# ThothII workflow UI contracts

- Pi reasoning arrives as nested `message_update.assistantMessageEvent.type = thinking_delta`.
  The backend maps it to the named SSE event `activity_delta`; the frontend EventSource must
  explicitly subscribe to that name. Model activity is separate from final `text_delta` output.
- Session create/resume must preserve the configured or persisted thinking level. Forcing
  `thinking: off` disables the upstream signal and makes the activity panel legitimately empty.
- A join-only `reviewer_decide` proposal is one complete, atomic join set. The read-only
  `join-review` widget persists every proposed join on Continue; `Other — specify` persists none
  and requires the model to propose the complete corrected set again. Ledger read, sequence
  assignment, and atomic replacement share a per-session cross-process writer lock.
- A v2 phase summary accepts `open_questions?: string[]`. Validate this at the gate boundary and
  normalize legacy malformed entries defensively in the viewer so one object cannot crash React.
- `SqlViewer`'s horizontal/vertical layout control is meaningful only with multiple SQL blocks;
  hide it for the single CTE result shown by `CteResultViewer`.
- A Pi turn is `idle`, `running`, `waiting`, or `failed`. A reviewer gate/request moves it to
  `waiting`; the reviewer response and steering move it back to `running`; provider failures and
  unexpected Pi child exits mark it `failed` without forwarding raw failure detail.
- Resume preserves `running`/`waiting` runtimes. After manifest/readiness validation, every cold
  path clears old SSE buffer/subscribers before reopen—including when a crashed child has already
  left no runtime—and reuses persisted provider/model/thinking. Failed validation does not clear.
- A successful Resume of the already selected session increments the stream generation so React
  closes the old EventSource and opens the same session URL again. Failed Resume must not reconnect.
- SSE endpoints are intentionally keep-alive. Browser cleanup and one-off probes must explicitly
  close the EventSource or cancel/abort the response reader after their terminal event.
- `activityLog` remains the complete in-memory chronological fold. The left Model activity panel
  default-denies every kind except prompt, thinking, and assistant, presenting them as Question,
  Reasoning, and Response in source order; status, tool, gate, lifecycle, and unknown kinds stay
  hidden. Its desktop width is pointer/keyboard resizable from 288–576 px while preserving 512 px
  centrally, persists globally in localStorage, and becomes an overlay drawer below `lg`.
- F6 CTE cards keep their semantic structure, responsive grids, 12/16 px lateral padding, and 8 px
  header/content edge padding. Internal section gaps are 12 px, headings/dividers use 4 px spacing,
  and table/filter rows use 4 px vertical padding with compact line heights.
- Pi tool events may cross the backend/client boundary only as call id, tool name, and
  `running`/`completed`/`failed` status. Tool updates, arguments, partial/final results, commands,
  raw output, and raw errors remain server-side.
- The frontend uses Tailwind CSS 3.4. Shared primitives must use concrete Tailwind 3-compatible
  spacing utilities; Tailwind 4 custom-spacing syntax can compile to no effective padding here.
- A native EventSource can retain a `Last-Event-ID` from an older backend process. If that cursor
  is newer than every id produced by the current `SseHub` generation, treat it as stale and replay
  the fresh generation from id 0 instead of suppressing all new low-id events.
- Batch delete mutates client selection, active-session, panel, and Resume intent only for ids whose
  DELETE actually succeeded. A failed active delete preserves its live binding, and deleting an
  unrelated session must not invalidate a concurrent Resume targeting another id.