@capybara-hq/kernel 0.1.0-rc.25 → 0.1.0-rc.26

package/dist/runtime/waits.js

@@ -607,6 +607,13 @@ let Waits = class Waits {
      * background tasks of every covered sub-agent conversation stop, whether it was running or idle.
      * Returns the number of runs asked to stop.
      *
+     * `windowsUpTo` (a root run's id; only after that root run a person stopped ended,
+     * {@link stopDescendantsOfStopped}) narrows the stop to the runs of the budget windows opened up
+     * to that run (`runs.budget_run_id`, agent map spec §6): a run of a window a later root run
+     * opened (the person's next message, started meanwhile) is never stopped by the late call, and
+     * the background task sweep is left out (a stopped child's own end stops its tasks,
+     * {@link childFinished}).
+     *
      * Lock order: nothing is held across runs. Each run's stop is its own transaction (or none), and
      * one that writes the terminal state locks that run's conversation row, then its run row, the
      * order of `StepLog.appendCounted` (conversation row, then the root's budget run row) and of
@@ -619,12 +626,22 @@ let Waits = class Waits {
         if (ids.length === 0)
             return 0;
         const level = new Map(tree.map((c) => [c.id, c.level]));
-        const runs = (await this.db
+        let q = this.db
             .selectFrom("runs")
             .select(["id", "conversation_id", "status"])
             .where("conversation_id", "in", ids)
-            .where("status", "in", ACTIVE_RUN_STATUSES)
-            .execute()).sort((a, b) => (level.get(a.conversation_id) ?? 0) - (level.get(b.conversation_id) ?? 0));
+            .where("status", "in", ACTIVE_RUN_STATUSES);
+        const upTo = opts.windowsUpTo;
+        if (upTo !== undefined) {
+            // a window is opened by a root run without a budget run of its own (`budgetWindowOf`)
+            q = q.where("budget_run_id", "in", (eb) => eb
+                .selectFrom("runs as w")
+                .select("w.id")
+                .where("w.conversation_id", "=", conversationId)
+                .where("w.budget_run_id", "is", null)
+                .where("w.created_at", "<=", (eb2) => eb2.selectFrom("runs as s").select("s.created_at").where("s.id", "=", upTo)));
+        }
+        const runs = (await q.execute()).sort((a, b) => (level.get(a.conversation_id) ?? 0) - (level.get(b.conversation_id) ?? 0));
         for (const r of runs) {
             try {
                 // a stopped wait's card updates are owed by its transaction's appends (outbox spec §8.1)
@@ -639,34 +656,39 @@ let Waits = class Waits {
         // all of each conversation's tasks, as a stopped child's run end does (`childFinished`), with
         // which this is idempotent (only running tasks are stopped; `stoppedBy: "subagent_end"`
         // never wakes). A root conversation is skipped (`stopSubagentTasks`); never throws.
-        await Promise.all(ids.map((id) => this.background.stopSubagentTasks(id)));
+        if (upTo === undefined) {
+            await Promise.all(ids.map((id) => this.background.stopSubagentTasks(id)));
+        }
         return runs.length;
     }
     /**
-     * After a sub-agent run's terminal commit (its worker): a run a person stopped (`run_aborted`
-     * with an account and no `detail`; only {@link stopTree} stops a sub-agent's run that way) stops
-     * the active runs below its conversation as well, so a descendant it dispatched after the tree
-     * stop read the tree still stops (dispatch needs its run `running`, so after its terminal commit
-     * the set is final). Any other end leaves its children running (agent map spec §5.4). Returns
-     * the number of runs asked to stop. A root conversation's run never stops its children here.
+     * After a run's terminal commit (its worker): a run a person stopped (`run_aborted` with an
+     * account and no `detail`; {@link stopTree} or a person's stop of the root) stops the active runs
+     * below its conversation as well, so a descendant it dispatched after the tree stop read the tree
+     * still stops (dispatch needs its run `running`, so after its terminal commit the set is final).
+     * A root's run stops only the runs of the budget windows up to it (`windowsUpTo`): the person's
+     * next message may already have started a new run with sub-agents of its own (agent map spec §6,
+     * changed in acceptance 2026-11-13). Any other end leaves its children running (§5.4). Returns
+     * the number of runs asked to stop.
      */
     async stopDescendantsOfStopped(runId) {
         const ev = await this.db
             .selectFrom("runs as r")
             .innerJoin("conversation_events as e", (j) => j.onRef("e.conversation_id", "=", "r.conversation_id").onRef("e.run_id", "=", "r.id"))
             .innerJoin("conversations as c", "c.id", "r.conversation_id")
-            .select(["r.conversation_id", "e.payload"])
+            .select(["r.conversation_id", "c.kind", "e.payload"])
             .where("r.id", "=", runId)
-            // a root's stop leaves its children running (agent map spec §6): a person-stopped root run
-            // reaching here (a redelivered job, the failure path) stops nothing
-            .where("c.kind", "=", "subagent")
+            .where("c.kind", "in", ["chat", "subagent"])
             .where("r.status", "=", "aborted")
             .where("e.type", "=", "run_aborted")
             .executeTakeFirst();
         const p = ev?.payload;
         if (!ev || typeof p?.byAccountId !== "string" || p.detail !== undefined)
             return 0;
-        return this.stopTree(ev.conversation_id, p.byAccountId, { includeSelf: false });
+        return this.stopTree(ev.conversation_id, p.byAccountId, {
+            includeSelf: false,
+            ...(ev.kind === "chat" && { windowsUpTo: runId }),
+        });
     }
     /**
      * Stops one active sub-agent run: a `waiting` one through its own {@link abortWaiting}, a

package/dist/schedules/scan.job.d.ts

@@ -15,9 +15,9 @@ import { ScheduledTaskStore } from "./store.js";
  * transaction owes `sched-fire-<taskRunId>` (transactional outbox spec §8.1), so a written tick is
  * never left unfired and the scan needs no repair of lost fire jobs (a fire delivered too late
  * marks its tick missed itself, `ScheduledTaskFirer`), and the run's unfired settle check (a fire
- * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored trigger the schedule
- * math cannot evaluate is paused (`invalid_schedule`) instead of failing the scan; a database
- * error fails the pass (the next minute retries) and pauses nothing.
+ * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored
+ * trigger the schedule math cannot evaluate is paused (`invalid_schedule`) instead of failing the
+ * scan; a database error fails the pass (the next minute retries) and pauses nothing.
  */
 export declare class ScheduledTaskScanJob {
     private readonly kdb;
@@ -33,9 +33,9 @@ export declare class ScheduledTaskScanJob {
     /** One scan as of `now` (tests pass their own); returns how many due tasks it handled. */
     scanAt(now: Date): Promise<number>;
     /**
-     * One due task in its own transaction (a task whose trigger cannot be evaluated rolls back
-     * alone and is paused, so it cannot block the others): locked with `SKIP LOCKED`, so replicas take different tasks. False
-     * when no task is due.
+     * One due task in its own transaction (a task whose trigger cannot be evaluated rolls back alone
+     * and is paused, so it cannot block the others): locked with `SKIP LOCKED`, so replicas take
+     * different tasks. False when no task is due.
      */
     private scanOne;
     /** A task the scan cannot advance stops being due: paused with `invalid_schedule`. */

package/dist/schedules/scan.job.js

@@ -46,9 +46,9 @@ class TaskScanFailed extends Error {
  * transaction owes `sched-fire-<taskRunId>` (transactional outbox spec §8.1), so a written tick is
  * never left unfired and the scan needs no repair of lost fire jobs (a fire delivered too late
  * marks its tick missed itself, `ScheduledTaskFirer`), and the run's unfired settle check (a fire
- * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored trigger the schedule
- * math cannot evaluate is paused (`invalid_schedule`) instead of failing the scan; a database
- * error fails the pass (the next minute retries) and pauses nothing.
+ * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored
+ * trigger the schedule math cannot evaluate is paused (`invalid_schedule`) instead of failing the
+ * scan; a database error fails the pass (the next minute retries) and pauses nothing.
  */
 let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     kdb;
@@ -96,9 +96,9 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
         return total;
     }
     /**
-     * One due task in its own transaction (a task whose trigger cannot be evaluated rolls back
-     * alone and is paused, so it cannot block the others): locked with `SKIP LOCKED`, so replicas take different tasks. False
-     * when no task is due.
+     * One due task in its own transaction (a task whose trigger cannot be evaluated rolls back alone
+     * and is paused, so it cannot block the others): locked with `SKIP LOCKED`, so replicas take
+     * different tasks. False when no task is due.
      */
     async scanOne(now, settings) {
         const t = this.db;

package/dist/skills/catalog.d.ts

@@ -156,13 +156,17 @@ export declare class SkillsCatalogService {
     constructor(db: KernelDb, eventLog: EventLog, log: KernelLogger, txHost: TransactionHost, config: KernelConfigService);
     /**
      * Records the run start's snapshot (see the class comment). `opts.log`: the run's logger
-     * (default the kernel logger).
+     * (default the kernel logger). False: the run had ended (a stop got there first), so nothing was
+     * appended and the run must not go on.
      */
     record(input: EffectiveSkillsInput & {
         runId: string;
     }, opts?: {
         log?: Pick<Logger, "warn" | "error">;
-    }): Promise<void>;
-    /** Under the conversation row lock, resolves the skills and appends a changed snapshot. */
+    }): Promise<boolean>;
+    /**
+     * Under the conversation row lock, resolves the skills and appends a changed snapshot; `ended`
+     * (nothing appended) when the run is terminal under the locks.
+     */
     private append;
 }

package/dist/skills/catalog.js

@@ -18,6 +18,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { CLAUDE_CODE_TOOL_MAP } from "../runtime/context/claude-tools.js";
 import { catalogLine, sameSnapshot, } from "../runtime/context/skills.js";
+import { runEndedIn } from "../runtime/run-status.js";
 import { agentOwnSkillIds, agentSkills, builtinSkillIds, builtinSkillPlugins, } from "./usable.js";
 /**
  * The skills in effect for this conversation now, sorted by name (code point order), as
@@ -264,16 +265,25 @@ let SkillsCatalogService = class SkillsCatalogService {
     }
     /**
      * Records the run start's snapshot (see the class comment). `opts.log`: the run's logger
-     * (default the kernel logger).
+     * (default the kernel logger). False: the run had ended (a stop got there first), so nothing was
+     * appended and the run must not go on.
      */
     async record(input, opts = {}) {
         const toSeq = await this.append(input, opts.log ?? this.log);
+        if (toSeq === "ended")
+            return false;
         if (toSeq !== null)
             await this.eventLog.notify(input.conversationId, toSeq);
+        return true;
     }
-    /** Under the conversation row lock, resolves the skills and appends a changed snapshot. */
+    /**
+     * Under the conversation row lock, resolves the skills and appends a changed snapshot; `ended`
+     * (nothing appended) when the run is terminal under the locks.
+     */
     async append(input, log) {
         const last = await lockLatestCatalog(this.db.db, input.conversationId);
+        if (await runEndedIn(this.db.db, input.runId))
+            return "ended";
         const all = await resolveSkills(this.db.db, input, log);
         const resolved = forModel(all, input, log);
         const budget = this.config.get().skills.catalogBudgetChars;

package/dist/tools/approvals.service.d.ts

@@ -6,7 +6,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { LockService } from "../infra/lock/lock.service.js";
-import { DevicePolicyService } from "../local-devices/device-policy.service.js";
+import { DevicePolicyService, type PolicyOpResult } from "../local-devices/device-policy.service.js";
 import { type OrgRole } from "../orgs/roles.js";
 import { RunResume } from "../runtime/run-jobs.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
@@ -47,7 +47,6 @@ export interface NetworkAskDetail {
     };
     /** The hosts the decision allowed (every approved decision writes them; none: nothing). */
     grantedHosts?: string[];
-    /** What took effect: a run grant, the device's policy, or a run grant because the device did not apply it. */
     /**
      * What took effect: a run grant (`once`), the device's policy (`always`), a run grant because
      * the device could not be reached or lacks the feature (`once_fallback`), or nothing because the
@@ -56,6 +55,22 @@ export interface NetworkAskDetail {
     outcome?: "once" | "always" | "once_fallback" | "refused";
     /** Why 「一直允许」 did not reach the device's policy. */
     fallback?: "offline" | "refused" | "unsupported";
+    /**
+     * Set while the ask is still pending: the last 「一直允许」 whose device change was recorded only
+     * after a crash (transactional outbox spec §7.4) and did not take effect: `failed` (the device
+     * refused it, never received it or stopped while applying it) or `unknown` (the device did not
+     * answer; its next connection tells), with the reason. The owner may decide again.
+     */
+    attempt?: NetworkAskAttempt;
+}
+/** Why a pending network ask's last 「一直允许」 did not decide it ({@link NetworkAskDetail.attempt}). */
+export interface NetworkAskAttempt {
+    /**
+     * `applied_undecided`: the device applied the change, but the account that chose it can no
+     * longer decide this ask (someone else must).
+     */
+    outcome: "failed" | "unknown" | "applied_undecided";
+    message: string;
 }
 /** A network ask's detail as the API shows it: without the kept command result. */
 export type NetworkAskView = Omit<NetworkAskDetail, "result">;
@@ -189,7 +204,7 @@ export interface NetworkAskInput {
     callId: string;
     /** The device owner: the only person who may decide. */
     requestedFor: string;
-    detail: Omit<NetworkAskDetail, "grantedHosts" | "outcome" | "fallback">;
+    detail: Omit<NetworkAskDetail, "grantedHosts" | "outcome" | "fallback" | "attempt">;
     /** `["once", "always"]`, or `["once"]` when the device takes no remote grants. */
     scopes: ("once" | "always")[];
 }
@@ -223,7 +238,10 @@ export declare class ApprovalsService {
     private readonly schedules;
     /** A trial approval is kept only for a tool the task may hold as a grant (its agent's tools). */
     private readonly registry;
-    /** 「这台设备一直允许」 sends the `policy` op to the device before the decision is recorded. */
+    /**
+     * 「这台设备一直允许」 records the device change's intent, sends the `policy` op, then records
+     * its outcome with the decision.
+     */
     private readonly policies;
     /** One decision of a network ask at a time, across replicas (the op is sent before the transaction). */
     readonly lockService: LockService;
@@ -234,8 +252,11 @@ export declare class ApprovalsService {
     constructor(db: KernelDb, config: Pick<KernelConfigService, "get">, eventLog: Pick<EventLog, "appendIn" | "notify">, events: Pick<KernelEvents, "emit">, txHost: TransactionHost, schedules: Pick<ScheduledTaskStore, "addGrant">, 
     /** A trial approval is kept only for a tool the task may hold as a grant (its agent's tools). */
     registry: Pick<ToolRegistry, "forAgent">, 
-    /** 「这台设备一直允许」 sends the `policy` op to the device before the decision is recorded. */
-    policies: Pick<DevicePolicyService, "apply" | "summary">, 
+    /**
+     * 「这台设备一直允许」 records the device change's intent, sends the `policy` op, then records
+     * its outcome with the decision.
+     */
+    policies: Pick<DevicePolicyService, "begin" | "send" | "settleIn" | "summary">, 
     /** One decision of a network ask at a time, across replicas (the op is sent before the transaction). */
     lockService: LockService, 
     /** A trial run's 「这次允许」 becomes a task grant only within the org's egress. */
@@ -272,28 +293,84 @@ export declare class ApprovalsService {
      * A network ask's decision (network ask-to-allow spec §5.2), one at a time per ask across
      * replicas: only the device owner (`requested_for`) decides, in a signed-in session (a personal
      * access token is refused; the route already refuses service and embed tokens); the allowed
-     * hosts are a subset of those asked. 「这台设备一直允许」 sends the `policy` op first, outside any
-     * transaction; when the device cannot be reached or lacks the feature the decision is recorded
-     * as a run grant with the reason, and when the device refuses (its owner takes no remote grants)
-     * as `always` with outcome `refused` and nothing granted. Then {@link decideIn} records what took
-     * effect and the run resumes after the commit; a change the device applied after the ask closed
-     * is audited (`late`) and answered with a 409 that says so.
+     * hosts are a subset of those asked. 「这台设备一直允许」 goes through the device change's intent
+     * ({@link decideAlways}): when the device cannot be reached or lacks the feature the decision is
+     * recorded as a run grant with the reason, and when the device refuses (its owner takes no
+     * remote grants) as `always` with outcome `refused` and nothing granted; the decision and the
+     * op's outcome are one transaction. Every decision resumes the run in its transaction and is
+     * announced after the commit; a change the device applied after the ask closed is audited
+     * (`late`) and answered with a 409 that says so.
      */
     private decideNetwork;
-    /** `device.network_allowed` of a policy change that reached the device after the ask closed. */
-    private auditLateAllow;
-    /** The owner of a live device of the org (null: none, deleted, or of another org). */
-    private deviceOwnerOf;
     /**
-     * Adds the hosts to the device's local policy (the `policy` op; never inside a transaction).
-     * Null when it was applied, else why not: the decision falls back to a run grant.
+     * 「这台设备一直允许」 (transactional outbox spec §7): the intent of the device change (naming the
+     * ask) is recorded, the `policy` op sent (no transaction open), then {@link settleNetworkOp}
+     * decides the ask and records the op's outcome in one transaction. When nothing could be sent
+     * (the device is offline, deleted, or its program lacks the feature) the decision is a run
+     * grant with the reason. The device's answer decides: applied → `always`; refused → `always`
+     * with outcome `refused`, nothing granted; no answer → a run grant (`once_fallback`, `offline`)
+     * while the op stays `unknown` for the machine's next hello or the resolver. A device that
+     * reconnects during the call and reports the op applied lets the resolver approve the ask as
+     * this owner first: that decision is returned (`toSeq` null: already announced), never a 409;
+     * when it granted other hosts than this call's (another of the owner's changes) and this call's
+     * change was not confirmed, `approval.already_decided` says so. A device deleted during the
+     * call is `device.not_found` (the op recorded unknown).
      */
-    private applyAlways;
+    private decideAlways;
+    /** Records only the op's outcome, in its own transaction (the ask is left as it is). */
+    private settleOpOnly;
+    /**
+     * The resolve transaction of a network ask's device change: the ask decided as `network` says
+     * ({@link decideTx}: lock order conversation → approval → run), then the op's outcome recorded
+     * (`DevicePolicyService.settleIn`: the machine's row). When the ask closed meanwhile (a reply,
+     * the expiry, a stop) only the op's outcome is recorded, and a change the device applied is
+     * audited `device.network_allowed` with `late: true` in the same transaction.
+     */
+    private settleNetworkOp;
+    /**
+     * The op's outcome for an ask that is no longer pending (in the caller's transaction): recorded,
+     * and a change the device applied audited `device.network_allowed` `late` (the change stands:
+     * the owner chose it; no inverse change is sent). True when it was audited late. `undecided`:
+     * the ask is still pending but the op's account can no longer decide it; the allow is audited
+     * without `late` (it is not after the ask) and the caller gives the ask the reason.
+     */
+    private settleClosedIn;
+    /** The live intent `opId` on machine `machineId` (null: settled already, or expired). */
+    private pendingOpOf;
+    /**
+     * The `device-op-resolve` job's outcome of an op that answers network ask `op.source.approvalId`
+     * (transactional outbox spec §7.4), in the resolver's transaction: under the ask's locks
+     * (conversation, then the approval) the op is read again (settled meanwhile: nothing to do).
+     * Applied, and the ask still pending → approved `always` by the op's account (`via` as it
+     * asked), the run resumed in this transaction as every decision does; the ask closed → audited
+     * `late`; still pending but the op's account can no longer decide it → the allow audited (not
+     * late) and the ask left pending with `applied_undecided`. Not applied (refused, never received,
+     * interrupted) or still unknown → the op's outcome recorded and the ask left pending with the
+     * reason (`detail.attempt`) and an `approval_updated` event so the card shows it: no person is
+     * there to fall back to a run grant (D2).
+     */
+    settleFromResolver(ref: {
+        machineId: string;
+        opId: string;
+        approvalId: string;
+    }, result: PolicyOpResult): Promise<void>;
+    /**
+     * A pending network ask's reason (`detail.attempt`) and its `approval_updated` event (one per
+     * op and outcome), in the caller's transaction with the ask locked; notified after the commit.
+     */
+    private attemptIn;
+    /** The owner of a live device of the org (null: none, deleted, or of another org). */
+    private deviceOwnerOf;
     /** After the commit: the decision's events reach the page, the run's waits and IM delivery. */
     private announceDecided;
     /** An account's display name (null when unknown). */
     private displayNameOf;
     private decideIn;
+    /**
+     * A decision in the caller's transaction: lock order conversation → approval → run (the resume).
+     * Refuses (`approval.already_decided`, `approval.not_found`, …) before any write.
+     */
+    private decideTx;
     /**
      * A trial run of a scheduled task (scheduled tasks spec §7): an approval its creator granted, in
      * any scope, is also added to the task's grants with the approved definition's hash, so its