@inetafrica/open-claudia 3.5.1 → 3.5.7

package/core/runner.js

@@ -13,11 +13,12 @@ const {
 } = require("./config");
 const {
   currentState, saveState, recordSession,
-  resetSessionUsage, acquireRunLock, cancelTargets, getActiveProvider, getProjectKey,
+  resetSessionUsage, admitLane, cancelTargets, getActiveProvider, getProjectKey,
+  laneFor, laneForRun, peekLane, laneBusy, runLaneKey, waitingLanes, slotBlocker, pruneIdleLanes,
   getProviderSession, setProviderSession, clearProviderSession, quarantineProviderSession, getUsageForSession, commitProviderCompaction,
   resolveProviderSettings,
 } = require("./state");
-const { chatContext, currentChannelId, currentAdapter } = require("./context");
+const { chatContext, currentChannelId, currentAdapter, currentThreadId } = require("./context");
 const { buildTurnPrompt } = require("./system-prompt");
 const { getProvider, resolveProviderForRun } = require("./providers");
 const { validateInvocation } = require("./providers/contract");
@@ -942,10 +943,10 @@ function createSideChatService(dependencies = {}) {
     timeoutMs: dependencies.timeoutMs,
     killTree: dependencies.killTree,
     killGraceMs: dependencies.killGraceMs,
-    onSpawn: dependencies.onSpawn || ((proc, runContext) => sideChatCoordinator.attachProcess(runContext.canonicalUserId, proc)),
+    onSpawn: dependencies.onSpawn || ((proc, runContext) => sideChatCoordinator.attachProcess(runContext.canonicalUserId, proc, runLaneKey(runContext))),
     onStderr: dependencies.onStderr || ((chunk) => console.error("SIDE PROVIDER STDERR:", redactSensitive(chunk))),
     cleanup: dependencies.cleanup || (async (proc, details, runContext) => {
-      sideChatCoordinator.detachProcess(runContext.canonicalUserId, proc);
+      sideChatCoordinator.detachProcess(runContext.canonicalUserId, proc, runLaneKey(runContext));
     }),
   });
   return {
@@ -1005,7 +1006,7 @@ function effectiveCompactThreshold(state = currentState(), opts = {}) {
 }
 
 function shouldAutoCompact(state = currentState(), opts = {}) {
-  if (opts.skipAutoCompact || opts.fresh || opts.continueSession || state.isCompacting) return false;
+  if (opts.skipAutoCompact || opts.fresh || opts.continueSession || peekLane(state, opts.laneKey)?.isCompacting) return false;
   if (!getProviderSession(state, getActiveProvider(state), getProjectKey(state))) return false;
   const threshold = effectiveCompactThreshold(state);
   if (threshold === 0) return false;
@@ -1308,10 +1309,14 @@ function createCompactionService(dependencies = {}) {
   const ackSchemaPath = dependencies.ackSchemaPath || ensureCompactionAckSchemaPath;
   const drainQueue = dependencies.drainQueue || drainQueuedMessages;
 
+  // Compaction acts on ONE conversation: the lane it is asked from (/compact)
+  // or the lane whose turn just finished (auto-compaction, admissionHeld).
+  // Other conversations of the speaker keep running meanwhile.
   async function compact(cwd, opts = {}) {
     const state = getState();
-    if (state.isCompacting) return { compacted: false, reason: "Compaction already in progress." };
-    if (state.runningProcess || (state.preparingRun && !opts.admissionHeld)) {
+    const lane = laneFor(state, opts.laneKey || null);
+    if (lane.isCompacting) return { compacted: false, reason: "Compaction already in progress." };
+    if (lane.runningProcess || ((lane.preparingRun || lane.settling) && !opts.admissionHeld)) {
       return { compacted: false, reason: "Finish or stop the active run before compacting." };
     }
     const provider = getActiveProvider(state);
@@ -1338,8 +1343,10 @@ function createCompactionService(dependencies = {}) {
       fresh: false,
     });
     const operationId = opts.operationId || (typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `compact-${Date.now()}`);
-    const recentTurns = collectRecent(state);
-    state.isCompacting = true;
+    // The recent turns come from THIS conversation's transcript: the captured
+    // project, not the state's legacy "Workspace" session (which read another file).
+    const recentTurns = collectRecent(capturedStateView(state, summaryContext));
+    lane.isCompacting = true;
     try {
       if (opts.notify) await send(opts.message || "Context is getting large, compacting first so this stays fast…");
       const summaryRun = await runCapture(summaryPrompt, summaryContext.cwd || cwd, {
@@ -1421,7 +1428,9 @@ function createCompactionService(dependencies = {}) {
         commit,
       };
     } finally {
-      state.isCompacting = false;
+      lane.isCompacting = false;
+      // A bare cancel flag names no run: whatever it was for is over now.
+      if (lane.cancelRequested === true) lane.cancelRequested = false;
       try { await drainQueue(state); }
       catch (error) { console.warn(`[compact] queue drain failed: ${redactSensitive(error.message)}`); }
     }
@@ -1666,14 +1675,17 @@ async function persistForegroundSession(result, runContext, state = currentState
 // dropped). Success without narration → the preview only ever showed the
 // streamed answer itself; delete it so the final message isn't a duplicate.
 // Failure/cancel → keep the partial text but drop the lying "working" footer.
-async function finalizeStreamPreview(state, result) {
-  if (state.streamInterval) { clearTimeout(state.streamInterval); state.streamInterval = null; }
-  const id = state.statusMessageId;
-  const channel = state.statusMessageChannel;
-  const buffer = String(state.streamBuffer || "").trim();
-  state.statusMessageId = null;
-  state.statusMessageChannel = null;
-  state.streamBuffer = "";
+async function finalizeStreamPreview(lane, result, runContext = null) {
+  // Only the run that owns the lane's preview may settle it.
+  if (runContext && lane.previewRunId && lane.previewRunId !== runContext.runId) return;
+  if (lane.streamInterval) { clearTimeout(lane.streamInterval); lane.streamInterval = null; }
+  const id = lane.statusMessageId;
+  const channel = lane.statusMessageChannel;
+  const buffer = String(lane.streamBuffer || "").trim();
+  lane.statusMessageId = null;
+  lane.statusMessageChannel = null;
+  lane.streamBuffer = "";
+  lane.previewRunId = null;
   if (typeof id !== "string") return;
   // A message id is only valid on the channel that minted it; a foreign-
   // channel preview is left as an orphan rather than edited cross-transport.
@@ -1687,21 +1699,22 @@ async function finalizeStreamPreview(state, result) {
     // the preview so settled chat carries just the final answer. Verbose ON keeps
     // the narration trail. Either way the live preview still showed progress mid-run.
     const narration = String(result.narrationText || "").trim();
-    if (narration && state.settings?.showThinking) await editMessage(id, narration.slice(-4000), telegramHtmlOpts({ streaming: true }));
+    if (narration && currentState().settings?.showThinking) await editMessage(id, narration.slice(-4000), telegramHtmlOpts({ streaming: true }));
     else await deleteMessage(id);
   } catch (_) { /* preview cleanup is best-effort; the final answer still goes out */ }
 }
 
 async function deliverForegroundResult(result, runContext, state = currentState()) {
-  if (runContext.lastInputWasVoice) state.lastInputWasVoice = false;
-  await finalizeStreamPreview(state, result);
+  const lane = laneForRun(state, runContext);
+  if (runContext.lastInputWasVoice) lane.lastInputWasVoice = false;
+  await finalizeStreamPreview(lane, result, runContext);
   // /stop unwind: the SIGTERM (or pre-spawn abort) that follows a user cancel
   // is not a failure worth announcing — /stop already replied "Cancelled.".
   // The flag is consumed here (and re-cleared on the run's unwind) so it can
   // never suppress a later run's genuine failure; it names the run it stopped.
-  const stoppedHere = cancelTargets(state.cancelRequested, runContext);
+  const stoppedHere = cancelTargets(lane.cancelRequested, runContext);
   if (!result.ok && (stoppedHere || result.error?.code === "RUN_CANCELLED")) {
-    if (stoppedHere) state.cancelRequested = false;
+    if (stoppedHere) lane.cancelRequested = false;
     return { ok: true, suppressed: "cancelled" };
   }
   const diagnostic = providerRunDiagnostic(result, runContext);
@@ -1788,6 +1801,9 @@ function runPrincipal(runContext) {
     adapterId: origin.adapterId || null,
     adapterType: origin.transport || null,
     channelId: channelId || null,
+    // The chat thread the run answers in (null for the main timeline), so the
+    // loopback can route a send by the attested run rather than by env.
+    threadId: runContext.threadId || null,
     userId: origin.userId || null,
   };
   if (!base.adapterType || !base.channelId) {
@@ -1809,6 +1825,7 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
   if (!compactionStage) {
     if (runContext.origin?.adapterId) env.OC_CHANNEL_ADAPTER = runContext.origin.adapterId;
     if (runContext.channelId) env.OC_CHANNEL_ID = String(runContext.channelId);
+    if (runContext.threadId) env.OC_THREAD_ID = String(runContext.threadId);
     if (runContext.origin?.userId) env.OC_CHANNEL_USER_ID = String(runContext.origin.userId);
     if (runContext.canonicalUserId) {
       env.OC_CANONICAL_USER_ID = String(runContext.canonicalUserId);
@@ -1831,9 +1848,11 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
   env.OC_RUN_ATTEST = require("./speaker-attest").registerRun(runContext.runId, principal);
   // A non-owner's turn never sees the AI service credentials: Claude Code
   // strips its own auth variables from every subprocess it starts (shell,
-  // hooks) when this is set. The agent process itself keeps them.
+  // hooks) when this is set. The agent process itself keeps them. Only where
+  // the sandbox it needs can run (sandbox-probe.js): in the fleet's
+  // containers it cannot, and the scrub made every staff turn crash.
   if (principal.owner !== true) {
-    env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB = "1";
+    if (require("./sandbox-probe").staffEnvScrub().ok) env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB = "1";
     // Read by the permission hook (which inherits the agent's env, not the
     // agent's shell's) so a guard that cannot load fails closed on this run.
     env.OC_GUARDED_RUN = "1";
@@ -1850,35 +1869,57 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
   return { ...invocation, env };
 }
 
-// Singleton per chat state: a new start supersedes any running heartbeat
-// (pre-turn "thinking" started at message receipt hands off to the run's own
-// heartbeat here). A stopper only acts while its own interval is current, so
-// a stale stopper from a superseded start can never kill a newer heartbeat.
-function startTypingHeartbeat(state, store) {
+// One heartbeat per lane: a new start in the same conversation supersedes the
+// running one (pre-turn "thinking" started at message receipt hands off to the
+// run's own heartbeat here), while other conversations keep their own. A
+// stopper only acts while its own interval is current, so a stale stopper from
+// a superseded start can never kill a newer heartbeat. Inside a chat thread
+// the indicator goes into the thread and is re-sent every 2.5 s (Kazee
+// expires a thread's typing indicator after 5 s).
+const TYPING_INTERVAL_MS = 4000;
+const THREAD_TYPING_INTERVAL_MS = 2500;
+function startTypingHeartbeat(state, store, laneKey = null) {
   const adapter = store?.adapter || currentAdapter();
   const channelId = store?.channelId || currentChannelId();
   if (!adapter || !channelId) return () => {};
-  if (state.typingHeartbeat) clearInterval(state.typingHeartbeat);
-  const tick = () => adapter.typing(channelId, state.thinkingPhase ? "thinking" : undefined).catch(() => {});
-  state.thinkingPhase = true;
+  const lane = laneFor(state, laneKey || store?.conversationKey || null);
+  const threadId = store ? (store.threadId || null) : currentThreadId();
+  const opts = threadId ? { threadId } : null;
+  if (lane.typingHeartbeat) clearInterval(lane.typingHeartbeat);
+  const phase = () => (lane.thinkingPhase ? "thinking" : undefined);
+  const tick = () => (opts ? adapter.typing(channelId, phase(), opts) : adapter.typing(channelId, phase())).catch(() => {});
+  lane.thinkingPhase = true;
   // Phase changes are PUSHED through this, not waited for. The interval only
-  // samples every 4s, so a final answer that starts streaming and finishes
-  // inside one interval would never emit a single "typing" frame — the chip
-  // would sit on "thinking" for the whole turn and then stop.
-  state.typingTick = tick;
+  // samples every few seconds, so a final answer that starts streaming and
+  // finishes inside one interval would never emit a single "typing" frame —
+  // the chip would sit on "thinking" for the whole turn and then stop.
+  lane.typingTick = tick;
+  lane.typingTarget = { adapter, channelId, threadId };
   tick();
-  const interval = setInterval(tick, 4000);
-  state.typingHeartbeat = interval;
+  const interval = setInterval(tick, threadId ? THREAD_TYPING_INTERVAL_MS : TYPING_INTERVAL_MS);
+  lane.typingHeartbeat = interval;
   return () => {
-    if (state.typingHeartbeat !== interval) return;
-    state.thinkingPhase = false;
-    state.typingTick = null;
-    clearInterval(interval);
-    state.typingHeartbeat = null;
-    try { adapter.typingStop?.(channelId); } catch (_) {}
+    if (lane.typingHeartbeat !== interval) return;
+    stopLaneTyping(lane);
   };
 }
 
+// Stop a lane's typing heartbeat now and tell the chat (into the lane's thread).
+function stopLaneTyping(lane) {
+  if (!lane) return;
+  const target = lane.typingTarget;
+  if (lane.typingHeartbeat) clearInterval(lane.typingHeartbeat);
+  lane.typingHeartbeat = null;
+  lane.thinkingPhase = false;
+  lane.typingTick = null;
+  lane.typingTarget = null;
+  if (!target) return;
+  try {
+    if (target.threadId) target.adapter.typingStop?.(target.channelId, { threadId: target.threadId });
+    else target.adapter.typingStop?.(target.channelId);
+  } catch (_) {}
+}
+
 function settleImmediateEffects(result, runContext, { state, store, capture }) {
   const stages = [
     ["transcript", persistForegroundTranscript],
@@ -1934,7 +1975,8 @@ function streamPreviewAllowed(runContext) {
 // emits mid-run is appended to one throttled status message, so the user sees
 // the narration as it happens instead of silence. finalizeStreamPreview
 // settles the message when the run ends.
-function createStreamPreview({ state, store }) {
+function createStreamPreview({ state, store, lane: givenLane = null }) {
+  let lane = givenLane;
   let enabled = !!store
     && (store?.adapter?.type || "") !== "voice"
     && store?.adapter?.suppressStreamPreview !== true;
@@ -1946,34 +1988,60 @@ function createStreamPreview({ state, store }) {
     catch (_) { enabled = false; }
   }
   const channelId = store?.channelId || null;
+  let owner = null; // the run whose preview this is
 
+  // The lane's preview belongs to one run at a time (previewRunId): a run
+  // never writes into or flushes a message another run owns, and only a /stop
+  // naming THIS run mutes it.
+  const ownsPreview = () => !!owner && lane.previewRunId === owner.runId;
   const flush = () => {
-    state.streamInterval = null;
-    if (!enabled || state.cancelRequested) return;
-    const body = String(state.streamBuffer || "").trim();
+    if (!ownsPreview()) return;
+    lane.streamInterval = null;
+    if (!enabled || cancelTargets(lane.cancelRequested, owner)) return;
+    const body = String(lane.streamBuffer || "").trim();
     if (!body) return;
     const display = body.slice(-3800) + STREAM_PREVIEW_FOOTER;
+    const runId = owner.runId;
     // Event callbacks arrive off the provider's stdout stream, outside the
     // chat AsyncLocalStorage context — rebind before any send/edit.
     chatContext.run(store, async () => {
       try {
-        if (typeof state.statusMessageId === "string" && String(state.statusMessageChannel) === String(channelId)) {
-          await editMessage(state.statusMessageId, display, telegramHtmlOpts({ streaming: true }));
+        if (typeof lane.statusMessageId === "string" && String(lane.statusMessageChannel) === String(channelId)) {
+          await editMessage(lane.statusMessageId, display, telegramHtmlOpts({ streaming: true }));
           return;
         }
-        if (state.statusMessageId === true) return; // sent but not editable — leave the single notice alone
+        if (lane.statusMessageId === true) return; // sent but not editable — leave the single notice alone
         const sent = await send(display, telegramHtmlOpts());
-        state.statusMessageId = sent.editable ? sent.messageId : (sent.ok ? true : null);
-        state.statusMessageChannel = sent.ok ? channelId : null;
+        // Settled while the send was in flight: an id minted for a finished
+        // run must never be adopted (and later edited) by the next one.
+        if (lane.previewRunId !== runId) {
+          if (sent.editable) deleteMessage(sent.messageId).catch(() => {});
+          return;
+        }
+        lane.statusMessageId = sent.editable ? sent.messageId : (sent.ok ? true : null);
+        lane.statusMessageChannel = sent.ok ? channelId : null;
       } catch (_) { /* preview is best-effort */ }
     }).catch(() => {});
   };
 
   const appendChunk = (chunk, runContext) => {
-    if (!enabled || !streamPreviewAllowed(runContext) || state.cancelRequested) return;
-    state.streamBuffer = state.streamBuffer ? `${state.streamBuffer}\n\n${chunk}` : chunk;
-    if (state.streamBuffer.length > 20000) state.streamBuffer = state.streamBuffer.slice(-16000);
-    if (!state.streamInterval) state.streamInterval = setTimeout(flush, STREAM_PREVIEW_THROTTLE_MS);
+    if (!enabled || !streamPreviewAllowed(runContext)) return;
+    if (!lane) lane = laneForRun(state, runContext);
+    if (cancelTargets(lane.cancelRequested, runContext)) return;
+    if (owner?.runId !== runContext.runId) {
+      owner = runContext;
+      if (lane.previewRunId !== runContext.runId) {
+        if (lane.streamInterval) clearTimeout(lane.streamInterval);
+        lane.previewRunId = runContext.runId;
+        lane.statusMessageId = null;
+        lane.statusMessageChannel = null;
+        lane.streamBuffer = "";
+        lane.streamInterval = null;
+      }
+    }
+    lane.streamBuffer = lane.streamBuffer ? `${lane.streamBuffer}\n\n${chunk}` : chunk;
+    if (lane.streamBuffer.length > 20000) lane.streamBuffer = lane.streamBuffer.slice(-16000);
+    if (!lane.streamInterval) lane.streamInterval = setTimeout(flush, STREAM_PREVIEW_THROTTLE_MS);
   };
 
   return {
@@ -1993,14 +2061,19 @@ function createStreamPreview({ state, store }) {
   };
 }
 
-function createForegroundService({ state, store, stopTyping, capture, ownsAdmissionLock, persistCapture = true }) {
+function createForegroundService({ state, store, lane, stopTyping, capture, ownsAdmissionLock, persistCapture = true, holdsLane = null, onOwnSpawn = null }) {
+  // Still the lane's holder? A run whose lane /stop's backstop freed (and
+  // another run then claimed) must not touch that lane's run slot.
+  const holds = () => (holdsLane ? holdsLane() : ownsAdmissionLock);
   const callSpeechLeases = new Map();
   const callStage = (stage, runContext) => {
     if (capture || runContext?.liveCall !== true) return;
     console.log(`${new Date().toISOString()} Kazee call provider: stage=${stage} run=${runContext.runId} elapsed=${Math.max(0, Date.now() - runContext.admittedAt)}ms`);
   };
   const persistEffects = !capture || persistCapture;
-  const preview = capture ? null : createStreamPreview({ state, store });
+  // The run's lane: given by executeAdmittedRun, else the captured run's own.
+  const laneOf = (runContext) => lane || laneForRun(state, runContext);
+  const preview = capture ? null : createStreamPreview({ state, store, lane });
   // Chat-visibility + learning-signal layer (skill/pack/tool announcements,
   // /recall + /tooltrace banners, recall/tool graph feeding). Foreground only.
   const observer = capture ? null : require("./turn-observer").createTurnObserver({ state, store });
@@ -2037,13 +2110,18 @@ function createForegroundService({ state, store, stopTyping, capture, ownsAdmiss
     onSpawn(proc, runContext) {
       callStage("started", runContext);
       callSpeechLeases.get(runContext.runId)?.activate();
-      state.runningProcess = proc;
-      if (ownsAdmissionLock) state.preparingRun = false;
+      // A capture (compaction stage, sub-agent) only records its process on a
+      // lane that has none, so it never displaces the lane's own turn.
+      const runLane = laneOf(runContext);
+      if (ownsAdmissionLock) onOwnSpawn?.(proc);
+      if (ownsAdmissionLock || !runLane.runningProcess) runLane.runningProcess = proc;
+      if (ownsAdmissionLock) runLane.preparingRun = false;
     },
     shouldAbort(runContext, { capture: isCapture } = {}) {
       if (isCapture || !ownsAdmissionLock) return false;
-      if (!cancelTargets(state.cancelRequested, runContext)) return false;
-      state.cancelRequested = false;
+      const runLane = laneOf(runContext);
+      if (!cancelTargets(runLane.cancelRequested, runContext)) return false;
+      runLane.cancelRequested = false;
       return true;
     },
     onPromptBundle(bundle, runContext) {
@@ -2056,13 +2134,14 @@ function createForegroundService({ state, store, stopTyping, capture, ownsAdmiss
       if (event.type === "result" || event.type === "error") callSpeechLeases.get(runContext.runId)?.close();
       // Streaming text reads as "typing"; tool work re-enters "thinking" so
       // the chip doesn't decay to a stale "typing" through long tool stretches.
-      const phaseBefore = state.thinkingPhase;
-      if (["text_delta", "text_final", "result", "error"].includes(event.type)) state.thinkingPhase = false;
-      else if (event.type === "tool_start") state.thinkingPhase = true;
+      const lane = laneOf(runContext);
+      const phaseBefore = lane.thinkingPhase;
+      if (["text_delta", "text_final", "result", "error"].includes(event.type)) lane.thinkingPhase = false;
+      else if (event.type === "tool_start") lane.thinkingPhase = true;
       // Emit on the TRANSITION rather than waiting for the next sample. Guarded
       // on an actual change, so a long text stream still sends one frame, not
       // one per delta.
-      if (state.thinkingPhase !== phaseBefore) { try { state.typingTick?.(); } catch (_) {} }
+      if (lane.thinkingPhase !== phaseBefore) { try { lane.typingTick?.(); } catch (_) {} }
       if (event.type === "tool_start" && ["Shell", "Bash"].includes(event.name)) {
         const command = typeof event.detail === "string" ? event.detail : event.detail?.command;
         if (command) { try { require("./tool-guard").noteRawOp(command); } catch (_) {} }
@@ -2087,10 +2166,11 @@ function createForegroundService({ state, store, stopTyping, capture, ownsAdmiss
       try { require("./speaker-attest").endRun(runContext.runId); } catch (_) {}
       callSpeechLeases.get(runContext.runId)?.close();
       callSpeechLeases.delete(runContext.runId);
-      if (state.runningProcess === proc) state.runningProcess = null;
-      // Keep the single-flight lock armed while transcript/usage/session
-      // persistence and required delivery settle after child close.
-      if (ownsAdmissionLock) state.preparingRun = true;
+      const runLane = laneOf(runContext);
+      if (runLane.runningProcess === proc) runLane.runningProcess = null;
+      // Keep the lane's lock armed while transcript/usage/session persistence
+      // and required delivery settle after child close.
+      if (holds()) runLane.preparingRun = true;
       stopTyping();
     },
     idleTimeoutMs: Math.max(60000, parseInt(config.OC_TURN_IDLE_MS || process.env.OC_TURN_IDLE_MS || "", 10) || 10 * 60 * 1000),
@@ -2123,6 +2203,15 @@ async function handoffMemoryReview(result, runContext, store, state) {
   });
 }
 
+// Thread titles: after a delivered thread reply the bot may name the thread
+// (core/thread-title.js decides). Never awaited, never throws.
+function nameThreadAfterTurn(result, runContext, store) {
+  try {
+    const pending = require("./thread-title").nameThreadAfterTurn(result, runContext, store);
+    if (pending) pending.catch((error) => console.warn(`[thread-title] ${redactSensitive(error.message)}`));
+  } catch (error) { /* best-effort: naming a thread must never break a turn */ }
+}
+
 // Track C — owner-guardrail capture. After a foreground turn, a deterministic
 // detector spots durable-rule statements ("from now on / never / stop") in the
 // owner's message and captures them into lessons.md (or asks first). Owner-only
@@ -2155,15 +2244,16 @@ function cancelledCallRunResult(runContext) {
   return cancelledRunResult(runContext, { id: runContext.provider, label: runContext.provider }, "Call turn superseded or ended before execution");
 }
 
-function cancelQueuedCallOnAbort(state, item) {
+function cancelQueuedCallOnAbort(lane, item) {
   if (item.store?.adapter?.liveCall !== true) return;
   const signal = item.store.adapter.callTurn?.signal;
   if (!signal) return;
   const cancel = () => {
-    const index = state.messageQueue.indexOf(item);
+    const index = lane.messageQueue.indexOf(item);
     if (index < 0) return; // Already admitted: pre-spawn checks and speech fences take over.
-    state.messageQueue.splice(index, 1);
+    lane.messageQueue.splice(index, 1);
     item.disposeCallListener?.();
+    if (!laneBusy(lane) && !lane.messageQueue.length) stopLaneTyping(lane);
     item.deferred.resolve(cancelledCallRunResult(item.runContext));
   };
   item.disposeCallListener = () => signal.removeEventListener("abort", cancel);
@@ -2171,19 +2261,37 @@ function cancelQueuedCallOnAbort(state, item) {
   if (signal.aborted) cancel();
 }
 
-function drainQueuedMessages(state) {
-  if (!Array.isArray(state.messageQueue) || !state.messageQueue.length || state.runningProcess || state.preparingRun) return Promise.resolve();
-  const item = state.messageQueue.shift();
-  item.disposeCallListener?.();
-  state.preparingRun = true;
-  setImmediate(() => {
-    const execute = () => executeAdmittedRun(item.runContext, state, item.store, false, true);
-    const promise = item.store ? chatContext.run(item.store, execute) : execute();
-    promise.then(item.deferred.resolve, item.deferred.reject);
-  });
+// Admit waiting lanes into free slots: every lane with queued work and no run,
+// oldest waiting message first, as far as the caps allow. An admitted lane runs
+// its next queued message (one at a time within a lane) in that message's own
+// captured context. Called whenever a run, a compaction or a /stop frees a
+// lane, and synchronous up to the admission, so no newcomer can take a freed
+// slot ahead of a lane that was already waiting. Every state's lanes are
+// considered (the global cap is shared); the argument is kept for callers.
+function drainQueuedMessages(_state) {
+  for (const { state, lane } of waitingLanes()) {
+    if (laneBusy(lane) || !lane.messageQueue.length) continue;
+    if (slotBlocker(state)) { lane.waitingForSlot = true; continue; }
+    const item = lane.messageQueue.shift();
+    item.disposeCallListener?.();
+    lane.preparingRun = true;
+    lane.waitingForSlot = false;
+    setImmediate(() => {
+      const execute = () => executeAdmittedRun(item.runContext, state, item.store, false, true);
+      const promise = item.store ? chatContext.run(item.store, execute) : execute();
+      promise.then(item.deferred.resolve, item.deferred.reject);
+    });
+  }
   return Promise.resolve();
 }
 
+let queueSequence = 0;
+function queueInLane(lane, item) {
+  item.seq = ++queueSequence;
+  lane.messageQueue.push(item);
+  return item;
+}
+
 // A refusal on a RESUMED session is almost always the safety classifier
 // rejecting flagged material in the old context — which every resume re-sends
 // — not the user's new message. Recovery: quarantine the poisoned session so
@@ -2235,13 +2343,52 @@ function refusalRetryContext(runContext, state) {
   });
 }
 
+// A run that owns its lane's admission holds the lane from admission until its
+// whole tail is done (delivery, memory review, auto-compaction), then frees it
+// and admits the next waiting lane. Captures (compaction stages, sub-agents)
+// run inside a lane without owning it.
 async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissionLock, executionOptions = {}) {
+  if (!ownsAdmissionLock) {
+    const result = await runAdmitted(runContext, state, store, capture, false, executionOptions);
+    if (!(capture && executionOptions.persistCapture === false)) await drainQueuedMessages(state);
+    return result;
+  }
+  const lane = laneForRun(state, runContext);
+  const ownerToken = {};
+  lane.ownerToken = ownerToken;
+  try {
+    return await runAdmitted(runContext, state, store, capture, true, { ...executionOptions, ownerToken });
+  } finally {
+    // Free the lane only while this run still holds it: after /stop's
+    // backstop released a stuck run, another run may own the lane now.
+    if (lane.ownerToken === ownerToken) {
+      lane.ownerToken = null;
+      lane.settling = false;
+      lane.preparingRun = false;
+      // A bare cancel flag (a /stop that named no run) must not outlive the
+      // turn that held the lane, or the next message would be cancelled.
+      if (lane.cancelRequested === true) lane.cancelRequested = false;
+    }
+    await drainQueuedMessages(state);
+    pruneIdleLanes(state);
+  }
+}
+
+async function runAdmitted(runContext, state, store, capture, ownsAdmissionLock, executionOptions = {}) {
+  const lane = laneForRun(state, runContext);
   const tracksMainRun = ownsAdmissionLock && !capture;
-  if (tracksMainRun) state.activeRunContext = runContext;
-  const stopTyping = startTypingHeartbeat(state, store);
   const persistCapture = executionOptions.persistCapture !== false;
   const internalCapture = capture && !persistCapture;
-  const service = createForegroundService({ state, store, stopTyping, capture, ownsAdmissionLock, persistCapture });
+  if (tracksMainRun) lane.activeRunContext = runContext;
+  if (!internalCapture) runContext = consumeOneShotBudget(runContext, state, executionOptions);
+  const stopTyping = startTypingHeartbeat(state, store, runLaneKey(runContext));
+  const holdsLane = () => ownsAdmissionLock
+    && (!executionOptions.ownerToken || lane.ownerToken === executionOptions.ownerToken);
+  const ownProcs = new Set();
+  const service = createForegroundService({
+    state, store, lane, stopTyping, capture, ownsAdmissionLock, persistCapture,
+    holdsLane, onOwnSpawn: (proc) => ownProcs.add(proc),
+  });
   let result;
   try {
     result = await service.executeCaptured(runContext.userPrompt, runContext, { capture });
@@ -2254,29 +2401,33 @@ async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissi
       result = await settleImmediateEffects(result, runContext, { state, store, capture });
     }
   } finally {
-    if (tracksMainRun && state.runningProcess) state.runningProcess = null;
-    if (ownsAdmissionLock) state.preparingRun = false;
+    // Only this run's own process: never one a later run put there.
+    if (tracksMainRun && lane.runningProcess && ownProcs.has(lane.runningProcess)) lane.runningProcess = null;
+    // The provider is done but the lane stays held until the turn's tail has
+    // finished: `settling`, not `preparingRun`, so a /stop now has nothing to
+    // cancel and cannot leave a stray flag for the next turn.
+    if (holdsLane()) { lane.preparingRun = false; lane.settling = true; }
     // A cancel flag that survived this run (e.g. /stop raced a run that
     // finished successfully anyway) must not leak into the next turn, where
     // it would falsely abort a queued run or mute a genuine failure.
-    if (ownsAdmissionLock && cancelTargets(state.cancelRequested, runContext)) state.cancelRequested = false;
-    if (tracksMainRun && state.activeRunContext === runContext) state.activeRunContext = null;
+    if (holdsLane() && cancelTargets(lane.cancelRequested, runContext)) lane.cancelRequested = false;
+    if (tracksMainRun && lane.activeRunContext === runContext) lane.activeRunContext = null;
     stopTyping();
   }
 
   if (shouldRetryRefusedRun(result, runContext, { capture, refusalRetried: executionOptions.refusalRetried })
     && quarantineRefusedRun(result, runContext, state)) {
     try { service.turnObserver?.onTurnSettled(false); } catch (e) { /* best-effort */ }
-    // Re-arm the admission lock across the notice's async gap so a racing
-    // incoming message queues behind the retry instead of interleaving.
-    if (ownsAdmissionLock) state.preparingRun = true;
+    // The lane stays held across the notice's async gap so a racing incoming
+    // message queues behind the retry instead of interleaving.
+    if (holdsLane()) lane.preparingRun = true;
     await send("♻️ That refusal came from flagged context in the old session — quarantined it, retrying your message in a fresh one.").catch(() => {});
-    return executeAdmittedRun(refusalRetryContext(runContext, state), state, store, capture, ownsAdmissionLock, { ...executionOptions, refusalRetried: true });
+    return runAdmitted(refusalRetryContext(runContext, state), state, store, capture, ownsAdmissionLock, { ...executionOptions, refusalRetried: true });
   }
 
   if (tracksMainRun) {
     sideChatCoordinator.noteMainResult(runContext, result);
-    for (const item of state.messageQueue) {
+    for (const item of lane.messageQueue) {
       finalizeSideChatQueueItem(item, runContext, result);
     }
   }
@@ -2287,24 +2438,40 @@ async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissi
   }
   if (!internalCapture) await handoffMemoryReview(result, runContext, store, state);
   if (!internalCapture) await considerGuardrail(result, runContext, store);
-  if (!internalCapture && state.settings?.backend === runContext.provider && state.settings.budget) {
-    state.settings.budget = null;
-    try { saveState({ strict: true }); }
-    catch (error) {
-      result.ok = false;
-      result.status = "failed";
-      result.error = result.error || stableRunError(error.message, "RUN_SETTINGS_PERSIST_FAILED");
-      result.diagnostic = providerRunDiagnostic(result, runContext) || result.error.message;
-    }
-  }
-  if (!capture && !runContext.skipAutoCompact && result.ok && state.messageQueue.length === 0 && sameCapturedProject(state, runContext) && shouldAutoCompact(state)) {
-    try { await compactActiveSession(runContext.project.dir, { notify: false }); }
+  // A thread's first delivered reply may name the thread. Detached: it never
+  // delays this turn, the lane or the queue behind it.
+  if (!capture) nameThreadAfterTurn(result, runContext, store);
+  // Auto-compaction is part of the lane's turn: only when nothing waits in
+  // this conversation, and it compacts this conversation only.
+  if (!capture && !runContext.skipAutoCompact && result.ok && lane.messageQueue.length === 0 && sameCapturedProject(state, runContext) && shouldAutoCompact(state, { laneKey: lane.key })) {
+    try { await compactActiveSession(runContext.project.dir, { notify: false, laneKey: lane.key, admissionHeld: ownsAdmissionLock }); }
     catch (error) { console.warn(`[proactive-compact] failed: ${redactSensitive(error.message)}`); }
   }
-  if (!internalCapture) await drainQueuedMessages(state);
   return result;
 }
 
+// The one-shot budget (/budget) belongs to the room and is spent by exactly one
+// turn: the first of that room to START with it. It used to be cleared when a
+// turn finished, which let parallel conversations of one room all run with it
+// until the first of them ended. A turn that starts after it was spent runs
+// without it, even if it captured it while it waited in a queue.
+function consumeOneShotBudget(runContext, state, executionOptions = {}) {
+  const captured = runContext.providerSettings?.budget ?? null;
+  if (captured === null || executionOptions.refusalRetried) return runContext;
+  let live = null;
+  try { live = resolveProviderSettings(state, runContext.provider)?.budget ?? null; } catch (_) { live = null; }
+  if (live !== null) {
+    try {
+      require("./state").getProviderSettings(state, runContext.provider).budget = null;
+      saveState({ strict: true });
+    } catch (error) {
+      console.warn(`[budget] could not clear the one-shot budget: ${redactSensitive(error.message)}`);
+    }
+    return runContext;
+  }
+  return deepFreeze({ ...runContext, providerSettings: { ...runContext.providerSettings, budget: null } });
+}
+
 function admissionOptions(state, opts = {}) {
   const provider = opts.provider || state.settings?.backend || null;
   return { ...opts, provider };
@@ -2339,7 +2506,13 @@ function queuedNotice(activeRunContext, at = Date.now()) {
   const kind = header ? { "Watch triggered": "watch", "Watch expired": "watch", "Watch check timing out": "watch", "Scheduled cron": "scheduled job", "Scheduled wakeup": "wakeup" }[header[1]] : null;
   const label = header && header[2].length > 60 ? `${header[2].slice(0, 59).trimEnd()}…` : header?.[2];
   const what = kind ? `the ${kind} "${label}"` : "an earlier message";
-  return `Queued behind ${what} (running ${minutes} min). /stop cancels it.`;
+  return `Queued behind ${what} (running ${minutes} min). /stop cancels it (and drops this message).`;
+}
+
+// What a message waiting for a free slot is told.
+function waitingNotice(running) {
+  const n = Math.max(1, Number(running) || 0);
+  return `Waiting: ${n} conversation${n === 1 ? " is" : "s are"} already running; this starts when one finishes.`;
 }
 
 function runAgent(prompt, cwd, replyToMsgId, opts = {}) {
@@ -2355,31 +2528,49 @@ function runAgent(prompt, cwd, replyToMsgId, opts = {}) {
   });
 
   if (obsoleteCallTurn(store)) return Promise.resolve(cancelledCallRunResult(runContext));
-  if (!acquireRunLock(state)) {
-    if (shouldStartSideChat(state, runContext, opts, sideChatCoordinator)) {
+  const admission = admitLane(state, runLaneKey(runContext));
+  if (!admission.ok) {
+    const lane = admission.lane;
+    if (admission.reason === "busy" && shouldStartSideChat(state, runContext, opts, sideChatCoordinator)) {
       return sideChatCoordinator.respond({
         runContext,
-        activeRunContext: state.activeRunContext,
+        activeRunContext: lane.activeRunContext,
         store,
       });
     }
     const deferred = deferredRunResult();
-    state.messageQueue.push({ runContext, store, deferred, queuedAt: Date.now() });
-    cancelQueuedCallOnAbort(state, state.messageQueue.at(-1));
+    // `text` is what the person typed (before reply/context blocks were added),
+    // so /stop can say which queued messages it dropped.
+    const item = queueInLane(lane, { runContext, store, deferred, queuedAt: Date.now(), text: admitted.userPrompt || prompt });
+    cancelQueuedCallOnAbort(lane, item);
+    // Waiting for a slot: admit whatever the free slots allow, oldest first.
+    // This message may be among them, and then it needs no notice.
+    if (admission.reason !== "busy") {
+      drainQueuedMessages(state);
+      if (!lane.messageQueue.includes(item)) return deferred.promise;
+      // Still waiting: nothing runs in this conversation, so no chip (a
+      // pre-turn heartbeat may have started before the cap applied).
+      if (!laneBusy(lane)) stopLaneTyping(lane);
+    }
     // Transient queue/compaction acks are a chat-UX affordance (Telegram/Kazee).
     // On a Spaces task thread they'd post a throwaway "Queued." comment on the
     // task — noise. On a live call, send() is the TTS line: "Queued." would be
     // spoken to the caller. Both stay quiet and just deliver the real reply.
     if (currentAdapter()?.type !== "spaces" && !statusChatterMuted()) {
-      send(state.isCompacting ? "Compacting context, will pick this up next…" : queuedNotice(state.activeRunContext), { replyTo: replyToMsgId }).catch(() => {});
+      const notice = admission.reason === "busy"
+        ? (lane.isCompacting ? "Compacting context, will pick this up next…" : queuedNotice(lane.activeRunContext))
+        : waitingNotice(admission.running);
+      send(notice, { replyTo: replyToMsgId }).catch(() => {});
     }
     return deferred.promise;
   }
   return executeAdmittedRun(runContext, state, store, false, true);
 }
 
+// Agent mode: a message sent while ITS OWN conversation is running gets a
+// read-only side answer (other conversations simply run in parallel).
 function shouldStartSideChat(state, runContext, opts = {}, coordinator = sideChatCoordinator) {
-  return !!state?.runningProcess
+  return !!peekLane(state, runLaneKey(runContext))?.runningProcess
     && !runContext?.liveCall
     && opts.sideChat !== false
     && runContext?.purpose === "foreground"
@@ -2409,7 +2600,7 @@ function createSideChatQueueItem(request, store, lineage, state, deferred) {
     : request.originalRunContext;
   const awaitsActiveMain = !lineage.mainSessionId
     && lineage.mainRunId
-    && state.activeRunContext?.runId === lineage.mainRunId;
+    && peekLane(state, runLaneKey(request.originalRunContext))?.activeRunContext?.runId === lineage.mainRunId;
   return {
     runContext: awaitsActiveMain ? null : queuedContext,
     store,
@@ -2440,11 +2631,13 @@ function enqueueSideChatRequest(request, store = null, lineage = {}) {
     error.code = "SIDE_CHAT_FORBIDDEN";
     throw error;
   }
+  // Queued in the lane of the conversation the side question came from.
+  const lane = laneForRun(state, request.originalRunContext);
   const deferred = deferredRunResult();
-  state.messageQueue.push(createSideChatQueueItem(request, store, lineage, state, deferred));
+  queueInLane(lane, createSideChatQueueItem(request, store, lineage, state, deferred));
   deferred.promise.catch((error) => console.error("side-chat queued run failed:", redactSensitive(error.message)));
-  if (!state.runningProcess && !state.preparingRun) drainQueuedMessages(state);
-  return { queued: true, position: state.messageQueue.length || 1 };
+  if (!laneBusy(lane)) drainQueuedMessages(state);
+  return { queued: true, position: lane.messageQueue.length || 1 };
 }
 
 function runAgentCapture(prompt, cwd, opts = {}) {
@@ -2467,6 +2660,9 @@ function runAgentSilent(prompt, cwd, label, opts = {}) {
 
 module.exports = {
   queuedNotice,
+  waitingNotice,
+  drainQueuedMessages,
+  stopLaneTyping,
   admitRunContext,
   streamPreviewAllowed,
   capturedTranscriptMetadata,