@bastani/atomic 0.9.18-alpha.5 → 0.9.18-alpha.7

package/CHANGELOG.md

@@ -2,6 +2,94 @@
 
 ## [Unreleased]
 
+## [0.9.18-alpha.7] - 2026-09-05
+
+### Added
+
+- Fullscreen mouse-wheel scrolling moves five times as far while Alt is held, through the Pi TUI 0.85.1 update ([upstream #9166](https://github.com/earendil-works/pi/pull/9166)).
+
+### Changed
+
+- Updated Pi runtime dependencies to 0.85.1, preserving Atomic's CLI startup, published client API, and footer watcher behavior.
+
+## [0.9.18-alpha.6] - 2026-09-04
+
+### Breaking Changes
+
+- Replaced the `/fast` toggle with explicit selectable fast model identity. `/fast`, its selector UI, the `codexFastMode.chat`/`codexFastMode.workflow` settings, the `ATOMIC_CODEX_FAST_MODE` environment variable, chat-versus-workflow scope inheritance, and every public export tied to that toggle state are removed with no compatibility shim or migration. Select fast inference by choosing a fast model.
+- Removed the `ENV_CODEX_FAST_MODE`, `CODEX_FAST_MODE_SERVICE_TIER`, `CodexFastModeResolvedSettings`, `CodexFastModeScope`, `formatCodexFastModeModelLabel`, `getCodexFastModeScope`, `hasSupportedCodexFastModeModel`, `isCodexFastModeCandidateModelId`, `isCodexFastModeEnabledForScope`, `isCodexFastModeSupportedModel`, `isCodexFastModeSupportedProvider`, `shouldApplyCodexFastMode`, `shouldApplyCodexFastModeForScope`, `withCodexFastModeHeaders`, `CODEX_FAST_MODE_ORIGINATOR`, and `CODEX_FAST_MODE_ROUTING_HEADER` package exports, and the `getCodexFastModeSettings`/`setCodexFastModeSettings` settings-manager methods. `usesChatGptCodexTransport` and `usesFirstPartyCodexRouting` remain, now exported from `core/fast-model-routing.ts` alongside `getModelFastRoute`, `resolveUpstreamModelId`, `withFastRouteStreamOptions`, and `withCodexFastRouteHeaders`; `CODEX_FAST_ROUTE_ORIGINATOR` and `CODEX_FAST_ROUTE_HEADER` come from `core/fast-model-routing-transport.ts`. All of them remain importable from the package root.
+- Removed the environment-sourced runtime settings-override layer, which existed only to inherit the fast-mode toggle into child sessions. Effective settings are now the global-then-project merge.
+- Cloudflare AI Gateway binding transport no longer falls back to `gateway(id).run(...)`. `createGatewayBindingFetch` requires `binding.fetch()`.
+- `WorkflowPendingStageDelivery`, exported from the package root, now requires a `fail(reason: Error): void` member. A delivery owner that has run out of recovery calls it to settle the stage's pending delivery terminally; `ready()` has no timeout, so a delivery nobody can settle leaves its stage parked forever. Implementers of the interface must add `fail(reason)`.
+- Removed the experimental remote-session lease API, transcript projection helpers, and harness factory after Pi 0.85 replaced their underlying contracts. `@bastani/atomic/client` now re-exports the service-addressed `@earendil-works/pi-client` API.
+
+### Added
+
+- Embedded PostgreSQL now provisions durable DBOS storage offline at runtime on Linux musl x64/ARM64 and Windows ARM64. npm installs receive only the matching runtime through the platform-specific native package, standalone archives carry only their target runtime, and Windows ARM64 deliberately runs PostgreSQL x64 through Windows 11 x64 emulation rather than claiming native ARM64 support.
+- Added `supportsMidConvoEffort` to custom Anthropic Messages model compatibility settings.
+- Added transcript notices for Anthropic thinking blocks dropped during provider recovery when cache miss notices are enabled.
+- `models.json` now accepts `compat.vllmPriority` on `openai-completions` models. Atomic sends it as the top-level `priority` request field, which vLLM uses to order queued requests when it runs with `--scheduling-policy priority`; lower values are handled earlier and the server default is `0`. Set it on a background or batch model so its long prefills queue behind interactive sessions ([#9004](https://github.com/earendil-works/pi/pull/9004)).
+- Eligible providers now publish a second selectable model whose canonical ID is the base model ID plus `-fast`, for example `openai-codex/gpt-5.6-sol-fast`. It appears in `/model`, `atomic --list-models`, workflow model catalogs, and scoped-model lists next to its normal sibling, is persisted and restored by that exact ID, and accepts a thinking suffix (`openai-codex/gpt-5.6-sol-fast:medium`). Normal and fast IDs stay distinct fallback candidates, usage rows, and model-attempt records.
+- First-party OpenAI and OpenAI Codex models route fast requests by sending the **base** upstream model ID plus the fixed `service_tier: priority`, preserving the existing first-party Codex `originator: codex_cli_rs` and `x-codex-routing-hint` HTTP/SSE and WebSocket contract. GitHub Copilot exposes only the fast sibling IDs its OAuth account catalog advertises when the corresponding base catalog model exists, and sends those real suffixed IDs with no OpenAI service-tier field. Renamed providers, proxies, Azure OpenAI, OpenRouter, and generic OpenAI-compatible providers publish no synthetic fast variants.
+- A `models.json` `modelOverrides` entry keyed on a derived `-fast` model ID now applies to that derived entry, after derivation. Overriding the base model still flows through by inheritance; a fast-specific override wins over the inherited value, and the entry's routing metadata survives the override.
+- New `core/fast-model-variants.ts` exports (`deriveFastModelVariants`, `withFastModelVariants`, `fastModelId`, `usesOpenAIFastServiceTier`, `isNativeFastRouteApi`, `copilotAdvertisedFastModelIds`, `FAST_MODEL_ID_SUFFIX`, `FAST_MODEL_SERVICE_TIER`, and the `FastModelVariantDiagnostic`/`FastModelVariantDerivation`/`FastModelVariantsOptions` types), plus `ModelRuntime.getFastModelVariantDiagnostics()` and `ModelRuntime.getWarning()`.
+- A provider, `models.json` custom model, or extension that already owns an exact `-fast` model ID wins: Atomic keeps that model exactly as declared, suppresses the derived duplicate, and reports an actionable warning in the interactive startup notices and from `--list-models`. The interactive notice renders on every launch, and is re-read after deferred extension loading so a collision an extension provider introduces is reported too. Fast behavior comes only from explicit route metadata, never from the `-fast` suffix.
+- Added a clickable "Jump to latest message" label with the `tui.altScreen.bottom` shortcut to the fullscreen transcript while it is scrolled up ([#9080](https://github.com/earendil-works/pi/pull/9080) by [@rwachtler](https://github.com/rwachtler)).
+- Gemini 3.8 Flash is now selectable in Atomic on Google (`google/gemini-3.8-flash`), Google Vertex, GitHub Copilot, opencode zen, OpenRouter (`openrouter/google/gemini-3.8-flash` and its `:batch` variant), and the Vercel AI Gateway. Provider metadata follows the upstream catalogs: Google, Google Vertex, opencode zen, and OpenRouter currently advertise a 1,048,576-token context window and 65,536 maximum output tokens; models.dev advertises 1,000,000 and 64,000 for GitHub Copilot; the Vercel AI Gateway advertises 1,000,000 and 65,536. Google, Google Vertex, opencode zen, OpenRouter, and GitHub Copilot offer low, medium, and high; the Vercel AI Gateway publishes no per-model thinking levels, so its entry also offers off and minimal. Run `--list-models` for the current catalog and the models your account can access ([#9076](https://github.com/earendil-works/pi/issues/9076)).
+- Claude Fable 5 and Claude Fable 5.1 are now present in the generated GitHub Copilot catalog with models.dev limits, pricing, and reasoning metadata. Copilot account availability remains gated by the authenticated model picker.
+- Baseten's models.dev-backed catalog now includes `zai-org/GLM-5.3-Fast` with the limits, pricing, inputs, and reasoning levels models.dev advertises.
+- GPT-6-Astra is now selectable through OpenAI, OpenAI Codex, Amazon Bedrock, OpenRouter, and the Vercel AI Gateway. Atomic derives distinct `openai/gpt-6-astra-fast` and `openai-codex/gpt-6-astra-fast` identities through the existing fast-model catalog overlay. The Codex fast identity sends upstream model `gpt-6-astra` with `service_tier: priority` while preserving the `codex_cli_rs` originator, the `model=gpt-6-astra;tier=priority` routing hint, session restore identity, usage attribution, and 2× request-time price accounting. Bedrock publishes the direct, global, and US IDs unchanged and sends `low` through `max` reasoning effort. The current dynamic OpenRouter catalog contributes `openai/gpt-6-astra` and `openai/gpt-6-astra-pro`; Vercel contributes `openai/gpt-6-astra` and its own route-less `openai/gpt-6-astra-fast`. Astra accepts text and image input, supports 128,000 output tokens, and retains each provider's long-context pricing above 272,000 aggregate input tokens.
+- Added provisional GitHub Copilot Astra support. `github-copilot/gpt-6-astra-fast` is derived only when the OAuth account catalog advertises that exact ID, and sends the suffixed ID without an OpenAI priority tier. The fallback base entry uses known Astra capabilities and zero costs for unknown Copilot pricing; it does not establish service availability.
+
+### Changed
+
+- Updated all upstream Pi runtime dependencies to 0.85.0.
+- Reduced fullscreen transcript search latency on large transcripts through pi-tui 0.85.0's cached search index and visible-match highlighting.
+- Changed the default interactive working copy from `Working...` to `Working` (and `Working (esc Interrupt)` while resetting extension UI) while preserving Atomic's animated `∀` luminance ramp in its standalone status row. Custom editors may opt into placing the indicator in their top border.
+- Replaced the fullscreen transcript's dock-reserved `Jump to bottom` row with the centered `Jump to latest message` overlay, so scrolling up no longer shrinks the transcript viewport by one row.
+- Aligned the shared workflow-stage-chat jump indicator with that overlay: `↓ Jump to latest message · <tui.altScreen.bottom>`, matching upstream pi's shortcut display.
+- `ModelRuntime` now attaches the first-party ChatGPT Codex routing identity itself, so a standalone `stream()`/`complete()`/`streamSimple()`/`completeSimple()` request on a route-bearing fast Codex model sends `originator: codex_cli_rs` and `x-codex-routing-hint: model=<base-upstream-model>;tier=priority` exactly as an agent-session turn does, and installs the WebSocket handshake identity that only CLI entrypoints used to install. It is applied after auth headers are merged, because the routing wrapper mutates a header object that header merging would otherwise copy. A normal model still sends `originator: pi` and no hint even when a caller requests the priority tier, and an extension that supplies its own stream function for a model's API keeps full ownership of its transport.
+- `ModelRuntime.canRestoreUnknownModel()` takes an optional second `modelId` argument, and session restore now passes it. A GitHub Copilot `-fast` model ID is refused when the stored credential does not advertise it or when an advertised fast sibling has no corresponding base model in the catalog, so the existing `Could not restore model …` warning fires rather than silently constructing a route-less identity. It consults the same per-account lists the Copilot provider's own model filter uses, so a Copilot model the account advertises as ordinary still restores even when its name ends in `-fast`. Other providers keep the provider-scoped answer.
+- `withCodexFastRouteHeaders` no longer takes an `enabled` flag, and the runtime transport wrapper no longer derives identity from a caller flag or the final payload tier. Both paths derive the first-party Codex identity from the model's own `fastRoute` — added only when that route declares the priority tier and the model uses first-party Codex routing — and the routing hint names the route's upstream model ID instead of the canonical `-fast` ID. A caller or payload hook therefore cannot grant fast identity to a normal model.
+- No fast variant is derived for a model whose API is served by a registered extension's own stream function, including a natively registered provider. Atomic cannot enforce the route through a transport it does not serialize, so publishing a `-fast` choice the extension may not honor is the same hazard as publishing one for an adapter that cannot carry the tier. Such a provider keeps its normal models and its transport untouched.
+- Fast variants are derived only for models on an adapter that can actually carry `service_tier` (`openai-responses` and `openai-codex-responses`). An `openai`/`openai-codex` model on `openai-completions` no longer offers a `-fast` choice that would have silently sent an ordinary request.
+- `ModelRuntime.getProvider()` now returns the same published provider as `getProviders()`, so every catalog accessor agrees about derived `-fast` models. It is the registered provider behind a `{ ...provider, getModels }` overlay, so `auth`, `login`, `stream`, and `streamSimple` remain the same function references; use `getRegisteredNativeProvider()` when you need the exact registered object.
+- The chat footer, startup banner, workflow stage labels, and subagent result labels no longer append a separate `fast` marker. The selected model ID carries the `-fast` suffix itself, so a subagent renders as `codebase-analyzer (openai-codex/gpt-5.6-sol-fast · thinking medium)`.
+- The `edit` tool's model-facing hashline guidance now includes compact worked examples and anti-patterns for commonly rejected patch shapes, and correctly identifies native Rust tree-sitter block resolution as primary with the brace/indent heuristic as its fallback. The hashline reference documentation is now a specification covering inputs, verified tolerated shapes, outputs, worked examples, limits, literal error messages, and warnings.
+- OpenAI Responses models that advertise explicit prompt-cache support, including GPT-5.6 and GPT-6 Astra, now use `prompt_cache_options.ttl: "30m"` for long cache retention. Earlier Responses models retain `prompt_cache_retention: "24h"`; no-cache and short-cache requests continue to omit unsupported fields.
+
+- Interactive model and thinking selections, including cycling shortcuts, now automatically become startup defaults. Scoped-model cycle-list changes also save immediately. Removed the Ctrl+S save-default shortcuts and UI.
+
+### Fixed
+
+- Fixed configurable save keybindings in the model and thinking selectors ([#8797](https://github.com/earendil-works/pi/issues/8797)).
+- Fixed RPC abort requests reporting success without cancelling an in-progress manual compaction ([#8920](https://github.com/earendil-works/pi/issues/8920)).
+- Fixed forked sessions losing a compaction boundary that referenced a removed label ([#8989](https://github.com/earendil-works/pi/issues/8989)).
+- Fixed session imports overwriting an existing stored session with the same filename ([#8985](https://github.com/earendil-works/pi/issues/8985)).
+- Fixed fd and rg auto-downloads failing behind exhausted shared GitHub API quotas by resolving release versions from GitHub's web redirect ([#8708](https://github.com/earendil-works/pi/issues/8708)).
+- Fixed JPEG orientation detection stopping at a non-EXIF APP1 segment before the EXIF segment ([#8616](https://github.com/earendil-works/pi/issues/8616)).
+- Fixed model-invocable skills disappearing when the bash tool is available but the read tool is not ([#8552](https://github.com/earendil-works/pi/issues/8552)).
+- Fixed concurrent `/share` commands overwriting one another's temporary session export ([#8613](https://github.com/earendil-works/pi/issues/8613)).
+- Fixed resumed sessions omitting persisted notices for Anthropic thinking blocks dropped during provider recovery.
+- Fixed proxied plain-HTTP provider requests hanging after a tool call by tunneling them with CONNECT ([#8134](https://github.com/earendil-works/pi/issues/8134)).
+- Fixed GitHub Copilot Claude Fable models to run through the Anthropic Messages adapter, so a selected thinking level reaches the provider instead of being dropped ([#8961](https://github.com/earendil-works/pi/issues/8961)).
+- Fixed every Fireworks GLM model to use the OpenAI-compatible completions endpoint. Previously only the `glm-5p2` family did, so newer entries such as `glm-5p3` were served over the Anthropic-compatible endpoint ([#8978](https://github.com/earendil-works/pi/issues/8978)).
+- Fixed the `write` tool reporting UTF-16 code-unit counts as byte counts by removing the misleading count. Every write confirmation now reads `Successfully wrote to <path>` ([#8979](https://github.com/earendil-works/pi/issues/8979)).
+- Fixed the `write` tool mistaking user-authored lines beginning with `Successfully wrote to` for copied tool confirmation text and silently discarding them. A copied confirmation is now recognized only when it names the complete path the write was asked for, its resolved or cwd-relative form, or the copied snapshot's own path, so prose that merely shares a prefix or a basename is written through unchanged.
+- Restricted synthetic fast aliases and first-party Codex routing identity to the explicit OpenAI/OpenAI Codex model route, suppressed aliases over native extension transports, and prevented Copilot from restoring an advertised fast ID without its base catalog model.
+- Fixed signal-killed child processes reporting a null exit code that callers could mistake for success; Unix signals now use the shell convention `128 + signal`, with unknown signal names falling back to the non-zero status 128 ([#8994](https://github.com/earendil-works/pi/pull/8994)).
+- Fixed Linux managed-tool downloads to use statically linked musl archives for fd and ripgrep on both x64 and ARM64 ([#9070](https://github.com/earendil-works/pi/pull/9070) by [@charlesisworkinghard](https://github.com/charlesisworkinghard)).
+- Fixed a jump-to-latest click discarding other mouse reports delivered in the same terminal input chunk.
+- Fixed branch summaries failing when reasoning consumes a 2048-token output cap by raising the cap to 4096 tokens, clamped to the model's `maxTokens` ([#8845](https://github.com/earendil-works/pi/issues/8845)).
+- Pinned managed fd downloads on darwin/x64 to 10.3.0, matching upstream pi's known-good archive for that host ([#8708](https://github.com/earendil-works/pi/issues/8708)).
+- Fixed model catalog refresh errors in the `/model` selector rendering without the blank line used by the corresponding success status.
+
+- Resumed workflows can no longer report completion after changed control flow omits their unfinished durable tool. Normal returns and explicit completed exits require exact frontier consumption. New model/task and child-workflow execution, including stage/task worktree setup, is rejected while that frontier is pending; completed work stays cached and cancellation controls retain precedence.
+
+### Removed
+
+- Removed the Ctrl+X copy-message/selection action to avoid confusion with workflow navigation. `/copy` and automatic mouse-selection copying remain available.
+
 ## [0.9.18-alpha.5] - 2026-09-01
 
 ### Added

package/README.md

@@ -152,7 +152,7 @@ The interface from top to bottom:
 
 - **Startup header** - Shows shortcuts (`/hotkeys` for all), loaded AGENTS.md files, prompt templates, skills, and extensions
 - **Messages** - Your messages, assistant responses, tool calls and results, notifications, errors, and extension UI
-- **Editor** - Where you type; border color indicates thinking level
+- **Editor** - Where you type; border color indicates thinking level, with streaming activity shown in a separate status row
 - **Footer** - Working directory, session name, total token/cache usage, cost, context usage, current model
 
 The editor can be temporarily replaced by other UI, like built-in `/settings` or custom UI from extensions (e.g., a Q&A tool that lets the user answer model questions in a structured format). [Extensions](#extensions) can also replace the editor, add widgets above/below it, a status line, custom footer, or overlays.
@@ -176,8 +176,8 @@ Type `/` in the editor to trigger commands. [Extensions](#extensions) can regist
 | Command | Description |
 |---------|-------------|
 | `/login`, `/logout` | OAuth authentication |
-| `/model` | Switch models; Ctrl+S in the picker saves the startup default |
-| `/thinking` | Switch thinking level; Ctrl+S in the picker saves the startup default |
+| `/model` | Switch models and automatically save the startup default |
+| `/thinking` | Switch thinking level and automatically save the startup default |
 | `/scoped-models` | Enable/disable models for CTRL+P cycling |
 | `/settings` | Theme, message delivery, transport, and other preferences |
 | `/resume` | Pick from previous sessions |

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.18-alpha.7] - 2026-09-05
+
+### Fixed
+
+- Host sessions that join multiple workflow groups retain workflow broadcast and pending-stage routing after reconnecting. Registration now preserves the startup home group instead of treating the most recently joined group as the session's origin; workflow workers still cannot gain another invocation's control authority through joins or reconnects.
+
+## [0.9.18-alpha.6] - 2026-09-04
+
+### Breaking Changes
+
+- Workflow-stage targets now accept only root-anchored `workflow:<rootRunId>/<segment>[/<segment>...]` paths. The legacy `<runId>:<stageKey>` form is refused with a canonical-path migration hint.
+
+### Added
+
+- Workflow-stage routing now supports literal, run-id, and glob path segments, sticky delivery to every future match, and `workflow:<rootRunId>/**` broadcast to live and future descendants until root termination.
+- `intercom list` now surfaces persisted possible future literals, patterns, and child paths with queued counts. Valid targets outside the known set queue with a `notInKnownSet` warning and produce a terminal undeliverable notification only when never delivered.
+
+### Changed
+
+- Intercom tool guidance, the bundled skill, and workflow-stage discovery documentation now teach canonical path targets, globs, sticky broadcasts, speculative acceptance, terminal settlement, and live-only asks.
+
+### Fixed
+
+- A recoverable broker disconnect no longer surfaces as a workflow-stage failure. Most visibly, a subagent launch no longer aborts with `Client disconnected` as its entire result: the supervisor-authorization request is advisory, so a transient disconnect now lets the launch proceed with supervisor metadata omitted, exactly as a runtime with no provider already did. Eager stage warm-up during `session_start` no longer reports the disconnect through the host extension-error channel, and the background event relays no longer log `Intercom event relay failed …` into the stage output.
+- A workflow-stage warm-up that loses the broker now has a retry owner. Previously nothing rescheduled it, so a stage holding queued pending messages could wait indefinitely for a delivery that never came. The wrapper now retries the warm-up on the same bounded reconnect backoff, and the next entry covers what happens when those attempts run out.
+- An exhausted workflow-stage warm-up retry no longer writes `Intercom could not reconnect for workflow stage "…" after 5 attempts` into the host session's transcript, and no longer leaves that stage waiting forever. The bounded retry previously ended with a raw `console.error`, which the root session paints into the main chat area, and nothing settled the stage's pending delivery — so the stage stayed running on an untimed `pendingStageDelivery.ready()` with no owner and no signal. The wrapper now hands the delivery a typed `IntercomWarmUpExhaustedError` through the `fail(reason)` member of the `WorkflowPendingStageDelivery` contract, and the workflow side settles `ready()` exactly once with a stage-scoped `WorkflowPendingStageDeliveryFailedError` naming the run, stage id, and stage name, so the stage ends `failed` at its own lifecycle boundary and spends no model retry or fallback candidate on a delivery no candidate could have received. Transient reconnects stay silent and keep retrying, a late success still delivers queued messages in admission order before stage work, and shutdown still cancels the retry silently. Nothing is dropped: after the terminal signal the queue is left untouched rather than marked delivered to a stage that will not read it, a stage with nothing queued still starts normally, and a duplicate `fail()`, a `fail()` before the first `ready()`, and a late drain are all safe. A host whose `fail` implementation throws cannot turn its own contract violation into an uncaught exception or an unhandled rejection in the session, and still gets no transcript output.
+- Recoverable-disconnect classification requires the typed error raised inside the broker client rather than message text or a copyable marker property, so protocol, authentication, configuration, non-recoverable initialization, terminal relay, exhausted-retry, user-initiated, and identically worded unrelated failures all stay visible and actionable.
+- The broker no longer writes to a departing peer's ended socket. A session was retired only when its connection finally closed, so a peer that half-closed — or one the broker itself ended after refusing a registration — stayed in the routing table and every later broadcast wrote into a socket whose writable side was gone. Node destroys the socket synchronously for such a write, so one departure cascaded into further disconnects and filled the 8 KiB `broker.log` with `ERR_STREAM_WRITE_AFTER_END` traces, leaving no room for any other diagnostic. Sessions are now retired as soon as their socket stops accepting frames, and every broker write checks writability as part of the write itself.
+- A session the broker ended is no longer advertised by `intercom list` and no longer acked as `delivered`. Previously a `send` to such a session was answered `delivered` while the peer received nothing, and the fabricated delivery record then refused the honest retry with `message_id_conflict`, leaving the message permanently undeliverable under its stable id. Delivery-producing sends now wait for the socket write callback, so an immediate asynchronous reset cannot be acknowledged before its failure arrives. A send that cannot be handed to its target fails with `Session not found`, keeps the message id retryable, and opens no reply authorization for a message that was never sent. Pending-stage routing and notifications fail the same way instead of stalling for their full acknowledgement timeout, and a sticky broadcast reports only the stages it actually reached.
+- A transport reset on an already-registered broker connection now enters the bounded reconnect path instead of failing the caller. `ECONNRESET`, `EPIPE`, and their relatives were stored raw and rejected pending work with the raw error, which the recoverable-disconnect classifier does not recognize, so an ordinary broker restart bypassed recovery. Such a reset is now the typed recoverable disconnect with the original transport error preserved as `cause`; the raw error still reaches `error` listeners, a protocol error that is followed by a socket error keeps its own diagnosis, and pre-registration failures are unchanged.
+- A recoverable `Client disconnected` result and both model-visible Intercom tool registrations now return/describe an opaque `retryToken` for the exact failed `send`, `ask`, or `reply`. Only an explicit matching claim reuses identity; a tokenless byte-identical call is always a distinct intentional operation. Concurrent failures receive separate process-local tokens, and invalid, expired, foreign-session, mismatched, concurrent, exhausted, or settled claims fail before sending. Omitted attachments and an explicit empty list remain distinct caller arguments, while attachment object member order is canonical. Each token allows at most three claimed attempts without extending the original 11-minute deadline.
+- A claimed retry no longer releases its accepted identity on an intermediate resolved nondelivery. `delivered: false`, `Session not found`, durable-authority uncertainty/capacity refusal, and another typed disconnect preserve and visibly return the same token/ID for the remaining bounded attempts; delivered or queued success settles it. This prevents an accepted operation with a lost acknowledgement from minting a second ID after an inconclusive retry.
+- Stable-message retries remain reconnect-safe: retry signatures use reconnect-stable sender/recipient authority and preserve the model-issued target verbatim while transport resolution changes independently. Canonical attachment object member order is ignored, while attachment omission, array order/duplicates, raw target aliases, whitespace, and reply fields remain significant.
+- A retry token for an implicit `reply` now retains the originally resolved sender and question route. An exact retry validates its caller-visible arguments before consulting mutable reply state, so a later inbound ask cannot make it ambiguous or steal its correlation. Public implicit `reply` still prefers the recorded exact sender ID while it is live; only a departed ID uses the authorized name fallback, ambiguity fails closed with the still-valid token, and explicit `to`/`replyTo` stay verbatim.
+- Retry-token capacity is now reserved before a fresh operation can consume an ID, open a confirmation prompt, resolve a target/reply route, or send. Live token claims still work at full capacity, settled tombstones are discarded, and releasing or expiring an in-flight/retained identity reopens capacity without evicting live authority.
+- Local subagent result relay delivery now reserves its process-local deduplication identity before the chat side effect and accepts it before positive acknowledgement. The 10,001st live ID, conflicts, invalid state, and uncertain in-flight replays fail closed without delivery or success acknowledgement; a proven side-effect failure forgets only its exact reservation, while an acceptance failure remains uncertain so replay cannot duplicate it.
+- Broker acceptance records now persist as fixed keyed SHA-256 HMAC authority rather than canonical plaintext signatures, so SQLite/WAL/SHM never contain message or attachment text and low-entropy payloads cannot be tested without the paired random key. The configurable Intercom directory and database/key artifacts are corrected to owner-only POSIX modes (`0700`/`0600`), while Windows permission semantics remain unchanged. Missing/malformed key-database pairs, corrupt records, capacity, and uncertain reservations fail closed; digest-based byte accounting, 12-minute restart durability, and 10,000-record/64 MiB bounds remain enforced.
+- Closed workflow stages suppress late messages from the subagent runs they own, without dropping messages from other stages' children. Cancelled sends stop before transport when possible; already-submitted sends preserve their delivery receipts and disconnect retry identities ([#2840](https://github.com/bastani-inc/atomic/issues/2840)).
+
 ## [0.9.18-alpha.5] - 2026-09-01
 
 ### Fixed

package/dist/builtin/intercom/README.md

@@ -184,6 +184,11 @@ intercom({
 
 To coordinate two plain chat sessions without changing startup config, have each call `intercom({ action: "join", group: "NAME" })`. Joining adds a membership without changing the session ID or removing existing memberships. Calls to `list`, `send`, and `ask` can then reach any session sharing at least one membership. Use `intercom({ action: "groups" })` to discover every available name, connected-session count, and membership marker. Call `intercom({ action: "leave", group: "NAME" })` to remove one membership while keeping the others, or bare `leave` to reset to the original home group. `contact_supervisor` keeps its dedicated capability-based cross-group behavior.
 
+Joined memberships survive broker reconnects without replacing the session's
+startup identity. An ordinary host can therefore control several joined workflow
+invocations, while a workflow worker cannot gain another invocation's parent-control
+authority by joining its group and reconnecting.
+
 **Worker finds something unexpected — escalates and waits:**
 ```typescript
 intercom({
@@ -335,10 +340,11 @@ The supervisor can reply with plain JSON or a fenced `json` block. If the reply
 | Parameter | Type | Description |
 |-----------|------|-------------|
 | `action` | string | `"list"`, `"groups"`, `"join"`, `"leave"`, `"send"`, `"ask"`, `"reply"`, `"pending"`, or `"status"` |
-| `to` | string | Exact session name/full session ID, or `<runId>:<stageKey>` for `send` to a not-yet-started workflow stage (for send/ask, or targeted reply) |
+| `to` | string | Exact session name/full session ID, or `workflow:<rootRunId>/<segment>[/<segment>...]`; `*` matches one segment and `**` any depth. Sends support pending/future patterns and broadcast; `ask` requires a live target. |
 | `message` | string | Message text (for send/ask/reply) |
 | `attachments` | array | Optional `file`, `snippet`, or `context` attachments |
 | `replyTo` | string | Optional message ID for threading or replying to an `ask` |
+| `retryToken` | string | Opaque claim returned by a retryable `send`/`ask`/`reply` failure; valid only with the exact same caller arguments. Omit it for fresh operations. |
 | `group` | string | Group name for `join` or optional targeted `leave`; read-only filter for `list`/`status`. `send`/`ask` require a shared membership. |
 
 ### contact_supervisor
@@ -367,7 +373,7 @@ Only registered in sessions where `pi-subagents` supplied the required child bri
 
 **`list`** — Keeps session-listing semantics: returns the current session and every active session sharing at least one membership. Pass `group` for a read-only view of one group.
 
-Live target lookup accepts only an exact full Intercom session ID or an exact case-insensitive session name. `intercom list` also returns materialized workflow-stage rows labeled `PENDING` or `RUNNING`, with canonical `<runId>:<stageId>` targets and actual groups. From the main chat, join `workflow:<rootRunId>` before controlling those targets. An eligible invocation member has directional list/send/live-ask control over stages in owned `workflow:<rootRunId>/...` subgroups. A subgroup stage or another workflow root cannot turn a mutable join into parent control; sibling subgroups stay isolated, and explicit `group: "default"` remains non-owned.
+Live target lookup accepts only an exact full Intercom session ID or an exact case-insensitive session name. Join `workflow:<rootRunId>` and use `intercom list` to see materialized `PENDING`/`RUNNING` workflow stages with canonical `workflow:<rootRunId>/<segment>[/<segment>...]` paths, plus possible future literals, globs, nested paths, and their queued counts. `*` matches one segment and `**` any depth. `workflow:<rootRunId>/**` reaches live stages now and remains sticky for every future stage until root termination; narrower patterns behave the same for their matches. A valid path outside the known set queues with `notInKnownSet` and settles undeliverable at terminal only if never delivered. Use `ask` only on live targets. An eligible invocation member has directional list/send/live-ask control over stages in owned `workflow:<rootRunId>/...` subgroups. A subgroup stage or another workflow root cannot turn a mutable join into parent control; sibling subgroups stay isolated, and explicit `group: "default"` remains non-owned.
 
 **`send`** — Sends through ordinary Intercom. Live workflow-stage sessions receive messages immediately and return `delivered`. Known pending invocation-owned stages queue durably and return the distinct `queued` result with its FIFO position; a main-chat session that explicitly joined the owning invocation group may use that route. Pending `group: "default"` stages remain ineligible, and an ineligible attempt is refused with `Target workflow run is in a different intercom group`. Each exact run/stage key retains at most 50 queued messages; the next send is refused rather than evicting an older one. Delivery occurs before the first model turn under **Messages received before you started**, with sender identity and `Sent:` timestamp separate from the task prompt. Resume/replay, broker restart, and stage-attempt restart preserve exactly-once delivery by logical message ID. Skipped, cancelled, and terminal-before-initialization destinations make pending messages undeliverable and notify the sender. If the sender reconnects with a new broker UUID, notification fallback requires one unique same-group match for the immutable registration-time name; mutable presence names/groups, cross-group matches, and ambiguous duplicates are rejected. The broker trusts that initial name/group as host-orchestration metadata, while the original display/provenance remains unchanged in the durable record. Live sends remain immediate by default; `confirmSend: true` still enables confirmation for non-reply sends.
 
@@ -453,6 +459,18 @@ graph TB
 
 The broker is a standalone TypeScript process that manages session registration and message routing. It auto-spawns when the first session that invokes Intercom needs it and exits after 5 seconds when it last has no registered sessions, including brokers that never received a connection and sockets that close before register. Clients reconnect automatically if the broker disappears and later comes back. A failed reconnect schedules the next attempt on a bounded backoff (1s, 2s, 5s, 10s, then 30s) once it releases reconnect ownership, so a transient failure never leaves a live session with nothing owning recovery; a failed explicit tool or overlay connection still returns its error to the caller and leaves the retry behind. A reconnect that fails after the broker already accepted it closes that connection first, so a session never appears twice in `intercom list`.
 
+An explicit `send`, `ask`, or `reply` that reports the typed `Client disconnected` failure returns an opaque `retryToken`. Retry the exact action and arguments with that token, up to three claimed attempts. A tokenless call is always a fresh intentional operation even if byte-identical, and concurrent failures receive separate tokens. Tokens are unguessable and process-local, scoped to this tool registration/session and one canonical operation; invalid, expired, foreign, mismatched, in-flight, exhausted, and settled claims fail before sending. Attachment object member order is canonical, but omission is distinct from an explicit empty array and attachment array order/duplicates remain exact. The identity expires at the original 11-minute deadline (the 10-minute `ask` window plus one minute), which retries never extend.
+
+A token-claimed retry preserves the same token and message ID after `delivered: false`, `Session not found`, durable-authority uncertainty/capacity refusal, or another typed disconnect; each claim consumes one of the three attempts. It settles on delivered/queued success or a genuinely conclusive non-recoverable outcome. Initial tokenless nondelivery and unrelated/non-recoverable error classification stay unchanged.
+
+The broker keeps accepted-operation authority for 12 minutes in `delivered-messages.sqlite`. It stores canonical signatures only as fixed keyed SHA-256 HMAC digests, with the random key in `delivered-messages.key`; message text and attachment contents never reach SQLite, and the key prevents offline guesses for low-entropy messages by other local users. On POSIX the Intercom directory is corrected to `0700` and database/WAL/SHM/key artifacts to `0600`; missing or malformed key/database pairs and corrupt digest records fail closed. The broker retains at most 10,000 live authority records and 64 MiB of digest/routing authority.
+
+The broker reserves an identity durably before forwarding, then marks it accepted after confirmed write and before acknowledging the sender. This survives broker replacement without redelivery. A deduplicated ask remains answerable after reconnect: implicit public `reply` uses the exact recorded sender ID while it is live, even alongside a same-name peer; only a departed ID falls back to authorized reconnect/name resolution, where ambiguity and changed identity/groups fail without sending. An implicit reply retry also retains its original sender/question snapshot, so later inbound asks cannot redirect or invalidate it. Explicit `to` and `replyTo` remain verbatim and `requirePendingReply` still binds the exact pending thread. Legacy sends without logical-target metadata retain transport-target behavior.
+
+Retry state is independently bounded and fails closed at pressure. A fresh client operation reserves one of 1,000 identity slots before consuming an ID, showing confirmation UI, resolving its target/reply route, or sending; existing token claims remain available when full. Capacity reopens when an in-flight or retained identity is released or expires, and settled tombstones are discarded without evicting live authority. The broker likewise refuses new delivery rather than evicting live authority, then accepts again after TTL cleanup. The local subagent result relay applies the same order in memory—reserve before its chat side effect, accept before positive acknowledgement—and refuses the 10,001st live ID or an uncertain replay without performing the side effect. SQLite transactions serialize replacement-broker access.
+
+A workflow stage warming up before its heavy module exists is the one case the reconnect backoff cannot own, so the lightweight wrapper retries that warm-up on the same bounded schedule. When those attempts run out it writes nothing to the console: it hands the stage's pending delivery a typed terminal reason through the delivery contract's required `fail(reason)`, and the workflow side fails that stage with a stage-scoped, non-retryable error instead of leaving it waiting on `pendingStageDelivery.ready()`. No model retry or fallback candidate is spent on it, since every candidate would be refused the same instructions. Queued messages are left queued rather than delivered to a stage that will not read them.
+
 Messages use length-prefixed JSON over a local socket/pipe transport (4-byte length + JSON payload) to handle fragmentation properly. The protocol includes request correlation for session listing, explicit delivery failures, and validation for malformed or out-of-order messages.
 
 Async extension work (startup, inbound flushes, reconnects, overlays, and relays) no-ops if the session shuts down or reloads before it settles.
@@ -462,6 +480,8 @@ Runtime files live under the active agent directory. Atomic defaults to `~/.atom
 - `broker.sock` — Unix domain socket for communication (macOS/Linux only; Windows uses a named pipe instead)
 - `broker-launch.vbs` — Windows helper script used to launch the broker without a console window
 - `broker.pid` — Broker process ID
+- `delivered-messages.sqlite` — bounded durable authority containing keyed digests, never plaintext payloads
+- `delivered-messages.key` — random owner-only HMAC key paired with the authority database
 - `broker.spawn.lock` — Short-lived lock used to avoid duplicate auto-spawns
 - `broker.log` — Broker stderr, truncated on every spawn and capped at 8 KiB by the broker itself
 - `config.json` — User configuration