@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/runtime/run-worker.js

@@ -25,11 +25,13 @@ import { KernelEvents } from "../infra/events/kernel-events.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { SkillsCatalogService } from "../skills/catalog.js";
 import { normalizeStoredDefinitionIn } from "../tools/legacy-data.js";
+import { ToolRegistry } from "../tools/registry.js";
 import { RunAbort } from "./abort.js";
 import { KyselyCheckpointSaver } from "./checkpointer.js";
 import { ConversationLock } from "./conversation-lock.js";
 import { runDeadline, tightestLimit } from "./limits.js";
 import { RunError } from "./model-call.js";
+import { PluginContextService } from "./plugin-context.service.js";
 import { ProviderListError, ProviderRegistry } from "./providers.js";
 import { ORG_QUOTA_LEASE_MS, orgRunLimit, RUN_QUOTA } from "./quota.js";
 import { RunContextService } from "./run-context.service.js";
@@ -64,6 +66,15 @@ async function requeue(job, token, delayMs) {
     await job.moveToDelayed(Date.now() + delayMs, token);
     throw new DelayedError();
 }
+/** An account's display name ("" when it is gone). */
+async function accountName(db, accountId) {
+    const row = await db
+        .selectFrom("accounts")
+        .select("display_name")
+        .where("id", "=", accountId)
+        .executeTakeFirst();
+    return row?.display_name ?? "";
+}
 /**
  * 运行 worker（只在含 `worker` 角色的进程消费）：领取 `cap-kernel-runs` 与 `cap-kernel-subagent-runs` 的任务
  * （两个 `@Processor`，见 run-processors.ts），取会话锁与组织配额，调用 AgentLoop，按结果写终态事件并推进
@@ -87,6 +98,8 @@ let RunWorker = class RunWorker {
     models;
     skillsCatalog;
     runContext;
+    pluginContext;
+    tools;
     finisher;
     txHost;
     drafts;
@@ -114,7 +127,11 @@ let RunWorker = class RunWorker {
     /** Run start's skills catalog snapshot (reads the pinned skills' bodies, phase B). */
     skillsCatalog, 
     /** Run start's run context (run context spec §5): who the agent is, the day, the person. */
-    runContext, finisher, txHost, 
+    runContext, 
+    /** Run start's plugin context (memory plugin spec §6.1): the `context@1` providers' text. */
+    pluginContext, 
+    /** The run's resolved tools, for the plugin context's `tools` (chat runs with providers). */
+    tools, finisher, txHost, 
     /** The steps' live drafts this process writes for the runs it executes. */
     drafts, hooks) {
         this.kdb = kdb;
@@ -134,6 +151,8 @@ let RunWorker = class RunWorker {
         this.models = models;
         this.skillsCatalog = skillsCatalog;
         this.runContext = runContext;
+        this.pluginContext = pluginContext;
+        this.tools = tools;
         this.finisher = finisher;
         this.txHost = txHost;
         this.drafts = drafts;
@@ -190,8 +209,10 @@ let RunWorker = class RunWorker {
     /**
      * After any terminal commit of a run that is not a sub-agent's (sub-agents spec §12): stops its
      * active fork invocation child on its behalf (no account); background `Agent` children keep
-     * running (agent map spec §5.4). The terminal transaction owed the same stop (`stop-tree`), the
-     * backstop when this call never happens.
+     * running (agent map spec §5.4), unless a person stopped the run: then the sub-agents of its
+     * windows stop too, also one it dispatched after the stop read the tree (agent map spec §6,
+     * changed in acceptance 2026-11-13). The terminal transaction owed the same stops
+     * (`stop-tree`), the backstop when this call never happens.
      */
     async stopChildren(runId) {
         try {
@@ -200,6 +221,12 @@ let RunWorker = class RunWorker {
         catch (err) {
             this.log.error("cannot stop the sub-agents of a finished run", { runId, err });
         }
+        try {
+            await this.waits.stopDescendantsOfStopped(runId);
+        }
+        catch (err) {
+            this.log.error("cannot stop the sub-agents of a stopped run", { runId, err });
+        }
     }
     /**
      * After a sub-agent run's terminal state committed (sub-agents spec §7.3): reports it to the
@@ -379,9 +406,10 @@ let RunWorker = class RunWorker {
         // 运行在等人处理（例如暂停后本任务被 stalled 机制重新投递）：不执行，续跑由处理 / 超时发起的新任务负责。
         if (run.status === "waiting")
             return;
+        await this.hooks?.afterRunRead?.(runId, conversationId);
         const conv = await this.db
             .selectFrom("conversations")
-            .select(["org_id", "agent_id", "kind", "subagent_depth"])
+            .select(["org_id", "agent_id", "kind", "subagent_depth", "source", "account_id"])
             .where("id", "=", conversationId)
             .executeTakeFirst();
         if (!conv)
@@ -448,8 +476,6 @@ let RunWorker = class RunWorker {
                 delayMs = QUOTA_FULL_DELAY_MS;
             }
             else {
-                // 运行开始执行（含续跑、stalled 后接手）：通知旁路（渠道出站投递据此把输出投到 IM），失败不影响运行
-                void this.events.emit("run.started", { conversationId, runId });
                 const r = await this.execute(run, { id: conversationId, ...conv }, state).catch(async (err) => {
                     if (state.abandoned)
                         return "abandoned";
@@ -574,6 +600,14 @@ let RunWorker = class RunWorker {
             saved = await normalizeStoredDefinitionIn(this.db, conv.org_id, version.definition);
             agent = saved;
         }
+        // the trigger account's role, read once per run for the plugin context and plugin tool
+        // handlers (memory plugin spec §6.2); an account no longer in the org counts as a guest
+        const role = (await this.db
+            .selectFrom("memberships")
+            .select("role")
+            .where("org_id", "=", conv.org_id)
+            .where("account_id", "=", run.trigger_account_id)
+            .executeTakeFirst())?.role ?? "guest";
         let startedAt = run.started_at;
         // The model / effort switch in effect (UI refresh B): the latest `model_switched` before this
         // run's `run_started`, read under the conversation lock when the run starts, so a replay
@@ -585,25 +619,36 @@ let RunWorker = class RunWorker {
         }
         if (run.status === "queued" || startedAt === null) {
             if (!existingStart) {
+                await this.hooks?.beforeRunStarted?.(runId, conversationId);
                 if (saved !== undefined)
                     await this.fallBackIfUnavailable(conv.org_id, conversationId, runId, saved);
                 const started = await this.appendRunStarted(conversationId, run, agent, saved);
+                // the status was read before the conversation lock: a stop that ended the run meanwhile
+                // (a queued run's direct abort, an orphan abort) wins, and the run never starts
+                if (started.terminal)
+                    return "finished";
                 agent = started.agent;
                 const toSeq = started.toSeq;
                 if (toSeq !== undefined)
                     await this.eventLog.notify(conversationId, toSeq);
             }
-            // 技能目录快照（Ruling M17）：在置为 running 之前写，崩溃重试时仍走这里（幂等键去重）
-            await this.skillsCatalog.record({
+            // Skills catalog snapshot (ruling M17): written before the run is running, and again on a
+            // crash retry (deduped by its idem key). Both records re-read the run under the conversation
+            // and run row locks in their append transactions: a stop that ended it meanwhile (a retried
+            // start reads `queued` before any lock) wins, nothing is appended after its end, and the run
+            // never starts.
+            const catalogged = await this.skillsCatalog.record({
                 orgId: conv.org_id,
                 agentId: conv.agent_id,
                 conversationId,
                 runId,
                 agent,
             }, { log: this.log });
+            if (!catalogged)
+                return "finished";
             // run context (spec §5): after the catalog, before the run is running, so before any
             // compaction and model call; a retried run start finds its event or no change
-            await this.runContext.record({
+            const contexted = await this.runContext.record({
                 orgId: conv.org_id,
                 conversationId,
                 runId,
@@ -617,14 +662,47 @@ let RunWorker = class RunWorker {
                     },
                 }),
             });
+            if (!contexted)
+                return "finished";
+            // plugin context (memory plugin spec §6.1): after the run context, still before the run is
+            // running; the providers are asked outside any transaction, a chat run only, so a stop may
+            // end the run meanwhile: its append transaction re-reads the run under the locks
+            const pluginContexted = await this.pluginContext.record({
+                orgId: conv.org_id,
+                conversationId,
+                runId,
+                agentId: conv.agent_id,
+                agentName: agent.name,
+                ownerAccountId: conv.account_id,
+                // only a chat run asks the providers
+                ownerName: conv.kind === "chat" ? await accountName(this.db, conv.account_id) : "",
+                triggerAccountId: run.trigger_account_id,
+                source: conv.source,
+                role,
+                kind: conv.kind,
+                toolKeysByPlugin: () => this.pluginToolKeys(conv, agent),
+                // the run's own abort watch starts with its execution below: until then, the shutdown
+                signal: state.shutdown.signal,
+            });
+            if (!pluginContexted)
+                return "finished";
+            await this.hooks?.beforeRunning?.(runId, conversationId);
+            // never over a terminal status: a run finished meanwhile stays finished
             const updated = await this.db
                 .updateTable("runs")
                 .set({ status: "running", started_at: sql `COALESCE(started_at, now())` })
                 .where("id", "=", runId)
+                .where("status", "in", ["queued", "running"])
                 .returning("started_at")
-                .executeTakeFirstOrThrow();
+                .executeTakeFirst();
+            if (updated === undefined)
+                return "finished";
             startedAt = updated.started_at;
         }
+        // the run executes (a first start, a resume, a stalled takeover): a hint to the side paths (the
+        // channel outbound delivers its output to IM), after the start went through, never for a run a
+        // stop ended first; a failure does not affect the run
+        void this.events.emit("run.started", { conversationId, runId });
         // 截止时间以首次开始为准：停机后在其他 worker 续跑也不重新计时；等人处理的时长（waited_ms）不计入。
         // `runtime.maxRunSeconds` 0: no deadline, no timer (the run ends when the model stops or is stopped)
         const deadline = runDeadline(startedAt.getTime() + Number(run.waited_ms), runtime.maxRunSeconds);
@@ -688,6 +766,9 @@ let RunWorker = class RunWorker {
                     runId,
                     agentId: conv.agent_id,
                     triggerAccountId: run.trigger_account_id,
+                    source: conv.source,
+                    ownerAccountId: conv.account_id,
+                    role,
                     agent,
                     agentVersion: run.agent_version,
                     signal: ac.signal,
@@ -788,6 +869,28 @@ let RunWorker = class RunWorker {
         // a completed run enqueues the conversation's title job (never throws)
         void this.titles.maybeEnqueue(conversationId);
     }
+    /**
+     * The run's extension tool keys by plugin, resolved as a chat run's first step lists them
+     * (disabled tools, org switches, the conversation's source): a provider's `tools`.
+     */
+    async pluginToolKeys(conv, agent) {
+        const { tools } = await this.tools.forAgent(conv.org_id, {
+            disabledTools: agent.disabledTools,
+            subagentTools: agent.subagentTools,
+            subagents: agent.subagents,
+            sandboxConversationId: conv.id,
+            source: conv.source,
+        });
+        const out = new Map();
+        for (const t of tools) {
+            if (t.source.kind !== "plugin")
+                continue;
+            const keys = out.get(t.source.plugin) ?? [];
+            keys.push(t.key);
+            out.set(t.source.plugin, keys);
+        }
+        return out;
+    }
     /**
      * When the conversation was switched to a model that no longer resolves (provider disabled,
      * model removed), writes `model_switched { model: null, effort: null, reason: "unavailable" }`
@@ -820,6 +923,26 @@ let RunWorker = class RunWorker {
         await this.eventLog.notify(conversationId, ev.seq);
         await this.eventLog.publishChanged(conversationId, "selection");
     }
+    /**
+     * Whether the run is gone or terminal, read in the caller's transaction under the locks
+     * (conversation, then run, as `RunFinish.finishIn`): the job read its status before taking the
+     * conversation lock, and a stop may have ended it since.
+     */
+    async endedUnderLocks(conversationId, runId) {
+        await this.db
+            .selectFrom("conversations")
+            .select("id")
+            .where("id", "=", conversationId)
+            .forUpdate()
+            .execute();
+        const row = await this.db
+            .selectFrom("runs")
+            .select("status")
+            .where("id", "=", runId)
+            .forUpdate()
+            .executeTakeFirst();
+        return !row || TERMINAL_STATUSES.has(row.status);
+    }
     /**
      * `run_started` under the conversation row lock, with the model / effort switch in effect then
      * (a chat run's `saved` version under the conversation's selection): what the run uses.
@@ -828,12 +951,9 @@ let RunWorker = class RunWorker {
     /** The definition so far (a sub-agent's frozen one is final). */
     current, saved) {
         const t = this.db;
-        await t
-            .selectFrom("conversations")
-            .select("id")
-            .where("id", "=", conversationId)
-            .forUpdate()
-            .execute();
+        if (await this.endedUnderLocks(conversationId, run.id)) {
+            return { toSeq: undefined, agent: current, terminal: true };
+        }
         const agent = saved !== undefined
             ? effectiveDefinition(saved, await readSelection(t, conversationId))
             : current;
@@ -951,10 +1071,12 @@ RunWorker = __decorate([
     __param(16, Inject(ProviderRegistry)),
     __param(17, Inject(SkillsCatalogService)),
     __param(18, Inject(RunContextService)),
-    __param(19, Inject(RunFinish)),
-    __param(20, Inject(TransactionHost)),
-    __param(21, Inject(RunDrafts)),
-    __param(22, Optional()),
-    __param(22, Inject(RUN_HOOKS))
+    __param(19, Inject(PluginContextService)),
+    __param(20, Inject(ToolRegistry)),
+    __param(21, Inject(RunFinish)),
+    __param(22, Inject(TransactionHost)),
+    __param(23, Inject(RunDrafts)),
+    __param(24, Optional()),
+    __param(24, Inject(RUN_HOOKS))
 ], RunWorker);
 export { RunWorker };

package/dist/runtime/runtime.module.js

@@ -23,6 +23,7 @@ import { RunAbort } from "./abort.js";
 import { KyselyCheckpointSaver } from "./checkpointer.js";
 import { ConversationLock } from "./conversation-lock.js";
 import { MAINTENANCE_QUEUE_NAME } from "./maintenance-queue.js";
+import { PluginContextService } from "./plugin-context.service.js";
 import { ProvidersModule } from "./providers.js";
 import { EVAL_QUOTA, EVAL_QUOTA_PREFIX, OrgQuota, RUN_QUOTA, RUN_QUOTA_PREFIX } from "./quota.js";
 import { RunContextService } from "./run-context.service.js";
@@ -83,6 +84,7 @@ RuntimeModule = __decorate([
             AgentLoops,
             RunSteps,
             RunContextService,
+            PluginContextService,
             RunWorker,
             // a finished background task wakes an idle conversation (background Bash spec §3)
             BackgroundWake,

package/dist/runtime/step-log.d.ts

@@ -9,10 +9,10 @@ import { UsageReportJobs } from "./usage-report-jobs.js";
 export type StepAuditEntry = Parameters<typeof audit>[1];
 /**
  * The writes of a run step that go to the event log together with another row, each in a
- * transaction of its own (the caller notifies the log after the commit): a model call with the
- * tool definitions it sent, a denial with its audit row, usage events with their owed
- * `usage.report` deliveries (transactional outbox spec §8.1), and a sub-agent's usage counted on
- * its parent run. The step functions (`model-call.ts`, `hook-calls.ts`) reach it through their deps.
+ * transaction of its own (the caller notifies the log after the commit): a model call with the tool
+ * definitions it sent, a denial with its audit row, usage events with their owed `usage.report`
+ * deliveries (transactional outbox spec §8.1), and a sub-agent's usage counted on its parent run.
+ * The step functions (`model-call.ts`, `hook-calls.ts`) reach it through their deps.
  */
 export declare class StepLog {
     private readonly kdb;
@@ -35,7 +35,8 @@ export declare class StepLog {
      * the whole tree counts on one run): `counter.budgetRunId`, the run's own window
      * (`SubagentParent.budgetRunId`), else the parent run's ({@link budgetRunOf}). A usage event
      * already in the log (an idempotent hit after a crash) adds nothing, so each call counts exactly
-     * once; the new usage events' `usage.report` deliveries are owed in the same transaction. Returns what was written (hits included) and the highest new seq (null: nothing new).
+     * once; the new usage events' `usage.report` deliveries are owed in the same transaction. Returns
+     * what was written (hits included) and the highest new seq (null: nothing new).
      */
     appendCounted(conversationId: string, counter: {
         parentRunId: string;

package/dist/runtime/step-log.js

@@ -20,10 +20,10 @@ import { budgetRunOf } from "./subagents/limits.js";
 import { UsageReportJobs, UsageReportJobsModule } from "./usage-report-jobs.js";
 /**
  * The writes of a run step that go to the event log together with another row, each in a
- * transaction of its own (the caller notifies the log after the commit): a model call with the
- * tool definitions it sent, a denial with its audit row, usage events with their owed
- * `usage.report` deliveries (transactional outbox spec §8.1), and a sub-agent's usage counted on
- * its parent run. The step functions (`model-call.ts`, `hook-calls.ts`) reach it through their deps.
+ * transaction of its own (the caller notifies the log after the commit): a model call with the tool
+ * definitions it sent, a denial with its audit row, usage events with their owed `usage.report`
+ * deliveries (transactional outbox spec §8.1), and a sub-agent's usage counted on its parent run.
+ * The step functions (`model-call.ts`, `hook-calls.ts`) reach it through their deps.
  */
 let StepLog = class StepLog {
     kdb;
@@ -53,7 +53,8 @@ let StepLog = class StepLog {
      * the whole tree counts on one run): `counter.budgetRunId`, the run's own window
      * (`SubagentParent.budgetRunId`), else the parent run's ({@link budgetRunOf}). A usage event
      * already in the log (an idempotent hit after a crash) adds nothing, so each call counts exactly
-     * once; the new usage events' `usage.report` deliveries are owed in the same transaction. Returns what was written (hits included) and the highest new seq (null: nothing new).
+     * once; the new usage events' `usage.report` deliveries are owed in the same transaction. Returns
+     * what was written (hits included) and the highest new seq (null: nothing new).
      */
     async appendCounted(conversationId, counter, events) {
         const t = this.kdb.db;

package/dist/runtime/subagents/dispatch.js

@@ -121,6 +121,7 @@ export async function dispatchSubagent(d, a) {
             parent_conversation_id: ctx.conversationId,
             subagent_type: entry.type,
             subagent_depth: childDepth,
+            source: "subagent",
         })
             .execute();
         const [, task] = await d.eventLog.appendIn(childId, [

package/dist/runtime/subagents/skill-fork.js

@@ -125,6 +125,9 @@ export async function advanceSkillForks(d, a) {
             agentVersion: ctx.agentVersion,
             agent: ctx.agent,
             accountId: ctx.triggerAccountId,
+            source: ctx.source,
+            ownerAccountId: ctx.ownerAccountId,
+            role: ctx.role,
             signal: ctx.signal,
             ...(ctx.limits.deadline !== undefined && { deadline: ctx.limits.deadline }),
             ...(ctx.conversationKind !== undefined &&

package/dist/runtime/usage-report.d.ts

@@ -58,7 +58,9 @@ export declare function narrowPending(stored: readonly string[] | undefined, fai
  *   `model_usage` row and owes job `usage-model-<rowId>` with it; the payload
  *   (`purpose: "embedding"`, `eventId` = the row id, the calling `extension`, no conversation fields)
  *   is read from the row when the job runs, and the row's `reported_at` is set once nothing is left
- *   to deliver; a job that gives up after its last attempt sets `report_failed_at`.
+ *   to deliver; a job that gives up after its last attempt sets `report_failed_at`. A row with
+ *   `reported_at IS NULL` is not necessarily pending: no job is owed when no enabled extension
+ *   subscribed to `usage.report` at the time of the call, and such a row is never reported.
  */
 export declare class UsageReporter {
     private readonly kdb;

package/dist/runtime/usage-report.js

@@ -113,7 +113,9 @@ export function narrowPending(stored, failed) {
  *   `model_usage` row and owes job `usage-model-<rowId>` with it; the payload
  *   (`purpose: "embedding"`, `eventId` = the row id, the calling `extension`, no conversation fields)
  *   is read from the row when the job runs, and the row's `reported_at` is set once nothing is left
- *   to deliver; a job that gives up after its last attempt sets `report_failed_at`.
+ *   to deliver; a job that gives up after its last attempt sets `report_failed_at`. A row with
+ *   `reported_at IS NULL` is not necessarily pending: no job is owed when no enabled extension
+ *   subscribed to `usage.report` at the time of the call, and such a row is never reported.
  */
 let UsageReporter = class UsageReporter {
     kdb;
@@ -359,7 +361,7 @@ let UsageReporter = class UsageReporter {
     /** One delivery job (the `@Processor` of {@link USAGE_REPORT_QUEUE} calls it). */
     async process(j, token) {
         const payload = await this.payloadOfJob(j.data);
-        // conversation (or org) deleted meanwhile: nothing to report
+        // conversation deleted meanwhile: nothing to report
         if (payload === null)
             return;
         const subscribers = await this.subscribers(payload.orgId);

package/dist/runtime/waits.d.ts

@@ -230,6 +230,13 @@ export declare class Waits implements OnApplicationShutdown {
      * background tasks of every covered sub-agent conversation stop, whether it was running or idle.
      * Returns the number of runs asked to stop.
      *
+     * `windowsUpTo` (a root run's id; only after that root run a person stopped ended,
+     * {@link stopDescendantsOfStopped}) narrows the stop to the runs of the budget windows opened up
+     * to that run (`runs.budget_run_id`, agent map spec §6): a run of a window a later root run
+     * opened (the person's next message, started meanwhile) is never stopped by the late call, and
+     * the background task sweep is left out (a stopped child's own end stops its tasks,
+     * {@link childFinished}).
+     *
      * Lock order: nothing is held across runs. Each run's stop is its own transaction (or none), and
      * one that writes the terminal state locks that run's conversation row, then its run row, the
      * order of `StepLog.appendCounted` (conversation row, then the root's budget run row) and of
@@ -238,14 +245,17 @@ export declare class Waits implements OnApplicationShutdown {
      */
     stopTree(conversationId: string, byAccountId: string | null, opts?: {
         includeSelf?: boolean;
+        windowsUpTo?: string;
     }): Promise<number>;
     /**
-     * After a sub-agent run's terminal commit (its worker): a run a person stopped (`run_aborted`
-     * with an account and no `detail`; only {@link stopTree} stops a sub-agent's run that way) stops
-     * the active runs below its conversation as well, so a descendant it dispatched after the tree
-     * stop read the tree still stops (dispatch needs its run `running`, so after its terminal commit
-     * the set is final). Any other end leaves its children running (agent map spec §5.4). Returns
-     * the number of runs asked to stop. A root conversation's run never stops its children here.
+     * After a run's terminal commit (its worker): a run a person stopped (`run_aborted` with an
+     * account and no `detail`; {@link stopTree} or a person's stop of the root) stops the active runs
+     * below its conversation as well, so a descendant it dispatched after the tree stop read the tree
+     * still stops (dispatch needs its run `running`, so after its terminal commit the set is final).
+     * A root's run stops only the runs of the budget windows up to it (`windowsUpTo`): the person's
+     * next message may already have started a new run with sub-agents of its own (agent map spec §6,
+     * changed in acceptance 2026-11-13). Any other end leaves its children running (§5.4). Returns
+     * the number of runs asked to stop.
      */
     stopDescendantsOfStopped(runId: string): Promise<number>;
     /**

package/dist/runtime/waits.js

@@ -607,6 +607,13 @@ let Waits = class Waits {
      * background tasks of every covered sub-agent conversation stop, whether it was running or idle.
      * Returns the number of runs asked to stop.
      *
+     * `windowsUpTo` (a root run's id; only after that root run a person stopped ended,
+     * {@link stopDescendantsOfStopped}) narrows the stop to the runs of the budget windows opened up
+     * to that run (`runs.budget_run_id`, agent map spec §6): a run of a window a later root run
+     * opened (the person's next message, started meanwhile) is never stopped by the late call, and
+     * the background task sweep is left out (a stopped child's own end stops its tasks,
+     * {@link childFinished}).
+     *
      * Lock order: nothing is held across runs. Each run's stop is its own transaction (or none), and
      * one that writes the terminal state locks that run's conversation row, then its run row, the
      * order of `StepLog.appendCounted` (conversation row, then the root's budget run row) and of
@@ -619,12 +626,22 @@ let Waits = class Waits {
         if (ids.length === 0)
             return 0;
         const level = new Map(tree.map((c) => [c.id, c.level]));
-        const runs = (await this.db
+        let q = this.db
             .selectFrom("runs")
             .select(["id", "conversation_id", "status"])
             .where("conversation_id", "in", ids)
-            .where("status", "in", ACTIVE_RUN_STATUSES)
-            .execute()).sort((a, b) => (level.get(a.conversation_id) ?? 0) - (level.get(b.conversation_id) ?? 0));
+            .where("status", "in", ACTIVE_RUN_STATUSES);
+        const upTo = opts.windowsUpTo;
+        if (upTo !== undefined) {
+            // a window is opened by a root run without a budget run of its own (`budgetWindowOf`)
+            q = q.where("budget_run_id", "in", (eb) => eb
+                .selectFrom("runs as w")
+                .select("w.id")
+                .where("w.conversation_id", "=", conversationId)
+                .where("w.budget_run_id", "is", null)
+                .where("w.created_at", "<=", (eb2) => eb2.selectFrom("runs as s").select("s.created_at").where("s.id", "=", upTo)));
+        }
+        const runs = (await q.execute()).sort((a, b) => (level.get(a.conversation_id) ?? 0) - (level.get(b.conversation_id) ?? 0));
         for (const r of runs) {
             try {
                 // a stopped wait's card updates are owed by its transaction's appends (outbox spec §8.1)
@@ -639,34 +656,39 @@ let Waits = class Waits {
         // all of each conversation's tasks, as a stopped child's run end does (`childFinished`), with
         // which this is idempotent (only running tasks are stopped; `stoppedBy: "subagent_end"`
         // never wakes). A root conversation is skipped (`stopSubagentTasks`); never throws.
-        await Promise.all(ids.map((id) => this.background.stopSubagentTasks(id)));
+        if (upTo === undefined) {
+            await Promise.all(ids.map((id) => this.background.stopSubagentTasks(id)));
+        }
         return runs.length;
     }
     /**
-     * After a sub-agent run's terminal commit (its worker): a run a person stopped (`run_aborted`
-     * with an account and no `detail`; only {@link stopTree} stops a sub-agent's run that way) stops
-     * the active runs below its conversation as well, so a descendant it dispatched after the tree
-     * stop read the tree still stops (dispatch needs its run `running`, so after its terminal commit
-     * the set is final). Any other end leaves its children running (agent map spec §5.4). Returns
-     * the number of runs asked to stop. A root conversation's run never stops its children here.
+     * After a run's terminal commit (its worker): a run a person stopped (`run_aborted` with an
+     * account and no `detail`; {@link stopTree} or a person's stop of the root) stops the active runs
+     * below its conversation as well, so a descendant it dispatched after the tree stop read the tree
+     * still stops (dispatch needs its run `running`, so after its terminal commit the set is final).
+     * A root's run stops only the runs of the budget windows up to it (`windowsUpTo`): the person's
+     * next message may already have started a new run with sub-agents of its own (agent map spec §6,
+     * changed in acceptance 2026-11-13). Any other end leaves its children running (§5.4). Returns
+     * the number of runs asked to stop.
      */
     async stopDescendantsOfStopped(runId) {
         const ev = await this.db
             .selectFrom("runs as r")
             .innerJoin("conversation_events as e", (j) => j.onRef("e.conversation_id", "=", "r.conversation_id").onRef("e.run_id", "=", "r.id"))
             .innerJoin("conversations as c", "c.id", "r.conversation_id")
-            .select(["r.conversation_id", "e.payload"])
+            .select(["r.conversation_id", "c.kind", "e.payload"])
             .where("r.id", "=", runId)
-            // a root's stop leaves its children running (agent map spec §6): a person-stopped root run
-            // reaching here (a redelivered job, the failure path) stops nothing
-            .where("c.kind", "=", "subagent")
+            .where("c.kind", "in", ["chat", "subagent"])
             .where("r.status", "=", "aborted")
             .where("e.type", "=", "run_aborted")
             .executeTakeFirst();
         const p = ev?.payload;
         if (!ev || typeof p?.byAccountId !== "string" || p.detail !== undefined)
             return 0;
-        return this.stopTree(ev.conversation_id, p.byAccountId, { includeSelf: false });
+        return this.stopTree(ev.conversation_id, p.byAccountId, {
+            includeSelf: false,
+            ...(ev.kind === "chat" && { windowsUpTo: runId }),
+        });
     }
     /**
      * Stops one active sub-agent run: a `waiting` one through its own {@link abortWaiting}, a

package/dist/sandbox/jobs.d.ts

@@ -1,5 +1,6 @@
 import type { Job, Queue } from "bullmq";
 import { LockService } from "../infra/lock/lock.service.js";
+import type { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
 import { SandboxService } from "./sandbox.service.js";
 /** The idle suspension sweep (every minute, once per tick across replicas). */
@@ -7,10 +8,25 @@ export declare const SANDBOX_SUSPEND_JOB = "sandbox-suspend-idle";
 /** The inactivity destruction sweep (hourly, once per tick across replicas). */
 export declare const SANDBOX_DESTROY_JOB = "sandbox-destroy-inactive";
 /**
- * One-off job: destroy a batch of devices now, instance and file system (device
- * deletion, offboarding; data `{ deviceIds }`).
+ * One-off job: destroy devices now, instance and file system (data `{ deviceIds }`). Owed through
+ * the outbox by the transaction that soft-deletes the device (a device's deletion, offboarding),
+ * one device per job under {@link deviceDestroyJobId} ({@link oweDeviceDestroy}).
  */
 export declare const SANDBOX_DESTROY_FOR_JOB = "sandbox-destroy-for";
+/** The data of a {@link SANDBOX_DESTROY_FOR_JOB} job. */
+export interface SandboxDestroyForData {
+    deviceIds: string[];
+}
+/**
+ * The deterministic id of a deleted device's destroy job (no `:`): a device is deleted once, so
+ * its destruction is owed once.
+ */
+export declare const deviceDestroyJobId: (deviceId: string) => string;
+/**
+ * Owes the destruction of a device in the caller's transaction, the one that soft-deleted it
+ * (transactional outbox spec §8.1; throws outside a transaction).
+ */
+export declare function oweDeviceDestroy(outbox: Pick<OutboxService, "add">, deviceId: string, orgId: string): Promise<boolean>;
 /**
  * One-off job: start a device over with empty files (`resetFileSystem`; data
  * `{ deviceId }`, job id {@link resetFilesJobId}).
@@ -22,18 +38,12 @@ export declare const SANDBOX_RESET_FILES_JOB = "sandbox-reset-files";
  */
 export declare const resetFilesJobId: (deviceId: string) => string;
 /**
- * The producer of the sandbox maintenance jobs: {@link SANDBOX_DESTROY_FOR_JOB} (BullMQ's own job
- * ids, as before: every enqueue is a new job, also after a batch failed all its attempts) and
- * {@link SANDBOX_RESET_FILES_JOB}; `MaintenanceProcessor` consumes them.
+ * The producer of {@link SANDBOX_RESET_FILES_JOB} (destroys are owed through the outbox,
+ * {@link oweDeviceDestroy}); `MaintenanceProcessor` consumes both.
  */
 export declare class SandboxJobs {
     private readonly queue;
     constructor(queue: Pick<Queue, "add">);
-    /**
-     * Enqueues the destruction of these devices: a failed batch is retried whole (destroying
-     * one already destroyed does nothing).
-     */
-    destroy(deviceIds: string[]): Promise<void>;
     /**
      * Enqueues the reset of a device's files (see {@link resetFilesJobId}): retried on failure
      * (the exclusive lease not obtained in time, the provider failing); a job that failed all its