v4.3.9

[4.3.9] - 2026-07-08

Candidate accounting coherence lore makes the 4.3.8 orchestration accounting
rules self-consistent, so valid manager records stop bouncing off the schema:

• decision: "parallel" on implementation-decision records is now rejected
  with one clear message (it stays valid for discovery, audit, and review
  passes); previously every candidateDecision pairing produced contradictory
  errors.
• Candidate-shaped decisions now require candidate execution evidence on every
  pass kind, so a decision label alone can no longer validate while being
  excluded from candidatePassCount.
• Candidate and verifier worker counts are checked per subtype instead of
  summed, so one worker may fill both roles on a single pass row.
• Orchestration pass dedup now remembers every recorded pass id in
  recordedPassIds, so resubmitted completions no longer double-count
  telemetry after the recent-pass window rolls over.
• The candidate accounting rules are documented once, in
  skills/flow/references/parallel-orchestration.md; the run skill, handoff
  format, and wiki point there instead of restating them, and the two doc
  instructions that contradicted the schema (omitted decision on decision
  records, workerCount=0 with positive candidateWorkerCount) are fixed.

v4.3.8

[4.3.8] - 2026-07-08

Parallel orchestration accounting lore makes broad worker use visible without
turning Flow state into a transcript store:

• flow_feature_complete can now record compact orchestrationPasses for
  serial, skipped, exact-path candidate, isolated-worktree, tournament,
  validation, review, and verifier passes.
• flow_status reports aggregate pass telemetry under
  session.budget.orchestration, including worker counts, candidate/verifier
  usage, skipped candidate decisions, and recent pass records.
• Completion now records orchestration telemetry on success, validation-gate
  failures, failed reviews, and needs_input, while deduping retry payloads and
  retaining only the latest compact pass records.
• Flow planning and running guidance now requires explicit implementation pass
  decisions for broad work and keeps full handoffs, logs, and manager scratch
  artifacts outside .flow/**.
• README runtime wording now matches the 4.3.6 behavior: completed feature
  counts are telemetry only, not a three-feature stop.

v4.3.7

[4.3.7] - 2026-07-08

Package-smoke patience lore keeps the 4.3.6 release path portable across slower
macOS Node 24 runners:

• The package smoke test now has an explicit timeout large enough for the packed
  consumer declaration check to finish on CI, avoiding a runner-speed-only
  failure after the Release workflow already passed.

v4.3.6

[4.3.6] - 2026-07-08

Phase-continuity lore removes the rough stop after three completed features and
adds sharper handoffs around long Flow sessions:

• Completed feature counts are now telemetry only; approved plans keep moving to
  the next runnable feature instead of requiring a fresh session after three
  completions.
• flow_status now includes a human-readable progress line, nextFeature,
  pendingFeatures, and remaining feature count so resumed sessions name the
  exact next slice.
• Hidden worker prompts now fail closed on empty or unstructured handoffs, and
  worker model routing can be configured with OPENCODE_FLOW_*_WORKER_MODEL
  environment variables.
• Release publishing now has bun run release:monitor, which watches the
  release commit's CI and tag-triggered Release workflow before declaring the
  release healthy.

v4.3.5

[4.3.5] - 2026-07-08

Flow now stops long autonomous loops more deliberately without making reviews
shallower:

• Runtime budget telemetry records completed features since the last phase
  boundary, feature/final review counts, failed review counts, per-feature
  retry attempts, and host token telemetry availability.
• Failed feature and final reviews now pause by default, allow only one
  autonomous repair plus one retry, then block the feature with a compact
  resume packet instead of continuing to edit in the same root session.
• Feature completion now records featureReviewDepth and rejects evidence that
  is shallower than the approved feature requires.
• Large sessions now checkpoint after three completed features and require an
  explicit phaseBoundaryAck in a fresh phase before the next feature starts.
• Flow planning, running, review, README, maintainer docs, and wiki pages now
  describe scoped review packets, risk-based review depth, retry limits, and
  phase-boundary handoffs.

v4.3.4

[4.3.4] - 2026-07-07

Planning and final-review lore sharpened without changing the runtime surface:

• flow-plan now has a pre-approval quality gate that checks outcome,
  requirements, decisions, uncertainty, feature shape, bounded targets,
  validation levels, dependencies, and review policy before a plan is saved or
  approved.
• Planning examples now cover bugfix, UI/frontend, runtime/schema, docs-only,
  audit-first, and stronger validation patterns, giving agents better few-shot
  guidance for common Flow sessions.
• Final review now includes a convergence scan that traces the original goal,
  approved requirements, every planned feature, changed artifacts, and
  validation evidence before returning a passing finalReview.
• The new planning checklist is shipped through synced skills and bundled
  /flow-plan and /flow-auto command instructions, so fresh and stale skill
  discovery paths get the same guidance.

v4.3.3

[4.3.3] - 2026-07-07

Verification only — no behavior change:

• The live OpenCode smoke test now proves the hidden read-only workers'
  isolation actually binds at runtime: against a real server it asserts each
  worker's resolved permission rules deny the state-changing flow_* tools,
  task, skill, and edit, while keeping flow_status readable. This
  confirms OpenCode compiles Flow's tool-name and wildcard permission keys
  (which are absent from the SDK's simplified permission type) rather than
  silently dropping them, closing the one unverified question from the 4.3.2
  review.

v4.3.2

[4.3.2] - 2026-07-07

Correctness and safety hardening from a full-project review, repairing two
edges introduced in 4.3.1 and several older ones:

• Uninstall no longer deletes a user file that merely resembles a backup name:
  a file counts as removable Flow residue only when its name and its content
  checksum both match Flow's backup format. Doctor applies the same check.
• Sync no longer overwrites a user-owned skill folder that has files at managed
  paths but no SKILL.md — any managed folder without a Flow marker is left
  untouched, not clobbered without a backup.
• An empty HOME no longer makes the skills root a current-directory-relative
  path (which sync wrote into and uninstall removed); it falls back to the OS
  home. engines now requires Node >=20.12 (doctor/uninstall rely on it).
• The CLI no longer aborts on a stray flow-* file in the skills root, and a
  CRLF-converted skill marker is no longer misreported as outdated.
• Session locks recover from more failure modes: a far-future or foreign-host
  lock timestamp and a recycled process id are now reclaimable instead of
  wedging every Flow call, and stale-lock reclamation no longer races two
  waiters into holding the lock at once.
• flow_status re-checks the session under the lock before quarantining, so a
  session written by a concurrent process can't be quarantined by mistake; a
  session file with an archive-unsafe id now routes to quarantine recovery
  instead of wedging every archive; and its output is framed as data to blunt
  instruction-injection from a cloned repo's session file.
• A user command named like an object built-in (e.g. /toString) no longer
  crashes command preflight, and a Flow command invoked with an attachment now
  keeps its worker isolated instead of double-running the instructions.
• Session history is bounded so long autonomous loops cannot grow the session
  file without limit. Docs corrected to match the current uninstall/doctor
  behavior.

v4.3.1

[4.3.1] - 2026-07-06

Doctor and uninstall now account for the .backup files Flow writes when it
retires a locally-edited managed skill file:

• doctor reports leftover .backup files as action-required instead of
  saying "ok", lists each one, and explains that they hold your earlier edits
  and can be deleted once you no longer need the saved copy.
• uninstall treats a folder that is pristine apart from Flow-created
  .backup residue as removable and names the removed backup files, so the
  cleanup is no longer silently blocked or silently destructive.

v4.3.0

[4.3.0] - 2026-07-06

Parallel orchestration reworked into a single pass playbook, plus sharper
planning and routing:

• The parallel-orchestration references collapse into one playbook with an
  explicit loop — orient, slice, manifest, fan out, account, verify,
  synthesize, extend or stop — so a manager reads one file instead of four
  cross-linked ones. Every bundled public Flow command got smaller as a result.
• A new pass manifest doubles as the pre-fan-out coverage gate and the
  accounting contract: one row per slice with its scope, expected coverage, and
  verification tier, and N rows spawned means N handoffs accounted for before
  synthesis.
• A worker-failure ladder handles a slice that errors, blocks, or returns
  partial: re-spawn once narrower, cover it directly, or carry it into the
  synthesis explicitly as not-covered — never as if coverage were complete.
• flow-plan gains uncertainty-typed decomposition: resolve specification
  uncertainty by stating an assumption (or asking when a wrong guess is costly)
  and environment uncertainty by inspecting, never by asking.
• Frontmatter descriptions for flow-plan, flow-run, and flow-review now
  describe only when to reach for each skill, so single-phase asks route
  cleanly.