@bastani/atomic 0.9.26-alpha.4 → 0.9.26-alpha.6

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [0.9.26-alpha.6] - 2026-10-04
+
+### Added
+
+- Added `samplingParamsByThinkingLevel` to `models.json` for per-thinking-level sampling parameter overrides on OpenAI-compatible APIs, including native fast routes. See [Sampling by Thinking Level](docs/models/reference.md#sampling-by-thinking-level) ([#9776](https://github.com/earendil-works/pi/pull/9776) by [@mrexodia](https://github.com/mrexodia))
+
+### Fixed
+
+- Fixed fresh SDK sessions being unable to inspect or resume crashed durable workflow runs from another process. Hosts using `SessionManager.inMemory()` can recover by full run UUID in the original working directory and workflow database without reopening a session file. Database ownership fencing protects healthy connected owners, including across cloned VM identities, and rejects late durable writes after connection loss. Older unfenced runs support explicit controlled enrollment after their workers stop. Completed checkpoints are preserved; interrupted external effects still require idempotency ([#3419](https://github.com/bastani-inc/atomic/issues/3419)).
+- Fixed managed workflow database monitoring timeouts unnecessarily dropping healthy run ownership. A persistent timeout now reports database unavailability without closing existing ownership connections ([#3419](https://github.com/bastani-inc/atomic/issues/3419)).
+
+## [0.9.26-alpha.5] - 2026-10-03
+
+### Added
+
+- Added `pi.registerToolRenderer()` to choose renderers for any tool, including tools not yet registered ([#10285](https://github.com/earendil-works/pi/issues/10285)).
+
+### Fixed
+
+- Fixed managed workflow PostgreSQL staying down after shutdown when its old launch options were missing. Database-unavailable errors and workflow status now show the provider, credential-redacted endpoint, and retained recovery refusal or failure ([#3413](https://github.com/bastani-inc/atomic/issues/3413)).
+- Fixed NVIDIA's built-in default pointing to a model missing from its current catalog. Automatic selection now prefers Nemotron 3 Ultra 550B A55B.
+- Fixed MCP tool calls in resumed sessions and HTML exports rendering fully expanded before their server connects, or when it never connects ([#10285](https://github.com/earendil-works/pi/issues/10285)).
+- Fixed JPEG, GIF, and WebP images rendered by extensions through `Image` not appearing on Kitty-protocol terminals ([#10292](https://github.com/earendil-works/pi/issues/10292)).
+- Fixed fullscreen Kitty images collapsing after scrolling in WezTerm ([#10319](https://github.com/earendil-works/pi/issues/10319)).
+- Fixed `codemode` scripts that print in a loop exhausting memory. Scripts now fail after exceeding 16 Mi characters or 100000 output items ([#10283](https://github.com/earendil-works/pi/issues/10283)).
+- Fixed resumed MCP calls and HTML exports assigning the wrong server to ambiguous tool names. Calls without known renderers now retain their full identifier when the server/tool boundary cannot be recovered.
+
 ## [0.9.26-alpha.3] - 2026-10-03
 
 ### Added

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.26-alpha.4",
+  "version": "0.9.26-alpha.6",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^1.0.0",
+    "@earendil-works/pi-tui": "^1.0.2",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.26-alpha.4",
+  "version": "0.9.26-alpha.6",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.26-alpha.4",
+  "version": "0.9.26-alpha.6",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [
@@ -35,8 +35,8 @@
   "peerDependencies": {
     "@bastani/atomic": "*",
     "@bastani/pi-ai": "*",
-    "@earendil-works/pi-agent-core": "^1.0.0",
-    "@earendil-works/pi-tui": "^1.0.0",
+    "@earendil-works/pi-agent-core": "^1.0.2",
+    "@earendil-works/pi-tui": "^1.0.2",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.26-alpha.4",
+  "version": "0.9.26-alpha.6",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [
@@ -31,7 +31,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^1.0.0"
+    "@earendil-works/pi-tui": "^1.0.2"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.26-alpha.6] - 2026-10-04
+
+### Fixed
+
+- Fixed SDK inspection rejecting earlier-process durable runs and crash recovery retaining the old session owner. Explicit SDK resume atomically adopts an eligible crashed root in the same working directory and workflow database, preserves its UUID and completed checkpoints, and excludes healthy connected owners and competing adopters. Database ownership fencing handles cloned VM identities and rejects disconnected owners' late durable writes. Older unfenced runs support controlled enrollment after their workers stop; unfinished external callbacks may overlap recovery and must use idempotent effects ([#3419](https://github.com/bastani-inc/atomic/issues/3419)).
+- Fixed managed PostgreSQL monitoring connection timeouts unnecessarily closing healthy workflow ownership connections. Monitoring retries once; a persistent timeout reports database unavailability without discarding connected owners or restarting the database ([#3419](https://github.com/bastani-inc/atomic/issues/3419)).
+
+## [0.9.26-alpha.5] - 2026-10-03
+
+### Added
+
+- Added `workflows.durability.systemDatabaseUrl` and `systemDatabaseUrlFile` in global and trusted project settings to choose a persistent workflow database without launcher-specific environment configuration. `DBOS_SYSTEM_DATABASE_URL` retains precedence; explicit selections never provision embedded PostgreSQL or Docker. Interactive and RPC sessions report the selected provider and host without credentials on the first workflow action; headless sessions print only a Docker fallback selection to stderr. Existing workflow-path arrays remain supported alongside the new object form with `paths` ([#3416](https://github.com/bastani-inc/atomic/issues/3416)).
+
+### Fixed
+
+- Fixed managed PostgreSQL staying down after shutdown when its old launch options were missing. Recovery preserves cluster ownership and identity checks, and database-unavailable admission errors and workflow status now show the provider, credential-redacted endpoint, and retained probe or recovery failure ([#3413](https://github.com/bastani-inc/atomic/issues/3413)).
+
 ## [0.9.26-alpha.4] - 2026-10-02
 
 ### Fixed

package/dist/builtin/workflows/builtin/{chunk-73p2cm5s.js → chunk-9bhs02gm.js}

@@ -5107,10 +5107,97 @@ function getDurableBackendProcessOwner() {
 }
 // dist/builtin/workflows/src/durable/dbos-admission.ts
 import { AsyncLocalStorage } from "node:async_hooks";
+
+// dist/builtin/workflows/src/durable/dbos-database-diagnostics.ts
+function redactedDatabaseEndpoint(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return "unparseable PostgreSQL endpoint";
+  }
+}
+function redactedDatabaseMessage(message, url) {
+  let safe = message.replace(/postgres(?:ql)?:\/\/[^\s"'<>]+/gi, (value) => redactedDatabaseEndpoint(value));
+  let configuredSecrets = [];
+  if (url !== undefined) {
+    try {
+      const parsed = new URL(url);
+      configuredSecrets = [parsed.username, parsed.password, ...parsed.searchParams.values()].flatMap((secret) => {
+        try {
+          return [secret, decodeURIComponent(secret)];
+        } catch {
+          return [secret];
+        }
+      }).filter((secret) => secret.length > 0);
+    } catch {
+      return "PostgreSQL diagnostic could not be safely redacted; check the configured endpoint.";
+    }
+  }
+  safe = safe.replace(/\b(password|passwd|token|secret|sslpassword|user(?:name)?)\s*(?:([=:])\s*|((?:is|was)\s+)|\s+)(?:"([^"]*)"|'([^']*)'|([^\s,;]+))/gi, (match, key, separator, filler, doubleQuoted, singleQuoted, bare) => {
+    const value = doubleQuoted ?? singleQuoted ?? bare ?? "";
+    const isUserContext = /^user(?:name)?$/i.test(key);
+    if (separator === undefined && !isUserContext && !configuredSecrets.includes(value))
+      return match;
+    const rendered = doubleQuoted !== undefined ? '"[redacted]"' : singleQuoted !== undefined ? "'[redacted]'" : "[redacted]";
+    return `${key}${separator ?? " "}${filler ?? ""}${rendered}`;
+  });
+  for (const secret of new Set(configuredSecrets)) {
+    if (secret.length < 4)
+      continue;
+    const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const expression = new RegExp(`(?<![\\p{L}\\p{N}_\\[])${escaped}(?![\\p{L}\\p{N}_\\]])`, "gu");
+    safe = safe.replace(expression, "[redacted]");
+  }
+  return safe;
+}
+function databaseDependencyMessage(message, diagnostics) {
+  const safe = redactedDatabaseMessage(message, diagnostics?.url);
+  if (diagnostics === undefined)
+    return safe;
+  const failure = diagnostics.failure === undefined ? "" : ` Last probe/recovery failure: ${redactedDatabaseMessage(diagnostics.failure, diagnostics.url)}`;
+  return `${safe} Provider: ${diagnostics.provider}; endpoint: ${redactedDatabaseEndpoint(diagnostics.url)}.${failure}`;
+}
+
+// dist/builtin/workflows/src/durable/dbos-process-owner.ts
+var DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
+function emptyOwner2() {
+  return {
+    version: 1,
+    state: "uninitialized",
+    configured: undefined,
+    active: undefined,
+    launchPromise: undefined,
+    shutdownPromise: undefined,
+    failure: undefined,
+    wrappers: undefined,
+    leases: new Set
+  };
+}
+function ownerBag2() {
+  return globalThis;
+}
+function getDbosProcessOwner() {
+  const bag = ownerBag2();
+  const existing = bag[DBOS_PROCESS_OWNER_KEY];
+  if (existing !== undefined && existing.version === 1)
+    return existing;
+  const created = emptyOwner2();
+  bag[DBOS_PROCESS_OWNER_KEY] = created;
+  return created;
+}
+
+// dist/builtin/workflows/src/durable/dbos-admission.ts
 class DbosDependencyError extends Error {
   code = "ATOMIC_DBOS_DEPENDENCY";
-  constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.") {
-    super(message);
+  admissionDetail;
+  constructor(message = "Workflow database unavailable during admission. Restore PostgreSQL before retrying.", diagnostics = getDbosProcessOwner().databaseDiagnostics?.(), admissionDetail) {
+    super(databaseDependencyMessage(message, diagnostics ?? undefined));
+    this.admissionDetail = admissionDetail === undefined ? undefined : redactedDatabaseMessage(admissionDetail);
     this.name = "DbosDependencyError";
   }
 }
@@ -5218,36 +5305,186 @@ var STATUS_RELATED_MESSAGE_REFINEMENT_CODES = new Set([
   "quota_limited",
   "cancelled"
 ]);
-// dist/builtin/workflows/src/durable/dbos-process-owner.ts
-var DBOS_PROCESS_OWNER_KEY = Symbol.for("atomic-workflows/dbos-process-owner@1");
-function emptyOwner2() {
-  return {
-    version: 1,
-    state: "uninitialized",
-    configured: undefined,
-    active: undefined,
-    launchPromise: undefined,
-    shutdownPromise: undefined,
-    failure: undefined,
-    wrappers: undefined,
-    leases: new Set
-  };
-}
-function ownerBag2() {
-  return globalThis;
-}
-function getDbosProcessOwner() {
-  const bag = ownerBag2();
-  const existing = bag[DBOS_PROCESS_OWNER_KEY];
-  if (existing !== undefined && existing.version === 1)
-    return existing;
-  const created = emptyOwner2();
-  bag[DBOS_PROCESS_OWNER_KEY] = created;
-  return created;
-}
+// dist/builtin/workflows/src/durable/dbos-owner-fence.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+
+// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
+var connectionErrnos = new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ETIMEDOUT",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EPIPE"
+]);
+var connectionMessages = new Set([
+  "Connection terminated unexpectedly",
+  "Connection terminated due to connection timeout",
+  "Client has encountered a connection error and is not queryable",
+  "timeout exceeded when trying to connect",
+  "Client was closed and is not queryable",
+  "Postgres connection pool changed while acquiring a connection"
+]);
+
+// dist/builtin/workflows/src/durable/dbos-row-guard.ts
+import { createHash } from "node:crypto";
+var guardSql = `
+CREATE TABLE IF NOT EXISTS dbos.atomic_owner_generation (
+ root text PRIMARY KEY, owner text, generation bigint,
+ terminal boolean NOT NULL DEFAULT false, claim text, claimant text, protocol integer NOT NULL DEFAULT 1 CHECK(protocol = 1)
+);
+CREATE TABLE IF NOT EXISTS dbos.atomic_guard_rows (workflow_uuid text PRIMARY KEY, root text NOT NULL);
+CREATE OR REPLACE FUNCTION dbos.atomic_metadata(value text) RETURNS jsonb
+LANGUAGE plpgsql IMMUTABLE SET search_path = pg_catalog AS $$
+DECLARE decoded jsonb;
+BEGIN
+ IF value IS NULL THEN RETURN NULL; END IF;
+ BEGIN decoded := value::jsonb; EXCEPTION WHEN invalid_text_representation THEN RETURN NULL; END;
+ IF decoded->>'__dbos_serializer' = 'superjson' THEN decoded := decoded->'json'; END IF;
+ IF decoded->>'__atomicDurableMetadata' IS DISTINCT FROM 'true' OR decoded->>'version' IS DISTINCT FROM '3' THEN RETURN NULL; END IF;
+ RETURN decoded->'metadata';
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_guard_row() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE
+ row_value jsonb; id text; root_id text; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE;
+ meta jsonb; prior jsonb; prior_generation bigint; next_generation bigint; absorbing boolean;
+ allowed boolean; cap_owner text; cap_generation bigint; claim_token text;
+BEGIN
+ row_value := CASE WHEN TG_OP = 'DELETE' THEN to_jsonb(OLD) ELSE to_jsonb(NEW) END;
+ id := row_value->>'workflow_uuid';
+ root_id := split_part(id, ':checkpoint:', 1);
+ IF TG_OP = 'UPDATE' AND to_jsonb(OLD)->>'workflow_uuid' IS DISTINCT FROM id AND (
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid') OR
+  (TG_TABLE_NAME = 'workflow_status' AND to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')) OR
+  (TG_TABLE_NAME = 'operation_outputs' AND EXISTS(SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid' AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')))
+ ) THEN
+  IF NULLIF(current_setting('atomic.row_authority',true),'') IS NULL OR current_setting('atomic.row_authority',true) = 'null' THEN RETURN NULL; END IF;
+  RAISE EXCEPTION 'Atomic workflow identities are immutable';
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND NOT (
+  COALESCE(row_value->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  COALESCE(to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id)
+ ) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ IF TG_TABLE_NAME = 'operation_outputs' AND NOT EXISTS (
+  SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = id AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')
+ ) AND NOT EXISTS (SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ INSERT INTO dbos.atomic_guard_rows VALUES(id, root_id) ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_guard_rows SELECT workflow_uuid, root_id FROM dbos.workflow_status
+  WHERE workflow_uuid = root_id AND name = 'atomicWorkflowHandle' ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_owner_generation(root) VALUES(root_id)
+  ON CONFLICT(root) DO UPDATE SET root = EXCLUDED.root RETURNING * INTO state;
+ IF state.owner IS NULL THEN
+  IF TG_TABLE_NAME <> 'workflow_status' OR TG_OP = 'DELETE' OR row_value->>'status' <> 'SUCCESS'
+   OR id NOT LIKE root_id || ':checkpoint:__atomic_metadata:%'
+   OR authority->>'root' IS DISTINCT FROM root_id OR authority->>'enroll' IS DISTINCT FROM 'true' THEN
+   IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+  END IF;
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id THEN
+   RAISE EXCEPTION 'Atomic metadata encoding is unavailable for enrollment';
+  END IF;
+  SELECT candidate.metadata, candidate.generation INTO prior, prior_generation FROM (
+   SELECT dbos.atomic_metadata(output) AS metadata,
+    split_part(substring(workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint AS generation
+   FROM dbos.workflow_status
+   WHERE workflow_uuid LIKE root_id || ':checkpoint:__atomic_metadata:%' AND status = 'SUCCESS'
+  ) candidate WHERE candidate.metadata IS NOT NULL
+  ORDER BY COALESCE(candidate.metadata->>'status' IN ('completed', 'cancelled') OR
+   (candidate.metadata->>'status' IN ('failed','blocked') AND candidate.metadata->>'resumable' = 'false'), false) DESC,
+   candidate.generation DESC LIMIT 1;
+  IF prior_generation IS DISTINCT FROM (authority->>'generation')::bigint
+   OR prior->>'ownerExecutorId' IS DISTINCT FROM authority->>'owner' THEN
+   RAISE EXCEPTION 'Atomic ownership generation changed before enrollment';
+  END IF;
+ ELSE
+  IF authority->>'root' IS DISTINCT FROM root_id THEN RETURN NULL; END IF;
+  cap_owner := authority->>'owner'; cap_generation := (authority->>'generation')::bigint;
+  allowed := cap_owner = state.owner AND cap_generation = state.generation AND (
+   authority->>'actor' = state.owner OR
+   (authority->>'claim' = state.claim AND authority->>'actor' = state.claimant) OR
+   (authority->>'claim' IS NOT NULL AND authority->>'checkpoint' = id));
+  IF NOT COALESCE(allowed, false) THEN RAISE EXCEPTION 'Atomic ownership generation changed; stale database writes are refused'; END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP = 'UPDATE' THEN
+  IF OLD.status = 'SUCCESS' AND OLD.name = 'atomicWorkflowCheckpoint' THEN
+   IF NEW.output IS DISTINCT FROM OLD.output OR NEW.status <> 'SUCCESS' THEN RAISE EXCEPTION 'Completed Atomic checkpoints are immutable'; END IF;
+   RETURN NEW;
+  END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP <> 'DELETE' AND row_value->>'status' = 'SUCCESS'
+  AND id LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN RAISE EXCEPTION 'Atomic metadata encoding or owner is unavailable'; END IF;
+  next_generation := split_part(substring(id FROM length(root_id) + 13), ':', 2)::bigint;
+  absorbing := COALESCE(meta->>'status' IN ('completed', 'cancelled') OR
+   (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+  claim_token := meta->>'transitionClaimId';
+  IF state.root IS NOT NULL AND (next_generation < state.generation OR (state.terminal AND NOT absorbing)) THEN
+   RAISE EXCEPTION 'Atomic terminal or newer generation cannot be overwritten';
+  END IF;
+  IF state.owner IS NOT NULL AND authority->>'actor' <> state.owner THEN
+   IF id NOT LIKE '%:claim' OR next_generation <> state.generation + 1 OR claim_token IS DISTINCT FROM authority->>'claim' OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN
+    RAISE EXCEPTION 'Atomic ownership transfer requires an exact generation claim';
+   END IF;
+  END IF;
+ END IF;
+ IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_project_metadata() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE root_id text; meta jsonb; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE; projected_generation bigint; absorbing boolean;
+BEGIN
+ IF NEW.name <> 'atomicWorkflowCheckpoint' OR NEW.status <> 'SUCCESS' THEN RETURN NEW; END IF;
+ root_id := split_part(NEW.workflow_uuid, ':checkpoint:', 1);
+ IF NEW.workflow_uuid NOT LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN RETURN NEW; END IF;
+ IF TG_OP = 'UPDATE' THEN IF OLD.status = 'SUCCESS' THEN RETURN NEW; END IF; END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ SELECT * INTO state FROM dbos.atomic_owner_generation WHERE root = root_id FOR UPDATE;
+ IF state.owner IS NULL AND authority->>'enroll' IS DISTINCT FROM 'true' THEN RETURN NEW; END IF;
+ meta := dbos.atomic_metadata(NEW.output);
+ projected_generation := split_part(substring(NEW.workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint;
+ absorbing := COALESCE(meta->>'status' IN ('completed','cancelled') OR (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+ UPDATE dbos.atomic_owner_generation SET owner = meta->>'ownerExecutorId', generation = projected_generation,
+  terminal = absorbing, claim = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN meta->>'transitionClaimId' END,
+  claimant = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN authority->>'actor' END WHERE root = root_id;
+ RETURN NEW;
+END $$;
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.operation_outputs'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.operation_outputs
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection') THEN
+  CREATE TRIGGER atomic_generation_projection AFTER INSERT OR UPDATE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_project_metadata();
+ END IF;
+END $$;
+`;
+var fingerprint = createHash("sha256").update(guardSql).digest("hex");
 
-// dist/builtin/workflows/src/durable/dbos-sdk-handle.ts
-var ATOMIC_EXECUTOR_ID = `atomic-${process.pid.toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+// dist/builtin/workflows/src/durable/dbos-owner-fence.ts
+var contextKey = Symbol.for("atomic-workflows/dbos-owner-write-context@1");
+var contextBag = globalThis;
+contextBag[contextKey] ??= new AsyncLocalStorage2;
+var writeContext = contextBag[contextKey];
+var rowContextKey = Symbol.for("atomic-workflows/dbos-row-authority@1");
+var rowContextBag = globalThis;
+rowContextBag[rowContextKey] ??= new AsyncLocalStorage2;
+var rowContext = rowContextBag[rowContextKey];
 
 // dist/builtin/workflows/src/durable/dbos-system-database-url.ts
 function nonEmptyTrimmed(value) {
@@ -5319,7 +5556,7 @@ import { tmpdir, uptime } from "node:os";
 import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute3, join as join4, relative as relative2, sep as sep2 } from "node:path";
 
 // dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import {
   chmod,
   chown,
@@ -5802,8 +6039,8 @@ async function snapshotSourceRuntime(root, publisher, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const sourceHash = createHash("sha256");
-  const sealedHash = createHash("sha256");
+  const sourceHash = createHash2("sha256");
+  const sealedHash = createHash2("sha256");
   await hashSourceEntry(sourceHash, sealedHash, root, ".", rootRealPath, publisher, progress);
   return { sourceIdentity: sourceHash.digest("hex"), sealedIdentity: sealedHash.digest("hex") };
 }
@@ -6068,7 +6305,7 @@ async function snapshotSealedManifest(root, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   const entries = [];
   await hashSealedEntry(hash, root, ".", rootRealPath, progress, entries);
   return { version: 1, sealedIdentity: hash.digest("hex"), entries };
@@ -6301,6 +6538,13 @@ function resolveEmbeddedPostgresTarget(host) {
 // dist/builtin/workflows/src/durable/dbos-postgres-health.ts
 var HEALTH_INTERVAL_MS = 5000;
 var RECOVERY_ATTEMPTS = 3;
+function isMonitoringConnectionTimeout(error) {
+  if (!(error instanceof Error))
+    return false;
+  if ("code" in error)
+    return error.code === "ETIMEDOUT";
+  return error.message === "timeout expired" || error.message === "Connection terminated due to connection timeout";
+}
 function isMonitoringConnectionFailure(error) {
   if (!(error instanceof Error))
     return false;
@@ -6321,6 +6565,7 @@ class PostgresHealth {
   attempts = 0;
   nextRecoveryAt = 0;
   failure;
+  healthySinceFailure = false;
   revision = 0;
   listeners = new Set;
   constructor(operations) {
@@ -6329,6 +6574,18 @@ class PostgresHealth {
   get lastFailure() {
     return this.failure;
   }
+  get endpoint() {
+    return this.operations.url?.();
+  }
+  retainFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const safe = redactedDatabaseMessage(message, this.endpoint);
+    this.failure = new Error(safe);
+    this.healthySinceFailure = false;
+  }
+  dependencyFailure(message) {
+    return new DbosDependencyError(message, this.endpoint === undefined ? undefined : { provider: "managed", url: this.endpoint, failure: this.failure?.message });
+  }
   subscribe(listener) {
     this.listeners.add(listener);
     return () => this.listeners.delete(listener);
@@ -6351,12 +6608,15 @@ class PostgresHealth {
         await this.operations.validate?.(client);
       }
     } catch (error) {
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!isQueryReadTimeout(error)) {
         this.invalidate();
-        throw error;
+        if (this.endpoint === undefined)
+          throw error;
+        const failure = this.dependencyFailure("Managed PostgreSQL connection validation refused. Preserve its data and ownership records.");
+        throw error instanceof DbosDependencyError ? failure : new Error(failure.message);
       }
-      throw new DbosDependencyError("Managed PostgreSQL did not answer a connection identity check in time.");
+      throw this.dependencyFailure("Managed PostgreSQL did not answer a connection identity check in time.");
     }
   }
   check() {
@@ -6395,9 +6655,9 @@ class PostgresHealth {
       try {
         identity = await this.operations.probe();
       } catch (retryError) {
-        if (!isMonitoringConnectionFailure(retryError))
+        if (isMonitoringConnectionTimeout(retryError) || !isMonitoringConnectionFailure(retryError))
           throw retryError;
-        this.failure = retryError;
+        this.retainFailure(retryError);
         return;
       }
     }
@@ -6412,6 +6672,7 @@ class PostgresHealth {
     this.available = identity;
     this.attempts = 0;
     this.nextRecoveryAt = 0;
+    this.healthySinceFailure = true;
     return identity.url;
   }
   async refresh() {
@@ -6420,20 +6681,22 @@ class PostgresHealth {
       if (ready !== undefined)
         return ready;
     } catch (error) {
-      if (isQueryReadTimeout(error)) {
-        this.failure = new DbosDependencyError("Managed PostgreSQL did not answer a health check in time.");
-        throw this.failure;
+      if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error)) {
+        this.retainFailure(new Error("Managed PostgreSQL did not answer a health check in time."));
+        throw this.dependencyFailure("Managed PostgreSQL did not answer a health check in time.");
       }
-      this.failure = error instanceof Error ? error : new Error(String(error));
+      this.retainFailure(error);
       if (!(error instanceof Error && ("code" in error) && error.code === "53300"))
         this.invalidate();
-      throw error;
+      throw this.endpoint === undefined ? error : this.dependencyFailure("Managed PostgreSQL recovery refused after a health probe failure. Preserve its data and ownership records.");
+    }
+    if (this.attempts === 0 && (this.failure === undefined || this.healthySinceFailure)) {
+      this.retainFailure(new Error("Managed PostgreSQL failed its live health check."));
+      this.healthySinceFailure = false;
     }
-    if (this.attempts === 0)
-      this.failure = new DbosDependencyError("Managed PostgreSQL failed its live health check.");
     this.invalidate();
     if ((this.operations.now ?? Date.now)() < this.nextRecoveryAt)
-      throw new DbosDependencyError("Managed Postgres recovery is cooling down after bounded attempts.");
+      throw this.dependencyFailure("Managed Postgres recovery is cooling down after bounded attempts.");
     while (!this.stopped && this.attempts < RECOVERY_ATTEMPTS) {
       const attempt = this.attempts++;
       if (attempt > 0)
@@ -6446,12 +6709,12 @@ class PostgresHealth {
         if (ready !== undefined)
           return ready;
       } catch (error) {
-        this.failure = error instanceof Error ? error : new Error(String(error));
+        this.retainFailure(error);
       }
     }
     this.attempts = 0;
     this.nextRecoveryAt = (this.operations.now ?? Date.now)() + HEALTH_INTERVAL_MS;
-    throw new DbosDependencyError("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
+    throw this.dependencyFailure("Managed Postgres is unavailable after bounded recovery. Preserve its data and ownership records.");
   }
 }
 
@@ -6725,7 +6988,7 @@ async function probePostgresIdentity(port) {
     const result = await client.query(POSTGRES_IDENTITY_SQL);
     return result.rows[0];
   } catch (error) {
-    if (isQueryReadTimeout(error))
+    if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
       throw error;
     const code = error instanceof Error && "code" in error ? error.code : undefined;
     if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "57P01" || code === "57P02" || code === "57P03" || error instanceof Error && /timeout|timed out|connection terminated/i.test(error.message))
@@ -6898,7 +7161,7 @@ async function ensureCluster(options = {}) {
         try {
           return await existingServerProbe()(probePort);
         } catch (error) {
-          if (isQueryReadTimeout(error))
+          if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
             return;
           throw error;
         }
@@ -7106,6 +7369,8 @@ async function ensureCluster(options = {}) {
           const server = current.server;
           if (!server)
             throw new Error("Managed Postgres published identity is missing.");
+          if (managedPostmaster(current) === undefined)
+            return;
           if (!managedPostgresRuntimeHealthy(current, server.port)) {
             verifyManagedPostmasterProcess(current, server);
             return;
@@ -7122,6 +7387,7 @@ async function ensureCluster(options = {}) {
         };
         health = new PostgresHealth({
           probe: () => inspect(),
+          url: embeddedDbosSystemDatabaseUrl,
           validate: async (client) => {
             const identity = await inspect(async () => {
               const query = { text: POSTGRES_IDENTITY_SQL, query_timeout: POSTGRES_HEALTH_QUERY_TIMEOUT_MS };

package/dist/builtin/workflows/builtin/{chunk-n95myjcg.js → chunk-gts8wgjr.js}

@@ -39,7 +39,7 @@ import {
   reviewerFailureText,
   summarizeReviewConvergence,
   reverify_consolidated_batch
-} from "./chunk-73p2cm5s.js";
+} from "./chunk-9bhs02gm.js";
 import {
   fold_usage
 } from "./chunk-tgt0s5e5.js";

package/dist/builtin/workflows/builtin/{chunk-ycvg8y8k.js → chunk-gw7rghda.js}

@@ -38,7 +38,7 @@ import {
   reviewerFailureText,
   summarizeReviewConvergence,
   reverify_consolidated_batch
-} from "./chunk-73p2cm5s.js";
+} from "./chunk-9bhs02gm.js";
 import {
   VERIFICATION_SCALE
 } from "./chunk-n1910xc4.js";