These are identified future needs, not claims that the current foundation provides them. The current language/consumer migration remains required by current-status.md; do not move unfinished migration into this roadmap merely because it is difficult.
Current decision: an external action with an uncertain outcome stops for reconciliation unless its definition declares it safe to repeat or checkable, or the host knows it was never sent (#99). Undeclared actions keep the deliberate hold. Still open below: stale in-flight claims after a worker crash, per-effect retry bounds (one runtime default today), and a reconciliation UI.
Desired property: users ordinarily do not need to reason about transient worker/network failures. The system recovers progress by checking whether operations already executed, reusing recorded results, retrying safely, and using idempotent operations where supported.
Required work:
Acceptance: representative applications recover through transient failures without duplicate external effects or lost progress, including simulated crash windows. No blanket exactly-once claim unless the external operation protocol actually supports it.
The frontend response-generation guards prevent late polls/autosaves from restoring stale UI state after newer drafts, completion, reopening or principal changes. They do not cancel or serialize writes already dispatched to the backend. A future stronger durability contract should cover per-command revisions/idempotency, ordered autosave recovery and ambiguous acknowledgements, with failure injection across reloads and concurrent clients—not just promise-resolution order.
Deferred until needed. A parent Process may fork child Processes and wait for them; each Process can retain one sequential execution position. Define joins, failure/cancellation and recovery policies before enabling concurrency. Arrow product/fanout is not automatically concurrent execution.
The generic/bespoke review selected independent peer frontends, bounded generic skins, and application identity independent of address. This is part of the current PR landing scope, not a deferred shared-component-framework refactor. See frontend ownership.
Uncertain external effects stop for reconciliation instead of blind retry.
Solana transfer amounts outside uint64 are rejected. A synthetic old-serializer fixture accepts2^64 but encodes bytes[0,0,0,0,0,0,0,16] (=2^60) while its summary reports2^64. Valid-input legacy rounding remains unchanged; this correction is only the invalid range.
Manual API completion of automatic steps is rejected. The executor must execute their declared work; the prior undocumented bypass was not available in the UI. Current automatic metadata edits/file access retain their existing authorization rules.
Executable HTML is removed at browser render boundaries (including AI previews); ordinary safe text, links and formatting remain. Stored values and downloaded payload bytes are not rewritten.