@bastani/atomic 0.9.46-alpha.1 → 0.9.46

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 ## [Unreleased]
 
+## [0.9.46] - 2026-10-27
+
+Stages on local workers can now be watched, steered, paused and answered live; large pooled workflows stay responsive and recover cleanly from rate limits, worker crashes and resumes; and GPT-6.1 Terra is available.
+
+- **Live chat for pooled stages:** opening a running stage on a local worker shows its live transcript. Enter steers, Ctrl+F queues a follow-up, `/workflow pause <run> <stage>` pauses just that stage, and `ctx.ui` and `ask_user_question` prompts are answered from the stage chat. When a worker dies, the chat reconnects to its replacement, a pending prompt is asked again, and every pending message is delivered exactly once.
+- **Responsive at scale:** a 150-worker fan-out no longer stalls the root while children start or finish, even with the graph and a stage chat open. One child that keeps losing its worker now fails alone instead of taking its siblings with it.
+- **Rate limits handled the way providers ask:** `Retry-After` is honored on every provider path, including Google and Bedrock. A quota-exhausted model moves straight to the next fallback, a chain where every model is throttled waits for the earliest cooldown, and a limit one local worker meets now holds back the other workers and the root too.
+- **Failures classified by what happened:** a child workflow's failure no longer depends on its name, and SDK callers get the classification in `RunResult.failure`.
+- **Pools that survive crashes and resumes:** resuming a quit root no longer fails in-flight children, journal writers are served in order instead of timing out, and workflow runs survive a deleted `jiti` cache.
+- **New models:** GPT-6.1 Terra on OpenAI, Azure and Codex, with a Fast tier on the OpenAI API, and correct reasoning-effort levels for GPT-6 models on Bedrock.
+- **Hardening from upstream pi:** OAuth logins accept only trusted URLs, terminal titles and the login dialog strip control characters, and the CLI auth file is written with mode 0600.
+
+### Added
+
+- GPT-6.1 Terra is available as `openai/gpt-6.1-terra`, `openai-codex/gpt-6.1-terra` and `azure/gpt-6.1-terra`, with a derived `openai/gpt-6.1-terra-fast` choice. It supports `off` through `max` (not `minimal`), and `openai-codex/gpt-6.1-terra` has a 500K context window ([pi 363ad78b](https://github.com/earendil-works/pi/commit/363ad78bf0625e1dfbe848429782f5e07bb1584e))
+- `@bastani/atomic` exports `observeProviderRateLimits()`, `providerRateLimitObservations()` and `applyProviderRateLimitObservation()` with the `ProviderRateLimitObservation` type, so another process on the same host can apply the provider and model cooldowns and quota-exhausted marks this process recorded. An applied limit only ever extends the matching provider or model limit and counts no failure ([#4023](https://github.com/bastani-inc/atomic/issues/4023))
+- `ctx.ui.custom()` accepts `blocked: { kind, message }` so an inline component that waits for an answer reports Atomic as blocked through OSC 7501 program status while it is visible, including in the default isolated mode. `kind` is `"question"`, `"permission"` or `"auth"`; overlays ignore the option ([pi #11428](https://github.com/earendil-works/pi/issues/11428))
+
+### Changed
+
+- The `openai` and `openai-api` providers default to `gpt-6.1-sol` instead of `gpt-5.5`, matching `openai-codex` ([pi #11467](https://github.com/earendil-works/pi/pull/11467))
+
+### Fixed
+
+- The `Full output:` path of a truncated shell result, both a foreground command and a `wait` on a background task, now sits on its own line and links to the file. Before, it followed its label on the same line, so word wrap could split a path containing spaces (such as `C:\Users\Jane Doe\AppData\Local\Temp\…`) partway through and the copied path no longer worked. A path wider than the terminal still wraps, but its link still opens the whole file ([#3828](https://github.com/bastani-inc/atomic/issues/3828))
+- A workflow child run whose stage had launched a background subagent no longer fails with `This extension ctx is stale after session replacement or reload` after the stage's model fallback replaces its session. The subagent's auto-routed model check, which the child also uses to pick its next fallback model, no longer reads the replaced session. The child now moves on to its next fallback model, and the run keeps the stage's real error, such as a rate limit. A subagent that waited for a free slot and starts after the replacement no longer fails to launch: it takes its settings from the replacement session, or from the launching session's last state when that session closed with no replacement ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- When the model that picks `auto` models (the router) answers with an HTTP 429 or an exhausted quota (402), the routing error now keeps that status, a rate-limit or quota code and the server's `Retry-After` hint. Before, it reported only `provider request failed`, so a workflow stage whose routing hit a rate limit was blocked as a provider outage. Now it is blocked as a rate limit or exhausted quota. The provider's error text is still never kept ([#4031](https://github.com/bastani-inc/atomic/issues/4031))
+- Provider cooldowns now honor `Retry-After` on every provider path, including Anthropic-format models, instead of guessing an exponential backoff. HTTP 402 and quota-exhaustion codes (`insufficient_quota`, `quota_exceeded`, `usage_limit*`) are classified as the new `quota_exhausted` failure kind: the account counts as unavailable until its reset, and the turn moves to a configured fallback model instead of retrying the same model. When a rate-limit response names the model that hit the limit, only that model cools down; other models on the provider stay usable. Limits that do not name a model still cool the whole provider ([#3984](https://github.com/bastani-inc/atomic/issues/3984))
+- A workflow stage whose model fallback replaced its session no longer fails the replacement's prompt with `Agent is already processing. Specify streamingBehavior…` when an Intercom message reaches the stage during the swap. Like a fresh stage, the replacement now holds turn-starting messages as context for the stage prompt's turn ([#3982](https://github.com/bastani-inc/atomic/issues/3982))
+- Fixed a `.ts` storage adapter that serves both `sessions.storage` and `workflows.journal` failing to import `@bastani/atomic/workflows` when sessions loaded first; the journal now gets the running Atomic's workflows module ([#3973](https://github.com/bastani-inc/atomic/issues/3973))
+- ES module and TypeScript files a storage adapter imports by relative path now get the running Atomic's `@bastani/atomic/workflows`, `@bastani/atomic/storage`, and `@bastani/atomic`, as the adapter's entry file does. Before, a `.mjs` file or a `.js` file in a `"type": "module"` adapter package could resolve these imports from `node_modules` instead, so errors such as `StaleLeaseError` thrown from it failed Atomic's `instanceof` checks. CommonJS files other than the entry file still resolve these imports from `node_modules` ([#3972](https://github.com/bastani-inc/atomic/issues/3972))
+- Fixed subagents launched with `context: "fork"` finishing instantly as "completed" with the parent's last message as their output. A forked child's history now stops before the parent's in-flight turn that is launching it, so providers that sign thinking no longer reject the child's first request as a modified turn. A child's output now comes only from messages it produced itself, and a child whose own turns all failed, or that ran none, is reported as failed with the provider's error instead of completing with inherited text. A child that completed a turn without final text, such as a tool-only child, still completes ([#3987](https://github.com/bastani-inc/atomic/issues/3987))
+- GitHub Copilot offers fewer models that fail on the first request with `model_not_available_for_integrator`: models enabled during `/login` are offered only if the model list re-read afterwards marks them usable, and an older login without a stored model list re-reads it on the next networked model refresh (until then, including offline, it keeps offering the catalog). Models you define for `github-copilot` in `models.json` stay offered. If Copilot still rejects a model this way, a fallback chain moves on to its next model, and the error reads "<model> isn't available to Atomic's GitHub Copilot integration; pick another model or run /login to refresh the model list" followed by the raw error ([#3998](https://github.com/bastani-inc/atomic/issues/3998))
+- `tool_search` and codemode `searchTools()` rank a tool first when the query is its name, either the full name or the part after a `__` separator (`thread_read` for `mcp__app__thread_read`). Before, a shorter description that shared the name's words could rank above it ([pi #11331](https://github.com/earendil-works/pi/issues/11331))
+- Writers to one SQLite journal in different processes now take its write lock in turn, so a busy process that commits and begins again can no longer starve the others, and a transaction waiting for the lock fails only when the lock is held for the whole lock wait with no other connection committing, instead of after 30 s however busy the lock was with real work. Large local worker pools no longer lose children to `database is locked … gave up after waiting 30000 ms for the write lock` under contention ([#3978](https://github.com/bastani-inc/atomic/issues/3978))
+- The login dialog opens only web (`http:`/`https:`) sign-in URLs, and no longer prints control characters from sign-in, device-code or info URLs, which could end a terminal hyperlink and send escape sequences to the terminal. The terminal title likewise replaces control characters in session names and extension titles ([pi 89c921d8](https://github.com/earendil-works/pi/commit/89c921d8b56b59e768b26e7f48b6832978119310))
+- A Bedrock `ServiceQuotaExceededException` and a Google error body reporting a per-day quota violation now count as an exhausted quota, so model fallback moves straight to the next model instead of retrying the same one, and a throttled Bedrock request (`ThrottlingException`, shown as `Throttling error: …`) now counts as a rate limit, so its `Retry-After` cools the model down for other requests. The classifier also reads the error code a provider failure diagnostic records.
+- `tool_search` and codemode `searchTools()` now find a tool whose name is made only of stop words (for example `is`) when the query names it; other stop-word-only queries still return nothing.
+- The `grep` tool numbers `context` lines the way ripgrep does when a file contains a lone carriage return: before, every line after it was off by one, so the wrong line showed as the match and the last context line went missing. Context and match lines no longer show the carriage return ([pi #11398](https://github.com/earendil-works/pi/issues/11398))
+- An open extension dialog (`confirm`, `select`, `input`, `editor`, or an inline `ctx.ui.custom()` component) stays visible and answerable when an extension calls `ctx.ui.setEditorComponent()`. Before, the new editor replaced it on screen and the dialog waited until its timeout, or forever. The new editor appears when the last dialog closes ([pi #11431](https://github.com/earendil-works/pi/issues/11431))
+- Installing, updating or removing an npm-hosted Atomic package no longer prints npm audit and funding messages. `npm audit fix` would have installed Atomic peer packages, because it runs without `--legacy-peer-deps` ([pi #11469](https://github.com/earendil-works/pi/pull/11469))
+- Hidden thinking with an empty label (for example after `ctx.ui.setHiddenThinkingLabel("")`) no longer draws blank rows: before, a message with thinking drew two blank rows before a tool call and three before its text ([pi #11402](https://github.com/earendil-works/pi/issues/11402))
+- A background shell stopped by a workflow stage or run pause is now recorded with the `pause` stop reason, and its completion notice says `Background shell interrupted by a pause` and asks to redo or continue the interrupted step, instead of "This execution has ended. Do not restart it". The shell's kind is saved with its completion intent, so a notice replayed after a restart keeps that wording; an intent saved by an earlier version asks to redo or continue the interrupted step and never offers a subagent resume call. Shells stopped with `/tasks` or `kill` keep the ended-for-good wording ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- The `wait` and `kill` results for a shell stopped by a pause now say `stopped by a pause` instead of `paused · awaiting resume`, since a shell does not resume ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+
 ## [0.9.46-alpha.1] - 2026-10-27
 
 Stages on local workers can now be watched, steered, paused and answered live; large pooled workflows stay responsive and recover cleanly from rate limits, worker crashes and resumes; and GPT-6.1 Terra is available.

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.46] - 2026-10-27
+
+### Fixed
+
+- The session that launched a workflow run can now send to that run's stages by exact path (`workflow:<rootRunId>/<stage>`) and by pattern (`workflow:<rootRunId>/**`), and sees them in `intercom list`, without joining the run's invocation group. Before, the send was refused with `Target workflow run is in a different intercom group`, because the run's route is registered on a separate connection and the broker could not tell that the sender had launched the run. The launching session now proves this with a secret that only its own process holds, never the run's stages. Its group memberships do not change, so the run's stages still cannot message it. A session that joins `workflow:<rootRunId>` keeps the same authority, and every other session is still refused, now with an error that names the group to join ([#4006](https://github.com/bastani-inc/atomic/issues/4006))
+- A send to a recipient that is still saving the message, such as a stage on a local worker whose journal commit waits behind other writers, now waits for that save instead of reporting after 8 s that the outcome is uncertain. The recipient reports progress while it saves; a recipient that dies stops reporting, so its sender still hears the outcome is uncertain, and no save holds a sender longer than 2 minutes. This also holds when the recipient is connected through another broker node ([#3983](https://github.com/bastani-inc/atomic/issues/3983))
+- A connection to the Intercom broker that the operating system refuses because the broker socket's listen backlog is full, as happens when a large pooled fan-out starts many sessions at once, is now retried briefly instead of failing that session's Intercom ([#3904](https://github.com/bastani-inc/atomic/issues/3904))
+- A session that launched a workflow run, or that joined `workflow:<rootRunId>` from another group, now receives the failure notice when a message it queued to one of the run's pending stages becomes undeliverable (for example because the stage was skipped). The notice used to reach only senders registered in the run's own group, so these senders never learned their message was dropped. The notice still goes only to the session that sent the message ([#4006](https://github.com/bastani-inc/atomic/issues/4006))
+- A send to a session on another broker node that quits cleanly while the send is being routed is now queued for that session and delivered when it reconnects, as a send made after the quit is. Before, when the sender's broker still saw the session as connected, the sender waited 8 s for a receipt that could never come and was told the outcome was uncertain, although the message had not reached anyone.
+- A workflow stage registered outside a run (another run's stage, or an isolated subgroup stage of the same run) that tries to send to the run's stages is now told `A workflow stage in <its group> cannot send to stages of workflow:<rootRunId>; joining that group does not grant it control`, instead of being told to join a group that would not help ([#4006](https://github.com/bastani-inc/atomic/issues/4006))
+
 ## [0.9.46-alpha.1] - 2026-10-27
 
 ### Fixed

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.46-alpha.1",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.46-alpha.1",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [0.9.46] - 2026-10-27
+
+### Fixed
+
+- A subagent that waited for a free slot (`concurrency`, or a burst of launches) or was restored, and that starts after its parent workflow stage's session was replaced by model fallback, now launches instead of failing with `This extension ctx is stale after session replacement or reload`. It takes its settings from the replacement session, and starts in the directory it was launched for ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A detached subagent that exits after its parent workflow stage's session was replaced by model fallback still sends its completion notice. Before, the notice was lost and the workflow run failed with `This extension ctx is stale after session replacement or reload` ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A resumed subagent child now receives its resume message and the messages it had queued and not read exactly as written. They used to go through `prompt()` or `followUp()` depending on whether the child had held messages, so `/review …` was replaced by a prompt template's contents, a registered command such as `/workflow` either ran or failed the child with `Extension command "/workflow" cannot be queued`, and text the child had already received was expanded a second time. Only an original task the child never read is still prompted the way a fresh launch prompts it ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent child paused, quit or stopped by its owner while it waited for its run's running capacity, before its session existed, can be resumed and restored again: it used to report `could not be resumed: no session was recorded for it`. A child admitted behind its run's concurrency limit and stopped that way no longer receives its task twice when it is restored. Resuming or restoring a child that had not started now says it started fresh with its task instead of claiming it resumed from its own session ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent whose model is pinned with a thinking suffix (such as `provider/model:low`) no longer shows that suffix as part of its model on its launch and status cards once its session has started; the cards show `provider/model` and the thinking level beside it, as they do before the session starts ([#4009](https://github.com/bastani-inc/atomic/issues/4009))
+- A paused subagent child resumed without a message, and a child restored after a restart, are now told to redo or continue a command or step the pause or restart interrupted, as a resumed workflow stage is ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+
 ## [0.9.46-alpha.1] - 2026-10-27
 
 ### Fixed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.46-alpha.1",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/src/extension/index.bundle.mjs

@@ -14866,7 +14866,7 @@ async function maybeBuildForegroundIntercomReceipt(input) {
 }
 
 // dist/builtin/subagents/src/runs/foreground/subagent-child-restore.ts
-var SUBAGENT_RESUME_CONTINUATION_PROMPT = "Atomic restarted while you were working, and your session has been restored. Continue where you left off. If you believe you are finished with your original task, stop.";
+var SUBAGENT_RESUME_CONTINUATION_PROMPT = "Atomic restarted while you were working, and your session has been restored. Continue where you left off. If the restart interrupted a command or step you were running, redo or continue that step as needed. If you believe you are finished with your original task, stop.";
 var SUBAGENT_AWAIT_INTERCOM_PEER_EVENT = "subagent:await-intercom-peer";
 var SUBAGENT_INTERCOM_PEER_TIMEOUT_MS = 15000;
 var SUBAGENT_AWAIT_CHILD_RESTORATION_EVENT = "subagent:await-child-restoration";
@@ -17484,7 +17484,7 @@ async function runSinglePath(data, deps) {
 }
 
 // dist/builtin/subagents/src/runs/foreground/subagent-run-control.ts
-var SUBAGENT_RUN_CONTROL_CONTINUATION_PROMPT = "Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
+var SUBAGENT_RUN_CONTROL_CONTINUATION_PROMPT = "Continue where you left off. If a pause interrupted a command or step you were running, redo or continue that step as needed. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
 var NON_RESUMABLE_STATUSES = new Map([
   ["killed", "it was cancelled for good (an owner or batch cancellation, or the removed kill action)"],
   [

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.46-alpha.1",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.46] - 2026-10-27
+
+### Added
+
+- `RunResult.failure` (type `RunFailureClassification`, exported from `@bastani/atomic/workflows`) describes how a failed or blocked run's failure was classified: `kind`, `code`, `retryable`, `resumable`, `recoverability`, `disposition` and `retryAfterMs`. It is absent for runs that did not fail and for results recorded by earlier releases ([#4031](https://github.com/bastani-inc/atomic/issues/4031))
+- Opening a running stage that runs on a local worker (`workflows.localWorkers`) from the workflow graph or `/workflow attach` now shows its live chat: the transcript so far, the reply as it streams, and tool calls, with `on local worker` in the chat header. It no longer shows "Post-mortem chat is available only after the stage completes". Only stages you have open stream to the root, so pools with many workers send nothing extra for stages nobody watches. ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- Enter (steer) and Ctrl+F (follow-up) in the chat of a stage that runs on a local worker now reach that stage and report the same delivery as an in-process stage. Each message is admitted at most once, even when a reply is lost and the send is retried. The stage's graph node shows `✉ N queued` with no chat open. SDK runs with `localWorkers` now accept `stageControlRegistry`, whose handles for pooled stages steer, queue follow-ups and stream events the same way ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- A single stage on a local worker can now be paused and resumed (`/workflow pause <run> <stage>`, stage chat, `session.workflows.pause/resume` with `stageId`) without pausing the pool; it keeps its worker's lease while paused. When the worker running an open stage dies or its attempt is fenced, the chat shows `RECONNECTING`, reattaches to the replacement attempt, and redelivers once each, in send order and in their original mode (a steer still steers), the messages the replacement does not have ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- Children on local workers can now ask for input. Their `ctx.ui` prompts show on their stage and are answered from the stage chat or the workflow tool's `answer` action, and a stage's `ask_user_question` shows its form in the stage chat as for an in-process stage; each answer reaches only the prompt it names on the worker's current attempt. Previously `ctx.ui` in a pooled child failed the child. SDK runs with `localWorkers` now accept `ui`, which answers those prompts (a rejecting `ui` fails the child with its error), and `stageUiBroker`, which receives the stages' `ask_user_question` forms (a broker that rejects a form fails that question in the stage with its error). `ctx.ui.custom` in a pooled child fails it with an error naming the limitation. When a worker dies, the replacement asks again a `ctx.ui` prompt that was still pending, and does not ask again one already answered. A stage's `ask_user_question` still waiting when its worker dies (or when a durable run resumes a stage) shows its form again on the replacement, and the answer becomes that call's result; previously the call was reported to the model as interrupted and the stage could finish without the answer ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- Added a GPT-6.1 Terra reference to the prompt-engineering skill, based on OpenAI's updated GPT-6 guide, covering when to choose Terra, effort selection, migration from GPT-5.6 Terra, computer-use and writing prompts, and selective use of the shared templates observed on Astra.
+
+### Fixed
+
+- Starting a large local worker pool (`workflows.localWorkers`) no longer freezes the root's input and rendering for hundreds of milliseconds while the workers start. When a workflow starts many pooled children at once, such as `Promise.all` over 150 `ctx.workflow` calls, their journal work used to run back to back in one turn of the event loop, and each child's dispatch listed and sorted every checkpoint of the root. While many journal operations are queued, journal work now gives the event loop a turn after 8 ms, checked before each operation, and a child's dispatch looks up only its own boundary. When those children finish at once, completing each one no longer reads every checkpoint of the root, and the sweep for undeliverable stage messages checks run ownership only for runs that have messages to settle, and children finishing together complete in turns of the event loop instead of all at once
+- An Intercom send to a workflow path pattern that matches a live or pending stage, such as `workflow:<run>/**/work-2` for a stage in a child on a local worker, no longer reports `notInKnownSet` ("not in the workflow's known stage set"). The message was delivered, but the known set came only from the launch-time scan of the workflow source, which cannot see stages of children loaded with `loadWorkerWorkflow`. Stages that already exist and can receive messages now count as known; a target that matches neither the scan nor any such stage still gets the warning.
+- Large pooled fan-outs no longer stall the root's main thread when the workflow graph or a stage chat is open: typing in a stage chat during dispatch, wave turnover and run end of 150+ local workers stayed responsive only with nothing attached. Each store change used to re-project, re-freeze, re-expand and re-serialize every run of the root for the graph snapshot, the graph view, the attach pane, the workflow activity bridge and the BACKGROUND widget. Unchanged runs and stages now keep their frozen graph projections and expansions, the graph view and attach pane catch up once before they render or handle input, an open stage chat projects only its own run, the activity bridge publishes each root's final activity once per turn of the event loop (reading published activity, a root run's own lifecycle event and `waitForSettled` always see it first), store-driven widget refreshes spend at most 8 ms per 50 ms after the first four, and the coordinator gets the root's boundaries once per turn instead of once per enqueue and published batch. A pooled child whose worker was replaced also keeps its last known stages, marked `reconnecting`, until the replacement republishes them, instead of briefly showing no stages ([#4009](https://github.com/bastani-inc/atomic/issues/4009))
+- Stages on local workers (`workflows.localWorkers`) now share provider rate limits. When one worker's stage gets an HTTP 429 or an exhausted quota (HTTP 402), the other workers and the root apply the same cooldown or unavailable mark, with the same provider or model scope and the same `Retry-After` end. They hold requests to that provider or model back, or move their fallback walk past it, instead of each sending requests until it gets its own 429. A worker that starts later gets the limits still running. Limits are sent only when a request is rate limited, at most once per provider or model every 250 ms ([#4023](https://github.com/bastani-inc/atomic/issues/4023))
+- Text typed into a stage chat reaches the stage the same way whether the stage is idle, streaming, or still preparing its turn. Only `/skill:` commands expand. Before, Enter or Ctrl+F while the stage was busy expanded prompt templates such as `/review` and ran registered extension commands, or refused them, while the same text sent to an idle stage arrived as typed
+- A message given when resuming a stage that was paused in the middle of its workflow prompt is now delivered as typed, as it is when resuming an idle stage chat. It used to go through the stage prompt's own options, which expand prompt templates and run registered extension commands
+- A failed child workflow (`ctx.workflow`), or a failed stage, no longer has its failure classified from workflow or stage names. Before, a name containing words such as `rate-limit`, `overloaded` or `quota` could turn an ordinary failure, such as a tool that throws `ENOENT`, into a resumable rate limit or provider outage. The root then stayed `running`, blocked for a resume that could not help, and `run()` returned status `running` with the error. A parent now classifies a failed child from the child's own classification (`RunResult.failure`), at any nesting depth, for in-process children and children on local workers, including a child result a resumed root reads back from the journal. A stage's model-resolution failure is classified from the routing error it wraps. A child that really fails on a rate limit still blocks the root resumably. Error messages are unchanged ([#4031](https://github.com/bastani-inc/atomic/issues/4031))
+- A stage whose model hits an exhausted quota (HTTP 402) or a rate limit that resets beyond the retry-delay cap now moves straight to the next fallback model, without spending retries or cooldown-wait rounds on it. A model-specific rate limit no longer delays a fallback on the same provider, and an HTTP 529 overload waits for its `Retry-After` like a 503 ([#3984](https://github.com/bastani-inc/atomic/issues/3984))
+- A stage whose whole model and fallback chain returns HTTP 429 now waits for the earliest recorded provider cooldown and retries, instead of failing after one attempt per model. The wait is bounded: at most `retry.maxRetries` extra rounds per prompt, and only when the earliest cooldown fits the retry-delay cap (`retry.provider.maxRetryDelayMs`, else `retry.maxAgentDelayMs`, else 60 s). A persistent 429 still fails the stage once those rounds are spent ([#3984](https://github.com/bastani-inc/atomic/issues/3984))
+- A workflow run whose stage replaced its session through model fallback no longer fails with `This extension ctx is stale after session replacement` and hides the stage's real error (such as a rate limit). An unhandled stale extension-context rejection no longer fails the run. It is logged to stderr with its stack and the run id, so the code that kept the retired session's context can be found ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- Disposing an SDK session right after a workflow run reports `completed`, without awaiting `session.workflows.waitForSettled(runId)`, no longer prints one `atomic-workflows: released stage listener failed Error: SessionClosed` warning per stage ([#3966](https://github.com/bastani-inc/atomic/issues/3966))
+- A workflow stage that has sent its first prompt no longer reads `startup first-dispatch (0s total, 0s on current step; dispatched)` in the workflow tool's `stages` and `stage` output, which looked like a stalled stage for the whole run. The line now reads `startup complete (dispatched after 2s)` ([#3967](https://github.com/bastani-inc/atomic/issues/3967))
+- A local-worker pool no longer fails every in-flight child with `Local worker process cleanup unconfirmed; permits quarantined` when one worker exits while its tool process groups are still running. The coordinator now reaps that worker's orphaned process groups (SIGTERM, then SIGKILL, with a bounded wait), holds the child's work lease so no other worker can claim it meanwhile, releases the permits of groups that are gone or hold only zombies, and replays only that worker's child on a replacement. If a group is still alive when the bound expires, only that child fails, with a retryable `WorkflowInfrastructureError` (`worker_cleanup_unconfirmed`) that names the process groups; their permits stay quarantined and the child is not replayed alongside them, also not by recovery after a stalled worker is stopped or by a durable resume (both read the quarantine from the journal), and closing the pool reports those groups. A durable resume reaps such an attempt's groups with the same bounded sequence, then replays it in the resumed root or fails only that child ([#3986](https://github.com/bastani-inc/atomic/issues/3986))
+- A direct Intercom send to a live stage in a local worker pool no longer routinely fails with `The recipient did not confirm that it saved the message in time` while the pool is busy. Saving a message to a pooled stage's session no longer waits for the worker to re-read the root workflow's journal or for a usage-total transaction; it is confirmed once the coordinator has committed it ([#3983](https://github.com/bastani-inc/atomic/issues/3983))
+- Resuming a quit or crashed root whose children run in `workflows.localWorkers` no longer fails in-flight children with `Session not found`. Resume used to make the previous run's pooled children claimable before the resumed root had enqueued them again, so workers crashed on `Stale work lease`, the pool failed with `Local worker retry limit`, and later children ran in the root process, which cannot see pooled stage sessions. A pooled child is now claimed only after the resumed root enqueues it, a child started after the pool has failed gets the pool's error instead of running in the root process, the three-attempt retry limit counts only crashes within one run of the root (a child resumed many times keeps its full budget), and a worker whose attempt was handed to another worker ends that attempt and serves new work instead of crashing and using up a retry ([#3979](https://github.com/bastani-inc/atomic/issues/3979))
+- Large local worker pools no longer lose child workflows to `database is locked … gave up after waiting 30000 ms for the write lock` after a few hours. Resource admission reconciliation, which every pooled worker runs before it starts a command, read the whole resource permit history twice for every live worker while it held the journal's write lock. With 160 workers and tens of thousands of permits, each pass held the lock for nearly a second. Reconciliation now uses indexes, keeps only the most recent 256 released permits, and takes the write lock only when it has a permit to fence or prune ([#3978](https://github.com/bastani-inc/atomic/issues/3978))
+- Workflow runs and local worker definitions load again after something such as a `/tmp` cleanup deletes the `jiti` transpile cache directory, instead of failing with `ENOENT: no such file or directory, open '/tmp/jiti/workflows-<name>.<hash>.cjs'` until Atomic restarts ([#3985](https://github.com/bastani-inc/atomic/issues/3985))
+- A sticky Intercom send to a workflow pattern target (for example `workflow:<rootRunId>/**`) no longer fails newly starting pooled stages with `Extension startup failed: … pending-stage message <id> changed during delivery`. A stage drain whose transcript snapshot was taken before a slow session append finished used to deliver the already-receipted message again and then fail. The drain now treats an existing delivery receipt for that stage and session as success, so the message reaches each stage exactly once ([#3980](https://github.com/bastani-inc/atomic/issues/3980))
+- A workflow that starts many child workflows at once, such as `Promise.all` over 150 `ctx.workflow` calls, no longer stalls the root session's input and rendering while the children start. Each workflow store change used to re-read every run and stage to detect lifecycle transitions, so a fan-out's cost grew with the square of its width; only the run, stage or tool node that changed is now re-read. Lifecycle events are unchanged
+- A finished stage that ran on a local worker now reopens for post-mortem chat. It used to report `The retained session is missing, unreadable, or invalid` in the same session and SESSION UNAVAILABLE after a restart, because its session lives in the workflow journal rather than the host's session store ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- A workflow heartbeat no longer goes missing when its wake-up timer fires a moment early. The early wake-up found nothing due and rescheduled, and if the boundary passed while that pass was running, the heartbeat moved to the following interval instead of being sent. The scheduler now reads the clock once per pass, so a boundary that comes due during it is still delivered
+- An idle local worker that meets its root's released lease (between the root's teardown and the pool's close) now ends cleanly instead of crashing, and the pool no longer spawns replacements that crash the same way ([#3979](https://github.com/bastani-inc/atomic/issues/3979))
+- A stage chat open on a `ctx.ui` prompt or `ask_user_question` form of a stage on a local worker (`workflows.localWorkers`) now takes the answer after that worker dies: it shows the prompt the replacement worker asks again and delivers your answer to it once. Before, the open chat kept a prompt that dropped typed text and ignored Enter until you closed and reopened the stage. An answer you submit after the worker died but before the replacement asks again is now kept and given to the replacement's identical prompt instead of being lost, so you are not asked twice. The re-asked `ask_user_question` form no longer shows "Tool execution was interrupted after it started…" above it. A replacement worker whose child asks a different `ctx.ui` question at the same point (its text depends on data) no longer fails the child with `Pool topology scope: direct child source orders are not unique`: the unanswered question of the dead worker is replaced, an open stage chat moves to the new question, and an answer held for the old question is discarded. A child that really takes different steps when it runs again now fails with an error that says so in plain words. The forms of `ask_user_question` and the readiness gate are now built by one helper for in-process and local-worker stages, so they cannot drift apart ([#4022](https://github.com/bastani-inc/atomic/issues/4022))
+- A child on a local worker that loses its worker three times now fails alone with a retryable `WorkflowInfrastructureError` (`worker_retry_limit`) that names its child run and definition export, as #3986 already did for a child whose processes survive cleanup. Before, it failed the whole pool within milliseconds: every other child, including one waiting on a prompt whose worker was never touched, was rejected with `Local worker retry limit`. The same applies to a child whose every attempt the root refused as stale. The failed child, its nested runs and their unfinished stages show failed with its error, so the graph counts none of them as active. Workers that keep crashing without work, worker startup failures and a coordinator that dies still fail the pool. When a pool closes without a quit, the root's unfinished work rows end `failed` instead of staying `ready` or `leased`; quarantined attempts keep their leases, and a resumed root replays failed work it enqueues again ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- The post-mortem chat of a completed or failed stage that ran on a local worker no longer shows `on local worker` in its header. Post-mortem chat runs in the root, so the header now matches an in-process stage's ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+- Pausing a stage or a run (`/workflow pause <run> [stage]`) no longer tells the stage that its interrupted background shell ended for good. The shell's notice now says a pause interrupted it and that the step should be redone or continued, and the "Continue where you left off" resume prompt says to redo or continue a step the pause interrupted. Previously the notice said "This execution has ended. Do not restart it", and a resumed stage could stop early with its remaining work never run ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+
 ## [0.9.46-alpha.1] - 2026-10-27
 
 ### Added

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.46-alpha.1",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/extension/index.bundle.mjs

@@ -13256,7 +13256,7 @@ var init_stage_question_form = __esm(() => {
 });
 
 // dist/builtin/workflows/src/shared/resume-continuation.ts
-var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
+var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If a pause interrupted a command or step you were running, redo or continue that step as needed. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
 
 // dist/builtin/workflows/src/runs/foreground/executor-hil.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -67675,13 +67675,19 @@ class HeldPromptAnswers {
       if (held.runId === runId && generation > held.generation && !present.has(key))
         this.held.delete(key);
   }
+  awaitsLaterAttempt(runId, stageId, generation) {
+    const held = this.held.get(JSON.stringify([runId, stageId]));
+    return held !== undefined && generation <= held.generation;
+  }
   takePrompt(runId, stageId, prompt, generation) {
     const key = JSON.stringify([runId, stageId]);
     const held = this.held.get(key);
     if (held === undefined || generation <= held.generation)
       return;
     this.held.delete(key);
-    return held.kind === "prompt" && held.identity === promptIdentity(prompt) ? { response: held.response } : undefined;
+    if (held.kind !== "prompt" || held.identity !== promptIdentity(prompt))
+      return;
+    return "error" in held ? { error: held.error } : { response: held.response };
   }
   takeQuestion(runId, stageId, question, generation) {
     const key = JSON.stringify([runId, stageId]);
@@ -67689,7 +67695,9 @@ class HeldPromptAnswers {
     if (held === undefined || generation <= held.generation)
       return;
     this.held.delete(key);
-    return held.kind === "question" && held.identity === questionIdentity(question) ? { answer: held.answer } : undefined;
+    if (held.kind !== "question" || held.identity !== questionIdentity(question))
+      return;
+    return "error" in held ? { error: held.error } : { answer: held.answer };
   }
   clear() {
     this.held.clear();
@@ -71148,18 +71156,39 @@ class LocalWorkerPool {
           const key = JSON.stringify([run.id, stage.id, prompt.id]);
           if (this.routedPrompts.has(key))
             continue;
+          if (this.heldAnswers.awaitsLaterAttempt(run.id, stage.id, generation))
+            continue;
           this.routedPrompts.add(key);
           const held = this.heldAnswers.takePrompt(run.id, stage.id, prompt, generation);
-          if (held !== undefined)
+          if (held !== undefined && "response" in held)
             store?.resolveStagePendingPrompt(run.id, stage.id, prompt.id, held.response);
-          const fail = (error) => this.answerPooledStagePrompt(run.id, stage.id, {
-            kind: "failed",
-            promptId: prompt.id,
-            error: error.message
-          });
+          const fail = async (error) => {
+            const result = await this.answerPooledStagePrompt(run.id, stage.id, {
+              kind: "failed",
+              promptId: prompt.id,
+              error: error.message
+            });
+            if (!result.ok && result.refusal !== "StageNotLive") {
+              this.heldAnswers.hold(run.id, stage.id, {
+                kind: "prompt",
+                generation,
+                promptId: prompt.id,
+                identity: promptIdentity(prompt),
+                error: error.message
+              });
+              this.applyHeldAnswer(run.id, stage.id, generation);
+            }
+            return result;
+          };
+          let failedElsewhere = held !== undefined && "error" in held;
           const heldLater = Promise.withResolvers();
-          this.routedPromptAnswers.set(key, heldLater.resolve);
-          const answered = held !== undefined ? Promise.resolve(held.response) : prompt.kind === "custom" ? Promise.reject(new Error(POOLED_CUSTOM_PROMPT_UNAVAILABLE)) : Promise.race([
+          this.routedPromptAnswers.set(key, (outcome) => {
+            if ("response" in outcome)
+              return heldLater.resolve(outcome.response);
+            failedElsewhere = true;
+            heldLater.reject(new Error(outcome.error));
+          });
+          const answered = held !== undefined ? "response" in held ? Promise.resolve(held.response) : Promise.reject(new Error(held.error)) : prompt.kind === "custom" ? Promise.reject(new Error(POOLED_CUSTOM_PROMPT_UNAVAILABLE)) : Promise.race([
             heldLater.promise,
             this.promptUi !== undefined ? askStagePromptUi(this.promptUi, prompt) : store?.awaitStagePendingPrompt(run.id, stage.id, prompt.id) ?? Promise.reject(new Error("No workflow store answers this prompt."))
           ]);
@@ -71181,9 +71210,9 @@ class LocalWorkerPool {
               this.applyHeldAnswer(run.id, stage.id, generation);
             }
             return result;
-          }, (error) => this.promptUi !== undefined || prompt.kind === "custom" ? fail(error) : undefined);
+          }, (error) => failedElsewhere || this.promptUi !== undefined || prompt.kind === "custom" ? fail(error) : undefined);
           answer.then((result) => {
-            if (result?.ok === false && result.refusal === "StaleAttempt")
+            if (result?.ok === false && result.refusal !== "StageNotLive")
               this.routedPrompts.delete(key);
           }).catch(() => this.routedPrompts.delete(key));
         }
@@ -71219,8 +71248,10 @@ class LocalWorkerPool {
     if (question?.promptId !== promptId || signal.aborted)
       return signal.aborted;
     const held = this.heldAnswers.takeQuestion(runId, stageId, question, generation);
-    if (held !== undefined)
-      return this.sendQuestionAnswer(runId, stageId, question, generation, held.answer, route);
+    if (held !== undefined) {
+      const sent = await this.sendQuestionOutcome(runId, stageId, question, generation, held, route);
+      return sent && "error" in held ? "failed" : sent;
+    }
     const broker = this.questionBroker ?? currentStageUiBroker();
     let answered;
     let failure;
@@ -71244,19 +71275,15 @@ class LocalWorkerPool {
         broker.clearStagePrompt(runId, stageId);
     }
     if (failure !== undefined) {
-      await this.answerPooledStagePrompt(runId, stageId, { kind: "failed", promptId, error: failure.message });
-      return "failed";
+      const sent = await this.sendQuestionOutcome(runId, stageId, question, generation, { error: failure.message }, route);
+      return sent ? "failed" : false;
     }
     if (answered === undefined)
       return true;
-    return this.sendQuestionAnswer(runId, stageId, question, generation, { raw: answered.value }, route);
+    return this.sendQuestionOutcome(runId, stageId, question, generation, { answer: { raw: answered.value } }, route);
   }
-  async sendQuestionAnswer(runId, stageId, question, generation, answer, route) {
-    const result = await this.answerPooledStagePrompt(runId, stageId, {
-      kind: "input",
-      promptId: question.promptId,
-      answer
-    });
+  async sendQuestionOutcome(runId, stageId, question, generation, outcome, route) {
+    const result = await this.answerPooledStagePrompt(runId, stageId, "error" in outcome ? { kind: "failed", promptId: question.promptId, error: outcome.error } : { kind: "input", promptId: question.promptId, answer: outcome.answer });
     if (result.ok || result.refusal === "StageNotLive")
       return true;
     this.heldAnswers.hold(runId, stageId, {
@@ -71264,7 +71291,7 @@ class LocalWorkerPool {
       generation,
       promptId: question.promptId,
       identity: questionIdentity(question),
-      answer
+      ...outcome
     });
     const key = JSON.stringify([runId, stageId]);
     const active = this.routedQuestions.get(key);
@@ -71272,7 +71299,7 @@ class LocalWorkerPool {
       this.routedQuestions.delete(key);
     else if (active !== undefined && active.promptId === question.promptId && active.generation > generation) {
       this.routedQuestions.delete(key);
-      active.controller.abort(new Error("The question was answered before its worker was replaced."));
+      active.controller.abort(new Error("The question was settled before its worker was replaced."));
     }
     this.applyHeldAnswer(runId, stageId, generation);
     return false;
@@ -71293,9 +71320,9 @@ class LocalWorkerPool {
     const held = this.heldAnswers.takePrompt(runId, stageId, prompt, generation);
     if (held === undefined)
       return;
-    if (this.promptUi === undefined)
+    if (this.promptUi === undefined && "response" in held)
       this.store?.resolveStagePendingPrompt(runId, stageId, prompt.id, held.response);
-    deliver(held.response);
+    deliver(held);
   }
   async pausePooledStage(watch) {
     if (this.closed || this.coordinatorLost !== undefined)

package/dist/builtin/workflows/src/extension/local-worker-entry.mjs

@@ -10755,7 +10755,7 @@ var init_stage_question_form = __esm(() => {
 });
 
 // dist/builtin/workflows/src/shared/resume-continuation.ts
-var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
+var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If a pause interrupted a command or step you were running, redo or continue that step as needed. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
 
 // dist/builtin/workflows/src/runs/foreground/executor-hil.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -64239,13 +64239,19 @@ class HeldPromptAnswers {
       if (held.runId === runId && generation > held.generation && !present.has(key))
         this.held.delete(key);
   }
+  awaitsLaterAttempt(runId, stageId, generation) {
+    const held = this.held.get(JSON.stringify([runId, stageId]));
+    return held !== undefined && generation <= held.generation;
+  }
   takePrompt(runId, stageId, prompt, generation) {
     const key = JSON.stringify([runId, stageId]);
     const held = this.held.get(key);
     if (held === undefined || generation <= held.generation)
       return;
     this.held.delete(key);
-    return held.kind === "prompt" && held.identity === promptIdentity(prompt) ? { response: held.response } : undefined;
+    if (held.kind !== "prompt" || held.identity !== promptIdentity(prompt))
+      return;
+    return "error" in held ? { error: held.error } : { response: held.response };
   }
   takeQuestion(runId, stageId, question, generation) {
     const key = JSON.stringify([runId, stageId]);
@@ -64253,7 +64259,9 @@ class HeldPromptAnswers {
     if (held === undefined || generation <= held.generation)
       return;
     this.held.delete(key);
-    return held.kind === "question" && held.identity === questionIdentity(question) ? { answer: held.answer } : undefined;
+    if (held.kind !== "question" || held.identity !== questionIdentity(question))
+      return;
+    return "error" in held ? { error: held.error } : { answer: held.answer };
   }
   clear() {
     this.held.clear();
@@ -67803,18 +67811,39 @@ class LocalWorkerPool {
           const key = JSON.stringify([run.id, stage.id, prompt.id]);
           if (this.routedPrompts.has(key))
             continue;
+          if (this.heldAnswers.awaitsLaterAttempt(run.id, stage.id, generation))
+            continue;
           this.routedPrompts.add(key);
           const held = this.heldAnswers.takePrompt(run.id, stage.id, prompt, generation);
-          if (held !== undefined)
+          if (held !== undefined && "response" in held)
             store?.resolveStagePendingPrompt(run.id, stage.id, prompt.id, held.response);
-          const fail = (error) => this.answerPooledStagePrompt(run.id, stage.id, {
-            kind: "failed",
-            promptId: prompt.id,
-            error: error.message
-          });
+          const fail = async (error) => {
+            const result = await this.answerPooledStagePrompt(run.id, stage.id, {
+              kind: "failed",
+              promptId: prompt.id,
+              error: error.message
+            });
+            if (!result.ok && result.refusal !== "StageNotLive") {
+              this.heldAnswers.hold(run.id, stage.id, {
+                kind: "prompt",
+                generation,
+                promptId: prompt.id,
+                identity: promptIdentity(prompt),
+                error: error.message
+              });
+              this.applyHeldAnswer(run.id, stage.id, generation);
+            }
+            return result;
+          };
+          let failedElsewhere = held !== undefined && "error" in held;
           const heldLater = Promise.withResolvers();
-          this.routedPromptAnswers.set(key, heldLater.resolve);
-          const answered = held !== undefined ? Promise.resolve(held.response) : prompt.kind === "custom" ? Promise.reject(new Error(POOLED_CUSTOM_PROMPT_UNAVAILABLE)) : Promise.race([
+          this.routedPromptAnswers.set(key, (outcome) => {
+            if ("response" in outcome)
+              return heldLater.resolve(outcome.response);
+            failedElsewhere = true;
+            heldLater.reject(new Error(outcome.error));
+          });
+          const answered = held !== undefined ? "response" in held ? Promise.resolve(held.response) : Promise.reject(new Error(held.error)) : prompt.kind === "custom" ? Promise.reject(new Error(POOLED_CUSTOM_PROMPT_UNAVAILABLE)) : Promise.race([
             heldLater.promise,
             this.promptUi !== undefined ? askStagePromptUi(this.promptUi, prompt) : store?.awaitStagePendingPrompt(run.id, stage.id, prompt.id) ?? Promise.reject(new Error("No workflow store answers this prompt."))
           ]);
@@ -67836,9 +67865,9 @@ class LocalWorkerPool {
               this.applyHeldAnswer(run.id, stage.id, generation);
             }
             return result;
-          }, (error) => this.promptUi !== undefined || prompt.kind === "custom" ? fail(error) : undefined);
+          }, (error) => failedElsewhere || this.promptUi !== undefined || prompt.kind === "custom" ? fail(error) : undefined);
           answer.then((result) => {
-            if (result?.ok === false && result.refusal === "StaleAttempt")
+            if (result?.ok === false && result.refusal !== "StageNotLive")
               this.routedPrompts.delete(key);
           }).catch(() => this.routedPrompts.delete(key));
         }
@@ -67874,8 +67903,10 @@ class LocalWorkerPool {
     if (question?.promptId !== promptId || signal.aborted)
       return signal.aborted;
     const held = this.heldAnswers.takeQuestion(runId, stageId, question, generation);
-    if (held !== undefined)
-      return this.sendQuestionAnswer(runId, stageId, question, generation, held.answer, route);
+    if (held !== undefined) {
+      const sent = await this.sendQuestionOutcome(runId, stageId, question, generation, held, route);
+      return sent && "error" in held ? "failed" : sent;
+    }
     const broker = this.questionBroker ?? currentStageUiBroker();
     let answered;
     let failure;
@@ -67899,19 +67930,15 @@ class LocalWorkerPool {
         broker.clearStagePrompt(runId, stageId);
     }
     if (failure !== undefined) {
-      await this.answerPooledStagePrompt(runId, stageId, { kind: "failed", promptId, error: failure.message });
-      return "failed";
+      const sent = await this.sendQuestionOutcome(runId, stageId, question, generation, { error: failure.message }, route);
+      return sent ? "failed" : false;
     }
     if (answered === undefined)
       return true;
-    return this.sendQuestionAnswer(runId, stageId, question, generation, { raw: answered.value }, route);
+    return this.sendQuestionOutcome(runId, stageId, question, generation, { answer: { raw: answered.value } }, route);
   }
-  async sendQuestionAnswer(runId, stageId, question, generation, answer, route) {
-    const result = await this.answerPooledStagePrompt(runId, stageId, {
-      kind: "input",
-      promptId: question.promptId,
-      answer
-    });
+  async sendQuestionOutcome(runId, stageId, question, generation, outcome, route) {
+    const result = await this.answerPooledStagePrompt(runId, stageId, "error" in outcome ? { kind: "failed", promptId: question.promptId, error: outcome.error } : { kind: "input", promptId: question.promptId, answer: outcome.answer });
     if (result.ok || result.refusal === "StageNotLive")
       return true;
     this.heldAnswers.hold(runId, stageId, {
@@ -67919,7 +67946,7 @@ class LocalWorkerPool {
       generation,
       promptId: question.promptId,
       identity: questionIdentity(question),
-      answer
+      ...outcome
     });
     const key = JSON.stringify([runId, stageId]);
     const active = this.routedQuestions.get(key);
@@ -67927,7 +67954,7 @@ class LocalWorkerPool {
       this.routedQuestions.delete(key);
     else if (active !== undefined && active.promptId === question.promptId && active.generation > generation) {
       this.routedQuestions.delete(key);
-      active.controller.abort(new Error("The question was answered before its worker was replaced."));
+      active.controller.abort(new Error("The question was settled before its worker was replaced."));
     }
     this.applyHeldAnswer(runId, stageId, generation);
     return false;
@@ -67948,9 +67975,9 @@ class LocalWorkerPool {
     const held = this.heldAnswers.takePrompt(runId, stageId, prompt, generation);
     if (held === undefined)
       return;
-    if (this.promptUi === undefined)
+    if (this.promptUi === undefined && "response" in held)
       this.store?.resolveStagePendingPrompt(runId, stageId, prompt.id, held.response);
-    deliver(held.response);
+    deliver(held);
   }
   async pausePooledStage(watch) {
     if (this.closed || this.coordinatorLost !== undefined)