fix(coding-agent): cancelling a turn now stops its subagents

[rynfar]

Problem

AgentSession.requestAbort() suspended the scheduler and aborted retry, compaction, branch summary, bash, refine, and the parent's provider stream, but it did not cancel active RLM child runs — only abort() called _cancelActiveRlmChildRuns. Every user-facing cancel routes through requestAbort(): interactive ctrl-c via AgentConnection.abort, ACP/in-process abort and abortAndClearQueue, and daemon abort and abort_and_clear_queue. Cancelling a parent turn therefore left its children streaming until they finished or idled out, holding provider concurrency and burning the user's subscription. This is the Prime-side half of Meridian's incomplete parent-to-child cancellation failure mode (#22).

Fix

requestAbort() now performs the same cascade abort() always did, and abort() inherits it instead of repeating it. Placement matters: the cascade runs after the scheduler suspension, so _cancelRlmChildRun routes each cancelled run through _abandonRlmRunForQuiescence. Cancelled children leave no unsettled quiescence work, cannot report success, and cannot inject a late terminal notice into a later turn. Grandchildren are covered because run.abort() calls the child's own abort(), which cascades recursively. No daemon command, event, or schema change — this is entirely session-local. abortForUpdateRestart() is unchanged.

I did not thread a cascade option. All five user-facing call sites want the same behavior, so a flag would only be ceremony, and the prompt-lifecycle route the issue floated would add a second cancellation owner for no additional coverage.

Which children die

• Every in-flight spawn run (_activeRlmChildRuns) is cancelled, including one admitted by an earlier turn under the fire-and-forget pattern docs/rlm-runtime.md recommends. There is no narrower correct cut: RLMSpawnHandle confirms admission only and never carries the child's answer, so no Python cell ever awaits a child result and the host has no marker separating an awaited child from a detached one. What ties a run to the session is the quiescence barrier and the terminal notice it injects into a later parent turn. Cancel is the user's stop-everything gesture, and dispose(), abort(), and abortForUpdateRestart() already cut all active runs; this wires the user's cancel to the semantic that already existed. Surgical control stays available through rlm.delete_subagent() and the interactive per-child stop.
• Retained child sessions (_rlmChildSessions) keep running. A retained child has already finished its spawn run and stays alive only so agent_message, rlm.list_subagents, and inspectors can keep addressing it; any work it is doing belongs to a later explicit request, not to the cancelled turn. abort() never terminated them either, so cascading into them would be a strictly larger change than the bug requires, and the user already has cancelRlmChildRun / rlm.delete_subagent to kill a specific one. Prime also exposes no detached or background spawn mode — rlm.run accepts only name, model, and thinking — so retained-versus-active is the only real distinction available to decide on. Pinned by a test.

Both outcomes are now documented in packages/coding-agent/docs/rlm-runtime.md.

Upstream

Not superseded. At PrimeIntellect-ai/prime-agent@c382f098 requestAbort() still leaves children running, and upstream PR PrimeIntellect-ai#346 pinned that with the characterization test "does not cancel active rlm children when only the parent turn is interrupted", which this PR inverts. Upstream PR PrimeIntellect-ai#464 (closed unmerged) made per-child cancellation explicit but never bound it to a turn abort; open PR PrimeIntellect-ai#1253 cancels child runs on kernel host teardown, which is teardown-scoped rather than turn-scoped. Recorded as turn-scoped-subagent-cancellation → redesign in .pylon/features.yaml, with the evidence in .pylon/upstream-review.md.

Validation

• New packages/coding-agent/test/suite/regressions/25-request-abort-rlm-cascade.test.ts (2 tests, faux provider): an in-flight child's provider stream is cut, the run status goes running → cancelled → untracked, no further child request reaches the faux provider (callCount stays 1, one queued response unconsumed), no terminal notice or pending next-turn message is produced, a fresh waitForRlmQuiescence() resolves, and the next parent turn runs. Second test pins retained-child survival. Verified to fail on the pre-change implementation.
• One existing test was inverted (upstream's characterization test above) and one adjusted: the ACP-close terminal-notice retention test now settles the child before the scheduler cut, since a live child no longer survives it. Its deferral, restore-snapshot, and no-agent_message coverage is unchanged.
• test/agent-session-recursion.test.ts 112/112. A 17-file affected batch across abort, RLM, subagent, queue, prompt, compaction, ACP, and correlated-lifecycle suites: 396/396.
• npm run check clean.

Claude Opus via Claude Agent SDK.

[rynfar]

Reviewed against #25 with an independent re-run (25-request-abort-rlm-cascade.test.ts + agent-session-recursion.test.ts, 114/114 from the package root) and a read of the diff.

Mechanics verified: the cascade sits at the end of requestAbort() after the scheduler suspension, so cancelled runs go through _abandonRlmRunForQuiescence — no orphaned quiescence waiters, no success-reporting terminal notice, no next-turn hang. abort() inherits the cascade by delegating to requestAbort() rather than repeating the call, so its semantics are unchanged, and grandchildren cascade recursively via the child's own abort(). No wire change, abortForUpdateRestart()/dispose() untouched. The regression's negative control (verified failing pre-change) and the retained-child survival pin are exactly the right coverage.

One decision to surface prominently for the maintainer, since it is this fork's largest deliberate reversal of upstream semantics so far: upstream Prime PR PrimeIntellect-ai#346 pinned that a turn interrupt does NOT cancel active RLM children, and this PR inverts that characterization test. With fire-and-forget as the documented spawn pattern, an interrupt intended to redirect the parent now also kills a long-running child admitted by an earlier turn. The analysis that no host-visible marker separates awaited from detached runs is correct, and the chosen cut (all unfinished spawn runs die; retained sessions survive; cancelRlmChildRun/rlm.delete_subagent remain the surgical path) is the safe default for the Meridian goal — a user cancel must not leak subscription-burning orphans. If maintainer experience later shows earlier-turn children being killed too eagerly, the follow-up is stamping the admitting turn at _startRlmChildRun and scoping the cascade to the interrupted turn; the ledger entry gives that decision a clean revisit point. Also note for the daily upstream sync: the inverted test will conflict whenever upstream touches that suite — the ledger records the intent, which is the right mitigation.

Approving from the review side; merge gate remains maintainer approval per PYLON.md.

Reviewed by Fable 5 via Claude Agent SDK.