if (outcome === "applied" || outcome === "refused")
+                reported.set(op.id, { outcome });
+            else if (now < op.resolveAt)
+                continue;
+            else if (outcome === undefined)
+                reported.set(op.id, { outcome: "absent" });
+            else if (policy !== null) {
+                reported.set(op.id, { outcome: opVisibleIn(op, policy) ? "applied" : "interrupted" });
+            }
+        }
+        if (reported.size === 0)
+            return;
+        const ops = Array.isArray(self.pending_policy_ops) ? self.pending_policy_ops : [];
+        const next = ops.map((e) => {
+            const id = e?.id;
+            const r = typeof id === "string" ? reported.get(id) : undefined;
+            return r === undefined ? e : { ...e, reported: r };
+        });
+        await this.db
+            .updateTable("device_machines")
+            .set({ pending_policy_ops: JSON.stringify(next) })
+            .where("id", "=", machineId)
+            .execute();
+        for (const opId of reported.keys()) {
+            await this.outbox.add({
+                queue: MAINTENANCE_QUEUE_NAME,
+                name: DEVICE_OP_RESOLVE_JOB,
+                jobId: deviceOpReportedJobId(opId),
+                data: { machineId, opId },
+                orgId: self.org_id,
+            });
+        }
     }
     /**
      * Stores the local policy summary a connected program pushed after its hello (a `policy` frame:
@@ -292,7 +353,6 @@ let MachinesService = class MachinesService {
                     via: "device",
                     machineId,
                     approvalId: null,
-                    confirmed: true,
                 },
             });
             return summary;
@@ -470,7 +530,8 @@ MachinesService = __decorate([
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(LocalDeviceRelay)),
     __param(3, Inject(KERNEL_BUS)),
-    __param(4, Inject(KERNEL_LOGGER))
+    __param(4, Inject(OutboxService)),
+    __param(5, Inject(KERNEL_LOGGER))
 ], MachinesService);
 export { MachinesService };
 const jsonOrNull = (v) => (v === null ? null : JSON.stringify(v));

package/dist/local-devices/policy-op-jobs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Settles a device policy op whose outcome was not recorded (transactional outbox spec §7): owed
+ * by the op's intent transaction for when the op can no longer reach the machine, and by a hello
+ * that reported its outcome. Consumed by `DeviceOpResolver` on the maintenance queue.
+ */
+export declare const DEVICE_OP_RESOLVE_JOB = "device-op-resolve";
+/** The `device-op-resolve` job's data. */
+export interface DeviceOpResolveData {
+    machineId: string;
+    opId: string;
+}
+/** The job id of the resolve job owed with an op's intent. */
+export declare const deviceOpResolveJobId: (opId: string) => string;
+/** The job id of the resolve job owed by a hello that reported the op's outcome. */
+export declare const deviceOpReportedJobId: (opId: string) => string;

package/dist/local-devices/policy-op-jobs.js

@@ -0,0 +1,12 @@
+// The device policy op jobs' names and ids: a leaf module (no service imports), read by the
+// producers (DevicePolicyService, MachinesService) and the maintenance processor.
+/**
+ * Settles a device policy op whose outcome was not recorded (transactional outbox spec §7): owed
+ * by the op's intent transaction for when the op can no longer reach the machine, and by a hello
+ * that reported its outcome. Consumed by `DeviceOpResolver` on the maintenance queue.
+ */
+export const DEVICE_OP_RESOLVE_JOB = "device-op-resolve";
+/** The job id of the resolve job owed with an op's intent. */
+export const deviceOpResolveJobId = (opId) => `device-op-resolve-${opId}`;
+/** The job id of the resolve job owed by a hello that reported the op's outcome. */
+export const deviceOpReportedJobId = (opId) => `device-op-reported-${opId}`;

package/dist/local-devices/policy-summary.d.ts

@@ -38,10 +38,28 @@ export interface LocalPolicyDiff {
 }
 /** The {@link LocalPolicyDiff} from `prev` to `next`; null when nothing the owner sets changed. */
 export declare function localPolicyDiff(prev: DeviceLocalPolicySummary, next: DeviceLocalPolicySummary): LocalPolicyDiff | null;
+/** Who asked for a `policy` op: the deciding account, where, and the network ask it answers. */
+export interface PolicyOpSource {
+    accountId: string;
+    via: "web" | "im";
+    approvalId: string | null;
+}
+/** What the machine reported of an op after its answer was lost (its hello's `recentOps`). */
+export interface ReportedPolicyOp {
+    /**
+     * `absent`: not in the hello's outcomes although the op can no longer reach the machine;
+     * `interrupted`: logged `started` only, and its change is not in the policy the hello reports
+     * (one whose change is there is `applied`).
+     */
+    outcome: "applied" | "refused" | "absent" | "interrupted";
+}
 /**
- * A `policy` op the platform sent to a machine whose answer may not be recorded yet (kept on the
- * machine's row, `pending_policy_ops`): the change asked for, and until when (epoch ms) a summary
- * the machine reports by itself may still be that op's.
+ * The intent of a `policy` op the platform sends to a machine (transactional outbox spec §7), kept
+ * on the machine's row (`pending_policy_ops`) from before the op is sent until its outcome is
+ * recorded: the change asked for, who asked, and until when (epoch ms) a summary the machine
+ * reports by itself may still be that op's. `sent`: on its way or in flight, the
+ * `device-op-resolve` job owed for `resolveAt`; `unknown`: no answer came, and only the machine's
+ * next hello (`recentOps`) or a later `policyStatus` can tell what became of it.
  */
 export interface PendingPolicyOp {
     id: string;
@@ -50,10 +68,25 @@ export interface PendingPolicyOp {
     /** Present when the op set the tier (null: follow the org's default). */
     tier?: SandboxTier | null;
     isolation?: "sandbox";
+    source: PolicyOpSource;
+    actorTokenId?: string;
+    status: "sent" | "unknown";
+    /** When the intent was written (epoch ms). */
+    sentAt: number;
+    /** From when the op can no longer reach the machine (epoch ms): the resolve job's `runAt`. */
+    resolveAt: number;
     until: number;
+    /** Set by a hello that reported the op's outcome (or its absence) before the op was resolved. */
+    reported?: ReportedPolicyOp;
 }
 /** The pending ops stored on a machine row (malformed entries dropped). */
 export declare function pendingPolicyOpsOf(v: unknown): PendingPolicyOp[];
+/**
+ * Whether the change of `op` is in `policy`: its hosts added and removed, its tier and isolation
+ * set. Tells an op the machine logged only as `started` (it stopped between the log and the
+ * answer) that was written from one that was not.
+ */
+export declare function opVisibleIn(op: PendingPolicyOp, policy: DeviceLocalPolicySummary): boolean;
 /**
  * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
  * before the answer was recorded): hosts within the op's, the tier the op set, and only what a

package/dist/local-devices/policy-summary.js

@@ -1,5 +1,10 @@
 import { isSandboxTier, } from "@capybara-hq/plugin-sdk";
-const KNOWN_FEATURES = ["networkReport", "policyOp", "tiers"];
+const KNOWN_FEATURES = [
+    "networkReport",
+    "policyOp",
+    "policyOpId",
+    "tiers",
+];
 /**
  * The known features in `v` (a hello's `features` or the stored column), in a fixed order and
  * deduped; anything else (unknown names, a non-array) is dropped.
@@ -99,17 +104,58 @@ export function pendingPolicyOpsOf(v) {
         const o = e;
         if (typeof o.id !== "string" || typeof o.until !== "number")
             continue;
+        if (typeof o.sentAt !== "number" || typeof o.resolveAt !== "number")
+            continue;
+        if (o.status !== "sent" && o.status !== "unknown")
+            continue;
+        const src = o.source;
+        if (typeof src !== "object" || src === null || typeof src.accountId !== "string")
+            continue;
+        if (src.via !== "web" && src.via !== "im")
+            continue;
+        const rep = o.reported;
+        const outcome = typeof rep === "object" && rep !== null ? rep.outcome : undefined;
+        const reported = outcome === "applied" ||
+            outcome === "refused" ||
+            outcome === "absent" ||
+            outcome === "interrupted"
+            ? { outcome }
+            : undefined;
         out.push({
             id: o.id,
             add: hosts(o.add),
             remove: hosts(o.remove),
             ...("tier" in o && { tier: isSandboxTier(o.tier) ? o.tier : null }),
             ...(o.isolation === "sandbox" && { isolation: "sandbox" }),
+            source: {
+                accountId: src.accountId,
+                via: src.via,
+                approvalId: typeof src.approvalId === "string" ? src.approvalId : null,
+            },
+            ...(typeof o.actorTokenId === "string" && { actorTokenId: o.actorTokenId }),
+            status: o.status,
+            sentAt: o.sentAt,
+            resolveAt: o.resolveAt,
             until: o.until,
+            ...(reported !== undefined && { reported }),
         });
     }
     return out;
 }
+/**
+ * Whether the change of `op` is in `policy`: its hosts added and removed, its tier and isolation
+ * set. Tells an op the machine logged only as `started` (it stopped between the log and the
+ * answer) that was written from one that was not.
+ */
+export function opVisibleIn(op, policy) {
+    if (!op.add.every((h) => policy.allowedDomains.includes(h)))
+        return false;
+    if (op.remove.some((h) => policy.allowedDomains.includes(h)))
+        return false;
+    if (op.tier !== undefined && (policy.tier ?? null) !== op.tier)
+        return false;
+    return op.isolation === undefined || policy.isolation === op.isolation;
+}
 /**
  * Whether `diff` is what the platform's `op` did (its answer, or the machine's own report of it
  * before the answer was recorded): hosts within the op's, the tier the op set, and only what a

package/dist/orgs/orgs.service.js

@@ -24,6 +24,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
+import { USAGE_REPORT_QUEUE } from "../runtime/usage-report-jobs.js";
 import { OrgLock } from "./org-lock.js";
 /** 组织 slug：小写字母数字与 `-`，首尾不能是 `-`，1–40 个字符。 */
 export const SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
@@ -242,11 +243,13 @@ let OrgsService = class OrgsService {
             .where("id", "=", orgId)
             .execute();
         // the org's owed jobs go with it; dead letters stay for the overview, and the deletion's own
-        // cleanup work carries no org_id (transactional outbox spec §9)
+        // cleanup work carries no org_id (transactional outbox spec §9). Usage reports stay owed: the
+        // usage happened, and billing plugins are still told about a deleted org's usage
         await this.db
             .deleteFrom("outbox")
             .where("org_id", "=", orgId)
             .where("dead_at", "is", null)
+            .where("queue", "<>", USAGE_REPORT_QUEUE)
             .execute();
         // after the org is marked deleted, so it counts as no user of what it shared (P3-18)
         await this.ownedItems.onOrgDeleted(orgId, actor.id, {

package/dist/overrides.d.ts

@@ -13,6 +13,7 @@ import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
 import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
 import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
 import type { KernelQueueName } from "./infra/queue/queue-names.js";
+import { DEVICE_POLICY_AFTER_CALL } from "./local-devices/device-policy.service.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
 import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
 import { ENSURE_RUN_FAILS } from "./runtime/run-queue.js";
@@ -47,6 +48,8 @@ import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
  * - `OUTBOX_FAST_PATH_SETTLED`: receives each detached outbox fast-path pass (a test awaits them);
  * - `ENSURE_RUN_FAILS`: returns true to make `RunQueue.ensureRun` throw (Redis unreachable, or the
  *   direct call after a commit skipped by a crash);
+ * - `DEVICE_POLICY_AFTER_CALL`: called after a device policy op's call, before its outcome is
+ *   recorded (throwing stands for a crash between the call and the resolve transaction);
  * - `SCOPE_BACKSTOP_DELAY`: the delay of a confirmation's scope sync backstop (ruling R24);
  * - `APP_INTERCEPTOR`: one more global interceptor (a probe of the matched routes).
  */
@@ -72,6 +75,7 @@ interface KernelSeams {
     [OUTBOX_FAST_PATH_SETTLED]: (pass: Promise<void>) => void;
     [ENSURE_RUN_FAILS]: () => boolean;
     [SCOPE_BACKSTOP_DELAY]: number;
+    [DEVICE_POLICY_AFTER_CALL]: (opId: string) => void;
     [APP_INTERCEPTOR]: NestInterceptor;
 }
 /**

package/dist/overrides.js

@@ -10,6 +10,7 @@ import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
 import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
 import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
 import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
+import { DEVICE_POLICY_AFTER_CALL } from "./local-devices/device-policy.service.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
 import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
 import { ENSURE_RUN_FAILS } from "./runtime/run-queue.js";
@@ -42,6 +43,7 @@ const SEAM_TOKENS = [
     OUTBOX_FAST_PATH_SETTLED,
     ENSURE_RUN_FAILS,
     SCOPE_BACKSTOP_DELAY,
+    DEVICE_POLICY_AFTER_CALL,
     APP_INTERCEPTOR,
 ];
 const allSeamsListed = true;

package/dist/platform/ops/conversations.ops.js

@@ -368,7 +368,7 @@ let ConversationsOperations = class ConversationsOperations {
             }),
             defineOperation({
                 id: "conversations.abort",
-                description: "Stop the run that is active in one of your other conversations (its sub-agents keep working; stopping a sub-agent's conversation stops it and those below it). Nothing happens if no run is active. The person confirms every stop; it is never remembered. The conversation you are working in cannot be stopped.",
+                description: "Stop the run that is active in one of your other conversations (its sub-agents stop with it; stopping a sub-agent's conversation stops it and those below it). Nothing happens if no run is active. The person confirms every stop; it is never remembered. The conversation you are working in cannot be stopped.",
                 input: Id,
                 example: { conversationId: "3f2b8a40-6c1d-4e0b-9a77-5d1e2c8b9f10" },
                 authz: { orgAction: "agents.use" },

package/dist/runtime/maintenance.d.ts

@@ -7,6 +7,7 @@ import { DirectorySync } from "../orgs/directory-sync.js";
 import { Offboarding } from "../orgs/offboarding.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { ScheduledTaskFirer } from "../schedules/fire.js";
+import { DeviceOpResolver } from "../tools/device-op-resolver.js";
 import { ToolDrift } from "../tools/drift.js";
 import { RunQueue } from "./run-queue.js";
 import { Waits } from "./waits.js";
@@ -20,11 +21,12 @@ export declare const MAINTENANCE_CONCURRENCY = 5;
  * {@link DirectorySync}, `run-stop` → {@link Offboarding.stopRun}, `bg-wake` and `ensure-run` → {@link RunQueue.ensureRun}, `stop-tree` →
  * {@link processStopTree} and `deliver-to-parent` → {@link processDeliverToParent} (both in
  * runtime/subagents/tree-jobs.ts, over {@link Waits}), `owned-plugin-cleanup` →
- * {@link OwnedPluginCleanup}, `sched-fire` and `sched-settle` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link OwnedPluginCleanup}, `sched-fire` and `sched-settle` → {@link ScheduledTaskFirer}, `device-op-resolve` →
+ * {@link DeviceOpResolver}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
- * name is warned and completes. The producers are the domains' own (same names, ids and options).
+ * name fails the job (BullMQ retries it; in a rolling deploy a newer replica knows it). The producers are the domains' own (same names, ids and options).
  */
 export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly waits;
@@ -35,10 +37,11 @@ export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly runs;
     private readonly ownedCleanup;
     private readonly scheduledTasks;
+    private readonly deviceOps;
     private readonly scheduled;
     private readonly log;
     private readonly queue;
-    constructor(waits: Pick<Waits, "processTimeout" | "childFinished" | "stopChildren" | "stopDescendantsOfStopped" | "stopTree">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, offboarding: Pick<Offboarding, "stopRun">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduledTasks: Pick<ScheduledTaskFirer, "fire" | "settle">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    constructor(waits: Pick<Waits, "processTimeout" | "childFinished" | "stopChildren" | "stopDescendantsOfStopped" | "stopTree">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, offboarding: Pick<Offboarding, "stopRun">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduledTasks: Pick<ScheduledTaskFirer, "fire" | "settle">, deviceOps: Pick<DeviceOpResolver, "resolve">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
     /**
      * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
      * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a

package/dist/runtime/maintenance.js

@@ -19,6 +19,7 @@ import { runJob } from "../infra/queue/run-job.js";
 import { KernelScheduleModule } from "../infra/schedule/schedule.module.js";
 import { ScheduledRuns } from "../infra/schedule/scheduled-runs.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { DEVICE_OP_RESOLVE_JOB, } from "../local-devices/policy-op-jobs.js";
 import { DIRECTORY_SYNC_JOB, DirectorySync } from "../orgs/directory-sync.js";
 import { Offboarding, RUN_STOP_JOB } from "../orgs/offboarding.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
@@ -27,6 +28,7 @@ import { SandboxModule } from "../sandbox/sandbox.module.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { ScheduledTaskFireModule, ScheduledTaskFirer } from "../schedules/fire.js";
 import { SCHED_FIRE_JOB, SCHED_SETTLE_JOB, } from "../schedules/job-ids.js";
+import { DeviceOpResolver } from "../tools/device-op-resolver.js";
 import { ToolDrift } from "../tools/drift.js";
 import { DRIFT_CONNECTOR_JOB } from "../tools/job-ids.js";
 import { ToolsModule } from "../tools/tools.module.js";
@@ -46,11 +48,12 @@ export const MAINTENANCE_CONCURRENCY = 5;
  * {@link DirectorySync}, `run-stop` → {@link Offboarding.stopRun}, `bg-wake` and `ensure-run` → {@link RunQueue.ensureRun}, `stop-tree` →
  * {@link processStopTree} and `deliver-to-parent` → {@link processDeliverToParent} (both in
  * runtime/subagents/tree-jobs.ts, over {@link Waits}), `owned-plugin-cleanup` →
- * {@link OwnedPluginCleanup}, `sched-fire` and `sched-settle` → {@link ScheduledTaskFirer}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
+ * {@link OwnedPluginCleanup}, `sched-fire` and `sched-settle` → {@link ScheduledTaskFirer}, `device-op-resolve` →
+ * {@link DeviceOpResolver}). The name of a periodic job (a `@LockedCron` / `@LockedInterval` job,
  * such as `sandbox-suspend-idle`) runs that job's body once ({@link ScheduledRuns.runNow}), as the
  * maintenance handlers did when those jobs were schedulers on this queue: an operator's or a
  * test's one-off run, not a second schedule (decision R23 of the Nest kernel spec). Any other
- * name is warned and completes. The producers are the domains' own (same names, ids and options).
+ * name fails the job (BullMQ retries it; in a rolling deploy a newer replica knows it). The producers are the domains' own (same names, ids and options).
  */
 let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
     waits;
@@ -61,10 +64,11 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
     runs;
     ownedCleanup;
     scheduledTasks;
+    deviceOps;
     scheduled;
     log;
     queue;
-    constructor(waits, sandbox, drift, directory, offboarding, runs, ownedCleanup, scheduledTasks, scheduled, log, queue) {
+    constructor(waits, sandbox, drift, directory, offboarding, runs, ownedCleanup, scheduledTasks, deviceOps, scheduled, log, queue) {
         super();
         this.waits = waits;
         this.sandbox = sandbox;
@@ -74,6 +78,7 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
         this.runs = runs;
         this.ownedCleanup = ownedCleanup;
         this.scheduledTasks = scheduledTasks;
+        this.deviceOps = deviceOps;
         this.scheduled = scheduled;
         this.log = log;
         this.queue = queue;
@@ -160,10 +165,18 @@ let MaintenanceProcessor = class MaintenanceProcessor extends WorkerHost {
             case SCHED_SETTLE_JOB:
                 await this.scheduledTasks.settle(job.data);
                 return;
+            // a device policy op whose outcome was not recorded (transactional outbox spec §7)
+            case DEVICE_OP_RESOLVE_JOB:
+                await this.deviceOps.resolve(job.data);
+                return;
             default:
                 if (await this.scheduled.runNow(job.name))
                     return;
-                this.log.warn("unknown maintenance job", { name: job.name, jobId: job.id });
+                // never completed unrun: in a rolling deploy an old worker meets a job a newer replica
+                // owed (its outbox row is gone once added); failing it leaves it to BullMQ's retries, so a
+                // newer replica can take it within the job's attempts (old workers still go first, see
+                // docs/deploy/upgrade.md)
+                throw new Error(`unknown maintenance job "${job.name}"`);
         }
     }
     failed(job, err) {
@@ -189,9 +202,10 @@ MaintenanceProcessor = __decorate([
     __param(5, Inject(RunQueue)),
     __param(6, Inject(OwnedPluginCleanup)),
     __param(7, Inject(ScheduledTaskFirer)),
-    __param(8, Inject(ScheduledRuns)),
-    __param(9, Inject(KERNEL_LOGGER)),
-    __param(10, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
+    __param(8, Inject(DeviceOpResolver)),
+    __param(9, Inject(ScheduledRuns)),
+    __param(10, Inject(KERNEL_LOGGER)),
+    __param(11, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME)))
 ], MaintenanceProcessor);
 export { MaintenanceProcessor };
 /**

package/dist/runtime/plugin-context.service.d.ts

@@ -54,8 +54,12 @@ export declare class PluginContextService {
     private readonly registry;
     private readonly log;
     constructor(db: KernelDb, eventLog: Pick<EventLog, "appendIn" | "notify">, txHost: TransactionHost, points: Pick<ExtensionPointDefaults, "providersFor">, registry: Pick<ExtensionRegistry, "list">, log: KernelLogger);
-    /** Asks the providers and records what changed (see the class); notifies after the commit. */
-    record(input: PluginContextInput): Promise<void>;
+    /**
+     * Asks the providers and records what changed (see the class); notifies after the commit. False:
+     * the run had ended under the locks (a stop landed while the providers were asked), so nothing
+     * was appended and the run must not go on (as `RunContextService.record`).
+     */
+    record(input: PluginContextInput): Promise<boolean>;
     /** One provider's call, bounded by the run's signal and the time limit. */
     private ask;
     /**
@@ -63,7 +67,9 @@ export declare class PluginContextService {
      * answer's hash with the plugin's latest `plugin_context` and appends the ones that differ (a
      * plugin with no earlier event and no text writes nothing), plus an empty event for each plugin
      * in `off` whose latest text is not empty. Idem key per run and plugin, so a retried run
-     * start finds its events or nothing changed. Returns the last seq written.
+     * start finds its events or nothing changed. Returns the last seq written; `ended` when the run
+     * is terminal under the locks (the providers are asked outside the transaction, so a stop may
+     * have ended it meanwhile: nothing is appended after its end).
      */
     private append;
 }

package/dist/runtime/plugin-context.service.js

@@ -18,6 +18,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { latestPluginContexts, pluginContextIdemKey } from "./context/plugin-context.js";
+import { runEndedIn } from "./run-status.js";
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 /**
  * Run start's plugin context (memory plugin spec §6.1): asks every `context@1` provider enabled in
@@ -48,10 +49,14 @@ let PluginContextService = class PluginContextService {
         this.registry = registry;
         this.log = log;
     }
-    /** Asks the providers and records what changed (see the class); notifies after the commit. */
+    /**
+     * Asks the providers and records what changed (see the class); notifies after the commit. False:
+     * the run had ended under the locks (a stop landed while the providers were asked), so nothing
+     * was appended and the run must not go on (as `RunContextService.record`).
+     */
     async record(input) {
         if (input.kind !== "chat")
-            return;
+            return true;
         let found;
         try {
             found = await this.points.providersFor(input.orgId, "context");
@@ -64,7 +69,7 @@ let PluginContextService = class PluginContextService {
                 runId: input.runId,
                 err,
             });
-            return;
+            return true;
         }
         const { providers } = found;
         const tools = providers.length > 0 ? await input.toolKeysByPlugin() : new Map();
@@ -93,10 +98,13 @@ let PluginContextService = class PluginContextService {
             .filter((plugin) => !serving.has(plugin) && !found.failed.has(plugin)));
         // nothing answered and nothing to switch off: no transaction, no row lock
         if (texts.size === 0 && off.size === 0)
-            return;
+            return true;
         const seq = await this.append(input, texts, off);
+        if (seq === "ended")
+            return false;
         if (seq !== null)
             await this.eventLog.notify(input.conversationId, seq);
+        return true;
     }
     /** One provider's call, bounded by the run's signal and the time limit. */
     async ask(p, input, tools) {
@@ -141,7 +149,9 @@ let PluginContextService = class PluginContextService {
      * answer's hash with the plugin's latest `plugin_context` and appends the ones that differ (a
      * plugin with no earlier event and no text writes nothing), plus an empty event for each plugin
      * in `off` whose latest text is not empty. Idem key per run and plugin, so a retried run
-     * start finds its events or nothing changed. Returns the last seq written.
+     * start finds its events or nothing changed. Returns the last seq written; `ended` when the run
+     * is terminal under the locks (the providers are asked outside the transaction, so a stop may
+     * have ended it meanwhile: nothing is appended after its end).
      */
     async append(input, texts, off) {
         const t = this.db.db;
@@ -151,6 +161,8 @@ let PluginContextService = class PluginContextService {
             .where("id", "=", input.conversationId)
             .forUpdate()
             .executeTakeFirst();
+        if (await runEndedIn(t, input.runId))
+            return "ended";
         const rows = await t
             .selectFrom("conversation_events")
             .select(["seq", "payload"])

package/dist/runtime/run-context.service.d.ts

@@ -41,12 +41,16 @@ export declare class RunContextService {
     private readonly now;
     constructor(db: KernelDb, eventLog: Pick<EventLog, "appendIn" | "notify">, txHost: TransactionHost, now?: () => number);
     private clock;
-    /** Records the run's context (see the class) and notifies after the commit. */
-    record(input: RunContextInput): Promise<void>;
+    /**
+     * Records the run's context (see the class) and notifies after the commit. False: the run had
+     * ended (a stop got there first), so nothing was appended and the run must not go on.
+     */
+    record(input: RunContextInput): Promise<boolean>;
     /**
      * One transaction under the conversation row lock (as `lockLatestCatalog`): fold, read the
      * current values, append when something differs, with the idem key `run_context:<runId>` (a
-     * retried run start finds its event, or finds nothing changed). Returns the seq written.
+     * retried run start finds its event, or finds nothing changed). Returns the seq written;
+     * `ended` when the run is terminal under the locks (nothing is appended after its end).
      */
     private append;
     /** A root run: agent, org, and the date, zone and language of the run's person (§3.4). */

package/dist/runtime/run-context.service.js

@@ -17,6 +17,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
 import { isTimeZone } from "../time-zone.js";
 import { currentRunContext, dateIn, runContextChange, sanitizeSenderName, snapshotDescription, } from "./context/run-context.js";
+import { runEndedIn } from "./run-status.js";
 /**
  * Optional provider: the clock run start reads the date from and the `CurrentTime` builtin reads
  * the time from (default `Date.now`; tests).
@@ -46,16 +47,23 @@ let RunContextService = class RunContextService {
     clock() {
         return new Date(this.now());
     }
-    /** Records the run's context (see the class) and notifies after the commit. */
+    /**
+     * Records the run's context (see the class) and notifies after the commit. False: the run had
+     * ended (a stop got there first), so nothing was appended and the run must not go on.
+     */
     async record(input) {
         const seq = await this.append(input);
+        if (seq === "ended")
+            return false;
         if (seq !== null)
             await this.eventLog.notify(input.conversationId, seq);
+        return true;
     }
     /**
      * One transaction under the conversation row lock (as `lockLatestCatalog`): fold, read the
      * current values, append when something differs, with the idem key `run_context:<runId>` (a
-     * retried run start finds its event, or finds nothing changed). Returns the seq written.
+     * retried run start finds its event, or finds nothing changed). Returns the seq written;
+     * `ended` when the run is terminal under the locks (nothing is appended after its end).
      */
     async append(input) {
         const t = this.db.db;
@@ -65,6 +73,8 @@ let RunContextService = class RunContextService {
             .where("id", "=", input.conversationId)
             .forUpdate()
             .executeTakeFirst();
+        if (await runEndedIn(t, input.runId))
+            return "ended";
         const prev = await foldOf(t, input.conversationId);
         const next = input.subagent === undefined
             ? await this.rootContext(t, input)