@bastani/atomic 0.9.13-alpha.1 → 0.9.13-alpha.2

package/dist/builtin/workflows/src/extension/lifecycle-notifications.ts

@@ -19,6 +19,7 @@ import type {
 	StoreSnapshot,
 	WorkflowActor,
 } from "../shared/store-types.js";
+import type { WorkflowOutputValues } from "../shared/types.js";
 import { deriveGraphThemeFromPiTheme, type GraphTheme } from "../tui/graph-theme.js";
 import { renderWorkflowNoticeCard, type WorkflowNoticeTone } from "../tui/workflow-notice-card.js";
 import type { ExtensionAPI, PiMessageRenderComponent, PiMessageRenderer } from "./index.js";
@@ -73,12 +74,14 @@ export interface WorkflowLifecycleNoticeDetails {
 	readonly promptKind?: PromptKind | StageInputKind;
 	readonly promptMessage?: string;
 	readonly error?: string;
+	/** Partial declared outputs carried by an author-initiated terminal exit. */
+	readonly outputs?: WorkflowOutputValues;
 	readonly failedStageId?: string;
 	readonly toolNodeId?: string;
 	readonly toolName?: string;
 	readonly durationMs?: number;
 	readonly active?: boolean;
-	/** Whether a quit run advertises itself as resumable. */
+	/** Whether a failed author exit or quit run advertises itself as resumable. */
 	readonly resumable?: boolean;
 	/** Who performed this lifecycle action, when a control path attributed it. */
 	readonly actor?: WorkflowActor;
@@ -374,7 +377,9 @@ export function formatWorkflowLifecycleNoticeText(details: WorkflowLifecycleNoti
 		const tool = lifecycleToolOrigin(details);
 		const failureSite = stage ? `, stage ${stage}` : tool !== undefined ? `, tool ${tool}` : "";
 		const errorText = details.error ? `: ${details.error}` : "";
-		return `✗ Workflow "${workflowName}" failed (run ${details.runId}${failureSite})${origin}${errorText}. Inspect: /workflow status ${details.runId}`;
+		const outputsText = formatLifecycleOutputs(details.outputs);
+		const outputSuffix = outputsText === undefined ? "" : ` Partial outputs: ${outputsText}`;
+		return `✗ Workflow "${workflowName}" failed (run ${details.runId}${failureSite})${origin}${errorText}${outputSuffix}. Inspect: /workflow status ${details.runId}`;
 	}
 	if (details.kind === "blocked") {
 		const errorText = details.error ? `: ${details.error}` : "";
@@ -420,9 +425,12 @@ function makeTerminalNotice(
 	const failedToolNodeId = kind === "failed" && run.failedStageId === undefined ? run.failedToolNodeId : undefined;
 	const failedTool = (run.toolNodes ?? []).find((node) => node.id === failedToolNodeId);
 	const activeBlocked = kind === "blocked" && isActiveRecoverableBlockedRun(run);
+	const outputs = kind === "failed" && run.exited === true && run.result !== undefined ? run.result : undefined;
 	const error = activeBlocked
 		? (run.failureMessage ?? structuredRecoverableWorkflowFailureText(run) ?? run.error)
-		: (run.error ?? returnedNoticeError(run, kind) ?? (kind === "blocked" ? run.exitReason : undefined));
+		: (run.error ??
+			returnedNoticeError(run, kind) ??
+			(kind === "blocked" || kind === "failed" ? run.exitReason : undefined));
 	return {
 		kind,
 		scope: "run",
@@ -430,7 +438,11 @@ function makeTerminalNotice(
 		workflowName: run.name,
 		status: effectiveRunStatus(run),
 		...(activeBlocked ? { active: true } : {}),
+		...(run.exited === true && run.status === "failed" && run.resumable !== undefined
+			? { resumable: run.resumable }
+			: {}),
 		...(error ? { error: truncateSnippet(error) } : {}),
+		...(outputs !== undefined ? { outputs } : {}),
 		...(run.failedStageId ? { failedStageId: run.failedStageId } : {}),
 		...(failedStage ? { stageId: failedStage.id, stageName: failedStage.name } : {}),
 		...(failedToolNodeId !== undefined ? { toolNodeId: failedToolNodeId } : {}),
@@ -504,6 +516,7 @@ function lifecycleOccurrenceAt(run: RunSnapshot, kind: "completed" | "failed" |
 }
 
 function returnedNoticeError(run: RunSnapshot, kind: "completed" | "failed" | "blocked"): string | undefined {
+	if (run.exited === true && (kind === "failed" || kind === "blocked")) return run.exitReason;
 	const structuredFailureText = structuredRecoverableWorkflowFailureText(run);
 	if (kind === "blocked" && structuredFailureText !== undefined) return structuredFailureText;
 	const returnedStatus = normalizeReturnedWorkflowStatus(run.result?.status);
@@ -618,6 +631,16 @@ function truncateSnippet(value: string): string {
 	return `${normalized.slice(0, LIFECYCLE_NOTICE_SNIPPET_LIMIT - 1)}…`;
 }
 
+function formatLifecycleOutputs(outputs: WorkflowOutputValues | undefined): string | undefined {
+	if (outputs === undefined) return undefined;
+	try {
+		const serialized = JSON.stringify(outputs);
+		return serialized === undefined ? "available; inspect the run result" : truncateSnippet(serialized);
+	} catch {
+		return "available; inspect the run result";
+	}
+}
+
 function makeNoticeComponent(
 	details: WorkflowLifecycleNoticeDetails,
 	theme: GraphTheme | undefined,
@@ -660,6 +683,11 @@ function renderLifecycleNoticeCard(
 			{ label: "launched", value: details.origin, tone: "muted" },
 			{ label: "prompt", value: details.promptMessage, tone: "muted" },
 			{ label: "error", value: details.error, tone: "error" },
+			{
+				label: "partial outputs",
+				value: formatLifecycleOutputs(details.outputs),
+				tone: "muted",
+			},
 			{ label: "resumable", value: resumableFieldValue(details), tone: "muted" },
 			{ label: "duration", value: formatDurationMs(details.durationMs), tone: "muted" },
 		],

package/dist/builtin/workflows/src/extension/mcp.ts

@@ -11,6 +11,7 @@
  * without a bundled MCP adapter dependency.
  */
 
+import { isStaleExtensionContextError } from "@bastani/atomic";
 // ---------------------------------------------------------------------------
 // Minimal structural types — no hard imports from host MCP internals
 // ---------------------------------------------------------------------------
@@ -79,7 +80,12 @@ export function setMcpScope(pi: PiMcpExtensionAPI, opts: McpScopeOpts): void {
 		deny: opts.deny ?? null,
 	};
 
-	pi.events.emit("mcp.scope.set", payload as unknown as Record<string, unknown>);
+	try {
+		pi.events.emit("mcp.scope.set", payload as unknown as Record<string, unknown>);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		// Scope events are advisory and a stage can outlive its extension runtime.
+	}
 }
 
 /**
@@ -98,7 +104,12 @@ export function clearMcpScope(pi: PiMcpExtensionAPI, stageId: string): void {
 		deny: null,
 	};
 
-	pi.events.emit("mcp.scope.set", payload as unknown as Record<string, unknown>);
+	try {
+		pi.events.emit("mcp.scope.set", payload as unknown as Record<string, unknown>);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		// Scope events are advisory and a stage can outlive its extension runtime.
+	}
 }
 
 /**

package/dist/builtin/workflows/src/extension/render-result.ts

@@ -414,6 +414,7 @@ export function renderResult(result: WorkflowToolResult, opts?: RenderResultOpts
 			}
 			if (
 				r.status === "completed" ||
+				r.status === "failed" ||
 				r.status === "skipped" ||
 				r.status === "cancelled" ||
 				r.status === "blocked" ||

package/dist/builtin/workflows/src/extension/ui-surface.ts

@@ -51,7 +51,8 @@ export interface PiOverlayOptions {
 
 export interface PiCustomComponent {
 	render(width: number): string[];
-	handleInput?: (data: string) => void;
+	/** Return true when input was consumed; false lets fullscreen viewport input fall through. */
+	handleInput?: (data: string) => boolean;
 	invalidate?: () => void;
 	dispose?: () => void;
 }
@@ -136,33 +137,19 @@ export interface PiCustomOverlayOptions {
 	onHandle?: (handle: PiOverlayHandle) => void;
 }
 
-/**
- * Optional remote-control capability exposed on `PiCustomOverlayFactoryTui.terminal`.
- *
- * In isolated interactive mode the workflow extension runs inside the engine
- * child, whose stdout is the JSONL transport rather than a TTY — writing raw
- * mouse/autowrap escape sequences to `process.stdout` there is a no-op. The
- * host instead exposes these typed setters on the factory TUI's terminal so the
- * overlay can drive host-TTY modes over the allowlisted engine protocol. Absent
- * on non-isolated hosts and test seams, where the overlay falls back to writing
- * escape sequences to its local `process.stdout`.
- */
-export interface PiRemoteTerminalControl {
-	setMouseScrollTracking(enabled: boolean): void;
-	setAutowrap(enabled: boolean): void;
-}
-
 /**
  * Surface of the Pi `TUI` instance exposed to overlay factories. The
- * `terminal` accessor is optional because some host implementations and
- * test mocks do not surface it; consumers must handle `undefined`.
+ * `terminal` accessor is optional because some host implementations and test
+ * mocks do not surface it; consumers must handle `undefined`. `mode` identifies
+ * whether the host renderer already owns fullscreen terminal modes, so local
+ * fallback controls do not disable that baseline.
  */
 export interface PiCustomOverlayFactoryTui {
+	readonly mode?: "regular" | "fullscreen";
 	requestRender?: () => void;
 	terminal?: {
 		rows?: number;
 		columns?: number;
-		setMouseScrollTracking?: (enabled: boolean) => void;
 		setAutowrap?: (enabled: boolean) => void;
 	};
 	setFocus?: (target: unknown) => void;

package/dist/builtin/workflows/src/extension/wiring.ts

@@ -21,7 +21,11 @@
  *            pi docs/sdk.md createAgentSession
  */
 
-import type { CreateAgentSessionOptions, DefaultResourceLoaderInheritanceSnapshot } from "@bastani/atomic";
+import {
+	type CreateAgentSessionOptions,
+	type DefaultResourceLoaderInheritanceSnapshot,
+	isStaleExtensionContextError,
+} from "@bastani/atomic";
 import type { StageAdapters, StageSessionCreateResult, StageSessionRuntime } from "../runs/foreground/stage-runner.js";
 import { resolveStageGroup, stageHasIntercomAccess } from "../shared/intercom-group.js";
 import { type StageUiBroker, stageUiBroker } from "../shared/stage-ui-broker.js";
@@ -57,7 +61,6 @@ export type {
 	PiKeybindings,
 	PiOverlayHandle,
 	PiOverlayOptions,
-	PiRemoteTerminalControl,
 	PiTheme,
 	PiUIDialogOptions,
 	PiUISurface,
@@ -285,11 +288,33 @@ function emitLateIntercomRoute(
 		workflowStageId: meta.stageId,
 		workflowStageName: meta.stageName,
 	};
-	pi.events.emit(LATE_STAGE_MESSAGE_EVENT, event as unknown as Record<string, unknown>);
+	try {
+		pi.events.emit(LATE_STAGE_MESSAGE_EVENT, event as unknown as Record<string, unknown>);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		// The captured runtime is gone; reject so callers can distinguish this drop
+		// from a route that was accepted. Do not retry through stale sendMessage.
+		return Promise.reject(error);
+	}
 	if (!event.handled) return undefined;
 	return event.completion ?? Promise.resolve();
 }
 
+/**
+ * Preserve one late-route contract: a resolved call means delivery was accepted,
+ * while a stale-runtime rejection tells the caller that the message was dropped.
+ * This helper normalizes stale synchronous host throws without hiding any other
+ * failure.
+ */
+function routeThroughStaleContextGuard(route: () => void | Promise<void>): void | Promise<void> {
+	try {
+		return route();
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		return Promise.reject(error);
+	}
+}
+
 function makeWorkflowStageOrchestrationContext(
 	meta: StageExecutionMeta,
 	pi: RuntimeWiringSurface,
@@ -308,13 +333,15 @@ function makeWorkflowStageOrchestrationContext(
 			routeMessage(message, options) {
 				const intercomRoute = emitLateIntercomRoute(pi, meta, [message], options, false);
 				if (intercomRoute) return intercomRoute;
-				if (!pi.sendMessage) throw new Error("atomic-workflows: main-chat late-message route is unavailable");
-				return pi.sendMessage(message, options);
+				const sendMessage = pi.sendMessage;
+				if (!sendMessage) throw new Error("atomic-workflows: main-chat late-message route is unavailable");
+				return routeThroughStaleContextGuard(() => sendMessage(message, options));
 			},
 			routeMessages(messages, options) {
 				const intercomRoute = emitLateIntercomRoute(pi, meta, messages, options, true);
 				if (intercomRoute) return intercomRoute;
-				if (pi.sendMessages) return pi.sendMessages(messages, options);
+				const sendMessages = pi.sendMessages;
+				if (sendMessages) return routeThroughStaleContextGuard(() => sendMessages(messages, options));
 				const sendMessage = pi.sendMessage;
 				if (!sendMessage) throw new Error("atomic-workflows: main-chat late-message route is unavailable");
 				return (async () => {

package/dist/builtin/workflows/src/extension/workflow-ports.ts

@@ -24,14 +24,22 @@ export function makeMcpPort(pi: ExtensionAPI): WorkflowMcpPort | undefined {
 	};
 	return {
 		setScope(stageId: string, allow: string[] | null, deny: string[] | null) {
-			setMcpScope(piForMcp, {
-				stageId,
-				allow: allow ?? undefined,
-				deny: deny ?? undefined,
-			});
+			try {
+				setMcpScope(piForMcp, {
+					stageId,
+					allow: allow ?? undefined,
+					deny: deny ?? undefined,
+				});
+			} catch {
+				// A workflow can outlive its extension instance; scope events are advisory.
+			}
 		},
 		clearScope(stageId: string) {
-			clearMcpScope(piForMcp, stageId);
+			try {
+				clearMcpScope(piForMcp, stageId);
+			} catch {
+				// A workflow can outlive its extension instance; scope events are advisory.
+			}
 		},
 	};
 }

package/dist/builtin/workflows/src/extension/workflow-prompts.ts

@@ -16,7 +16,7 @@ export const DEFAULT_PROMPT_GUIDANCE: string[] = [
   - Workflow fit check: prefer a workflow for implementation, build, debug/diagnosis, bug-fix, migration, new-feature, scoped multi-file, or docs/code changes with validation; and whenever there are multiple steps, dependencies, handoffs, uncertainty, review/validation needs, long-running work, measurable done criteria, or an outcome that needs evidence.
   - Treat loop or stop-condition wording as a strong workflow signal, especially "do X until Y", "repeat until", "iterate until", "review/fix until passing", "run checks and fix until green", "keep going until done", or any prompt that names an approval gate or evidence requirement.
   - Do not force-fit an installed workflow. When another graph better matches the task, write a task-specific TypeScript workflow inline. Rich custom workflows may use deterministic branching, dynamic fan-out, child workflows, artifacts, structured outputs, human-in-the-loop prompts, gates, retries, and explicit stop conditions.
-  - Before launching any workflow for a non-trivial task, perform a short workflow-architecture pass. Derive implementation lifecycle needs, whole-codebase research needs, independent slices, competing strategies, exact API/type/build contracts, schema or generated-artifact contracts, state transitions/lifecycle behavior, deterministic stop conditions, and required evidence. Use a compact internal coverage matrix: \`requirement/risk | required evidence | workflow/stage that produces it | gap\`. Add the topology row \`acyclic topology | node/edge sketch for branches and loops | architecture pass | unresolved back-edge\`. Unresolved material rows or back-edges must change the graph before launch.
+  - Before launching any workflow for a non-trivial task, perform a short workflow-architecture pass. Derive implementation lifecycle needs, whole-codebase research needs, independent slices, competing strategies, exact API/type/build contracts, schema or generated-artifact contracts, state transitions/lifecycle behavior, deterministic stop conditions, and required evidence. Enumerate implementation slices in this same pass, not a second planning ritual; give each slice its own objective, acceptance criteria, and gates, and require each to leave a buildable, testable repository state before the next slice. Use a compact internal coverage matrix: \`requirement/risk | required evidence | workflow/stage that produces it | gap\`. Add the topology row \`acyclic topology | node/edge sketch for branches and loops | architecture pass | unresolved back-edge\`. Unresolved material rows or back-edges must change the graph before launch.
   - In that architecture pass, sketch each branch, loop, and nested workflow boundary. Identify which stages repeat, require distinct tracked work for every iteration, name the current frontier before each repeat, reject self-edges and ancestor edges, compose nested workflows through \`ctx.workflow(...)\` boundaries rather than recursive \`run\` invocation, and preserve stable per-iteration identity and call order for resume/replay.
   - Compare candidate workflows by guarantees, not broad objectives: run one named workflow only when it covers the lifecycle and produces evidence for every material requirement/risk. A generic implementation workflow may cover the lifecycle without covering exact API/type/build contracts, schemas/generated artifacts, state transitions, or domain-specific gates. Do not treat "has reviewers" as proof that a task-specific risk is covered.
   - Use these routing signals without adding decorative stages: broad repository uncertainty → Fan-out-and-synthesize with repository-focused branches; independent slices → Fan-out-and-synthesize; plausible-but-wrong contract risk → Adversarial verification or a task-specific verification stage; competing architectures or implementations → Generate-and-filter or Tournament; an explicit repeat-until condition → Loop until done; implementation lifecycle → a task-specific worker/reviewer loop; exact API/build/schema requirements → dedicated deterministic gates.
@@ -30,9 +30,11 @@ export const DEFAULT_PROMPT_GUIDANCE: string[] = [
   - When plausible-but-wrong behavior is a material risk in an arbitrary task-specific workflow, prefer a bounded evidence-backed adversarial loop. Give a fresh-context grumpy/skeptical-but-fair reviewer the literal objective and require actionable, evidence-backed falsification probes without invented requirements. Have it emit a structured verifier plan containing each exact probe, inputs, command/assertion, expected success condition, and requirement/risk covered.
   - Support both verifier shapes: for explicit known contracts, author direct task-specific \`ctx.tool(...)\` gates before launch; for risks requiring adversarial discovery, let the model select high-value probes through structured output, then execute the selected compile, test, schema generation/validation, runtime, or artifact-inspection checks authoritatively through durable \`ctx.tool(...)\` calls. Actual tool results—not model self-report—must feed skeptical evaluation, consolidated evidence-backed repair findings, and reruns after the implementation child repairs them.
   - Define bounded pass, repair, failure, and iteration-limit conditions before launch. Use \`ctx.tool\` for workflow-owned external checks and side effects whose results should be durably checkpointed. Each \`ctx.tool\` call is tracked as a durable, non-chat graph node and may run before, between, after, or without model stages; a tool-only workflow is valid tracked execution; keep pure transformations as ordinary TypeScript, and do not wrap every model-stage action in a tool call.
-  - Choose the cheapest graph that covers every material coverage row. Avoid decorative composition and duplicated research or review loops. Prefer composing a proven builtin or shared child over copying its prompt/graph.
+  - Choose the cheapest graph that covers every material coverage row without collapsing independently verifiable implementation slices merely to minimize stage count. Avoid decorative composition and duplicated research or review loops. Prefer composing a proven builtin or shared child over copying its prompt/graph.
   - Before the first launch, state the selected graph, why one broad builtin is sufficient or insufficient, the evidence each major stage produces, and the stop/repair conditions. A simple direct match may use one sentence; a composed graph must briefly name its children and task-specific gates. For a custom adversarial loop, also name the skeptical reviewer, deterministic \`ctx.tool\` verifier gates, how model-selected plans become tool executions, and how failures reach bounded repair.
-  - Example custom shapes: classify a request and dispatch category-specific stages; fan out per package and synthesize artifact-backed results; implement, run fresh-context verifiers, reduce findings, and loop through repairs until approved; generate several plans and filter or tournament-rank them; or rerun checks and fixes until green with a progress ledger and max-iteration escape hatch.
+  - Before launching an authored workflow, assign every model stage a role, failure cost, primary model, thinking level, and fallback policy. Use the role/risk defaults in the model-selection guide: reserve \`max\` for high-cost-of-error roles such as security, identity, adversarial challenge, and final approval; use \`high\` for demanding codebase mapping, lifecycle analysis, compatibility, planning, synthesis, triage, and repair; use \`medium\` for user-impact review and final reporting; keep deterministic checks as tool nodes with no model call. An explicit user request for a thinking level always wins over these defaults, subject to catalog support. For a mixed workflow, mapping may be \`high\`, approval \`max\`, reporting \`medium\`, and tests tool-only; never assign \`max\` to every model stage without a stage-specific reason.
+  - Print a compact \`Stage | Model | Thinking | Role\` assignment before launch with a short cost/quality rationale for each model stage. Apply the same role/risk policy to every fallback attempt rather than inheriting \`max\` mechanically; choose each primary and fallback level from the configured catalog, and if no selected catalog model supports the role's level, leave the stage unpinned rather than inventing an unsupported level.
+  - Example custom shapes: classify a request and dispatch category-specific stages; fan out per package and synthesize artifact-backed results; decompose one implementation objective into stacked, independently verified slices with a bounded child lifecycle per slice; implement, run fresh-context verifiers, reduce findings, and loop through repairs until approved; generate several plans and filter or tournament-rank them; or rerun checks and fixes until green with a progress ledger and max-iteration escape hatch.
   - Budget reconnaissance: once workflow fit is clear, keep pre-workflow exploration to a few quick reads that sharpen the objective and validation criteria. Put deep research, upstream/design comparison, and behavior probing inside the workflow. Pass large context through files/artifacts and \`reads\` rather than injecting it into prompts.
   - Course-correct instead of drifting: after roughly ten exploratory tool calls with no artifact, edit, or commit, or repeated "let me verify one more thing" loops, stop, write findings to a context file, and hand the task to the best-fit named or custom workflow. Sunk inline research transfers through files; it is not a reason to stay inline.
   - Only skip workflows for tiny, deterministic, low-risk answers or direct edits where stage tracking clearly costs more than it adds, typically a single-file/no-test/no-review change or a simple answer.`,
@@ -48,12 +50,15 @@ export const DEFAULT_PROMPT_GUIDANCE: string[] = [
 	`**Workflow authoring and handoffs**:
   - When a user asks to create or edit a workflow, clarify only unresolved requirements that materially affect its purpose, inputs, stages, handoffs, validation, success criteria, or starter pattern. Read the workflow docs/examples, implement the TypeScript definition with normal coding tools, reload it, and run representative test inputs before presenting it. Use the create-spec skill when it adds value; it is not mandatory when context is already sufficient.
   - After creating and reloading a newly authored custom workflow, close the loop by stating the folder containing the workflow file just written, for example \`.atomic/workflows/\`, in this shape: \`Custom workflow created. You can inspect its code at: <workflow-folder-path>\`. Do this only for newly created custom workflows, never builtin or pre-existing workflows.
-  - When creating or editing a workflow that pins an explicit stage \`model\` or \`fallbackModels\`, consult \`packages/coding-agent/docs/models/model-selection.md\` for role-based recommendations, then call \`workflow({ action: "models" })\` to see the models actually present in the user's configured catalog. Use only the catalog's returned \`fullId\` values as model strings, and append a thinking suffix only when that exact level appears in the entry's \`availableThinkingLevels\`; treat an absent or empty \`availableThinkingLevels\` as no suffix support rather than inferring one. If a guide-recommended model for the role is unavailable, try another guide-recommended model that is present in the catalog. If no recommendation intersects with the catalog, leave the stage unpinned rather than inventing a substitute, and mention the limitation, asking the user only if the workflow requires an explicit model choice. If the catalog is empty, continue with unpinned stages, state that no configured models were returned, and do not fabricate model IDs. Do not inspect or infer credentials, environment variables, auth files, token validity, entitlements, or the reason a model is absent; \`isCurrent\` marks the active selection, not a quality recommendation.
-  - Consult docs/workflows.md and its starter patterns (Classify-and-act, Fan-out-and-synthesize, Adversarial verification, Generate-and-filter, Tournament, and Loop until done) when designing a stage graph.
+  - When creating or editing a workflow that pins an explicit stage \`model\` or \`fallbackModels\`, consult \`packages/coding-agent/docs/models/model-selection.md\` for role-based recommendations, treating benchmark thinking levels as measurement configurations rather than universal workflow defaults, then call \`workflow({ action: "models" })\` to see the models actually present in the user's configured catalog. Use only the catalog's returned \`fullId\` values as model strings, and append a thinking suffix only when that exact level appears in the entry's \`availableThinkingLevels\`; apply the stage role and failure-cost policy independently to the primary and every fallback; treat an absent or empty \`availableThinkingLevels\` as no suffix support rather than inferring one. If a guide-recommended model for the role is unavailable, try another guide-recommended model that is present in the catalog. If the selected model does not support the role's level, choose another catalog model that does or leave the stage unpinned rather than inventing or silently promoting a level. An explicit user request for a level overrides the role default, but never fabricate an unsupported catalog level. If no recommendation intersects with the catalog, leave the stage unpinned rather than inventing a substitute, and mention the limitation, asking the user only if the workflow requires an explicit model choice. If the catalog is empty, continue with unpinned stages, state that no configured models were returned, and do not fabricate model IDs. Do not inspect or infer credentials, environment variables, auth files, token validity, entitlements, or the reason a model is absent; \`isCurrent\` marks the active selection, not a quality recommendation.
+  - Consult docs/workflows.md and its starter patterns (Classify-and-act, Fan-out-and-synthesize, Adversarial verification, Generate-and-filter, Tournament, Loop until done, and Stacked implementation slices) when designing a stage graph.
   - Treat workflow composition as a first-class authoring option. Before duplicating stages, inspect reusable workflow modules and builtin exports; import their definitions and invoke them with \`ctx.workflow(...)\`, mapping typed inputs and consuming only declared outputs. Nested workflows can themselves import children, so combine small reusable graphs into a richer parent while respecting \`maxDepth\`.
+  - For implementation objectives, prefer the smallest independently verifiable slice: target roughly 100–500 changed lines between verification points by default, with one reviewable concern that builds and tests on its own. This is a default, not a law: a genuinely atomic change (for example, a mechanical rename across many files or a generated-artifact refresh) stays one slice, and a small objective is not split merely to reach a count.
+  - Decompose those slices during the pre-launch architecture pass, not in a second planning ritual. Run every slice through a child workflow with its own implement/review/repair lifecycle: invoke imported \`goal\`, \`ralph\`, or a task-specific child via \`ctx.workflow(...)\`, rather than making one parent stage own all slices.
+  - Stack implementation slices in order: give each slice an explicit branch input and, before invoking its child, create or check out that named branch in its worktree with a durable \`ctx.tool(...)\` step; \`base_branch\` and \`git_worktree_dir\` alone do not create/check out a feature branch. Slice N+1 must be created from slice N's verified branch, pass that branch as \`base_branch\`, and use a distinct worktree. Verify each slice before proceeding; if a slice fails its gates, stop at the first unverified slice; earlier verified slices remain verified and are reported as such; do not roll them back or continue past the failure.
   - Atomic \`workflow({ run })\` definitions are imperative, dynamic TypeScript. Discovery validates module loading, imports, and definition shape, including schemas and the \`run\` function, but it does not compile \`run\` into a complete graph or prove acyclicity. Runtime inputs, branches, loops, files, network data, model or human output, helpers, and nested workflows determine the materialized graph during execution.
   - Cyclic workflow graphs are unsupported. Workflow authors and coding agents MUST NOT create self-edges or dependency edges from the current frontier to an existing ancestor. Every materialized execution topology must remain a DAG. Redesign or stop before launch if a cycle cannot be removed.
-  - Bounded loops must create distinct tracked work for every iteration; never reopen an ancestor below its downstream work. If a retained session receives follow-up without new dependency work, keep it as non-topological activity metadata rather than adding a back-edge. Before launch, sketch nodes and dependencies for every branch and loop and reject any proposed parent edge to the node itself or an ancestor.
+  - Bounded loops must create distinct tracked work for every iteration; never reopen an ancestor below its downstream work. Stacked implementation slices are unrolled, not looped: each slice gets a fresh child boundary and distinct tracked nodes, and no slice may add an edge back to the current frontier, itself, or an ancestor. If a retained session receives follow-up without new dependency work, keep it as non-topological activity metadata rather than adding a back-edge. Before launch, sketch nodes and dependencies for every branch and loop and reject any proposed parent edge to the node itself or an ancestor.
   - Treat dynamic graph validation during execution, replay, and DBOS hydration as the authoritative cycle boundary. If runtime topology code changes, require incremental edge checks and DBOS hydration validation; prompt guidance and TypeScript types cannot replace those runtime checks.
   - Every workflow invocation automatically receives one stable, non-default Intercom group. Intercom-capable stages inherit it, nested workflows keep the top-level invocation group, and subagents inherit their launching stage's group. Do not mint or thread group names through ordinary workflow definitions. Use an explicit \`group\` only for an intentional override: a named group or \`group: true\` creates a subgroup, while \`group: "default"\` opts into the shared default group. Stages without Intercom access receive no group, and \`contact_supervisor\` still crosses group boundaries for authorized escalation.
   - Prefer \`ctx.tool(name, args, fn)\` for workflow-owned TypeScript operations with side effects, such as filesystem writes, network mutations, and external API actions. It creates a tracked, non-attachable durable graph node before invoking \`fn\`; it may be used before, between, after, or without model stages. A completed \`ctx.tool\` call is durably checkpointed with its serializable result, so resume replays that result without rerunning \`fn\`. For checks that may fail during a bounded repair loop, opt into \`failureMode: "return"\`, branch on the typed outcome, and pass only the needed error fields to the repair stage or artifact yourself; Atomic does not inject failure evidence into later prompts. Cancellation and storage faults still throw. Keep pure computation and side-effect-free transformations as ordinary TypeScript. Do not wrap agent-stage internals or every function call indiscriminately; this rule applies to side effects orchestrated directly by the workflow definition.

package/dist/builtin/workflows/src/extension/workflow-run-control-command.ts

@@ -275,11 +275,15 @@ export async function handleRunControlCommand(
 					}
 					const run = store.runs().find((r) => r.id === resolved.runId);
 					const isPaused = run !== undefined && workflowHasPausedState(store, resolved.runId);
+					const isDurableAuthorExit = run?.exited === true && run.status === "failed" && run.resumable === true;
 					const isResumableContinuation =
 						run !== undefined &&
 						!isPaused &&
 						run.exitReason !== "quit" &&
 						isWorkflowRunResumable(workflowRunResumeCandidate(run));
+					if (isDurableAuthorExit) {
+						return await handleDurableResume(resolved.runId, ctx, reporter, deps);
+					}
 					if (isResumableContinuation) {
 						await ensureWorkflowResourcesVisible();
 						const continuation = await deps
@@ -471,6 +475,7 @@ export async function handleRunControlCommand(
 		const hadPausedRunState = run?.status === "paused";
 		const hadPausedStageState = run !== undefined && workflowHasPausedStages(store, stageRunId);
 		const isPaused = run !== undefined && workflowHasPausedState(store, stageRunId);
+		const isDurableAuthorExit = run?.exited === true && run.status === "failed" && run.resumable === true;
 		const isResumableContinuation =
 			run !== undefined &&
 			!isPaused &&
@@ -493,6 +498,9 @@ export async function handleRunControlCommand(
 			);
 			return true;
 		}
+		if (isDurableAuthorExit) {
+			return await handleDurableResume(stageRunId, ctx, reporter, deps);
+		}
 		if (isResumableContinuation) {
 			await ensureWorkflowResourcesVisible();
 			const continuation = await deps

package/dist/builtin/workflows/src/extension/workflow-tool-control.ts

@@ -482,11 +482,13 @@ export async function workflowResumeAction(
 	const hadPausedRunState = run?.status === "paused";
 	const hadPausedStageState = run !== undefined && workflowHasPausedStages(store, stageRunId);
 	const isPaused = run !== undefined && workflowHasPausedState(store, stageRunId);
+	const isDurableAuthorExit = run?.exited === true && run.status === "failed" && run.resumable === true;
 	const isResumableContinuation =
 		run !== undefined &&
 		!isPaused &&
 		run.exitReason !== "quit" &&
 		isWorkflowRunResumable(workflowRunResumeCandidate(run));
+	if (isDurableAuthorExit) return resumeDurableShadow(stageRunId, deps);
 	if (isResumableContinuation) {
 		try {
 			await deps.ensureWorkflowResourcesLoaded();

package/dist/builtin/workflows/src/intercom/intercom-routing.ts

@@ -7,6 +7,7 @@
  * cross-ref: spec §5.10, RFC §8.1 Phase G
  */
 
+import { isStaleExtensionContextError } from "@bastani/atomic";
 import type { Store } from "../shared/store.js";
 import type { NoticeLevel } from "../shared/store-types.js";
 import type { IntercomControlCallbacks, IntercomControlPayload } from "./result-intercom.js";
@@ -90,12 +91,17 @@ export function buildIntercomCallbacks(deps: IntercomRoutingDeps): IntercomContr
 					? await confirm("Subagent needs decision", payload.message).catch(() => false)
 					: false;
 
-			emit?.("subagent:control-intercom:response", {
-				requestId: payload.requestId ?? "",
-				runId: payload.runId ?? "",
-				stageId: payload.stageId ?? "",
-				accepted,
-			});
+			try {
+				emit?.("subagent:control-intercom:response", {
+					requestId: payload.requestId ?? "",
+					runId: payload.runId ?? "",
+					stageId: payload.stageId ?? "",
+					accepted,
+				});
+			} catch (error) {
+				if (!isStaleExtensionContextError(error)) throw error;
+				// The decision can finish after the workflow extension reloads.
+			}
 
 			store.ackNotice(noticeId);
 		},

package/dist/builtin/workflows/src/intercom/result-intercom.ts

@@ -15,6 +15,7 @@
  * cross-ref: spec §5.10 Integration with pi-intercom, §8.1 Phase G
  */
 
+import { isStaleExtensionContextError } from "@bastani/atomic";
 import type { WorkflowDetails } from "../shared/types.js";
 
 // ---------------------------------------------------------------------------
@@ -103,6 +104,10 @@ export interface WorkflowControlIntercomPayload {
 	readonly mode: WorkflowDetails["mode"];
 	readonly status: WorkflowDetails["status"];
 	readonly message: string;
+	/** Terminal ctx.exit() discriminator and payload for parent sessions. */
+	readonly exited?: boolean;
+	readonly exitReason?: string;
+	readonly outputs?: WorkflowDetails["output"];
 	readonly parentSession?: string;
 	readonly createdAt: number;
 }
@@ -150,10 +155,19 @@ export function emitWorkflowControlIntercom(
 		mode: details.mode,
 		status: details.status,
 		message,
+		...(details.exited !== undefined ? { exited: details.exited } : {}),
+		...(details.exitReason !== undefined ? { exitReason: details.exitReason } : {}),
+		...(details.output !== undefined ? { outputs: details.output } : {}),
 		...(parentSession !== undefined ? { parentSession } : {}),
 		createdAt: Date.now(),
 	};
-	port!.emit!("workflow:control-intercom", payload as unknown as Record<string, unknown>);
+	try {
+		port!.emit!("workflow:control-intercom", payload as unknown as Record<string, unknown>);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		// A workflow can outlive the extension runtime that supplied the port.
+		return false;
+	}
 	return true;
 }
 
@@ -174,7 +188,13 @@ export function emitWorkflowResultIntercom(
 		...(parentSession !== undefined ? { parentSession } : {}),
 		createdAt: Date.now(),
 	};
-	port!.emit!("workflow:result-intercom", payload as unknown as Record<string, unknown>);
+	try {
+		port!.emit!("workflow:result-intercom", payload as unknown as Record<string, unknown>);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		// A workflow can outlive the extension runtime that supplied the port.
+		return false;
+	}
 	return true;
 }
 
@@ -231,10 +251,21 @@ export function subscribeIntercomControl(
 		});
 	};
 
-	const unsubscribe = pi.events!.on!("subagent:control-intercom", handler);
+	let unsubscribe: unknown;
+	try {
+		unsubscribe = pi.events!.on!("subagent:control-intercom", handler);
+	} catch (error) {
+		if (!isStaleExtensionContextError(error)) throw error;
+		return null;
+	}
 
 	return () => {
 		active = false;
-		if (typeof unsubscribe === "function") unsubscribe();
+		try {
+			if (typeof unsubscribe === "function") unsubscribe();
+		} catch (error) {
+			if (!isStaleExtensionContextError(error)) throw error;
+			// Stale event-bus cleanup is best effort.
+		}
 	};
 }

package/dist/builtin/workflows/src/runs/background/status.ts

@@ -342,6 +342,21 @@ export async function resumeRun(
 			message: "This workflow is not resumable; inspect the snapshot and start a new workflow run when ready.",
 		};
 	}
+	if (
+		current.status === "failed" &&
+		current.endedAt !== undefined &&
+		current.exited === true &&
+		current.resumable === true
+	) {
+		return {
+			ok: true,
+			runId,
+			snapshot,
+			resumed: resumedCopy,
+			mode: "snapshot",
+			message: `This failed run is marked resumable; use /workflow resume ${runId} to ask the durable backend to retry it or start a new workflow run.`,
+		};
+	}
 	if (
 		current.endedAt === undefined &&
 		current.resumable === true &&

package/dist/builtin/workflows/src/runs/foreground/executor-abort.ts

@@ -7,6 +7,7 @@ const WORKFLOW_EXIT_STATUSES: ReadonlySet<WorkflowExitStatus> = new Set([
 	"skipped",
 	"cancelled",
 	"blocked",
+	"failed",
 ]);
 
 export type WorkflowExitOutputSnapshot =
@@ -24,6 +25,7 @@ export interface WorkflowExitSignal {
 	readonly scope: symbol;
 	readonly status: WorkflowExitStatus;
 	readonly reason?: string;
+	readonly resumable?: boolean;
 	readonly outputSnapshot?: WorkflowExitOutputSnapshot;
 	readonly validationError?: Error;
 }
@@ -32,6 +34,7 @@ export function makeWorkflowExitSignal(input: {
 	readonly scope: symbol;
 	readonly status: WorkflowExitStatus;
 	readonly reason?: string;
+	readonly resumable?: boolean;
 	readonly outputSnapshot?: WorkflowExitOutputSnapshot;
 	readonly validationError?: Error;
 }): WorkflowExitSignal {
@@ -40,6 +43,7 @@ export function makeWorkflowExitSignal(input: {
 		scope: input.scope,
 		status: input.status,
 		...(input.reason !== undefined ? { reason: input.reason } : {}),
+		...(input.resumable !== undefined ? { resumable: input.resumable } : {}),
 		...(input.outputSnapshot !== undefined ? { outputSnapshot: input.outputSnapshot } : {}),
 		...(input.validationError !== undefined ? { validationError: input.validationError } : {}),
 	};
@@ -81,13 +85,13 @@ function workflowExitSnapshotError(message: string, cause: unknown): Error {
 	return new Error(`${message}: ${unknownErrorMessage(cause)}`, { cause });
 }
 
-function workflowExitOptionReadError(key: "status" | "reason" | "outputs", cause: unknown): Error {
+function workflowExitOptionReadError(key: "status" | "reason" | "resumable" | "outputs", cause: unknown): Error {
 	return workflowExitSnapshotError(`atomic-workflows: ctx.exit() ${key} option could not be read`, cause);
 }
 
 export function readWorkflowExitOption(
-	options: Pick<WorkflowExitOptions, "status" | "reason" | "outputs"> | null | undefined,
-	key: "status" | "reason" | "outputs",
+	options: Pick<WorkflowExitOptions, "status" | "reason" | "resumable" | "outputs"> | null | undefined,
+	key: "status" | "reason" | "resumable" | "outputs",
 ): { readonly ok: true; readonly value: unknown } | { readonly ok: false; readonly error: Error } {
 	try {
 		return { ok: true, value: options?.[key] };
@@ -339,6 +343,9 @@ function readWorkflowExitSignalCandidate(value: object, scope: symbol): Workflow
 	const reason = safeGetProperty(value, "reason");
 	if (!reason.ok || (reason.value !== undefined && typeof reason.value !== "string")) return undefined;
 
+	const resumable = safeGetProperty(value, "resumable");
+	if (!resumable.ok || (resumable.value !== undefined && typeof resumable.value !== "boolean")) return undefined;
+
 	const outputSnapshotValue = safeGetProperty(value, "outputSnapshot");
 	if (!outputSnapshotValue.ok) return undefined;
 	const outputSnapshot = readWorkflowExitOutputSnapshot(outputSnapshotValue.value);
@@ -352,6 +359,7 @@ function readWorkflowExitSignalCandidate(value: object, scope: symbol): Workflow
 		scope,
 		status: status.value,
 		...(reason.value !== undefined ? { reason: reason.value } : {}),
+		...(resumable.value !== undefined ? { resumable: resumable.value } : {}),
 		...(outputSnapshot !== undefined ? { outputSnapshot } : {}),
 		...(validationError.value !== undefined ? { validationError: safeErrorValue(validationError.value) } : {}),
 	};

package/dist/builtin/workflows/src/runs/foreground/executor-child-boundary.ts

@@ -41,11 +41,12 @@ export interface WorkflowBoundaryStage {
 }
 
 function workflowChildResultFromReplay(snapshot: WorkflowChildReplaySnapshot): WorkflowChildResult {
+	const exited = snapshot.exited ?? (snapshot.status === "completed" ? false : undefined);
 	const candidate = {
 		workflow: snapshot.workflow,
 		runId: snapshot.runId,
 		status: snapshot.status,
-		exited: snapshot.exited,
+		exited,
 		outputs: cloneWorkflowChildValue(snapshot.outputs),
 		...(snapshot.exitReason !== undefined ? { exitReason: snapshot.exitReason } : {}),
 	} as WorkflowSerializableValue;