@bastani/atomic 0.9.32-alpha.1 → 0.9.33-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [0.9.33-alpha.1] - 2026-10-10
+
+### Fixed
+
+- Fixed workflows falling back to a non-durable in-memory backend after a macOS reboot because the managed PostgreSQL cluster was refused with `Managed Postgres cluster identity mismatch` when only the data volume's device number changed. The cluster now attaches and its ownership record is updated when the data directory inode, path, cluster ID, major version, and PostgreSQL system identifier still match; genuine identity mismatches name the fields that differ ([#3555](https://github.com/bastani-inc/atomic/issues/3555)).
+- Fixed terminal program status (OSC 7501) ignoring workflow runs: it now reports `working` while a workflow run executes, `blocked` while a run or stage waits for your input, `error` when a run fails (held until your next message, even after the run-end notice turn settles), and `done` once the agent and all runs finish ([#3556](https://github.com/bastani-inc/atomic/issues/3556)).
+
+## [0.9.32] - 2026-10-10
+
+### Fixed
+
+- Fixed workflow stages in SDK-hosted sessions losing extensions supplied through `additionalExtensionPaths` and `extensionFactories`, and using the host process directory instead of the owning session's working directory when no stage `cwd` is set. Stage reports use that same resolved directory ([#3551](https://github.com/bastani-inc/atomic/issues/3551)).
+
 ## [0.9.32-alpha.1] - 2026-10-10
 
 ### Fixed

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.32-alpha.1",
+  "version": "0.9.33-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.32-alpha.1",
+  "version": "0.9.33-alpha.1",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.32-alpha.1",
+  "version": "0.9.33-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.32-alpha.1",
+  "version": "0.9.33-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.33-alpha.1] - 2026-10-10
+
+### Fixed
+
+- Fixed the managed PostgreSQL cluster being refused with `Managed Postgres cluster identity mismatch` after a macOS reboot changed the data volume's device number. Atomic now attaches the cluster and updates its ownership record when the data directory inode, path, cluster ID, major version, and PostgreSQL system identifier still match, and genuine identity mismatches name the fields that differ ([#3555](https://github.com/bastani-inc/atomic/issues/3555)).
+
+## [0.9.32] - 2026-10-10
+
+### Fixed
+
+- Fixed stages without an explicit `cwd` running in the host process directory instead of the workflow invocation directory in SDK-hosted sessions. Stage reports now use the same resolved directory as their sessions, including adapter and session-manager overrides ([#3551](https://github.com/bastani-inc/atomic/issues/3551)).
+
 ## [0.9.32-alpha.1] - 2026-10-10
 
 ### Fixed

package/dist/builtin/workflows/builtin/{chunk-bnz4knhy.js → chunk-0d0pd4fz.js}

@@ -1,7 +1,7 @@
 import {
   getDurableBackend2,
   getAvailableDurableBackend2
-} from "./chunk-v4scsq3y.js";
+} from "./chunk-119gt64q.js";
 export {
   getAvailableDurableBackend2 as getAvailableDurableBackend,
   getDurableBackend2 as getDurableBackend

package/dist/builtin/workflows/builtin/{chunk-v4scsq3y.js → chunk-119gt64q.js}

@@ -6753,7 +6753,6 @@ class PostgresHealth {
 import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { createServer } from "node:net";
-import { endianness } from "node:os";
 import { dirname as dirname2, isAbsolute as isAbsolute2, join as join3 } from "node:path";
 
 // dist/builtin/workflows/src/durable/dbos-postgres-ownership.ts
@@ -6768,6 +6767,7 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
+import { endianness } from "node:os";
 import { join as join2 } from "node:path";
 function trustedPath(path, directory = false) {
   const stat = lstatSync(path);
@@ -6778,6 +6778,24 @@ function trustedPath(path, directory = false) {
 function postgresOwnershipDirectory(baseDir, major) {
   return join2(baseDir, `v${major}.shared`);
 }
+function controlFileSystemIdentifier(dataDir) {
+  const controlPath = join2(dataDir, "global", "pg_control");
+  if (!lstatSync(controlPath).isFile())
+    throw new Error("Untrusted managed Postgres control file.");
+  const control = readFileSync(controlPath);
+  return (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+}
+var directoryInode = (identity) => /^\d+:(\d+)$/.exec(identity)?.[1];
+function managedPostgresIdentityMismatches(expected, current, compareSystemIdentifier = true) {
+  const inode = directoryInode(expected.directoryIdentity);
+  return [
+    current.clusterId !== expected.clusterId && "clusterId",
+    current.dataDir !== expected.dataDir && "dataDir",
+    (inode === undefined || inode !== directoryInode(current.directoryIdentity)) && "inode",
+    current.major !== expected.major && "major",
+    compareSystemIdentifier && current.server?.systemIdentifier !== expected.server?.systemIdentifier && "systemIdentifier"
+  ].filter((field) => field !== false);
+}
 function managedPostgresMetadata(baseDir, major, create) {
   if (!lstatSync(join2(baseDir, `v${major}`)).isDirectory()) {
     throw new Error("Managed Postgres data must be a real directory, not a link.");
@@ -6811,10 +6829,30 @@ function managedPostgresMetadata(baseDir, major, create) {
   }
   trustedPath(path);
   const record = JSON.parse(readFileSync(path, "utf8"));
-  if (record?.version !== 1 || typeof record.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) || record.dataDir !== dataDir || record.directoryIdentity !== directoryIdentity || record.major !== major || record.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier))) {
-    throw new Error(`Managed Postgres cluster identity mismatch: ${path}. Preserve the data and ownership records.`);
+  const mismatches = [
+    ...record?.version !== 1 ? ["version"] : [],
+    ...typeof record?.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) ? ["clusterId"] : [],
+    ...record?.dataDir !== dataDir ? ["dataDir"] : [],
+    ...typeof record?.directoryIdentity !== "string" || directoryInode(record.directoryIdentity) !== String(stat.ino) ? ["inode"] : [],
+    ...record?.major !== major ? ["major"] : [],
+    ...record?.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier)) ? ["server"] : []
+  ];
+  const mismatch = (fields) => new Error(`Managed Postgres cluster identity mismatch (${fields.join(", ")}): ${path}. Preserve the data and ownership records.`);
+  if (record === null || mismatches.length > 0)
+    throw mismatch(mismatches);
+  if (record.directoryIdentity === directoryIdentity)
+    return record;
+  if (record.server && controlSystemIdentifierOrUndefined(dataDir) !== record.server.systemIdentifier) {
+    throw mismatch(["systemIdentifier"]);
+  }
+  return { ...record, directoryIdentity };
+}
+function controlSystemIdentifierOrUndefined(dataDir) {
+  try {
+    return controlFileSystemIdentifier(dataDir);
+  } catch {
+    return;
   }
-  return record;
 }
 function publishPostgresServer(baseDir, metadata, server) {
   const current = managedPostgresMetadata(baseDir, metadata.major, false);
@@ -6965,11 +7003,7 @@ function managedPostmaster(metadata) {
   return { pid, started, port, systemIdentifier };
 }
 function managedSystemIdentifier(metadata) {
-  const controlPath = join3(metadata.dataDir, "global", "pg_control");
-  if (!lstatSync2(controlPath).isFile())
-    throw new Error("Untrusted managed Postgres control file.");
-  const control = readFileSync2(controlPath);
-  const systemIdentifier = (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+  const systemIdentifier = controlFileSystemIdentifier(metadata.dataDir);
   if (metadata.server && metadata.server.systemIdentifier !== systemIdentifier) {
     throw new Error("Managed Postgres system identity mismatch. Preserve the existing data.");
   }
@@ -7179,8 +7213,9 @@ async function ensureCluster(options = {}) {
         adoptedRegistry = postgresOwnershipDirectory(root, EMBEDDED_PG_MAJOR);
       if (options.recovery && !metadata)
         throw new Error("Managed Postgres recovery requires existing ownership records.");
-      if (options.recovery && (metadata?.clusterId !== options.recovery.clusterId || metadata.directoryIdentity !== options.recovery.directoryIdentity || metadata.server?.systemIdentifier !== options.recovery.server?.systemIdentifier)) {
-        throw new Error("Managed Postgres recovery identity changed while waiting for ownership.");
+      const recoveryMismatches = options.recovery && metadata ? managedPostgresIdentityMismatches(options.recovery, metadata) : [];
+      if (recoveryMismatches.length > 0) {
+        throw new Error(`Managed Postgres recovery identity changed (${recoveryMismatches.join(", ")}) while waiting for ownership.`);
       }
       const existing = metadata && managedPostmaster(metadata);
       let port = existing?.port ?? metadata?.server?.port ?? preferredPort;
@@ -7395,8 +7430,9 @@ async function ensureCluster(options = {}) {
         };
         const inspect = async (probe = options.probeIdentity) => {
           const current = managedPostgresMetadata(root, EMBEDDED_PG_MAJOR, false);
-          if (current.clusterId !== pinned.clusterId || current.directoryIdentity !== pinned.directoryIdentity || current.server?.systemIdentifier !== pinned.server.systemIdentifier) {
-            throw new Error("Managed Postgres health identity mismatch. Preserve the data and ownership records.");
+          const mismatches = managedPostgresIdentityMismatches(pinned, current);
+          if (mismatches.length > 0) {
+            throw new Error(`Managed Postgres health identity mismatch (${mismatches.join(", ")}). Preserve the data and ownership records.`);
           }
           const server = current.server;
           if (!server)
@@ -7456,8 +7492,9 @@ async function ensureCluster(options = {}) {
 async function stopBrokenManagedPostmaster(metadata, verified, pgCtl, context, lease, wait = delay, platform = process.platform) {
   const check = () => {
     const current = managedPostgresMetadata(context.baseDir, metadata.major, false);
-    if (current.clusterId !== metadata.clusterId || current.directoryIdentity !== metadata.directoryIdentity) {
-      throw new Error("Managed Postgres restart identity changed. Preserve the server and data directory.");
+    const mismatches = managedPostgresIdentityMismatches(metadata, current, false);
+    if (mismatches.length > 0) {
+      throw new Error(`Managed Postgres restart identity changed (${mismatches.join(", ")}). Preserve the server and data directory.`);
     }
     return { current, process: verifyManagedPostmasterProcess(current, verified) };
   };
@@ -9279,6 +9316,7 @@ function reciprocalWorkflowRootRunId(runById, runId) {
 function workflowActivityNodeKey(runId, nodeId) {
   return `${runId}:${nodeId}`;
 }
+var endedStatuses = new Set(["completed", "cached", "failed", "cancelled"]);
 
 // dist/builtin/workflows/src/shared/workflow-observation-runtime.ts
 class WorkflowObservationRuntime {
@@ -9922,7 +9960,7 @@ function createPendingStageDeliveryStoreMethods(context) {
         const run = context.findRun(input.runId);
         if (run === undefined)
           return;
-        const { getAvailableDurableBackend } = await import("./chunk-bnz4knhy.js");
+        const { getAvailableDurableBackend } = await import("./chunk-0d0pd4fz.js");
         const availableBackend = getAvailableDurableBackend();
         const backend = availableBackend === undefined ? undefined : durableBackendForRun(availableBackend, context.state.runs, input.runId);
         const receipt = await backend?.readSettledPendingStageMessage?.(input.runId, input.message.id);

package/dist/builtin/workflows/builtin/{chunk-9ywkdsa9.js → chunk-s7y3hw0n.js}

@@ -37,7 +37,7 @@ import {
   parseFailureDiagnostics,
   summarizeReviewConvergence,
   reverify_consolidated_batch
-} from "./chunk-v4scsq3y.js";
+} from "./chunk-119gt64q.js";
 import {
   VERIFICATION_SCALE
 } from "./chunk-n1910xc4.js";

package/dist/builtin/workflows/builtin/{chunk-dx5sjaxe.js → chunk-y68758re.js}

@@ -39,7 +39,7 @@ import {
   reviewerFailureText,
   summarizeReviewConvergence,
   reverify_consolidated_batch
-} from "./chunk-v4scsq3y.js";
+} from "./chunk-119gt64q.js";
 import {
   fold_usage
 } from "./chunk-tgt0s5e5.js";

package/dist/builtin/workflows/builtin/goal.js

@@ -1,7 +1,7 @@
 import {
   goal_default
-} from "./chunk-9ywkdsa9.js";
-import"./chunk-v4scsq3y.js";
+} from "./chunk-s7y3hw0n.js";
+import"./chunk-119gt64q.js";
 import"./chunk-2377r57g.js";
 import"./chunk-z0d03ktm.js";
 import"./chunk-n1910xc4.js";

package/dist/builtin/workflows/builtin/index.js

@@ -16,8 +16,8 @@ import {
 } from "./chunk-kb7s3gx2.js";
 import {
   goal_default
-} from "./chunk-9ywkdsa9.js";
-import"./chunk-v4scsq3y.js";
+} from "./chunk-s7y3hw0n.js";
+import"./chunk-119gt64q.js";
 import"./chunk-z0d03ktm.js";
 import {
   open_claude_design_default
@@ -27,7 +27,7 @@ import {
 } from "./chunk-94f8zfz1.js";
 import {
   ralph_default
-} from "./chunk-dx5sjaxe.js";
+} from "./chunk-y68758re.js";
 import {
   tournament_default
 } from "./chunk-wf876n16.js";

package/dist/builtin/workflows/builtin/ralph.js

@@ -1,7 +1,7 @@
 import {
   ralph_default
-} from "./chunk-dx5sjaxe.js";
-import"./chunk-v4scsq3y.js";
+} from "./chunk-y68758re.js";
+import"./chunk-119gt64q.js";
 import"./chunk-2377r57g.js";
 import"./chunk-z0d03ktm.js";
 import"./chunk-n1910xc4.js";

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.32-alpha.1",
+  "version": "0.9.33-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/extension/index.bundle.mjs

@@ -38545,6 +38545,7 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
+import { endianness } from "node:os";
 import { join as join3 } from "node:path";
 function trustedPath(path, directory = false) {
   const stat = lstatSync(path);
@@ -38555,6 +38556,23 @@ function trustedPath(path, directory = false) {
 function postgresOwnershipDirectory(baseDir, major) {
   return join3(baseDir, `v${major}.shared`);
 }
+function controlFileSystemIdentifier(dataDir) {
+  const controlPath = join3(dataDir, "global", "pg_control");
+  if (!lstatSync(controlPath).isFile())
+    throw new Error("Untrusted managed Postgres control file.");
+  const control = readFileSync2(controlPath);
+  return (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+}
+function managedPostgresIdentityMismatches(expected, current, compareSystemIdentifier = true) {
+  const inode = directoryInode(expected.directoryIdentity);
+  return [
+    current.clusterId !== expected.clusterId && "clusterId",
+    current.dataDir !== expected.dataDir && "dataDir",
+    (inode === undefined || inode !== directoryInode(current.directoryIdentity)) && "inode",
+    current.major !== expected.major && "major",
+    compareSystemIdentifier && current.server?.systemIdentifier !== expected.server?.systemIdentifier && "systemIdentifier"
+  ].filter((field) => field !== false);
+}
 function managedPostgresMetadata(baseDir, major, create) {
   if (!lstatSync(join3(baseDir, `v${major}`)).isDirectory()) {
     throw new Error("Managed Postgres data must be a real directory, not a link.");
@@ -38588,10 +38606,30 @@ function managedPostgresMetadata(baseDir, major, create) {
   }
   trustedPath(path);
   const record = JSON.parse(readFileSync2(path, "utf8"));
-  if (record?.version !== 1 || typeof record.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) || record.dataDir !== dataDir || record.directoryIdentity !== directoryIdentity || record.major !== major || record.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier))) {
-    throw new Error(`Managed Postgres cluster identity mismatch: ${path}. Preserve the data and ownership records.`);
+  const mismatches = [
+    ...record?.version !== 1 ? ["version"] : [],
+    ...typeof record?.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) ? ["clusterId"] : [],
+    ...record?.dataDir !== dataDir ? ["dataDir"] : [],
+    ...typeof record?.directoryIdentity !== "string" || directoryInode(record.directoryIdentity) !== String(stat.ino) ? ["inode"] : [],
+    ...record?.major !== major ? ["major"] : [],
+    ...record?.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier)) ? ["server"] : []
+  ];
+  const mismatch = (fields) => new Error(`Managed Postgres cluster identity mismatch (${fields.join(", ")}): ${path}. Preserve the data and ownership records.`);
+  if (record === null || mismatches.length > 0)
+    throw mismatch(mismatches);
+  if (record.directoryIdentity === directoryIdentity)
+    return record;
+  if (record.server && controlSystemIdentifierOrUndefined(dataDir) !== record.server.systemIdentifier) {
+    throw mismatch(["systemIdentifier"]);
+  }
+  return { ...record, directoryIdentity };
+}
+function controlSystemIdentifierOrUndefined(dataDir) {
+  try {
+    return controlFileSystemIdentifier(dataDir);
+  } catch {
+    return;
   }
-  return record;
 }
 function publishPostgresServer(baseDir, metadata, server) {
   const current = managedPostgresMetadata(baseDir, metadata.major, false);
@@ -38664,13 +38702,13 @@ function assertManagedPostmaster(metadata, port) {
     throw new Error("Managed Postgres postmaster identity does not match the shared data directory and port.");
   }
 }
+var directoryInode = (identity) => /^\d+:(\d+)$/.exec(identity)?.[1];
 var init_dbos_postgres_ownership = () => {};
 
 // dist/builtin/workflows/src/durable/dbos-postgres-identity.ts
 import { existsSync as existsSync3, lstatSync as lstatSync2, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { createServer } from "node:net";
-import { endianness } from "node:os";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4 } from "node:path";
 function preferredPostgresPort(value2 = process.env.ATOMIC_POSTGRES_PORT) {
   if (value2 === undefined)
@@ -38748,11 +38786,7 @@ function managedPostmaster(metadata) {
   return { pid, started, port, systemIdentifier };
 }
 function managedSystemIdentifier(metadata) {
-  const controlPath = join4(metadata.dataDir, "global", "pg_control");
-  if (!lstatSync2(controlPath).isFile())
-    throw new Error("Untrusted managed Postgres control file.");
-  const control = readFileSync3(controlPath);
-  const systemIdentifier = (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+  const systemIdentifier = controlFileSystemIdentifier(metadata.dataDir);
   if (metadata.server && metadata.server.systemIdentifier !== systemIdentifier) {
     throw new Error("Managed Postgres system identity mismatch. Preserve the existing data.");
   }
@@ -38963,8 +38997,9 @@ async function ensureCluster(options = {}) {
         adoptedRegistry = postgresOwnershipDirectory(root, EMBEDDED_PG_MAJOR);
       if (options.recovery && !metadata)
         throw new Error("Managed Postgres recovery requires existing ownership records.");
-      if (options.recovery && (metadata?.clusterId !== options.recovery.clusterId || metadata.directoryIdentity !== options.recovery.directoryIdentity || metadata.server?.systemIdentifier !== options.recovery.server?.systemIdentifier)) {
-        throw new Error("Managed Postgres recovery identity changed while waiting for ownership.");
+      const recoveryMismatches = options.recovery && metadata ? managedPostgresIdentityMismatches(options.recovery, metadata) : [];
+      if (recoveryMismatches.length > 0) {
+        throw new Error(`Managed Postgres recovery identity changed (${recoveryMismatches.join(", ")}) while waiting for ownership.`);
       }
       const existing = metadata && managedPostmaster(metadata);
       let port = existing?.port ?? metadata?.server?.port ?? preferredPort;
@@ -39179,8 +39214,9 @@ async function ensureCluster(options = {}) {
         };
         const inspect = async (probe = options.probeIdentity) => {
           const current = managedPostgresMetadata(root, EMBEDDED_PG_MAJOR, false);
-          if (current.clusterId !== pinned.clusterId || current.directoryIdentity !== pinned.directoryIdentity || current.server?.systemIdentifier !== pinned.server.systemIdentifier) {
-            throw new Error("Managed Postgres health identity mismatch. Preserve the data and ownership records.");
+          const mismatches = managedPostgresIdentityMismatches(pinned, current);
+          if (mismatches.length > 0) {
+            throw new Error(`Managed Postgres health identity mismatch (${mismatches.join(", ")}). Preserve the data and ownership records.`);
           }
           const server = current.server;
           if (!server)
@@ -39240,8 +39276,9 @@ async function ensureCluster(options = {}) {
 async function stopBrokenManagedPostmaster(metadata, verified, pgCtl, context, lease, wait = delay, platform = process.platform) {
   const check = () => {
     const current = managedPostgresMetadata(context.baseDir, metadata.major, false);
-    if (current.clusterId !== metadata.clusterId || current.directoryIdentity !== metadata.directoryIdentity) {
-      throw new Error("Managed Postgres restart identity changed. Preserve the server and data directory.");
+    const mismatches = managedPostgresIdentityMismatches(metadata, current, false);
+    if (mismatches.length > 0) {
+      throw new Error(`Managed Postgres restart identity changed (${mismatches.join(", ")}). Preserve the server and data directory.`);
     }
     return { current, process: verifyManagedPostmasterProcess(current, verified) };
   };
@@ -77738,6 +77775,7 @@ function isStoppingRun(run, rootRunId, runs, stoppingRunIds) {
   }
   return stoppingRunIds.has(rootRunId);
 }
+var endedStatuses = new Set(["completed", "cached", "failed", "cancelled"]);
 function projectRoot(rootRunId, runs, runById, ownership) {
   let activeExecutionCount = 0;
   let humanWaits = 0;
@@ -77748,6 +77786,7 @@ function projectRoot(rootRunId, runs, runById, ownership) {
   let paused = false;
   let stoppingExecutionCount = 0;
   let independentContinuation = false;
+  let childContinuation = false;
   for (const run of runs) {
     const runStopping = isStoppingRun(run, rootRunId, runById, ownership.stoppingRunIds);
     let runExecutionCount = (run.toolNodes ?? []).filter((tool) => ownership.executingToolNodeIds.has(workflowActivityNodeKey(run.id, tool.id))).length;
@@ -77762,7 +77801,17 @@ function projectRoot(rootRunId, runs, runById, ownership) {
       else
         manualWaits++;
     }
-    const statuses = new Map([...run.stages, ...run.toolNodes ?? []].map((node) => [node.id, node.status]));
+    const statuses = new Map([...run.stages, ...run.toolNodes ?? []].map((node) => [
+      node.id,
+      endedStatuses.has(node.status) ? "ended" : node.status
+    ]));
+    const live = ownership.liveRunIds?.has(run.id) === true;
+    for (const tool of run.toolNodes ?? []) {
+      if (live && run.status === "running" && !runStopping && tool.status === "pending" && tool.parentIds.every((id) => statuses.get(id) === "ended")) {
+        runnable = true;
+        independentContinuation = true;
+      }
+    }
     for (const stage of run.stages) {
       if (run.status === "running" && stage.status === "paused")
         paused = true;
@@ -77779,20 +77828,29 @@ function projectRoot(rootRunId, runs, runById, ownership) {
         if (!runStopping)
           independentContinuation = true;
       }
-      if (run.status === "running" && !runStopping && stage.status === "pending" && stage.parentIds.every((id) => statuses.get(id) === "completed")) {
+      if (run.status === "running" && !runStopping && stage.status === "pending" && stage.parentIds.every((id) => statuses.get(id) === "ended")) {
         runnable = true;
         independentContinuation = true;
       }
     }
-    if (ownership.liveRunIds?.has(run.id) && run.status === "running" && !runStopping && !run.pendingPrompt && run.blockedAt === undefined && run.failureDisposition !== "active_blocked" && run.stages.every((stage) => !stage.pendingPrompt && (stage.status === "completed" || stage.status === "skipped")) && (run.toolNodes ?? []).every((tool) => tool.status === "completed")) {
-      runnable = true;
-      independentContinuation = true;
+    const childBoundary = (stage) => stage.status === "running" && stage.workflowChildRun !== undefined;
+    if (live && run.status === "running" && !runStopping && !run.pendingPrompt && run.blockedAt === undefined && run.failureDisposition !== "active_blocked" && run.stages.every((stage) => !stage.pendingPrompt && (stage.status === "completed" || stage.status === "failed" || stage.status === "skipped" || childBoundary(stage))) && (run.toolNodes ?? []).every((tool) => endedStatuses.has(tool.status))) {
+      if (run.stages.some(childBoundary))
+        childContinuation = true;
+      else {
+        runnable = true;
+        independentContinuation = true;
+      }
     }
     activeExecutionCount += runExecutionCount;
     if (runStopping)
       stoppingExecutionCount += runExecutionCount;
   }
   const actionableBlockCount = humanWaits + manualWaits;
+  if (childContinuation && actionableBlockCount === 0 && !paused) {
+    runnable = true;
+    independentContinuation = true;
+  }
   let state = "idle";
   let reason = paused ? "paused" : "quiescent";
   if (activeExecutionCount > 0 || retrying || runnable) {

package/dist/builtin/workflows/src/index.js

@@ -37030,6 +37030,7 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
+import { endianness } from "node:os";
 import { join as join2 } from "node:path";
 function trustedPath(path, directory = false) {
   const stat = lstatSync(path);
@@ -37040,6 +37041,23 @@ function trustedPath(path, directory = false) {
 function postgresOwnershipDirectory(baseDir, major) {
   return join2(baseDir, `v${major}.shared`);
 }
+function controlFileSystemIdentifier(dataDir) {
+  const controlPath = join2(dataDir, "global", "pg_control");
+  if (!lstatSync(controlPath).isFile())
+    throw new Error("Untrusted managed Postgres control file.");
+  const control = readFileSync(controlPath);
+  return (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+}
+function managedPostgresIdentityMismatches(expected, current, compareSystemIdentifier = true) {
+  const inode = directoryInode(expected.directoryIdentity);
+  return [
+    current.clusterId !== expected.clusterId && "clusterId",
+    current.dataDir !== expected.dataDir && "dataDir",
+    (inode === undefined || inode !== directoryInode(current.directoryIdentity)) && "inode",
+    current.major !== expected.major && "major",
+    compareSystemIdentifier && current.server?.systemIdentifier !== expected.server?.systemIdentifier && "systemIdentifier"
+  ].filter((field) => field !== false);
+}
 function managedPostgresMetadata(baseDir, major, create) {
   if (!lstatSync(join2(baseDir, `v${major}`)).isDirectory()) {
     throw new Error("Managed Postgres data must be a real directory, not a link.");
@@ -37073,10 +37091,30 @@ function managedPostgresMetadata(baseDir, major, create) {
   }
   trustedPath(path);
   const record = JSON.parse(readFileSync(path, "utf8"));
-  if (record?.version !== 1 || typeof record.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) || record.dataDir !== dataDir || record.directoryIdentity !== directoryIdentity || record.major !== major || record.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier))) {
-    throw new Error(`Managed Postgres cluster identity mismatch: ${path}. Preserve the data and ownership records.`);
+  const mismatches = [
+    ...record?.version !== 1 ? ["version"] : [],
+    ...typeof record?.clusterId !== "string" || !/^[0-9a-f-]{36}$/.test(record.clusterId) ? ["clusterId"] : [],
+    ...record?.dataDir !== dataDir ? ["dataDir"] : [],
+    ...typeof record?.directoryIdentity !== "string" || directoryInode(record.directoryIdentity) !== String(stat.ino) ? ["inode"] : [],
+    ...record?.major !== major ? ["major"] : [],
+    ...record?.server !== undefined && (!Number.isInteger(record.server?.port) || record.server.port < 1 || record.server.port > 65535 || !Number.isSafeInteger(record.server.pid) || record.server.pid <= 0 || !Number.isSafeInteger(record.server.started) || record.server.started <= 0 || !/^\d+$/.test(record.server.systemIdentifier)) ? ["server"] : []
+  ];
+  const mismatch = (fields) => new Error(`Managed Postgres cluster identity mismatch (${fields.join(", ")}): ${path}. Preserve the data and ownership records.`);
+  if (record === null || mismatches.length > 0)
+    throw mismatch(mismatches);
+  if (record.directoryIdentity === directoryIdentity)
+    return record;
+  if (record.server && controlSystemIdentifierOrUndefined(dataDir) !== record.server.systemIdentifier) {
+    throw mismatch(["systemIdentifier"]);
+  }
+  return { ...record, directoryIdentity };
+}
+function controlSystemIdentifierOrUndefined(dataDir) {
+  try {
+    return controlFileSystemIdentifier(dataDir);
+  } catch {
+    return;
   }
-  return record;
 }
 function publishPostgresServer(baseDir, metadata, server) {
   const current = managedPostgresMetadata(baseDir, metadata.major, false);
@@ -37149,13 +37187,13 @@ function assertManagedPostmaster(metadata, port) {
     throw new Error("Managed Postgres postmaster identity does not match the shared data directory and port.");
   }
 }
+var directoryInode = (identity) => /^\d+:(\d+)$/.exec(identity)?.[1];
 var init_dbos_postgres_ownership = () => {};
 
 // dist/builtin/workflows/src/durable/dbos-postgres-identity.ts
 import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { createServer } from "node:net";
-import { endianness } from "node:os";
 import { dirname as dirname2, isAbsolute as isAbsolute2, join as join3 } from "node:path";
 function preferredPostgresPort(value = process.env.ATOMIC_POSTGRES_PORT) {
   if (value === undefined)
@@ -37233,11 +37271,7 @@ function managedPostmaster(metadata) {
   return { pid, started, port, systemIdentifier };
 }
 function managedSystemIdentifier(metadata) {
-  const controlPath = join3(metadata.dataDir, "global", "pg_control");
-  if (!lstatSync2(controlPath).isFile())
-    throw new Error("Untrusted managed Postgres control file.");
-  const control = readFileSync2(controlPath);
-  const systemIdentifier = (endianness() === "LE" ? control.readBigUInt64LE(0) : control.readBigUInt64BE(0)).toString();
+  const systemIdentifier = controlFileSystemIdentifier(metadata.dataDir);
   if (metadata.server && metadata.server.systemIdentifier !== systemIdentifier) {
     throw new Error("Managed Postgres system identity mismatch. Preserve the existing data.");
   }
@@ -37448,8 +37482,9 @@ async function ensureCluster(options = {}) {
         adoptedRegistry = postgresOwnershipDirectory(root, EMBEDDED_PG_MAJOR);
       if (options.recovery && !metadata)
         throw new Error("Managed Postgres recovery requires existing ownership records.");
-      if (options.recovery && (metadata?.clusterId !== options.recovery.clusterId || metadata.directoryIdentity !== options.recovery.directoryIdentity || metadata.server?.systemIdentifier !== options.recovery.server?.systemIdentifier)) {
-        throw new Error("Managed Postgres recovery identity changed while waiting for ownership.");
+      const recoveryMismatches = options.recovery && metadata ? managedPostgresIdentityMismatches(options.recovery, metadata) : [];
+      if (recoveryMismatches.length > 0) {
+        throw new Error(`Managed Postgres recovery identity changed (${recoveryMismatches.join(", ")}) while waiting for ownership.`);
       }
       const existing = metadata && managedPostmaster(metadata);
       let port = existing?.port ?? metadata?.server?.port ?? preferredPort;
@@ -37664,8 +37699,9 @@ async function ensureCluster(options = {}) {
         };
         const inspect = async (probe = options.probeIdentity) => {
           const current = managedPostgresMetadata(root, EMBEDDED_PG_MAJOR, false);
-          if (current.clusterId !== pinned.clusterId || current.directoryIdentity !== pinned.directoryIdentity || current.server?.systemIdentifier !== pinned.server.systemIdentifier) {
-            throw new Error("Managed Postgres health identity mismatch. Preserve the data and ownership records.");
+          const mismatches = managedPostgresIdentityMismatches(pinned, current);
+          if (mismatches.length > 0) {
+            throw new Error(`Managed Postgres health identity mismatch (${mismatches.join(", ")}). Preserve the data and ownership records.`);
           }
           const server = current.server;
           if (!server)
@@ -37725,8 +37761,9 @@ async function ensureCluster(options = {}) {
 async function stopBrokenManagedPostmaster(metadata, verified, pgCtl, context, lease, wait = delay, platform = process.platform) {
   const check = () => {
     const current = managedPostgresMetadata(context.baseDir, metadata.major, false);
-    if (current.clusterId !== metadata.clusterId || current.directoryIdentity !== metadata.directoryIdentity) {
-      throw new Error("Managed Postgres restart identity changed. Preserve the server and data directory.");
+    const mismatches = managedPostgresIdentityMismatches(metadata, current, false);
+    if (mismatches.length > 0) {
+      throw new Error(`Managed Postgres restart identity changed (${mismatches.join(", ")}). Preserve the server and data directory.`);
     }
     return { current, process: verifyManagedPostmasterProcess(current, verified) };
   };
@@ -40069,6 +40106,7 @@ function reciprocalWorkflowRootRunId(runById, runId) {
 function workflowActivityNodeKey(runId, nodeId) {
   return `${runId}:${nodeId}`;
 }
+var endedStatuses = new Set(["completed", "cached", "failed", "cancelled"]);
 
 // dist/builtin/workflows/src/shared/workflow-observation-runtime.ts
 class WorkflowObservationRuntime {