@gajae-code/coding-agent 0.5.3 → 0.5.4

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [0.5.4] - 2026-06-17
+
+### Fixed
+
+- Fixed subagent resume returning `not_found` after terminal job eviction removed the in-memory subagent record. Resume descriptors are now retained as durable same-session metadata and rehydrate a resumable record from the saved subagent session file, so ralplan Planner revision passes can resume with fallback metadata instead of forcing a fresh Planner spawn after 0.5.3.
+- `AgentSession` now forwards the live provider session state (`providerSessionState`), session affinity id (`providerSessionId ?? sessionId`), and configured WebSocket transport preference (`preferWebsockets`) into local maintenance one-shot calls — manual/automatic compaction summaries, handoff generation, and tree branch summaries — via a shared `#maintenanceProviderTransport()` helper. Previously these Codex/OpenAI-compatible maintenance calls could fall back to HTTP/SSE and lose `session_id` affinity even when `providers.openaiWebsockets: "on"` routed live turns over WebSocket (#736).
+- Fixed `ollama-cloud` first-event timeouts driving an unbounded, usage-spiking retry loop. The ollama-chat backend (exclusively `ollama-cloud`; local Ollama uses the `openai-responses` API) can stall before its first token even for tiny prompts, surfacing `Provider stream timed out while waiting for the first event`. That message matched the generic transient classifier, which retries forever (capped only on delay), so every continuation re-issued the full request to a billable backend and silently spiked usage — disabling retries was the only workaround. First-event timeouts on the ollama-chat API are now a distinct fail-closed class bounded by `retry.maxRetries`: they still retry transient cold starts a few times, then surface instead of looping. First-party providers keep their existing unbounded first-event-timeout retry behavior (#713).
+- Interactive sessions no longer orphan the `browser` tool's headless/spawned Chrome (and the Python eval kernel) to PID 1 when killed by a signal. The interactive entry now registers a bounded, idempotent `postmortem` cleanup (`session-subprocess-teardown`) that runs `AgentSession.disposeChildSubprocesses()` on `SIGINT`/`SIGTERM`/`SIGHUP`, force-releasing the session's browser tabs (`kill:true`) and disposing its Python/JS kernels — the teardown the graceful `/quit` (`dispose()`) path already performs but that an external `kill`/terminal-close used to bypass. Headless `disposeBrowserHandle` now also SIGTERM/SIGKILLs the captured Chrome process tree as a fallback when forced, so a wedged renderer can't survive a bounded CDP `close()`; graceful release behavior is unchanged. The teardown is time-boxed (5s) so a stuck subprocess can't hang process exit (#698).
+
 ## [0.5.3] - 2026-06-16
 
 ### Added

package/dist/types/config/model-profiles.d.ts

@@ -4,6 +4,16 @@ export type ModelProfileRole = GjcModelAssignmentTargetId;
 export interface ModelProfileDefinition {
     name: string;
     requiredProviders: string[];
+    /**
+     * Optional groups of providers that are interchangeable fallbacks.
+     * Each group is an array of provider ids where at least one must be
+     * authenticated. Providers NOT in any group are treated as strict
+     * requirements (all must be authenticated).
+     *
+     * Example: `[["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"]]`
+     * means any single xiaomi credential satisfies the group.
+     */
+    alternativeProviderGroups?: readonly (readonly string[])[];
     modelMapping: Partial<Record<ModelProfileRole, string>>;
     source: "builtin" | "user";
 }

package/dist/types/modes/interactive-mode.d.ts

@@ -93,6 +93,7 @@ export declare class InteractiveMode implements InteractiveModeContext {
     locallySubmittedUserSignatures: Set<string>;
     lastSigintTime: number;
     lastEscapeTime: number;
+    lastComposerClearEscapeTime: number;
     shutdownRequested: boolean;
     hookSelector: HookSelectorComponent | undefined;
     hookInput: HookInputComponent | undefined;

package/dist/types/modes/types.d.ts

@@ -100,6 +100,7 @@ export interface InteractiveModeContext {
     locallySubmittedUserSignatures: Set<string>;
     lastSigintTime: number;
     lastEscapeTime: number;
+    lastComposerClearEscapeTime: number;
     shutdownRequested: boolean;
     hookSelector: HookSelectorComponent | undefined;
     hookInput: HookInputComponent | undefined;

package/dist/types/session/agent-session.d.ts

@@ -407,6 +407,18 @@ export declare class AgentSession {
      * Call this when completely done with the session.
      */
     dispose(): Promise<void>;
+    /**
+     * Bounded, best-effort teardown of the subprocess-spawning resources this session
+     * owns: the browser tool's headless/spawned Chrome and the Python eval kernel + JS VM
+     * contexts. Unlike {@link dispose}, this touches only child processes and is time-boxed,
+     * so a top-level `SIGINT`/`SIGTERM`/`SIGHUP` handler can run it without hanging — without
+     * it, an external kill bypasses `dispose()` and orphans Chrome/Python to PID 1 (#698).
+     *
+     * Idempotent: every step is a no-op once the graceful {@link dispose} path has released
+     * the resources. Never throws; per-step failures are logged and the whole run is capped
+     * at `timeoutMs` so a wedged subprocess can't stall process exit.
+     */
+    disposeChildSubprocesses(timeoutMs?: number): Promise<void>;
     /** Full agent state */
     get state(): AgentState;
     /** Current model (may be undefined if not yet selected) */

package/dist/types/session/streaming-output.d.ts

@@ -57,6 +57,13 @@ export interface OutputSinkOptions {
      * relative to the sink (the sink does not catch errors from this callback).
      */
     onRawChunk?: (chunk: string) => void;
+    /**
+     * Opt-in (F21): when true, sanitization + live callback delivery + retention are coalesced over
+     * batched raw chunks instead of run per chunk, bounding sync CPU for many-small-chunk output. The
+     * raw artifact mirror stays byte-correct. Defaults to the PI_OUTPUT_SANITIZE_COALESCE env flag
+     * (default OFF — the per-chunk path is byte-identical to historical behavior).
+     */
+    coalesceSanitize?: boolean;
 }
 export interface TruncationResult {
     content: string;

package/dist/types/web/search/providers/codex.d.ts

@@ -14,12 +14,12 @@ export interface CodexSearchParams {
  * Executes a web search using OpenAI code provider's built-in web search tool.
  *
  * Default-model behavior:
- * - If `PI_OPENAI_CODE_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
+ * - If `PI_CODEX_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
  *   upstream error verbatim.
- * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.4, GPT-5
- *   OpenAI code backend, GPT-5, …) and retry the next candidate only when OpenAI code backend returns the
+ * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.5, GPT-5.4,
+ *   GPT-5 code backend, …) and retry the next candidate only when OpenAI code backend returns the
  *   known 400 "model is not supported" family. This avoids selecting
- *   `gpt-5-OpenAI code backend-mini` first on ChatGPT accounts, which OpenAI rejects.
+ *   `gpt-5-codex-mini` first on ChatGPT accounts, which OpenAI rejects.
  */
 export declare function searchCodex(params: SearchParams): Promise<SearchResponse>;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.5.3",
+	"version": "0.5.4",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gaebal-gajae.dev",
 	"author": "Yeachan-Heo",
@@ -51,12 +51,12 @@
 		"@agentclientprotocol/sdk": "0.21.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.5.3",
-		"@gajae-code/agent-core": "0.5.3",
-		"@gajae-code/ai": "0.5.3",
-		"@gajae-code/natives": "0.5.3",
-		"@gajae-code/tui": "0.5.3",
-		"@gajae-code/utils": "0.5.3",
+		"@gajae-code/stats": "0.5.4",
+		"@gajae-code/agent-core": "0.5.4",
+		"@gajae-code/ai": "0.5.4",
+		"@gajae-code/natives": "0.5.4",
+		"@gajae-code/tui": "0.5.4",
+		"@gajae-code/utils": "0.5.4",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/async/job-manager.ts

@@ -118,6 +118,12 @@ export interface ResumeDescriptor {
 	data: unknown;
 }
 
+function sessionFileFromResumeDescriptorData(data: unknown): string | null {
+	if (typeof data !== "object" || data === null) return null;
+	const sessionFile = (data as { sessionFile?: unknown }).sessionFile;
+	return typeof sessionFile === "string" && sessionFile.trim().length > 0 ? sessionFile : null;
+}
+
 /** A pending resume awaiting a free concurrency slot. */
 interface ResumeQueueEntry {
 	subagentId: string;
@@ -595,11 +601,31 @@ export class AsyncJobManager {
 		record.modelFellBack = model.modelFellBack;
 	}
 
+	#recordFromResumeDescriptor(subagentId: string, filter?: AsyncJobFilter): SubagentRecord | undefined {
+		const descriptor = this.getResumeDescriptor(subagentId, filter);
+		if (!descriptor) return undefined;
+		const sessionFile = sessionFileFromResumeDescriptorData(descriptor.data);
+		const record: SubagentRecord = {
+			subagentId: descriptor.subagentId,
+			ownerId: descriptor.ownerId,
+			currentJobId: null,
+			historicalJobIds: [],
+			status: "completed",
+			sessionFile,
+			resumable: sessionFile !== null,
+		};
+		this.#subagentRecords.set(record.subagentId, record);
+		return record;
+	}
+
 	getSubagentRecord(subagentId: string, filter?: AsyncJobFilter): SubagentRecord | undefined {
-		const rec = this.#subagentRecords.get(subagentId.trim());
-		if (!rec) return undefined;
-		if (filter?.ownerId && rec.ownerId !== filter.ownerId) return undefined;
-		return rec;
+		const trimmed = subagentId.trim();
+		const rec = this.#subagentRecords.get(trimmed);
+		if (rec) {
+			if (filter?.ownerId && rec.ownerId !== filter.ownerId) return undefined;
+			return rec;
+		}
+		return this.#recordFromResumeDescriptor(trimmed, filter);
 	}
 
 	getSubagentRecords(filter?: AsyncJobFilter): SubagentRecord[] {
@@ -696,8 +722,6 @@ export class AsyncJobManager {
 		if (rec.status === "paused" || rec.status === "queued") return;
 		this.#liveHandles.delete(rec.subagentId);
 		this.#subagentProgress.delete(rec.subagentId);
-		this.#resumeDescriptors.delete(rec.subagentId);
-		this.#subagentRecords.delete(rec.subagentId);
 	}
 
 	#markRecordTerminal(jobId: string, status: "completed" | "failed" | "cancelled"): void {

package/src/config/model-profile-activation.ts

@@ -61,6 +61,49 @@ function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<stri
 	return replacement && profiles.has(replacement) ? replacement : profileName;
 }
 
+/**
+ * Rewrite a selector only within the selector provider's own alternative group.
+ * Strict providers are never rewritten, and authenticated alternative providers
+ * keep their original selectors.
+ */
+function rewriteSelectorProvider(
+	selector: string,
+	authenticatedProviders: ReadonlySet<string>,
+	alternativeGroups: readonly (readonly string[])[],
+): string {
+	const slash = selector.indexOf("/");
+	if (slash < 0) return selector;
+
+	const provider = selector.substring(0, slash);
+	if (authenticatedProviders.has(provider)) return selector;
+
+	const group = alternativeGroups.find(candidates => candidates.includes(provider));
+	if (!group) return selector;
+
+	const replacement = group.find(candidate => authenticatedProviders.has(candidate));
+	if (!replacement) return selector;
+
+	return replacement + selector.substring(slash);
+}
+
+function rewriteBindingsProviders(
+	bindings: { defaultSelector?: string; agentModelOverrides: Record<string, string> },
+	authenticatedProviders: ReadonlySet<string>,
+	alternativeGroups: readonly (readonly string[])[],
+): { defaultSelector?: string; agentModelOverrides: Record<string, string> } {
+	return {
+		defaultSelector: bindings.defaultSelector
+			? rewriteSelectorProvider(bindings.defaultSelector, authenticatedProviders, alternativeGroups)
+			: undefined,
+		agentModelOverrides: Object.fromEntries(
+			Object.entries(bindings.agentModelOverrides).map(([role, sel]) => [
+				role,
+				rewriteSelectorProvider(sel, authenticatedProviders, alternativeGroups),
+			]),
+		),
+	};
+}
+
 export async function prepareModelProfileActivation(
 	options: PrepareModelProfileActivationOptions,
 ): Promise<PreparedModelProfileActivation> {
@@ -72,19 +115,44 @@ export async function prepareModelProfileActivation(
 		throw new Error(`Unknown model profile "${options.profileName}". Available profiles: ${available}`);
 	}
 
+	const allProviders = aggregateModelProfileRequiredProviders(profile.requiredProviders, profile);
+	const alternativeGroups = profile.alternativeProviderGroups ?? [];
+	const alternativeSet = new Set(alternativeGroups.flat());
+
 	const missingProviders: string[] = [];
-	for (const provider of aggregateModelProfileRequiredProviders(profile.requiredProviders, profile)) {
+	const authenticatedProviders: string[] = [];
+	for (const provider of allProviders) {
 		const apiKey = await options.modelRegistry.getApiKeyForProvider(provider, options.session.sessionId);
 		if (!isAuthenticated(apiKey)) {
 			missingProviders.push(provider);
+		} else {
+			authenticatedProviders.push(provider);
 		}
 	}
-	if (missingProviders.length > 0) {
+
+	// Check strict (non-alternative) providers — all must be authenticated.
+	const strictMissing = missingProviders.filter(p => !alternativeSet.has(p));
+	if (strictMissing.length > 0) {
+		throw new Error(formatModelProfileCredentialError(options.profileName, strictMissing));
+	}
+
+	// Check alternative groups — at least one provider per group must be authenticated.
+	for (const group of alternativeGroups) {
+		const groupAuthenticated = group.some(p => authenticatedProviders.includes(p));
+		if (!groupAuthenticated) {
+			throw new Error(formatModelProfileCredentialError(options.profileName, [...group]));
+		}
+	}
+
+	if (authenticatedProviders.length === 0) {
 		throw new Error(formatModelProfileCredentialError(options.profileName, missingProviders));
 	}
 
 	const availableModels = options.modelRegistry.getAll();
-	const bindings = resolveProfileBindings(profile);
+	let bindings = resolveProfileBindings(profile);
+	if (missingProviders.length > 0 && alternativeGroups.length > 0) {
+		bindings = rewriteBindingsProviders(bindings, new Set(authenticatedProviders), alternativeGroups);
+	}
 	const resolvedDefault = bindings.defaultSelector
 		? resolveModelRoleValue(bindings.defaultSelector, availableModels, {
 				settings: options.settings as Settings,

package/src/config/model-profiles.ts

@@ -6,6 +6,16 @@ export type ModelProfileRole = GjcModelAssignmentTargetId;
 export interface ModelProfileDefinition {
 	name: string;
 	requiredProviders: string[];
+	/**
+	 * Optional groups of providers that are interchangeable fallbacks.
+	 * Each group is an array of provider ids where at least one must be
+	 * authenticated. Providers NOT in any group are treated as strict
+	 * requirements (all must be authenticated).
+	 *
+	 * Example: `[["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"]]`
+	 * means any single xiaomi credential satisfies the group.
+	 */
+	alternativeProviderGroups?: readonly (readonly string[])[];
 	modelMapping: Partial<Record<ModelProfileRole, string>>;
 	source: "builtin" | "user";
 }
@@ -46,9 +56,11 @@ const profile = (
 	name: string,
 	requiredProviders: string[],
 	modelMapping: Record<ModelProfileRole, string>,
+	alternativeProviderGroups?: readonly (readonly string[])[],
 ): ModelProfileDefinition => ({
 	name,
 	requiredProviders: aggregateModelProfileRequiredProviders(requiredProviders, { modelMapping }),
+	alternativeProviderGroups,
 	modelMapping,
 	source: "builtin",
 });
@@ -138,20 +150,30 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "xiaomi/mimo-v2.5-pro:medium",
 		architect: "xiaomi/mimo-v2.5-pro:high",
 	}),
-	profile("mimo-medium", ["xiaomi"], {
-		default: "xiaomi/mimo-v2.5-pro:medium",
-		executor: "xiaomi/mimo-v2.5-pro:low",
-		planner: "xiaomi/mimo-v2.5-pro:medium",
-		critic: "xiaomi/mimo-v2.5-pro:high",
-		architect: "xiaomi/mimo-v2.5-pro:xhigh",
-	}),
-	profile("mimo-pro", ["xiaomi"], {
-		default: "xiaomi/mimo-v2.5-pro:xhigh",
-		executor: "xiaomi/mimo-v2.5-pro:medium",
-		planner: "xiaomi/mimo-v2.5-pro:high",
-		critic: "xiaomi/mimo-v2.5-pro:xhigh",
-		architect: "xiaomi/mimo-v2.5-pro:xhigh",
-	}),
+	profile(
+		"mimo-medium",
+		["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"],
+		{
+			default: "xiaomi/mimo-v2.5-pro:medium",
+			executor: "xiaomi/mimo-v2.5-pro:low",
+			planner: "xiaomi/mimo-v2.5-pro:medium",
+			critic: "xiaomi/mimo-v2.5-pro:high",
+			architect: "xiaomi/mimo-v2.5-pro:xhigh",
+		},
+		[["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"]],
+	),
+	profile(
+		"mimo-pro",
+		["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"],
+		{
+			default: "xiaomi/mimo-v2.5-pro:xhigh",
+			executor: "xiaomi/mimo-v2.5-pro:medium",
+			planner: "xiaomi/mimo-v2.5-pro:high",
+			critic: "xiaomi/mimo-v2.5-pro:xhigh",
+			architect: "xiaomi/mimo-v2.5-pro:xhigh",
+		},
+		[["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"]],
+	),
 	profile("grok-eco", ["xai"], {
 		default: "xai/grok-4.3:low",
 		executor: "xai/grok-4.3:minimal",
@@ -292,6 +314,9 @@ const PROFILE_RECOMMENDATIONS: Record<string, string> = {
 	zai: "glm-medium",
 	"kimi-code": "kimi-coding-plan-medium",
 	xiaomi: "mimo-medium",
+	"xiaomi-token-plan-sgp": "mimo-medium",
+	"xiaomi-token-plan-ams": "mimo-medium",
+	"xiaomi-token-plan-cn": "mimo-medium",
 	xai: "grok-medium",
 	"grok-build": "grok-build-pro",
 	cursor: "cursor-medium",

package/src/defaults/gjc/skills/deep-interview/SKILL.md

@@ -39,7 +39,8 @@ Inspired by the [Ouroboros project](https://github.com/Q00/ouroboros) which demo
 
 <Execution_Policy>
 - Ask ONE question at a time -- never batch multiple questions
-- Preserve the user/session language for every user-facing announcement, topology confirmation, option label, and interview question when state includes `language.instruction`; for example Korean initial ideas must receive Korean deep-interview questions unless the user explicitly requests another language
+- Default to English when no language preference is explicit or obvious. Preserve the user/session language for every user-facing announcement, topology confirmation, option label, and interview question when state includes `language.instruction`; do not add language-specific special cases
+- Before emitting any user-facing natural-language prose governed by `language.instruction`, perform one silent, best-effort self-proofread in the preserved session language for obvious spelling, spacing, grammar, inflection/particle, and word-choice errors, using the same language-agnostic pass for whatever language is active rather than special-casing any single language. Apply it only to newly generated prose and never announce the proofreading, show before/after text, apologize for it, or re-emit a corrected copy. Do not alter code blocks or identifiers, file paths, CLI commands, JSON/configuration keys, `ask` metadata keys, table/round structure, fixed labels, numeric scores, component ids, status tokens, user quotes or source text, Phase 0 threshold markers such as `Deep Interview threshold: <resolvedThresholdPercent> (source: <resolvedThresholdSource>)`, or fixed paths such as `.gjc/specs/deep-interview-{slug}.md`; still apply the self-proofread to generated natural-language clauses or cells inside those structures, including Why now rationale, gap text, next-target phrasing, and coverage notes
 - Target the WEAKEST clarity dimension with each question
 - Before Round 1 ambiguity scoring, run a one-time Round 0 topology enumeration gate that confirms the top-level component list and locks it into state
 - Make weakest-dimension targeting explicit every round: name the weakest dimension, state its score/gap, and explain why the next question is aimed there
@@ -96,7 +97,7 @@ Deep Interview threshold: <resolvedThresholdPercent> (source: <resolvedThreshold
    - Substitute `<resolvedThreshold>`, `<resolvedThresholdPercent>`, and `<resolvedThresholdSource>` throughout the remaining instructions before continuing.
    - Include `threshold_source` in the first `gjc state write` payload and preserve it on later state updates; do not edit `.gjc/state` files directly unless an explicit force override is active.
    - Include both threshold and source in the final spec metadata.
-- Read any `language` object from active deep-interview state and carry `language.instruction` forward mechanically. If absent, infer the user/session language from `{{ARGUMENTS}}` only when it is obvious. Do not surprise a Korean session with English questions.
+- Read any `language` object from active deep-interview state and carry `language.instruction` forward mechanically. If absent, default to English unless `{{ARGUMENTS}}` makes another user/session language obvious or the user explicitly requests another language. Do not add language-specific special cases.
 
 ## Phase 1: Initialize
 
@@ -175,6 +176,8 @@ The first line of this announcement MUST be exactly the Phase 0 threshold marker
 > **Project type:** {greenfield|brownfield}
 > **Current ambiguity:** 100% (we haven't started yet)
 
+Before emitting the prose lines in this announcement, apply the `<Execution_Policy>` self-proofread once; keep the required threshold marker and the quoted `{initial_idea}` unchanged.
+
 ## Round 0: Topology Enumeration Gate
 
 Run this gate exactly once after Phase 1 initialization and before any Phase 2 ambiguity scoring. The goal is to lock the **shape** of the user's scope before depth-first Socratic questioning can overfit to the most-described component.
@@ -293,6 +296,8 @@ Round {n} | Component: {target_component_name} | Targeting: {weakest_dimension}
 
 Options should include contextually relevant choices plus free-text, translated/localized according to `language.instruction` when present.
 
+After applying `language.instruction` to the visible question, options, and generated rationale, apply the self-proofread once to new prose only; preserve only the Round/Component/Targeting/Ambiguity line structure, fixed labels, numeric ambiguity value, component/target identifiers, and `deepInterview.*` metadata keys. Do not exempt generated natural-language rationale such as Why now.
+
 When calling `ask`, SHOULD include optional structured metadata so the runtime can record the round without manual state writes: `deepInterview.round_id?`, `deepInterview.round`, `deepInterview.component`, `deepInterview.dimension`, and `deepInterview.ambiguity`. Keep this metadata aligned with the visible Round/Component/Targeting/Ambiguity line; if metadata cannot be supplied, the legacy formatted question text remains the fallback.
 
 ### Step 2b′: Auto-Answer Opted-Out Questions
@@ -436,6 +441,8 @@ Round {n} complete.
 
 Apply `language.instruction` when present before showing this progress report so status text, gaps, and next-target phrasing stay in the preserved session language.
 
+Then apply the self-proofread once to narrative status text, generated prose cells, gaps, and next-target phrasing; preserve only table structure, fixed status labels, scores, weights, component ids, and trigger tokens.
+
 ### Step 2e: Update State
 
 Update state in two phases. The `ask` answer is first recorded by the runtime as an `answered` shell. Scoring then enriches the same round record to `scored` with global scores, per-component `topology.components[].clarity_scores`, `topology.components[].weakest_dimension`, trigger metadata, established-facts changes, ontology snapshot, `topology.last_targeted_component_id`, `auto_researched_rounds`, `auto_answered_rounds`, and `architect_failures`. When `deepInterview` ask metadata is present, no manual per-round `gjc state write` is required for the answer shell; only scoring enrichment/state maintenance remains. When metadata is absent, use the legacy `gjc state write` path to persist the new round and never patch `.gjc/state` directly unless an explicit force override is active.
@@ -486,6 +493,7 @@ When ambiguity ≤ threshold (or hard cap / early exit):
 
 1. **Generate the specification** using opus model with the prompt-safe transcript. If the full interview transcript or initial context is too large, include the summary plus all concrete decisions, acceptance criteria, unresolved gaps, and ontology snapshots; never overflow the prompt with raw oversized context.
    - Apply `language.instruction` when present so user-facing prose in the spec preserves the session language; keep code identifiers, file paths, commands, JSON/settings keys, and quoted source text unchanged.
+   - Apply the self-proofread once to newly generated spec prose before persistence, including generated natural-language table cells such as coverage notes, while preserving transcript answers, quoted/source text, code identifiers, file paths, commands, JSON/settings keys, table structure/fixed labels, and `.gjc/specs/deep-interview-{slug}.md` unchanged.
 2. **Write the final spec through the workflow CLI**: persist the artifact at `.gjc/specs/deep-interview-{slug}.md`
    - Always use this exact final spec path. Do not write temporary working files to the repo root or other ad hoc paths; repos may allowlist `.gjc/` for planning artifacts while protecting product branches.
    - Use the native deep-interview write command with `--write --stage final --slug {slug} --spec <markdown-or-path> [--json]` for artifact and state persistence; direct `.gjc/` file edits are forbidden unless an explicit force override is active.
@@ -785,6 +793,7 @@ Why bad: 45% ambiguity means nearly half the requirements are unclear. The mathe
 <Final_Checklist>
 - [ ] Phase 0 ran before anything: threshold resolved and first line emitted as `Deep Interview threshold: <resolvedThresholdPercent> (source: <resolvedThresholdSource>)`; state and spec metadata record both `threshold` and `threshold_source`
 - [ ] `language.instruction` preserved across announcements, questions, options, progress reports, and spec prose when present
+- [ ] User-facing natural-language prose, including generated prose clauses/cells inside round lines or tables, was silently self-proofread once according to `language.instruction`, while code/paths/commands/keys/table or round structure/fixed labels/status tokens/quotes/threshold markers/fixed paths remained unchanged
 - [ ] Oversized initial context/history summarized before scoring, question generation, spec generation, or handoff
 - [ ] Round 0 topology gate completed before scoring; `topology.confirmed_at` persisted
 - [ ] Ambiguity scored and displayed every round, naming the weakest component/dimension target (rotating across active components when N > 1)

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -94,7 +94,7 @@ Follow the Plan skill's full documentation for consensus mode details.
 
 The Planner is a **same-session persisted subagent**: launched detached once, awaited before the Architect, then **resumed** with consolidated Architect + Critic feedback on every re-review pass instead of being re-spawned. The Architect and Critic stay **fresh, independent spawns each pass** so their verdicts remain reproducible from their pass artifacts alone. Do NOT modify the subagent control surface; this orchestration uses the existing `subagent` resume/steer controls only.
 
-**Persistence boundary:** this is same-parent, active-session continuity only. Resumability depends on the in-memory subagent record (and a persistent parent session — an in-memory parent yields `resumable:false`), not just a session file. The `.gjc` run-state record is an audit/routing hint, NOT a durable cross-process subagent registry. After a process restart, a missing record, or any unavailable/failed resume, use the fresh Planner fallback.
+**Persistence boundary:** this is same-parent, active-session continuity only. Resumability depends on the manager's retained subagent resume metadata and a persistent parent session (an in-memory parent yields `resumable:false`), not just the `.gjc` run-state record. A terminal subagent whose live job record was evicted can still be resumed when its retained resume descriptor points at a saved subagent session file. After a process restart, missing resume metadata, or any unavailable/failed resume, use the fresh Planner fallback.
 
 **Resume routing table** (per re-review pass, when resuming the persisted Planner id):
 
@@ -102,7 +102,7 @@ The Planner is a **same-session persisted subagent**: launched detached once, aw
 |---|---|
 | `running` | `steer`/inject the consolidated feedback to the same id, then await — do NOT fresh-spawn |
 | `queued` | retain/update the queued message or await the same id — do NOT fresh-spawn just because it is queued |
-| `context_unavailable`, `not_found`, `no_runner`, `resume_failed` | fresh Planner spawn for that pass; record the fallback metadata |
+| `context_unavailable`, `not_found`, `no_runner`, `resume_failed` | fresh Planner spawn for that pass; record the fallback metadata. `not_found` should only mean same-session resume metadata is unavailable, not merely that a terminal live job was evicted. |
 | terminal (`completed`/`failed`/`cancelled`) + revision message | resume the same id when context is available; otherwise use the fresh fallback above |
 
 **Recording persisted-Planner metadata** (audit/routing only — never claim `subagent list` proves resumability, since the snapshot does not expose `resumable`). Ride these optional flags on the normal `--write` for the planner/revision stage of the pass:

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -192,7 +192,7 @@ An ultragoal story cannot be checkpointed `complete` until the active agent has
 5. Delegate an `executor` QA/red-team lane to build and run the e2e/read-teaming QA suite appropriate for the story. This lane must try to break the change, not just confirm the happy path. It must start from the approved plan/spec/acceptance criteria, then user-facing contracts, and only then implementation code as supporting evidence. Plan/code mismatches are blockers, not items to paper over with implementation intent.
 6. The executor QA/red-team lane must prove evidence by the real surface under test:
    - GUI/web surfaces require a valid automation transcript plus a non-uniform screenshot. Bare `inlineEvidence` text or typed receipts never prove live GUI/web execution.
-   - CLI surfaces require runtime argv replay: `replaySafe: true`, an allowlisted argv `command`, and replayed normalized stdout matching `recordedStdout`; unsafe commands require audited `replayExempt` metadata plus a structurally valid fallback artifact.
+   - CLI surfaces require runtime argv replay: `replaySafe: true`, an allowlisted argv `command`, and replayed normalized stdout matching `recordedStdout`; unsafe commands require audited `replayExempt` metadata with exact fields `reasonCode`, `reason`, `approvedBy`, and `fallbackArtifactRefs` plus a structurally valid fallback artifact. Allowed `reasonCode` values are exactly `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
    - Native/desktop/tui surfaces require a structurally valid screenshot, PTY capture with terminal control codes, or app-automation transcript.
    - API/package/algorithm/math surfaces require a real artifact file or typed receipt. Bare `inlineEvidence` text alone is not sufficient for any surface.
 7. The executor QA/red-team lane must report a matrix using `executorQa.contractCoverage`, `executorQa.surfaceEvidence`, `executorQa.adversarialCases`, and `executorQa.artifactRefs`. Not-applicable rows are allowed only in `contractCoverage` and `surfaceEvidence`; each `status: "not_applicable"` row requires `contractRef` plus `reason`. `adversarialCases` rows cannot be not-applicable.
@@ -316,7 +316,7 @@ The native `checkpoint --status complete` command rejects missing or shallow gat
 }
 ```
 
-For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"recordedStdout":"ultragoal-cli-ok\n"}`. Use `replayExempt` only for audited unsafe/non-deterministic invocations, with a substantive reason, approver, and same-surface fallback artifacts.
+For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"recordedStdout":"ultragoal-cli-ok\n"}`. Use `replayExempt` only for audited unsafe/non-deterministic invocations, with exact fields `reasonCode`, `reason`, `approvedBy`, and `fallbackArtifactRefs`. `reason` must be substantive and audited, `approvedBy` must identify the verifier, and `fallbackArtifactRefs` must reference same-surface structurally valid fallback artifacts. Allowed `reasonCode` values are exactly `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
 
 ## Review mode
 

package/src/gjc-runtime/deep-interview-runtime.ts

@@ -124,8 +124,8 @@ interface ResolvedDeepInterviewArgs {
 }
 
 interface DeepInterviewLanguagePreference {
-	code: "en" | "ko";
-	label: "English" | "Korean";
+	code: "en" | "user";
+	label: "English" | "User language";
 	source: "explicit-user-request" | "initial-idea";
 	instruction: string;
 }
@@ -239,21 +239,22 @@ function englishLanguagePreference(): DeepInterviewLanguagePreference {
 	};
 }
 
+function userLanguagePreference(): DeepInterviewLanguagePreference {
+	return {
+		code: "user",
+		label: "User language",
+		source: "initial-idea",
+		instruction:
+			"Ask every user-facing deep-interview question in the user/session language inferred from the initial idea unless the user explicitly requests another language. Keep code identifiers, file paths, commands, settings/JSON keys, library/API names, and quoted source text unchanged when appropriate.",
+	};
+}
+
 function resolveDeepInterviewLanguagePreference(idea: string): DeepInterviewLanguagePreference | undefined {
 	if (/\b(?:answer|ask|respond|reply|write|use|speak)\s+(?:only\s+)?in\s+English\b/i.test(idea)) {
 		return englishLanguagePreference();
 	}
-	if (/(?:영어로|영문으로|영어\s*(?:질문|답변|응답)|English\s+only)/i.test(idea)) {
-		return englishLanguagePreference();
-	}
-	if (/\p{Script=Hangul}/u.test(idea)) {
-		return {
-			code: "ko",
-			label: "Korean",
-			source: "initial-idea",
-			instruction:
-				"Ask every user-facing deep-interview question in Korean unless the user explicitly requests another language.",
-		};
+	if (/[^\p{Script=Latin}\p{Script=Common}\p{Script=Inherited}]/u.test(idea)) {
+		return userLanguagePreference();
 	}
 	return undefined;
 }

package/src/gjc-runtime/ralplan-runtime.ts

@@ -13,6 +13,7 @@ import {
 } from "./ledger-event-renderer";
 import { isRestrictedRoleAgentBash } from "./restricted-role-agent-bash";
 import { migrateWorkflowState } from "./state-migrations";
+import { runNativeStateCommand } from "./state-runtime";
 import {
 	appendJsonlIdempotent,
 	readExistingStateForMutation,
@@ -104,6 +105,10 @@ export function isRalplanArtifactWriteInvocation(args: readonly string[]): boole
 	return hasFlag(args, "--write");
 }
 
+function isRalplanDoctorInvocation(args: readonly string[]): boolean {
+	return args[0] === "doctor";
+}
+
 function assertSafePathComponent(value: string, label: string): void {
 	if (!PATH_COMPONENT_RE.test(value) || value.includes("..")) {
 		throw new RalplanCommandError(2, `invalid path component for --${label}: ${value}`);
@@ -854,10 +859,15 @@ async function handleConsensusHandoff(args: readonly string[], cwd: string): Pro
 	return { status: 0, stdout };
 }
 
+async function handleDoctor(args: readonly string[], cwd: string): Promise<RalplanCommandResult> {
+	return await runNativeStateCommand(["doctor", "--skill", "ralplan", ...args.slice(1)], cwd);
+}
+
 /* -------------------------------- entry --------------------------------- */
 
 export async function runNativeRalplanCommand(args: string[], cwd = process.cwd()): Promise<RalplanCommandResult> {
 	try {
+		if (isRalplanDoctorInvocation(args)) return await handleDoctor(args, cwd);
 		if (isRalplanArtifactWriteInvocation(args)) return await handleArtifactWrite(args, cwd);
 		return await handleConsensusHandoff(args, cwd);
 	} catch (error) {