@bastani/atomic 0.9.5-alpha.8 → 0.9.5

package/dist/builtin/web-access/index.ts

@@ -2,9 +2,10 @@ import type { ExtensionAPI, ExtensionContext, HandlerFn, MessageRenderer, Regist
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Text } from "@mariozechner/pi-tui";
+import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { renderWebAccessToolResult } from "./result-renderers.js";
+import { assertCurrentLifecycleLease, createLifecycleLease, retainSettledLifecycleCleanup, retireLifecycleLease, type LifecycleLease } from "./lifecycle-lease.js";
 
 type CapturedCommand = Omit<RegisteredCommand, "name" | "sourceInfo">;
 type CapturedShortcut = Parameters<ExtensionAPI["registerShortcut"]>[1];
@@ -15,12 +16,18 @@ type CapturedHeavy = {
 	handlers: Map<string, HandlerFn[]>;
 	shortcuts: Map<string, CapturedShortcut>;
 };
+type ShutdownSnapshot = { event: unknown; ctx: ExtensionContext; generation: number };
+type WebLease = LifecycleLease<ShutdownSnapshot>;
 type SessionSnapshot = {
 	eventName: "session_start" | "session_tree";
 	event: unknown;
 	ctx: ExtensionContext;
 	generation: number;
+	lease: WebLease;
 };
+type HeavyHandle = { heavy: CapturedHeavy; assertCurrent: () => void };
+type HeavyAttempt = { lease: WebLease; promise: Promise<HeavyHandle> };
+type ReplayAttempt = { lease: WebLease; heavy: CapturedHeavy; promise: Promise<void> };
 
 function addHandler(captured: CapturedHeavy, event: string, handler: HandlerFn): void {
 	const handlers = captured.handlers.get(event) ?? [];
@@ -65,22 +72,54 @@ function createHeavyProxy(pi: ExtensionAPI, captured: CapturedHeavy): ExtensionA
 	}) as ExtensionAPI;
 }
 
+function waitForCaller<T>(promise: Promise<T>, signal?: AbortSignal): Promise<T> {
+	if (!signal) return promise;
+	signal.throwIfAborted();
+	return new Promise<T>((resolve, reject) => {
+		let settled = false;
+		const finish = (callback: () => void): void => {
+			if (settled) return;
+			settled = true;
+			signal.removeEventListener("abort", onAbort);
+			callback();
+		};
+		const onAbort = (): void => finish(() => reject(signal.reason));
+		signal.addEventListener("abort", onAbort, { once: true });
+		void promise.then((value) => finish(() => resolve(value)), (error: unknown) => finish(() => reject(error)));
+		if (signal.aborted) onAbort();
+	});
+}
+
 async function executeHeavyTool(
-	loadHeavy: () => Promise<CapturedHeavy>,
+	loadHeavy: () => Promise<HeavyHandle>,
 	name: string,
 	args: Parameters<NonNullable<ToolDefinition["execute"]>>,
-): Promise<ReturnType<NonNullable<ToolDefinition["execute"]>>> {
-	const heavy = await loadHeavy();
-	const tool = heavy.tools.get(name);
+): Promise<Awaited<ReturnType<NonNullable<ToolDefinition["execute"]>>>> {
+	args[2]?.throwIfAborted();
+	const handle = await waitForCaller(loadHeavy(), args[2]);
+	args[2]?.throwIfAborted();
+	handle.assertCurrent();
+	const tool = handle.heavy.tools.get(name);
 	if (!tool?.execute) throw new Error(`Web access tool implementation not found: ${name}`);
-	return tool.execute(...args) as ReturnType<NonNullable<ToolDefinition["execute"]>>;
+	let result: Awaited<ReturnType<NonNullable<ToolDefinition["execute"]>>>;
+	try {
+		result = await tool.execute(...args);
+	} catch (error) {
+		args[2]?.throwIfAborted();
+		throw error;
+	}
+	args[2]?.throwIfAborted();
+	handle.assertCurrent();
+	return result as Awaited<ReturnType<NonNullable<ToolDefinition["execute"]>>>;
 }
 
-async function runHeavyCommand(loadHeavy: () => Promise<CapturedHeavy>, name: string, args: string | undefined, ctx: ExtensionContext): Promise<void> {
-	const heavy = await loadHeavy();
-	const command = heavy.commands.get(name);
+async function runHeavyCommand(loadHeavy: () => Promise<HeavyHandle>, name: string, args: string | undefined, ctx: ExtensionContext): Promise<void> {
+	const handle = await loadHeavy();
+	handle.assertCurrent();
+	const command = handle.heavy.commands.get(name);
 	if (!command) throw new Error(`Web access command implementation not found: ${name}`);
 	await command.handler(args, ctx);
+	handle.assertCurrent();
 }
 
 function renderHeavyToolResult(loadedHeavy: CapturedHeavy | null, name: string, args: ToolRenderResultArgs): ReturnType<NonNullable<ToolDefinition["renderResult"]>> {
@@ -106,58 +145,161 @@ function getInitialShortcutConfig(): { curate: string; activity: string } {
 	return defaults;
 }
 
+function isAllFailedWebResult(toolName: string, details: unknown): boolean {
+	if (toolName !== "web_search" && toolName !== "fetch_content") return false;
+	if (!details || typeof details !== "object") return false;
+	return Reflect.get(details, "outcome") === "all_failed";
+}
+
 export default function webAccess(pi: ExtensionAPI) {
-	let heavyPromise: Promise<CapturedHeavy> | null = null;
-	let loadedHeavy: CapturedHeavy | null = null;
+	let heavyAttempt: HeavyAttempt | null = null;
+	let loadedHeavy: HeavyHandle | null = null;
 	let sessionSnapshot: SessionSnapshot | null = null;
 	let lifecycleGeneration = 0;
+	let nextLeaseId = 1;
+	let activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++);
 	let replayedGeneration = 0;
+	let replayAttempt: ReplayAttempt | null = null;
+	const invalidatedMessage = "Web access initialization was invalidated by session shutdown";
+
+	function assertLease(lease: WebLease): void {
+		assertCurrentLifecycleLease(activeLease, lease, invalidatedMessage);
+	}
 
-	async function replayCurrentSession(heavy: CapturedHeavy): Promise<void> {
-		if (!sessionSnapshot || replayedGeneration === sessionSnapshot.generation) return;
-		replayedGeneration = sessionSnapshot.generation;
-		await dispatchHandlers(heavy, sessionSnapshot.eventName, sessionSnapshot.event, sessionSnapshot.ctx);
+	function createHandle(heavy: CapturedHeavy, lease: WebLease): HeavyHandle {
+		return { heavy, assertCurrent: () => assertLease(lease) };
 	}
 
-	async function loadHeavy(): Promise<CapturedHeavy> {
-		if (!heavyPromise) {
-			heavyPromise = (async () => {
-				const captured: CapturedHeavy = { tools: new Map(), commands: new Map(), handlers: new Map(), shortcuts: new Map() };
+	async function waitForPriorCleanup(lease: WebLease): Promise<void> {
+		await lease.priorCleanup;
+		assertLease(lease);
+	}
+
+	async function replayCurrentSession(heavy: CapturedHeavy, lease: WebLease, onReplay?: (ctx: ExtensionContext) => void): Promise<void> {
+		for (;;) {
+			assertLease(lease);
+			const snapshot = sessionSnapshot;
+			if (!snapshot || snapshot.lease !== lease || replayedGeneration === snapshot.generation) return;
+			onReplay?.(snapshot.ctx);
+			await dispatchHandlers(heavy, snapshot.eventName, snapshot.event, snapshot.ctx);
+			assertLease(lease);
+			if (sessionSnapshot === snapshot) {
+				replayedGeneration = snapshot.generation;
+				return;
+			}
+		}
+	}
+
+	async function ensureCurrentSessionReplayed(heavy: CapturedHeavy, lease: WebLease, onReplay?: (ctx: ExtensionContext) => void): Promise<void> {
+		await waitForPriorCleanup(lease);
+		const snapshot = sessionSnapshot;
+		if (!snapshot || snapshot.lease !== lease || replayedGeneration === snapshot.generation) return;
+		const existing = replayAttempt;
+		if (existing?.lease === lease && existing.heavy === heavy) return existing.promise;
+		let promise: Promise<void>;
+		promise = replayCurrentSession(heavy, lease, onReplay).finally(() => {
+			if (replayAttempt?.promise === promise) replayAttempt = null;
+		});
+		replayAttempt = { lease, heavy, promise };
+		await promise;
+	}
+
+	async function loadHeavy(): Promise<HeavyHandle> {
+		const lease = activeLease;
+		if (lease.retired) throw new Error("Web access initialization unavailable: no active session");
+		await waitForPriorCleanup(lease);
+		const existing = heavyAttempt;
+		if (existing?.lease === lease) {
+			const handle = await existing.promise;
+			assertLease(lease);
+			await ensureCurrentSessionReplayed(handle.heavy, lease);
+			assertLease(lease);
+			return handle;
+		}
+		let promise: Promise<HeavyHandle>;
+		promise = (async (): Promise<HeavyHandle> => {
+			const captured: CapturedHeavy = { tools: new Map(), commands: new Map(), handlers: new Map(), shortcuts: new Map() };
+			let replayCtx: ExtensionContext | null = null;
+			let cleaned = false;
+			const cleanupCandidate = async (): Promise<void> => {
+				const shutdown = lease.shutdown;
+				const cleanupCtx = shutdown?.ctx ?? replayCtx;
+				if (!cleanupCtx || cleaned) return;
+				cleaned = true;
+				try {
+					await dispatchHandlers(captured, "session_shutdown", shutdown?.event ?? { type: "session_shutdown", reason: "quit" }, cleanupCtx);
+				} catch (cleanupError) {
+					console.error("[pi-web-access] Failed to clean rejected lazy candidate:", cleanupError);
+				}
+			};
+			try {
 				const mod = await import("./index-heavy.js");
+				assertLease(lease);
 				await mod.default(createHeavyProxy(pi, captured));
-				loadedHeavy = captured;
-				await replayCurrentSession(captured);
-				return captured;
-			})();
-		}
-		return heavyPromise;
+				assertLease(lease);
+				await ensureCurrentSessionReplayed(captured, lease, (ctx) => { replayCtx = ctx; });
+				assertLease(lease);
+				const handle = createHandle(captured, lease);
+				loadedHeavy = handle;
+				return handle;
+			} catch (error) {
+				await cleanupCandidate();
+				throw error;
+			}
+		})();
+		heavyAttempt = { lease, promise };
+		void promise.then(
+			() => undefined,
+			() => { if (heavyAttempt?.promise === promise) heavyAttempt = null; },
+		);
+		return promise;
 	}
 
 	pi.on("session_start", async (event, ctx) => {
+		if (activeLease.retired) activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++, activeLease.cleanupBarrier);
+		const lease = activeLease;
+		await waitForPriorCleanup(lease);
 		const generation = ++lifecycleGeneration;
-		sessionSnapshot = { eventName: "session_start", event, ctx, generation };
-		if (loadedHeavy) {
-			replayedGeneration = generation;
-			await dispatchHandlers(loadedHeavy, "session_start", event, ctx);
-		}
+		sessionSnapshot = { eventName: "session_start", event, ctx, generation, lease };
+		if (loadedHeavy) await ensureCurrentSessionReplayed(loadedHeavy.heavy, lease);
 	});
 
 	pi.on("session_tree", async (event, ctx) => {
+		const lease = activeLease;
+		if (lease.retired) return;
+		await lease.priorCleanup;
+		if (activeLease !== lease || lease.retired) return;
 		const generation = ++lifecycleGeneration;
-		sessionSnapshot = { eventName: "session_tree", event, ctx, generation };
-		if (loadedHeavy) {
-			replayedGeneration = generation;
-			await dispatchHandlers(loadedHeavy, "session_tree", event, ctx);
-		}
+		sessionSnapshot = { eventName: "session_tree", event, ctx, generation, lease };
+		if (loadedHeavy) await ensureCurrentSessionReplayed(loadedHeavy.heavy, lease);
 	});
 
 	pi.on("session_shutdown", async (event, ctx) => {
-		++lifecycleGeneration;
-		if (loadedHeavy) {
-			await dispatchHandlers(loadedHeavy, "session_shutdown", event, ctx);
-		}
+		const lease = activeLease;
+		const generation = ++lifecycleGeneration;
+		const shutdown = { event, ctx, generation };
+		retireLifecycleLease(lease, shutdown);
+		const retiredHeavy = loadedHeavy?.heavy ?? null;
+		const retiredAttempt = heavyAttempt?.lease === lease ? heavyAttempt.promise : null;
+		const retiredReplay = replayAttempt?.lease === lease ? replayAttempt.promise : null;
 		sessionSnapshot = null;
-		replayedGeneration = lifecycleGeneration;
+		heavyAttempt = null;
+		loadedHeavy = null;
+		replayAttempt = null;
+		replayedGeneration = generation;
+		const publishedCleanup = retiredHeavy
+			? dispatchHandlers(retiredHeavy, "session_shutdown", event, ctx)
+			: Promise.resolve();
+		const retainedCleanup = retainSettledLifecycleCleanup(lease, [publishedCleanup, retiredAttempt, retiredReplay]);
+		try {
+			await publishedCleanup;
+		} finally {
+			await retainedCleanup;
+		}
+	});
+
+	pi.on("tool_result", (event) => {
+		if (isAllFailedWebResult(event.toolName, event.details)) return { isError: true };
 	});
 
 	const shortcuts = getInitialShortcutConfig();
@@ -165,10 +307,12 @@ export default function webAccess(pi: ExtensionAPI) {
 		pi.registerShortcut(shortcut, {
 			description: name === "curate" ? "Open web search curator" : "Show web search activity",
 			handler: async (ctx) => {
-				const heavy = await loadHeavy();
-				const handler = heavy.shortcuts.get(shortcut)?.handler;
+				const handle = await loadHeavy();
+				handle.assertCurrent();
+				const handler = handle.heavy.shortcuts.get(shortcut)?.handler;
 				if (!handler) throw new Error(`Web access shortcut implementation not found: ${shortcut}`);
 				await handler(ctx);
+				handle.assertCurrent();
 			},
 		});
 	}
@@ -189,7 +333,7 @@ export default function webAccess(pi: ExtensionAPI) {
 			workflow: Type.Optional(Type.String({ enum: ["none", "summary-review"], description: "Search workflow mode: none = no curator, summary-review = open curator with auto summary draft (default)" })),
 		}),
 		execute: (...args) => executeHeavyTool(loadHeavy, "web_search", args),
-		renderResult: (...args) => renderHeavyToolResult(loadedHeavy, "web_search", args),
+		renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "web_search", args),
 		renderCall(args, theme) {
 			const input = args as { query?: string; queries?: string[] };
 			const label = input.queries?.length ? `${input.queries.length} queries` : input.query ?? "(no query)";
@@ -207,7 +351,7 @@ export default function webAccess(pi: ExtensionAPI) {
 			maxTokens: Type.Optional(Type.Integer({ minimum: 1000, maximum: 50000, description: "Maximum tokens of code/documentation context to return (default: 5000)" })),
 		}),
 		execute: (...args) => executeHeavyTool(loadHeavy, "code_search", args),
-		renderResult: (...args) => renderHeavyToolResult(loadedHeavy, "code_search", args),
+		renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "code_search", args),
 	});
 
 	pi.registerTool({
@@ -225,7 +369,7 @@ export default function webAccess(pi: ExtensionAPI) {
 			model: Type.Optional(Type.String({ description: "Override the Gemini model for video/YouTube analysis." })),
 		}),
 		execute: (...args) => executeHeavyTool(loadHeavy, "fetch_content", args),
-		renderResult: (...args) => renderHeavyToolResult(loadedHeavy, "fetch_content", args),
+		renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "fetch_content", args),
 	});
 
 	pi.registerTool({
@@ -241,7 +385,7 @@ export default function webAccess(pi: ExtensionAPI) {
 			urlIndex: Type.Optional(Type.Number({ description: "Get content for URL at index" })),
 		}),
 		execute: (...args) => executeHeavyTool(loadHeavy, "get_search_content", args),
-		renderResult: (...args) => renderHeavyToolResult(loadedHeavy, "get_search_content", args),
+		renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "get_search_content", args),
 	});
 
 	for (const [name, description] of [

package/dist/builtin/web-access/lifecycle-lease.ts

@@ -0,0 +1,38 @@
+export interface LifecycleLease<TShutdown> {
+	readonly id: number;
+	readonly priorCleanup: Promise<void>;
+	retired: boolean;
+	shutdown: TShutdown | null;
+	cleanupBarrier: Promise<void>;
+}
+
+export function createLifecycleLease<TShutdown>(
+	id: number,
+	priorCleanup: Promise<void> = Promise.resolve(),
+): LifecycleLease<TShutdown> {
+	return { id, priorCleanup, retired: false, shutdown: null, cleanupBarrier: priorCleanup };
+}
+
+export function retireLifecycleLease<TShutdown>(lease: LifecycleLease<TShutdown>, shutdown: TShutdown): void {
+	if (lease.retired) return;
+	lease.retired = true;
+	lease.shutdown = shutdown;
+}
+
+export function retainSettledLifecycleCleanup<TShutdown>(
+	lease: LifecycleLease<TShutdown>,
+	cleanup: readonly (Promise<unknown> | null)[],
+): Promise<void> {
+	const previousCleanup = lease.cleanupBarrier;
+	const pendingCleanup = cleanup.filter((task): task is Promise<unknown> => task !== null);
+	lease.cleanupBarrier = Promise.allSettled([previousCleanup, ...pendingCleanup]).then(() => undefined);
+	return lease.cleanupBarrier;
+}
+
+export function assertCurrentLifecycleLease<TShutdown>(
+	current: LifecycleLease<TShutdown>,
+	expected: LifecycleLease<TShutdown>,
+	message: string,
+): void {
+	if (current !== expected || expected.retired) throw new Error(message);
+}

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.5-alpha.8",
+  "version": "0.9.5",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [
@@ -31,7 +31,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.80.3"
+    "@earendil-works/pi-tui": "^0.80.6"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/web-access/result-renderers.ts

@@ -1,5 +1,5 @@
 import type { ToolDefinition } from "@bastani/atomic";
-import { Box, Text } from "@mariozechner/pi-tui";
+import { Box, Text } from "@earendil-works/pi-tui";
 import { formatSeconds } from "./utils.js";
 
 type ToolResultRenderer = NonNullable<ToolDefinition["renderResult"]>;

package/dist/builtin/web-access/summary-review.ts

@@ -1,4 +1,4 @@
-import { complete, getModel, type Message, type Model } from "@mariozechner/pi-ai/compat";
+import { complete, getModel, type Message, type Model } from "@earendil-works/pi-ai/compat";
 import type { ExtensionContext } from "@bastani/atomic";
 import type { QueryResultData } from "./storage.js";
 

package/dist/builtin/web-access/web-search-activity.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@bastani/atomic";
-import { Text, truncateToWidth } from "@mariozechner/pi-tui";
+import { Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { activityMonitor, type ActivityEntry } from "./activity.js";
 
 export interface ActivityWidgetState {

package/dist/builtin/web-access/web-search-return.ts

@@ -48,6 +48,7 @@ function storeAndPublishSearch(pi: ExtensionAPI, results: QueryResultData[]): st
 export function buildSearchReturn(opts: SearchReturnOptions, deps: BuildSearchReturnDeps): SearchReturnPayload {
 	const sc = opts.results.filter(r => !r.error).length;
 	const tr = opts.results.reduce((sum, r) => sum + r.results.length, 0);
+	const allFailed = opts.results.length > 0 && sc === 0;
 
 	const hasApprovedSummary = typeof opts.approvedSummary === "string" && opts.approvedSummary.trim().length > 0;
 	let output = "";
@@ -98,6 +99,12 @@ export function buildSearchReturn(opts: SearchReturnOptions, deps: BuildSearchRe
 	return {
 		content: [{ type: "text", text: output.trim() }],
 		details: {
+			...(allFailed ? {
+				outcome: "all_failed",
+				stage: "provider_execution",
+				failedQueries: opts.results.length,
+				error: `All ${opts.results.length} search provider request(s) failed`,
+			} : {}),
 			queries: opts.queryList,
 			queryCount: opts.queryList.length,
 			successfulQueries: sc,

package/dist/builtin/web-access/web-search-summary.ts

@@ -1,4 +1,4 @@
-import { complete, getModel, type Model } from "@mariozechner/pi-ai/compat";
+import { complete, getModel, type Model } from "@earendil-works/pi-ai/compat";
 import type { QueryResultData } from "./storage.js";
 import {
 	buildDeterministicSummary,

package/dist/builtin/web-access/web-search-tool.ts

@@ -1,6 +1,6 @@
 import type { ExtensionAPI } from "@bastani/atomic";
-import { Text } from "@mariozechner/pi-tui";
-import { StringEnum } from "@mariozechner/pi-ai/compat";
+import { Text } from "@earendil-works/pi-tui";
+import { StringEnum } from "@earendil-works/pi-ai/compat";
 import { Type } from "typebox";
 import { renderWebSearchResult } from "./result-renderers.js";
 import type { ExtractedContent } from "./extract.js";
@@ -243,6 +243,7 @@ export function registerWebSearchTool(pi: ExtensionAPI, deps: RegisterWebSearchT
 					}
 					if (inlineContent) allInlineContent.push(...inlineContent);
 				} catch (err) {
+					signal?.throwIfAborted();
 					const message = err instanceof Error ? err.message : String(err);
 					const requestedProvider = typeof resolvedProvider === "string" && resolvedProvider !== "auto"
 						? resolvedProvider
@@ -251,6 +252,7 @@ export function registerWebSearchTool(pi: ExtensionAPI, deps: RegisterWebSearchT
 				}
 			}
 
+			signal?.throwIfAborted();
 			return deps.buildSearchReturn({
 				queryList,
 				results: searchResults,

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,92 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.5] - 2026-07-11
+
+### Breaking Changes
+
+- Hardened the builtin `goal` and `ralph` review contracts against objective-drift failures: review findings now require `objective_alignment`, Goal and Ralph review decisions require `requirements_traceability`, and reviewer approval rejects empty or non-proven traceability. Consumers that parse or synthesize these structured reviewer outputs must emit the new required fields.
+
+### Added
+
+- Added model-capability-aware `max` reasoning suffix support throughout workflow stage schemas, fallback candidates, authoring contracts, and TUI status labels ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Added `git_worktree_dir` to the builtin `goal` workflow with Ralph-parity input binding so Goal runs can create or reuse a repository worktree from `base_branch` while preserving the invoking repo-relative cwd for worker, reviewer, and optional final PR stages.
+- Added immutable `acceptance_criteria` to the builtin `goal` and `ralph` workflows. Goal persists it in the ledger/model-visible projection and final reports; Ralph threads it through research, orchestrator, and reviewer prompts next to the literal objective contract. Orchestrators should pass the original task text when launching follow-up Goal or Ralph runs from reviewer findings.
+- Added literal-contract prompt language shared by `goal` and `ralph`, objective-alignment arbitration for reviewer findings, non-blocking treatment for `beyond_objective`/`contradicts_objective` findings, and clause-by-clause requirements traceability so reviewer evidence must map directly back to the objective/acceptance criteria.
+- Added attempt-first E2E guidance for `goal` and `ralph`: workers/reviewers must not skip playwright-cli/tmux validation because credentials or auth are merely assumed missing, and skipped E2E must cite the exact attempted commands and observed failure output.
+
+### Changed
+
+- Aligned the workflows extension peer dependency with upstream `pi-tui` `^0.80.6` as part of the consolidated Pi sync ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Replaced workflow-default routing with intent-first least orchestration: interactive exploration stays inline, bounded specialist delegation uses subagents, and workflows are reserved for clearly delegated autonomous jobs that benefit from long-running/background execution or durable stages, artifacts, resumability, HIL, gates, retries, or loops. Explicit loop and stop-condition requests remain key workflow signals when the user delegates execution, so convergence and evidence are tracked. Guidance now documents builtin/project/user/package workflows, direct one-off shapes, and the option to author a custom TypeScript workflow inline whenever that shape best achieves a workflow-fit task.
+- Changed the builtin `ralph` workflow review fan-out from three reviewers to two (`reviewer-a` and `reviewer-b`), removing `reviewer-c` and its GLM-led model chain while keeping unanimous approval across the remaining reviewers.
+- Aligned durable mid-chat workflow resumes with the standard pause/resume continuation prompt so resumed stages continue only when their scoped work remains unfinished.
+- Improved workflow extension startup by seeding only the bundled startup registry during extension registration/session start, then loading user, project, and package workflow modules in the background or when `/workflow` commands and workflow tool actions need the full registry.
+- Tightened the workflow-stage resume continuation prompt so resumed agents continue interrupted work only when needed and stop when the original or user-redefined task is already complete.
+- Updated the bundled `impeccable` skill from upstream 3.8.0 to 3.9.1, adding native platform guidance, hooks support, expanded detector rules, and the latest reference/script fixes ([#1696](https://github.com/bastani-inc/atomic/issues/1696)).
+- Changed the Claude Fable 5 reasoning level from `xhigh` to `high` across all builtin workflow model chains (`ralph` prompt-engineer/orchestrator/reviewer-a/reviewer-b/reviewer-c, `goal` reviewer, `deep-research-codebase` planner, and `open-claude-design`), covering both the native `anthropic/claude-fable-5` entries and their OpenRouter mirrors.
+- Changed the Claude Opus 4.8 reasoning level from `xhigh` to `high` across the same builtin workflow model chains, covering the `github-copilot/claude-opus-4.8 (1m)`, `anthropic/claude-opus-4-8`, and `openrouter/anthropic/claude-opus-4-8` entries; Opus 4.8 entries already at `medium`/`low` value points are unchanged.
+- Hardened the builtin `goal` and `ralph` loops against spec-vs-objective drift on enumerated error behavior (observed in an eval trace where an adversarial reviewer flagged a task-mandated diagnostic as a spec-conformance defect and the fix cycle silently reinterpreted the ambiguous input as valid behavior, losing the required error): the shared literal objective contract now instructs workers and reviewers to prefer loud errors over silent reinterpretation — when the objective/acceptance criteria enumerate required error conditions, messages, or rejections, each enumerated error gets the widest plausible trigger surface, ambiguous or unspecified inputs near an enumerated error case default to raising that error even when external spec knowledge says the input is valid, and narrowing an enumerated error's trigger surface requires explicit contract or pre-existing required-test demand. Both loops' reviewer bug-selection guidelines now forbid using external spec/standard conformance alone to flag a wide trigger surface for a contract-enumerated error as a defect; such spec-vs-objective tension must be classified `beyond_objective` instead of becoming a blocking finding that steers the implementation away from the contract's errors.
+- Extracted the Ralph reviewer prompt into `builtin/ralph-reviewer-prompt.ts` (`renderRalphReviewerPrompt`) and deduplicated the new reviewer guard into a shared `REVIEWER_SPEC_VS_OBJECTIVE_GUARD` constant consumed by both the Goal and Ralph reviewer prompts, keeping `ralph-runner.ts` under the repository's 500-line file gate. No behavioral change beyond the guard itself.
+- Hardened the workflow-tool prompt guidance against inline analysis-paralysis drift (observed in eval transcripts where an agent spent ~2 hours of pure reconnaissance on a workflow-fit task without ever considering a workflow): the agent must now decide and state the inline-vs-workflow execution mode before its first tool call (reconnaissance explicitly counts as inline execution), budget pre-workflow scoping to a few quick reads that only sharpen the objective and validation criteria, course-correct after roughly ten deliverable-free exploration tool calls (or repeated "let me verify one more thing" loops) by writing findings to a context file and handing off to the best-fit workflow via `reads` (named or user-defined workflows discovered with `action: "list"` first, builtin `goal`/`ralph` as fallbacks when nothing more specific fits), and treat sunk inline research as transferable via files rather than a reason to stay inline. Mirrored the same "Decide before you explore" and "Course-correct instead of drifting" guidance in `docs/workflows.md` under "When to Use Workflows".
+- Refreshed the July 2026 frontier model rosters for the builtin Ralph, Goal, deep-research-codebase, and open-claude-design workflows: critical prompt-engineering, orchestration, planning, and review chains now use high-capacity Fable 5 `:xhigh` primaries or fallbacks with GPT-5.5, Opus 4.8 long-context `:xhigh`, GLM-5.2, and OpenRouter Fugu Ultra coverage, while Ralph research stays on the measured GPT-5.5 `:medium` / Fable 5 `:low` performance-per-dollar path and reviewer-C remains GLM-led for diversity.
+- Updated workflow model-option schema documentation to show `:xhigh` long-context examples and kept the fallback fixtures aligned so unsupported direct `sakana/` IDs stay out of workflow chains while the valid `openrouter/sakana/fugu-ultra:high` mirror remains available.
+
+### Fixed
+
+- Fixed archived/read-only workflow transcript views to use the standard responsive footer and Ctrl+T copy-mode toggle/status, enabling normal terminal or tmux text selection while preserving Escape and Ctrl+D navigation ([#1706](https://github.com/bastani-inc/atomic/issues/1706)).
+- Fixed workflow tool validation coercing `output: false` into the literal file path `false`, so disabled output remains disabled across direct task, parallel task, and chain execution.
+- Hardened the bundled `impeccable` skill's local detector/live scripts against CodeQL-reported sanitization and command-injection patterns by tightening HTML block stripping, avoiding shell interpolation for `git check-ignore`, escaping Svelte preview CSS selectors correctly, and fixing the `ms*` JSX style prefix conversion.
+- Fixed lazy workflow startup follow-through so `session_start` loads only workflow config before restore/cleanup, discovery diagnostics are reported after deferred discovery settles, failed lazy discovery attempts are retryable, direct workflow-tool `task`/`tasks`/`chain` runs bypass full workflow discovery, named workflow-tool runs and failed-run resume re-resolve their runtime after discovery, paused/current live-run resume and live resume pickers avoid registry discovery, failed/durable resume still loads resources before registry-dependent lookups, and command autocomplete falls back to current/admin completions when lazy discovery fails without evaluating workflow modules on the startup path.
+- Fixed workflow lazy-startup session generation so session restarts and shutdowns invalidate in-flight background discovery before it can publish stale workflow registries into later sessions.
+- Fixed workflow failure finalization so structured recoverable auth, rate-limit, and provider-exhaustion metadata captured on the run or its blocking stage (`failedStageId`) no longer allows the top-level run, `/workflow status`, durable status, or lifecycle notice to appear as a successful `completed` state. Goal-like `needs_human`, incomplete, or auth-blocked reducer outputs are still treated as blocked, structured provider/auth fallback exhaustion now preserves an actionable blocked/failure message and resumable metadata, legacy completed snapshots with incomplete returned statuses or structured blocking-stage failures render as blocked, tolerated non-fail-fast branch failures no longer reclassify completed runs, and Goal reviewer-batch fallback exhaustion stops promptly as `needs_human` instead of launching another worker turn.
+- Fixed the fullscreen workflow graph statusline to mirror non-workflow extension statuses, so async/background subagent progress and completion remain visible while the graph overlay is active.
+- Fixed `/workflow resume` and fresh runs for workflows that use reusable `gitWorktreeDir`/`git_worktree_dir` worktrees by persisting the original invocation cwd and resolved reusable-worktree metadata, replaying durable resumes from that original repository context instead of the resumed interactive session cwd, caching repeated per-run reusable-worktree setup, retrying transient read-only Git `rev-parse` timeouts, hardening Git subprocesses against interactive prompts, and reporting exact Git command/cwd/timeout/elapsed/status/signal diagnostics when worktree preflight fails.
+- Fixed builtin `goal` and `ralph` reviewer convergence reporting so review artifacts and reducer/controller decisions now persist explicit parse/convergence summaries (`parsed`, `approved`, `stopReviewLoop`, `nextAction`, `finalActionRemaining`, and diagnostics). Malformed or missing structured reviewer output is surfaced as a parse failure distinct from parsed reviewer rejection/findings; PR/MR/review creation is represented as a post-approval final action when it is the only remaining task; successful reviewer convergence records the final action (`pull-request` or `finish`) without consuming another implementation loop; and the workflow authoring docs, default workflow guidance, and create-spec prompt now tell custom reviewer-gated workflows to model authorized PR, release, deployment, or publication work as final actions rather than implementation blockers while writing local, action-oriented prompts that do not rely on workflow/stage names as hidden context.
+- Fixed workflow stage model fallback for unrecoverable context-window overflow: when Atomic's same-model auto-compaction exhausts its recovery attempt, the stage now advances to the next configured `fallbackModels` tier and, once all tiers are exhausted, stops with the terminal context-overflow error instead of compacting and retrying the same model indefinitely.
+- Fixed workflow controlled-pause ordering around unresolved context overflow: paused stages now honor the pause/resume handshake before surfacing the terminal overflow, and a resume message is not sent over an already-recorded unresolved-overflow signal.
+- Fixed reattached workflow stage fallback after unresolved context overflow: if the restored/resumed model tier exhausts context recovery, fallback now continues with the next tier after that resumed model (or stops terminally when it was the final tier) instead of replaying the primary model.
+- Fixed durable workflow resume hydration so replayed `ctx.parallel`/`ctx.task` fanout keeps its original branch parentage, completed stages restore persisted summaries, timing, session/model metadata, and DBOS/file checkpoints round-trip the richer stage metadata used by status and graph views.
+- Fixed workflow stage chats so attach, exit, and re-attach cycles during an in-flight `subagent` call replay the latest live tool partial result immediately instead of collapsing single, parallel, or chain calls back to the bare `renderCall` title until the next update; stage chats also prefer renderers from the stage's own agent session before falling back to the host chat so nested workflow stages can render tools that the parent chat does not expose. ([#1643](https://github.com/bastani-inc/atomic/issues/1643))
+
+## [0.9.5-alpha.10] - 2026-07-11
+
+### Added
+
+- Added model-capability-aware `max` reasoning suffix support throughout workflow stage schemas, fallback candidates, authoring contracts, and TUI status labels ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
+### Changed
+
+- Aligned the workflows extension peer dependency with upstream `pi-tui` `^0.80.6` as part of the consolidated Pi sync ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Replaced workflow-default routing with intent-first least orchestration: interactive exploration stays inline, bounded specialist delegation uses subagents, and workflows are reserved for clearly delegated autonomous jobs that benefit from long-running/background execution or durable stages, artifacts, resumability, HIL, gates, retries, or loops. Explicit loop and stop-condition requests remain key workflow signals when the user delegates execution, so convergence and evidence are tracked. Guidance now documents builtin/project/user/package workflows, direct one-off shapes, and the option to author a custom TypeScript workflow inline whenever that shape best achieves a workflow-fit task.
+
+- Changed the builtin `ralph` workflow review fan-out from three reviewers to two (`reviewer-a` and `reviewer-b`), removing `reviewer-c` and its GLM-led model chain while keeping unanimous approval across the remaining reviewers.
+
+- Aligned durable mid-chat workflow resumes with the standard pause/resume continuation prompt so resumed stages continue only when their scoped work remains unfinished.
+
+### Fixed
+
+- Fixed archived/read-only workflow transcript views to use the standard responsive footer and Ctrl+T copy-mode toggle/status, enabling normal terminal or tmux text selection while preserving Escape and Ctrl+D navigation ([#1706](https://github.com/bastani-inc/atomic/issues/1706)).
+- Fixed workflow tool validation coercing `output: false` into the literal file path `false`, so disabled output remains disabled across direct task, parallel task, and chain execution.
+
+## [0.9.5-alpha.9] - 2026-07-09
+
+### Changed
+
+- Improved workflow extension startup by seeding only the bundled startup registry during extension registration/session start, then loading user, project, and package workflow modules in the background or when `/workflow` commands and workflow tool actions need the full registry.
+- Tightened the workflow-stage resume continuation prompt so resumed agents continue interrupted work only when needed and stop when the original or user-redefined task is already complete.
+- Updated the bundled `impeccable` skill from upstream 3.8.0 to 3.9.1, adding native platform guidance, hooks support, expanded detector rules, and the latest reference/script fixes ([#1696](https://github.com/bastani-inc/atomic/issues/1696)).
+
+### Fixed
+
+- Hardened the bundled `impeccable` skill's local detector/live scripts against CodeQL-reported sanitization and command-injection patterns by tightening HTML block stripping, avoiding shell interpolation for `git check-ignore`, escaping Svelte preview CSS selectors correctly, and fixing the `ms*` JSX style prefix conversion.
+- Fixed lazy workflow startup follow-through so `session_start` loads only workflow config before restore/cleanup, discovery diagnostics are reported after deferred discovery settles, failed lazy discovery attempts are retryable, direct workflow-tool `task`/`tasks`/`chain` runs bypass full workflow discovery, named workflow-tool runs and failed-run resume re-resolve their runtime after discovery, paused/current live-run resume and live resume pickers avoid registry discovery, failed/durable resume still loads resources before registry-dependent lookups, and command autocomplete falls back to current/admin completions when lazy discovery fails without evaluating workflow modules on the startup path.
+- Fixed workflow lazy-startup session generation so session restarts and shutdowns invalidate in-flight background discovery before it can publish stale workflow registries into later sessions.
+
+- Fixed workflow failure finalization so structured recoverable auth, rate-limit, and provider-exhaustion metadata captured on the run or its blocking stage (`failedStageId`) no longer allows the top-level run, `/workflow status`, durable status, or lifecycle notice to appear as a successful `completed` state. Goal-like `needs_human`, incomplete, or auth-blocked reducer outputs are still treated as blocked, structured provider/auth fallback exhaustion now preserves an actionable blocked/failure message and resumable metadata, legacy completed snapshots with incomplete returned statuses or structured blocking-stage failures render as blocked, tolerated non-fail-fast branch failures no longer reclassify completed runs, and Goal reviewer-batch fallback exhaustion stops promptly as `needs_human` instead of launching another worker turn.
+- Fixed the fullscreen workflow graph statusline to mirror non-workflow extension statuses, so async/background subagent progress and completion remain visible while the graph overlay is active.
+- Fixed `/workflow resume` and fresh runs for workflows that use reusable `gitWorktreeDir`/`git_worktree_dir` worktrees by persisting the original invocation cwd and resolved reusable-worktree metadata, replaying durable resumes from that original repository context instead of the resumed interactive session cwd, caching repeated per-run reusable-worktree setup, retrying transient read-only Git `rev-parse` timeouts, hardening Git subprocesses against interactive prompts, and reporting exact Git command/cwd/timeout/elapsed/status/signal diagnostics when worktree preflight fails.
+
 ## [0.9.5-alpha.8] - 2026-07-08
 
 ### Fixed