@bastani/atomic 0.9.16-alpha.4 → 0.9.16-alpha.6

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.16-alpha.4",
+  "version": "0.9.16-alpha.6",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [
@@ -31,7 +31,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.84.2"
+    "@earendil-works/pi-tui": "^0.84.3"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.16-alpha.6] - 2026-08-26
+
+### Changed
+
+- The `workflow` tool description, agent routing guidance, and workflow docs now treat a blocked run as continuable by default: resume resumable blocks, answer pending prompts, steer past the obstacle, or start a follow-up workflow past a terminal block (inline only when the remaining work is minimal), stopping for user input only when the task is so ambiguous that judgment cannot infer intent from the objective and repository evidence — git history, commits, PRs, issues, and the user's own comments. When `ask_user_question` or human input is unavailable, the agent is instructed to continue fully autonomously on the interpretation best supported by that evidence and to record the assumption.
+- `WORKFLOW BLOCKED` lifecycle notices now carry that continuation instruction in their text: resume or steer the run, or continue with a follow-up workflow (inline only if what remains is minimal), and ask the user only when intent cannot be inferred from repository evidence.
+- A budget-exceeded stop is now reported as its own blocked-notice variant (`stopped at its <dimension> budget limit`, with `budgetExceeded`/`budgetDimension` details and a `/workflow resume` hint) whose text instructs the agent to summarize progress and estimated next steps, ask the user whether to proceed — preferring the `ask_user_question` tool when available — and resume with a raised `budget` only after approval. Matching guidance was added to the routing prompts and docs.
+
+## [0.9.16-alpha.5] - 2026-08-26
+
+### Changed
+
+- Raised the public `workflow` tool request deadline from 30 seconds to two minutes. Timed-out requests still return `WORKFLOW_TIMEOUT` with `timeoutMs: 120000`, abort cancellable work, discard late settlement, and never retry. Mutating actions keep the unknown-outcome warning that tells callers to inspect workflow status before retrying ([#2654](https://github.com/bastani-inc/atomic/issues/2654)).
+- Agent guidance now treats "no budget" as the default for workflow runs. A `budget` is passed on `run`/`resume` only when the operator asked for a limit, and only the fields they named; otherwise the field is omitted so the workflow declaration and config resolve normally.
+- Agent guidance now assumes the existing 15-minute heartbeat cadence and does not shorten, lengthen, or disable it unless the operator asks. Heartbeats are documented as periodic alignment checks rather than failure signals, so a progressing run is not interrupted, re-capped, or polled in response to one.
+
+### Fixed
+
+- Fixed running durable `ctx.tool` message blocks showing a trailing `●` after the tool call header; running and completed calls now use the same marker-free `$ <tool-name>` presentation while other tool-state markers remain unchanged.
+- Fixed a completed `ctx.task` leaving the root raw `running` with no active stage or tool and no path to the next budget boundary. The durable task-result checkpoint now fails closed, duration is rechecked after that checkpoint, quit/interrupt can abort a never-settling persist, a checkpoint created after its signal is already aborted settles without an unobserved rejection, an active task-checkpoint control — including one owned by an expanded child run — is not diagnosed as a stranded root, bulk interrupt forwards an injected tool-control registry, cancellation settles the DBOS write queue, and a terminal-only stage checkpoint replays the complete `WorkflowTaskResult` — the exact persisted text including schema-backed `maxOutput` truncation, structured output including `null`, generated worktree artifacts, warnings, session, and model metadata — without rerunning the task. A workflow that catches a task-tail quit rejection and returns outputs still stays paused. Exact-id quit or interrupt of a nested task tail now quits the aggregate root so the parent snapshot and durable handle do not stay raw `running`. Exact `/workflow status <id>` uses the live tool-control registry so a task tail is not reported as stranded. Same-process DBOS hydration rejects unknown checkpoint history instead of replaying around it ([#2650](https://github.com/bastani-inc/atomic/issues/2650)).
+- Fixed raised-budget resume of a blocked workflow when parallel stages shared a completed `ctx.tool` parent. Fresh-ID continuations translate tool parent identities during fail-closed topology validation, preserve cached root-level tool siblings without a false mismatch, reject a replayed tool whose restored parents disagree with the continuation graph or cannot be translated, and keep a blocked source retryable after that rejection without dropping recorded prompt answers, pending-prompt descriptors, or its BLOCKED notice. The local source kill remains process-only until settlement: a mismatch leaves no terminal session entry so the durable blocked row stays reload-recoverable, while a successful continuation durably retires the superseded source so reload cannot resurrect it ([#2639](https://github.com/bastani-inc/atomic/issues/2639)).
+- Fresh-ID continuations reuse the source `ctx.tool` checkpoint, including `failureMode: "return"` success and `return_failure` outcomes. A later hop reuses that result when the intermediate run republishes it; that write is best-effort. To re-run a completed return-mode callback, start a new run or change the tool name or args ([#2639](https://github.com/bastani-inc/atomic/issues/2639)).
+- Fixed ordinary in-process subagents stealing the parent session's workflow store binding. Subagent children retain bundled workflow definitions as resources without loading the workflows extension or exposing its tool, and the extension factory rejects admitted child sessions as a second boundary. Full `/reload` also recovers a live store displaced by an older generation, including stage, job, cancellation, tool-control, and prompt owners, merges retained parent history, and remounts the `BACKGROUND` panel. New session scopes remain isolated.
+- Fixed simultaneous post-task budget exhaustion in `ctx.parallel(..., { failFast: false })` being replaced by a generic aggregate failure after every task had already persisted a complete result. Budget-only parallel failures now retain the engine-owned resumable `budget_exceeded` classification, select the earliest authored exhausted task as the deterministic completed resume frontier, and replay all completed task results under a raised budget without rerunning their models; mixed ordinary failures retain the existing aggregate-failure behavior.
+- Fixed workflow name resolution racing past an in-flight `/workflow reload`: a run dispatched immediately after a reload could resolve against the pre-reload registry and execute the old module (observed live as reload generation N applying only after the run had started). Resolution now awaits any in-flight discovery before resolving names; a reload that fails while a registry already exists still surfaces through the reload's own caller, and resolution proceeds on the retained registry instead of throwing. ([#2667](https://github.com/bastani-inc/atomic/pull/2667) by [@uppifyagency](https://github.com/uppifyagency))
+- Fixed Goal losing its ledger, orchestrator receipt, and review artifacts when a durable resume continued under a fresh run ID. Goal now checkpoints the complete artifact directory, reloads exact turn-bearing ledger state from a durable sidecar without truncating records or fabricating reducer turns, keeps the model-visible ledger free of internal turn numbers, avoids duplicating replayed receipts and reviews, and scopes artifact ownership to the run's own identity plus its continuation chain. Fresh-ID continuation chains retain and report the original referenced owner correctly, and retention pruning protects that owner while any continuation remains live without allowing incidental quoted paths to pin failed runs forever.
+- Fixed a missing Goal reviewer `reads` artifact being reported as malformed structured reviewer output. Missing referenced files now remain explicit reviewer execution failures attributed to the `reads` contract, while completed unstructured reviewer responses continue to use the existing parse-failure path.
+
 ## [0.9.16-alpha.2] - 2026-08-23
 
 ### Added

package/dist/builtin/workflows/README.md

@@ -58,6 +58,8 @@ Workflow lifecycle notices are enabled by default. They send steer prompts into
 
 Set `enabled` to `false` to disable all lifecycle notices, or narrow `notifyOn` to a non-empty list of selected events. Completion, failure, and blocked lifecycle notices are emitted for top-level workflow runs, use steer delivery, and wake an idle model so the lifecycle update enters the model context when it happens. When a fulfilled workflow body leaves admitted tool failures, the engine promotes the first admission and persists that exact tool origin for the failed notice. Ordinary body rejections retain their original error and failed graph nodes without claiming a tool origin because transparent native promises do not expose the source promise; this prevents a caught tool rejection from being misattributed when body code later throws the same object or primitive. Nested child workflow completion/failure is reflected inside the expanded parent graph instead of producing separate top-level completion cards. Awaiting-input states are tracked for dedupe/restore, but workflows do not enqueue main-chat `/workflow connect` cards for them; prompt state remains visible through workflow status/connect surfaces, avoiding stale actionable cards if a prompt resolves while the main chat is streaming.
 
+Treat a blocked run as continuable by default; the blocked notice text itself carries this instruction. On a `WORKFLOW BLOCKED` notice or a blocked status, keep the work moving: resume a resumable block, answer the pending prompt, steer the stage past the obstacle, or start a follow-up workflow that carries the remaining tracked work past a terminal block — continue inline only if the remaining work is minimal. Stop for user input only when the task is so ambiguous that competing interpretations lead to materially different outcomes and judgment cannot infer intent from the stated objective and repository evidence; mine git history, commits, PRs, issues, and the user's own comments before asking. When `ask_user_question` or another human input channel is unavailable, continue fully autonomously on the interpretation best supported by that evidence, and record the assumption in the result or an artifact. A budget-exceeded stop (the resumable `budget_exceeded` blocked rail) is the exception, and its notice says so: the exhausted budget is a boundary someone chose, so summarize progress and the estimated next steps, ask the user whether to proceed — prefer the `ask_user_question` tool when it is available — and resume with a raised `budget` only after approval.
+
 Control notices report deliberate actions on a top-level run: `/workflow <name>` produces a `WORKFLOW STARTED` card (`▶`), `/workflow pause` a `WORKFLOW PAUSED` card (`⏸`, warning tone), `/workflow quit` a `WORKFLOW QUIT` card (`⏹`, warning tone, plus a `resumable` field), and `/workflow resume` a `WORKFLOW RESUMED` card (`▶`). All four travel the same steer delivery, capped-backoff retry, and card path as the failure notice. The paused and quit text says the stop was deliberate and user-requested and instructs the model not to resume the run or take the work over unless asked, hinting `/workflow resume <run-id>`; the resumed text does not, since the run is progressing again.
 
 Only user actions notify. The matching `workflow({ action: "run" | "pause" | "quit" | "resume" })` tool calls stay silent, because the tool result already reports them to the agent, and `/workflow interrupt` raises nothing. Engine-internal transitions stay silent too — a notice exists only when a control path named an actor — which is what keeps answering a human-in-the-loop prompt, per-stage control, and the resume-acknowledgement pass from flooding the chat.
@@ -677,7 +679,7 @@ Raw stage-chat prompt answer replay is live-memory only. `StageSnapshot.promptAn
 ```json
 {
   "name": "workflow",
-  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. For action 'run' and 'resume', budget accepts per-field duration, token, cost, and warning overrides; fields resolve over the workflow declaration and config, and 0 disables a field. For primitive prompt answers, use booleans or the documented confirm labels, exact case-insensitive select labels or 1-based indexes, and text strings for input/editor; an invalid answer remains pending and returns guidance instead of choosing a default. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
+  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. Treat a blocked run as continuable by default: resume resumable blocks, answer pending prompts, steer past the obstacle, or start a follow-up workflow past a terminal block, and escalate to the user only when the blocked result is so ambiguous that human input or steering must settle it; when ask_user_question or human input is unavailable, continue fully autonomously on the interpretation best supported by the objective and repository evidence, and record the assumption. For action 'run' and 'resume', budget accepts per-field duration, token, cost, and warning overrides; fields resolve over the workflow declaration and config, and 0 disables a field. Pass budget only when the user asked for a limit; otherwise omit it entirely and inherit the declaration and config rather than inventing a cap. For primitive prompt answers, use booleans or the documented confirm labels, exact case-insensitive select labels or 1-based indexes, and text strings for input/editor; an invalid answer remains pending and returns guidance instead of choosing a default. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
   "parameters": {
     "workflow": "string (optional) — workflow ID or normalized name",
     "inputs": "object (optional) — key/value map of workflow inputs",

package/dist/builtin/workflows/builtin/goal-ledger.ts

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
-import { writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { createWorkflowArtifactDirectory } from "../src/shared/workflow-artifacts.js";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { LEDGER_FILENAME, type GoalLedger, type GoalLifecycleEvent } from "./goal-types.js";
 
+const LEDGER_STATE_FILENAME = "goal-ledger-state.json";
+
 type ModelVisibleGoalLedger = Omit<
   GoalLedger,
   "turns" | "receipts" | "reviews" | "blockers" | "decisions" | "lifecycle"
@@ -39,6 +40,10 @@ function modelVisibleLedger(ledger: GoalLedger): ModelVisibleGoalLedger {
   };
 }
 
+function goalLedgerStatePath(ledgerPath: string): string {
+  return join(dirname(ledgerPath), LEDGER_STATE_FILENAME);
+}
+
 export function appendLifecycleEvent(
   ledger: GoalLedger,
   event: GoalLifecycleEvent["event"],
@@ -54,13 +59,40 @@ export function appendLifecycleEvent(
   });
 }
 
+/**
+ * Restore only lossless authoritative state. A model-visible legacy ledger has
+ * no turn fields, so treating it as fresh is safer than fabricating reducer state.
+ *
+ * A sidecar that cannot be parsed is treated as absent for the same reason: the
+ * authoritative file is published by atomic rename below, so unparsable content
+ * means a torn write from before that guarantee (or a foreign file). Starting
+ * fresh loses recorded turns; throwing here would instead make the whole
+ * continuation unable to start.
+ */
+async function readExistingGoalLedger(ledgerPath: string): Promise<GoalLedger | undefined> {
+  let contents: string;
+  try {
+    contents = await readFile(goalLedgerStatePath(ledgerPath), "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return undefined;
+    throw error;
+  }
+  try {
+    return JSON.parse(contents) as GoalLedger;
+  } catch {
+    return undefined;
+  }
+}
 export async function createGoalLedger(
   objective: string,
-  acceptanceCriteria = objective,
-  runId?: string,
+  acceptanceCriteria: string,
+  artifactDir: string,
 ): Promise<{ ledger: GoalLedger; ledgerPath: string; artifactDir: string }> {
+  const ledgerPath = join(artifactDir, LEDGER_FILENAME);
+  const existing = await readExistingGoalLedger(ledgerPath);
+  if (existing !== undefined) return { ledger: existing, ledgerPath, artifactDir };
+
   const goalId = randomUUID();
-  const artifactDir = await createWorkflowArtifactDirectory(runId);
   const now = new Date().toISOString();
   const ledger: GoalLedger = {
     goal_id: goalId,
@@ -79,7 +111,6 @@ export async function createGoalLedger(
     convergence: [],
   };
   appendLifecycleEvent(ledger, "created", "Goal created.", 0);
-  const ledgerPath = join(artifactDir, LEDGER_FILENAME);
   await writeGoalLedger(ledgerPath, ledger);
   return { ledger, ledgerPath, artifactDir };
 }
@@ -89,7 +120,20 @@ export async function writeGoalLedger(
   ledger: GoalLedger,
 ): Promise<void> {
   ledger.updated_at = new Date().toISOString();
-  await writeFile(ledgerPath, `${JSON.stringify(modelVisibleLedger(ledger), null, 2)}\n`, {
-    encoding: "utf8",
-  });
+  const visibleContents = `${JSON.stringify(modelVisibleLedger(ledger), null, 2)}\n`;
+  const stateContents = `${JSON.stringify(ledger, null, 2)}\n`;
+  const statePath = goalLedgerStatePath(ledgerPath);
+  // The sidecar is the authoritative resume state, so it is published by a
+  // complete same-directory write followed by an atomic rename. Overwriting it
+  // in place leaves a partial file readable when a write is interrupted, and
+  // the next continuation would then start from nothing.
+  const pendingStatePath = `${statePath}.${randomUUID()}.tmp`;
+  await writeFile(pendingStatePath, stateContents, { encoding: "utf8" });
+  try {
+    await rename(pendingStatePath, statePath);
+  } catch (error) {
+    await rm(pendingStatePath, { force: true });
+    throw error;
+  }
+  await writeFile(ledgerPath, visibleContents, { encoding: "utf8" });
 }

package/dist/builtin/workflows/builtin/goal-runner.ts

@@ -1,5 +1,15 @@
 import { join } from "node:path";
-import type { WorkflowParallelOptions, WorkflowTaskOptions, WorkflowTaskResult, WorkflowTaskStep } from "../src/shared/types.js";
+import type {
+  WorkflowParallelOptions,
+  WorkflowTaskOptions,
+  WorkflowTaskResult,
+  WorkflowTaskStep,
+  WorkflowToolPrimitive,
+} from "../src/shared/types.js";
+import {
+  ensureWorkflowArtifactDirectory,
+  workflowArtifactDirectoryPath,
+} from "../src/shared/workflow-artifacts.js";
 import { fold_usage } from "./verification-usage.js";
 import {
   convergence_escalation_evidence,
@@ -26,6 +36,7 @@ import { formatReviewReport, renderFinalReport } from "./goal-reports.js";
 import {
   parsedReviewDecisionFromResult,
   reviewDecisionToRecord,
+  reviewerErrorDecision,
 } from "./goal-review.js";
 import { reviewerFailureText } from "./review-convergence.js";
 import { consolidateFindingsBatch } from "./review-convergence.js";
@@ -73,10 +84,22 @@ function normalizeBranchInput(
 type GoalRunnerContext = {
   readonly inputs: GoalWorkflowInputs;
   readonly runId?: string;
+  readonly tool: WorkflowToolPrimitive;
   task(name: string, options: WorkflowTaskOptions): Promise<WorkflowTaskResult>;
   parallel(steps: readonly WorkflowTaskStep[], options: WorkflowParallelOptions): Promise<WorkflowTaskResult[]>;
 };
 
+type GoalArtifactContext = Pick<GoalRunnerContext, "runId" | "tool">;
+
+export async function createGoalArtifactDirectory(ctx: GoalArtifactContext): Promise<string> {
+  const artifactDir = await ctx.tool(
+    "artifact-root",
+    { workflow: "goal" },
+    async () => workflowArtifactDirectoryPath(ctx.runId),
+  );
+  return ensureWorkflowArtifactDirectory(artifactDir);
+}
+
 type GoalWorkflowOptions = {
   readonly createPr: boolean;
   readonly workflowStartCwd: string;
@@ -120,7 +143,8 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
     const reviewQuorum = DEFAULT_REVIEW_QUORUM;
     const blockerThreshold = Math.min(DEFAULT_BLOCKER_THRESHOLD, maxTurns);
     const comparisonBaseBranch = normalizeBranchInput(inputs.base_branch, "origin/main");
-    const { ledger, ledgerPath, artifactDir } = await createGoalLedger(objective, acceptanceCriteria, ctx.runId);
+    const artifactDir = await createGoalArtifactDirectory(ctx);
+    const { ledger, ledgerPath } = await createGoalLedger(objective, acceptanceCriteria, artifactDir);
 
     let latestReviews: ReviewRecord[] = [];
     let latestReviewArtifactPaths: string[] = [];
@@ -188,13 +212,18 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
 
       previousOrchestratorSessionFile = orchestrator.sessionFile;
       ledger.turns = turn;
-      ledger.receipts.push({
-        turn,
-        stage: orchestrator.name ?? orchestrator.stageName,
-        artifact_path: orchestratorReceiptPath,
-        summary: `Orchestrator receipt artifact: ${orchestratorReceiptPath}`,
-      });
-      appendLifecycleEvent(ledger, "receipt_recorded", "Orchestrator receipt recorded.", turn);
+      const receiptAlreadyRecorded = ledger.receipts.some(
+        (receipt) => receipt.turn === turn && receipt.artifact_path === orchestratorReceiptPath,
+      );
+      if (!receiptAlreadyRecorded) {
+        ledger.receipts.push({
+          turn,
+          stage: orchestrator.name ?? orchestrator.stageName,
+          artifact_path: orchestratorReceiptPath,
+          summary: `Orchestrator receipt artifact: ${orchestratorReceiptPath}`,
+        });
+        appendLifecycleEvent(ledger, "receipt_recorded", "Orchestrator receipt recorded.", turn);
+      }
       await writeGoalLedger(ledgerPath, ledger);
 
       const reviewerStep = (
@@ -238,6 +267,7 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
 
       let reviewResults: WorkflowTaskResult[];
       let reviewerBatchFailed = false;
+      let reviewerExecutionDiagnostic: string | undefined;
       try {
         reviewResults = await ctx.parallel(reviewerSteps, {
           task: objective,
@@ -246,11 +276,15 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
         });
       } catch (err) {
         reviewerBatchFailed = true;
+        const failure = reviewerFailureText(err);
+        reviewerExecutionDiagnostic = failure.includes("referenced artifact does not exist")
+          ? `Reviewer execution failed while resolving its reads contract: ${failure}`
+          : `Reviewer execution failed before producing a decision: ${failure}`;
         reviewResults = [
           {
             name: "reviewer-error",
             stageName: "reviewer-error",
-            text: reviewerFailureText(err),
+            text: failure,
           },
         ];
       }
@@ -258,7 +292,13 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
       latestReviews = await Promise.all(reviewResults.map(async (result) => {
         const reviewerName = result.name ?? result.stageName;
         const normalizedReviewerName = reviewerName.replace(/-\d+$/u, "");
-        const parsed = parsedReviewDecisionFromResult(result, reviewerName);
+        const parsed = reviewerBatchFailed
+          ? {
+              decision: reviewerErrorDecision(reviewerExecutionDiagnostic ?? "Reviewer execution failed."),
+              parsed: false,
+              diagnostics: [reviewerExecutionDiagnostic ?? "Reviewer execution failed."],
+            }
+          : parsedReviewDecisionFromResult(result, reviewerName);
         const reviewArtifactPath = join(
           artifactDir,
           `review-${artifactSafeName(normalizedReviewerName)}.json`,
@@ -332,7 +372,12 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
           usage: fold_usage([orchestrator, ...reviewResults, ...reverifyResults]),
         }));
       }
-      ledger.reviews.push(...latestReviews);
+      const newReviews = latestReviews.filter(
+        (review) => !ledger.reviews.some(
+          (recorded) => recorded.turn === review.turn && recorded.reviewer === review.reviewer,
+        ),
+      );
+      ledger.reviews.push(...newReviews);
       // Consolidated round artifact leads so the next orchestrator turn plans the full findings batch first.
       latestReviewArtifactPaths = [latestReviewReportPath, ...latestReviews.map((review) => review.artifact_path)];
       appendLifecycleEvent(

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.16-alpha.4",
+  "version": "0.9.16-alpha.6",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -83,7 +83,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.84.2"
+    "@earendil-works/pi-tui": "^0.84.3"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {