@signalridge/pi-workflows 1.11.1 → 1.12.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.12.0
+### Minor Changes
+
+- 3096585: Give Workflows one rich below-editor overview and keep Subagents Fleet limited to independent agents. Preserve workflow navigation, completed-call token semantics, periodic projection/footer updates, and exact retained-child access through the owner navigator and explicit `/agents` retained-child paths, including when Fleet is disabled. No execution/model policy or managed/UI protocol changes.
+  
+  Update both packages together for the new layout: older Subagents can still duplicate the new overview; newer Subagents paired with older Workflows leaves the older upper progress panel. Existing running sessions do not acquire these UI changes until a later normal activation.
+
+### Patch Changes
+
+- 3096585: Do not charge managed-request preflight rejections as submissions, and finalize schema-invalid logical calls with their exact settled attempt metadata. Count all owner-side workflows in the passive overview without expanding the bounded peer snapshot.
+- 3096585: Validate complete managed requests before allocating dispatch leases, preserving local validation diagnostics and completed resume prefixes. Apply structured-output constraints conjunctively and extract balanced JSON from large malformed replies in linear time without changing bounded repair behavior.
+- 3096585: Validate persisted transcript pointers with the managed protocol contract and settle logical calls when a token budget prevents a repair attempt, preserving the completed child's usage and ownership on restore.
+- Updated dependencies [3096585]
+- Updated dependencies [3096585]
+  - @signalridge/pi-ui@1.5.0
+
 ## 1.11.1
 ### Patch Changes
 

package/README.md

@@ -265,7 +265,13 @@ Phase entry, task attempts and call attribution come from fenced runtime observa
 
 A selected root agent call can open its retained conversation through the subagent owner's optional exact-attempt UI endpoint. Unknown or reused old attempts are not redirected to a newer child. Workflow controls remain here; steering, child stop, sessions, model policy and foreground handoff remain in `pi-subagents`. The optional UI protocol does not change the required managed v4 handshake.
 
-The passive progress panel uses a terminal-height row budget, prioritizes live calls and reports overflow rather than growing as runs × calls. Names/results are sanitized only in display copies; journals and stored source remain unchanged. Fullscreen, regular terminal, RPC and print paths retain their distinct public API boundaries.
+Workflows owns one rich passive overview **below the editor**; there is no second upper workflow list. Rows put the workflow name first, followed by semantic status, the observed current phase, running/total call counts, done/failed counts, elapsed time and available **settled-call tokens**. Tokens are completed call-result totals, not live in-flight usage; unknown is omitted and an explicit zero stays zero. Paused, stopping and childless runs remain visible; recent terminal runs linger for four seconds, while all retained history stays in `/workflows`.
+
+`/workflows-progress compact|detailed|status|max <N>` retains its settings: `status` reports them, `detailed` adds bounded call rows, and `max` caps shown runs/calls. The panel uses a terminal-height row budget, prioritizes live calls and reports overflow rather than growing as runs × calls. Names/results are sanitized only in display copies; journals and stored source remain unchanged. The panel takes no empty-prompt arrow keys: `/workflows` is the authoritative navigator. Closing or disposing presentation never stops execution. Fullscreen, regular terminal, RPC and print paths retain their distinct public API boundaries.
+
+Subagents Fleet lists independent agents only. For retained children, use a selected root call in `/workflows`, or `/agents → Retained workflow children` to open the owner inspector or directly inspect the bounded child list. The latter also works when the workflow UI peer is absent or Fleet is disabled. `/agents → Agent runs` retains individual sessions and child steering/stop controls; eligible independent foreground agents keep handoff. Workflow controls and model/execution policy do not move across owners. The optional validated UI query/change/open bridge remains available to external observers and is not a usage RPC.
+
+**Mixed-version UI caveat:** update both packages together for this ownership layout. An older Subagents may still render its own workflow overview alongside the new panel. A newer Subagents with older Workflows hides owned Fleet rows but leaves the older upper progress list in place. Managed protocol v4 and exact-attempt conversation admission are unchanged; no untyped event guessing or automatic legacy-peer suppression is used.
 
 ### Background result notifications
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-workflows",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Deterministic JavaScript orchestration workflows backed by pi-subagents managed spawning.",
   "type": "module",
   "license": "MIT",
@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "@signalridge/pi-subagents-protocol": "^1.6.0",
-    "@signalridge/pi-ui": "^1.4.1",
+    "@signalridge/pi-ui": "^1.5.0",
     "acorn": "^8.16.0"
   },
   "pi": {

package/skills/workflow-authoring/SKILL.md

@@ -2,7 +2,7 @@
 name: workflow-authoring
 description: Design, write, review, and debug Pi JavaScript workflows that coordinate multiple subagents. Use when a request needs named dependencies, bounded fan-out, per-item pipelines, quality gates, saved or nested workflows, pause/resume, or workflow progress; do not use it merely to run an existing named workflow.
 metadata:
-  version: "1.11.1"
+  version: "1.12.0"
 ---
 
 # Workflow authoring

package/skills/workflow-authoring/references/capabilities.md

@@ -2,7 +2,7 @@
 # Workflow capability index
 
 Contract format: `2.0.0`<br>
-Contract content / skill / extension: `1.11.1`
+Contract content / skill / extension: `1.12.0`
 
 This compact generated index covers supported runtime globals and workflow-tool inputs. For constraints, compatibility behavior, internal boundaries, and dynamic-reference ownership, follow the [exhaustive generated facts](capability-details.md).
 

package/skills/workflow-authoring/references/capability-details.md

@@ -2,7 +2,7 @@
 # Exhaustive workflow capability facts
 
 Contract format: `2.0.0`<br>
-Contract content / skill / extension: `1.11.1`
+Contract content / skill / extension: `1.12.0`
 
 Every exact fact below is projected from the installed extension's capability contract. Explanatory judgment belongs in the hand-written references next to this file.
 

package/skills/workflow-authoring/references/runtime.md

@@ -21,7 +21,9 @@ Call `agent(prompt, { label, schema?, strength? })`; it returns text, a schema-v
 
 Use `agent(prompt, { thread: "implementer" })` when the same managed subagent must receive a later follow-up with its complete conversation intact. Reuse a thread name sequentially; never put same-thread calls in one `parallel()` batch. Threads are scoped to one workflow run/session and cannot use worktree isolation. A pause or process restart may require a fresh thread session.
 
-When JavaScript reads fields, pass a small plain JSON Schema. Schema noncompliance after repair throws and bypasses agent retries. Catch it only to return an explicit incomplete outcome without reading missing fields. Return objects, arrays, strings, numbers, booleans, and `null`—not functions, promises, cycles, `BigInt`, or runtime handles.
+Managed requests are validated locally before dispatch. The complete effective prompt must be nonblank and at most 100,000 characters after trimming, including schema instructions and any repair feedback. Leave room for both when sizing a prompt; aggregate compact summaries or bounded excerpts instead of concatenating full worker outputs. An oversized request throws a validation error without allocating a child or invalidating the completed journal prefix. A submitted request with a lost/ambiguous reply still requires positive exact-owner cleanup; a missing reconciliation record is not proof of cleanup.
+
+When JavaScript reads fields, pass a small plain JSON Schema. Supported constraints are conjunctive: `const` and `enum` do not bypass type, required/properties/items, bounds, or `additionalProperties: false`. Unsupported keywords are rejected, not silently ignored. JSON extraction accepts prose/fences and balanced nested values, handles escaped strings, and can recover a later balanced candidate after a malformed prefix in linear time; balanced but invalid JSON still enters bounded repair. Schema noncompliance after repair throws and bypasses agent retries. Catch it only to return an explicit incomplete outcome without reading missing fields. Return objects, arrays, strings, numbers, booleans, and `null`—not functions, promises, cycles, `BigInt`, or runtime handles.
 
 ## Routing and support
 

package/skills/workflow-patterns/SKILL.md

@@ -2,7 +2,7 @@
 name: workflow-patterns
 description: Choose and run one of Pi's built-in multi-agent workflows for research, adversarial review, code review, multi-perspective analysis, or codebase auditing. Use when the request matches a named pattern; use workflow-authoring instead for a new script or custom topology.
 metadata:
-  version: "1.11.1"
+  version: "1.12.0"
 ---
 
 # Built-in workflow patterns

package/skills/workflow-review/SKILL.md

@@ -2,7 +2,7 @@
 name: workflow-review
 description: Audit an existing Pi JavaScript workflow for topology, prompt/data flow, limits, failure handling, cancellation, resume safety, and publication compatibility. Use when reviewing or debugging a workflow script or saved run; do not use to run a standard named workflow.
 metadata:
-  version: "1.11.1"
+  version: "1.12.0"
 ---
 
 # Workflow review

package/src/engine.ts

@@ -20,7 +20,13 @@
 import { createHash, randomUUID } from "node:crypto";
 import type { ManagedSpawnResponse } from "@signalridge/pi-subagents-protocol";
 import { isManagedAgentTier } from "@signalridge/pi-subagents-protocol";
-import { describeWorkflowError, WorkflowError, WorkflowErrorCode, wrapError } from "./errors.js";
+import {
+  AllocationFreeDispatchError,
+  describeWorkflowError,
+  WorkflowError,
+  WorkflowErrorCode,
+  wrapError,
+} from "./errors.js";
 import { type WorkflowInspection, type WorkflowInspectionHeader, WorkflowPresentation } from "./inspection.js";
 import {
   applyRecoveryEvent,
@@ -46,6 +52,7 @@ import {
   type DispatchTask,
   type ManagedProtocolCheck,
   type ManagedSpawnClient,
+  prepareManagedSpawnRequest,
   type WorkflowEventBus,
 } from "./rpc-client.js";
 import {
@@ -179,6 +186,8 @@ interface ManagedCallFacts {
   executionGeneration: number;
   attemptId: string;
   agentId: string;
+  /** Exact-owner terminal admission, not merely a queued/running identity. */
+  settled?: boolean;
   tokenCount?: number;
   outputFile?: string;
   compactionCount: number;
@@ -788,6 +797,7 @@ export class WorkflowEngine {
       facts.agentId !== agentId
     )
       return;
+    facts.settled = true;
     facts.tokenCount = terminal.tokenCount;
     facts.outputFile = terminal.outputFile;
     facts.compactionCount = Math.max(facts.compactionCount, terminal.compactionCount);
@@ -1564,6 +1574,12 @@ export class WorkflowEngine {
         onAgentEnd: (event) => {
           if (!isPresentationCurrent()) return;
           const nodeId = event.id.startsWith(`${runId}:`) ? event.id.slice(runId.length + 1) : undefined;
+          // A completed child is not a successful logical call until runtime
+          // validation accepts it. Exhausted schema/repair failures must settle
+          // the current journal attempt too, not just its volatile presentation.
+          if (nodeId !== undefined && event.error !== undefined)
+            this.finalizeLogicalCallFailure(state, nodeId, event.error);
+          if (!isPresentationCurrent()) return;
           const persisted = nodeId === undefined ? undefined : state.run.callResults[nodeId];
           const persistedTokens =
             nodeId !== undefined && persisted?.attemptId === state.run.attemptIds[nodeId]
@@ -1712,7 +1728,6 @@ export class WorkflowEngine {
     const spawnNodeId = `call-${nodeId}`;
     const base = state.generations.get(nodeId) ?? 0;
     const generation = base + (runOptions.attempt ?? 1);
-    state.generations.set(nodeId, generation);
     const spawnAttemptId = `attempt-${generation}`;
     const attemptId = `${runId}/${nodeId}/attempt-${generation}`;
 
@@ -1725,13 +1740,6 @@ export class WorkflowEngine {
         { recoverable: false },
       );
     }
-    // This dispatch is authoritative for the current script revision. Do not
-    // carry an identity from the previous script: deleting `tier` must clear
-    // the recorded one instead of silently preserving the old route.
-    const tierIdentity: CallTierIdentity = tier === undefined ? {} : { tier };
-    state.callTiers.set(nodeId, tierIdentity);
-    run.callTiers[nodeId] = tierIdentity;
-    state.managedCallFacts.delete(nodeId);
     const task: DispatchTask = {
       subagent_type: type,
       prompt,
@@ -1743,6 +1751,25 @@ export class WorkflowEngine {
       ...(runOptions.isolation === undefined ? {} : { isolation: runOptions.isolation }),
     };
 
+    // Validate the complete effective wire request (schema/repair text included)
+    // before any attempt fact or submitted lease. A deterministic caller error
+    // owns no remote allocation; cleanup must not mask its original diagnostic.
+    try {
+      prepareManagedSpawnRequest(task, runId, spawnNodeId, spawnAttemptId);
+    } catch (error: unknown) {
+      // This proof is minted only on the allocation-free side of dispatch;
+      // errors from client.spawn below remain conservatively chargeable.
+      throw new AllocationFreeDispatchError(error);
+    }
+    state.generations.set(nodeId, generation);
+    // This dispatch is authoritative for the current script revision. Do not
+    // carry an identity from the previous script: deleting `tier` must clear
+    // the recorded one instead of silently preserving the old route.
+    const tierIdentity: CallTierIdentity = tier === undefined ? {} : { tier };
+    state.callTiers.set(nodeId, tierIdentity);
+    run.callTiers[nodeId] = tierIdentity;
+    state.managedCallFacts.delete(nodeId);
+
     // Journal the attempt rotation only for top-level calls. A nested frame is
     // represented by its parent workflow_result replay boundary instead of
     // leaking child call facts into the parent's numeric call namespace.
@@ -2235,6 +2262,33 @@ export class WorkflowEngine {
     state.run.updatedAt = Date.now();
   }
 
+  private finalizeLogicalCallFailure(state: ScriptRunState, nodeId: string, error: string): void {
+    const run = state.run;
+    const facts = state.managedCallFacts.get(nodeId);
+    // No guesses about unknown remote admissions, stale attempts, nested calls,
+    // or failures already committed by dispatch's lifecycle terminal path.
+    if (
+      run.callStatus[nodeId] !== "running" ||
+      !facts?.settled ||
+      facts.executionGeneration !== state.executionGeneration ||
+      facts.attemptId !== run.attemptIds[nodeId]
+    )
+      return;
+    const result = resultFromLifecycle(
+      "failed",
+      facts.agentId,
+      undefined,
+      error,
+      facts.compactionCount,
+      facts.tokenCount,
+      state.callTiers.get(nodeId)?.tier,
+    );
+    result.attemptId = facts.attemptId;
+    if (facts.outputFile !== undefined) result.outputFile = facts.outputFile;
+    // No call hash/store delta: invalid output can never enter the replay cache.
+    this.commitCallTerminal(run.runId, nodeId, result);
+  }
+
   private commitCallTerminal(runId: string, nodeId: string, result: CallResult, required = false): void {
     const state = this.runs.get(runId);
     if (!state) return;

package/src/errors.ts

@@ -67,6 +67,20 @@ export class WorkflowError extends Error {
   }
 }
 
+/**
+ * Host-only proof that effective managed-request validation rejected before any
+ * attempt rotation or remote allocation. Never infer this from a code/message,
+ * or attach it to an error received after submitting a spawn.
+ */
+export class AllocationFreeDispatchError extends WorkflowError {
+  constructor(cause: unknown) {
+    super(cause instanceof Error ? cause.message : String(cause), WorkflowErrorCode.SCRIPT_VALIDATION_ERROR, {
+      recoverable: false,
+      details: cause,
+    });
+  }
+}
+
 // Transported VM throws must not acquire provider/abort classification merely
 // because IPC reconstructed them in the host Error realm. Keep provenance and
 // helper-computed text outside user data (including non-Error object throws).

package/src/index.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { defineTool } from "@earendil-works/pi-coding-agent";
-import { Text, truncateToWidth } from "@earendil-works/pi-tui";
+import { Text } from "@earendil-works/pi-tui";
 import { sanitizeDisplayText } from "@signalridge/pi-ui";
 import { Type } from "@sinclair/typebox";
 import { DEFAULT_TRIGGER_WORD, hasTriggerWord, WORKFLOW_ARMING_MESSAGE_TYPE, WorkflowTurnArming } from "./arming.js";
@@ -26,8 +26,9 @@ import {
   WORKFLOW_STRENGTHS,
   type WorkflowStrengthTable,
 } from "./strengths.js";
-import { liveWidgetLines, showWorkflowNavigator } from "./ui.js";
+import { showWorkflowNavigator } from "./ui.js";
 import { buildWorkflowUiSnapshot, openOwnedConversation, WorkflowUiBridge, type WorkflowUiSurface } from "./ui-bus.js";
+import { overviewRuns, workflowOverviewLines } from "./ui-overview.js";
 import {
   loadProjectWorkflowSettings,
   loadWorkflowSettings,
@@ -509,11 +510,12 @@ export default function piWorkflows(pi: ExtensionAPI): void {
       .map((summary) => workflowEngine.getRun(String(summary.runId)))
       .filter((run): run is NonNullable<typeof run> => run !== undefined);
     if (statusSource?.()) tui.setStatus("pi-workflows", workflowStatusSummary(runs));
-    const hasActive = runs.some((run) => !["completed", "failed", "stopped"].includes(run.status));
+    const hasProgress = overviewRuns(runs).length > 0;
     const surfaceId = workflowUiSurfaceId;
+    const snapshot = buildWorkflowUiSnapshot(workflowEngine, surfaceId);
     tui.setWidget(
       "pi-workflows",
-      hasActive
+      hasProgress
         ? (host, theme) => ({
             render(width) {
               if (
@@ -521,29 +523,33 @@ export default function piWorkflows(pi: ExtensionAPI): void {
                 engine !== workflowEngine ||
                 workflowEngine.isDisposed() ||
                 workflowUiSurfaceId !== surfaceId ||
+                !ownsDeliveryBranch() ||
                 !Number.isFinite(width) ||
                 width < 1
               )
                 return [];
               const height = Number.isFinite(host.terminal.rows) ? Math.max(0, host.terminal.rows) : 24;
-              const rowBudget = Math.max(1, Math.min(12, Math.floor(height / 4)));
-              return liveWidgetLines(
+              const rowBudget = Math.max(0, Math.min(12, Math.floor(height / 4)));
+              return workflowOverviewLines(
                 runs,
+                snapshot.runs,
+                theme,
+                width,
+                rowBudget,
                 workflowSettings.progressMode,
                 workflowSettings.maxAgentsShown,
-                rowBudget,
-              ).map((line, index) =>
-                truncateToWidth(theme.fg(index === 0 ? "accent" : "muted", line), Math.floor(width)),
               );
             },
             invalidate() {},
           })
         : undefined,
+      { placement: "belowEditor" },
     );
+    // Publication/footer cadence is independent of passive row visibility.
     workflowUiBridge?.publish();
-    if (hasActive && !widgetTimer) {
+    if (hasProgress && !widgetTimer) {
       widgetTimer = setInterval(refreshWidget, 2_000);
-    } else if (!hasActive && widgetTimer) {
+    } else if (!hasProgress && widgetTimer) {
       clearInterval(widgetTimer);
       widgetTimer = undefined;
     }
@@ -765,9 +771,6 @@ export default function piWorkflows(pi: ExtensionAPI): void {
     // re-run every finished call untabled.
     workflowEngine.strengths = () => workflowSettings.strengths;
     workflowEngine.loadSavedWorkflow = resolveNestedWorkflow;
-    // Command/tool registrations persist across session replacement, but the
-    // widget belongs to the newly restored engine and must be refreshed too.
-    refreshWidget();
     if (surfaceRegistered) return;
     surfaceRegistered = true;
 
@@ -2008,7 +2011,7 @@ export default function piWorkflows(pi: ExtensionAPI): void {
       return;
     }
     engine = recoveredEngine;
-    widgetUi = ctx.mode === "tui" ? ctx.ui : undefined;
+    widgetUi = ctx.mode === "tui" && ctx.hasUI ? ctx.ui : undefined;
     registerSurface();
 
     // Public API methods target the current session: generation + branch
@@ -2017,7 +2020,9 @@ export default function piWorkflows(pi: ExtensionAPI): void {
     deliveryBranchAnchor = journalBranchAnchor;
     registerStatusActions();
     workflowUiBridge ??= new WorkflowUiBridge(pi.events, workflowUiSurface);
-    workflowUiBridge.publish();
+    // Bind the presentation only after its session/branch source is installed.
+    refreshWidget();
+    if (!widgetUi) workflowUiBridge.publish();
     inputPreparing = false;
     compacting = false;
     navigating = false;

package/src/journal.ts

@@ -24,7 +24,7 @@
 
 import { createHash } from "node:crypto";
 import type { ManagedOwner } from "@signalridge/pi-subagents-protocol";
-import { isManagedAgentTier } from "@signalridge/pi-subagents-protocol";
+import { isManagedAgentTier, parseManagedTerminalSnapshot } from "@signalridge/pi-subagents-protocol";
 import {
   MAX_CALLS_PER_WORKFLOW,
   normalizeAgentRetries,
@@ -402,6 +402,17 @@ function parseResult(raw: unknown, label: string): CallResult {
   }
   const updatedAt = validTimestamp(raw.updatedAt, label);
   const tierIdentity = parseCallTierIdentity(raw, label);
+  // Transcript pointers have their own managed protocol contract (including
+  // normalization and the 2000-character bound), not the journal identity cap.
+  const outputFile =
+    raw.outputFile === undefined
+      ? undefined
+      : parseManagedTerminalSnapshot({
+          status,
+          outputFile: raw.outputFile,
+          compactionCount,
+          completedAt: updatedAt,
+        }).outputFile;
   const result: CallResult = {
     status,
     compactionCount,
@@ -413,9 +424,7 @@ function parseResult(raw: unknown, label: string): CallResult {
       : { attemptId: boundedString(raw.attemptId, `${label}.attemptId`, JOURNAL_ID_LIMIT) }),
     ...(raw.result === undefined ? {} : { result: raw.result }),
     ...(raw.error === undefined ? {} : { error: boundedString(raw.error, `${label}.error`, JOURNAL_ERROR_LIMIT) }),
-    ...(raw.outputFile === undefined
-      ? {}
-      : { outputFile: boundedString(raw.outputFile, `${label}.outputFile`, JOURNAL_ID_LIMIT) }),
+    ...(outputFile === undefined ? {} : { outputFile }),
     ...(raw.tokenCount === undefined
       ? {}
       : {

package/src/rpc-client.ts

@@ -6,10 +6,12 @@ import type {
 } from "@signalridge/pi-subagents-protocol";
 import {
   PROTOCOL_VERSION,
+  parseManagedSpawnRequest,
   parseManagedSpawnResponse,
   parseProtocolPing,
   requiredCapabilitiesMatch,
 } from "@signalridge/pi-subagents-protocol";
+import { WorkflowError, WorkflowErrorCode } from "./errors.js";
 import type { WorkflowOwner } from "./journal.js";
 
 /** Minimal dispatch task for a script-run agent() call. */
@@ -298,6 +300,31 @@ export interface ManagedSpawnClient {
   checkProtocol?: () => Promise<ManagedProtocolCheck>;
 }
 
+/** Shared wire preflight, also used before the engine submits an allocation lease. */
+export function prepareManagedSpawnRequest(task: DispatchTask, runId: string, nodeId: string, attemptId = "attempt-1") {
+  try {
+    return parseManagedSpawnRequest({
+      requestId: requestId(),
+      spawnKey: `${runId}/${nodeId}/${attemptId}`,
+      type: task.subagent_type,
+      prompt: task.prompt,
+      description: task.description,
+      ...(task.tier === undefined ? {} : { tier: task.tier }),
+      ...(task.toolset === undefined ? {} : { toolset: task.toolset }),
+      ...(task.thread === undefined ? {} : { thread: task.thread }),
+      ...(task.excludeTools === undefined ? {} : { excludeTools: task.excludeTools }),
+      ...(task.isolation === undefined ? {} : { isolation: task.isolation }),
+      owner: { extension: "pi-workflows", runId, nodeId, attemptId },
+    });
+  } catch (error: unknown) {
+    throw new WorkflowError(
+      error instanceof Error ? error.message : String(error),
+      WorkflowErrorCode.SCRIPT_VALIDATION_ERROR,
+      { recoverable: false, details: error },
+    );
+  }
+}
+
 /** Event-bus-only client for the additive pi-subagents managed protocol. */
 export function createManagedSpawnClient(
   events: WorkflowEventBus,
@@ -325,29 +352,15 @@ export function createManagedSpawnClient(
      * fingerprint still reuses the persisted tombstone (per-call cache).
      */
     async spawn(task, runId, nodeId, attemptId, signal) {
-      const effectiveAttemptId = attemptId ?? `attempt-1`;
-      const spawnKey = `${runId}/${nodeId}/${effectiveAttemptId}`;
+      // Outside the transport catch: a local rejection never emitted a request,
+      // so it must not create reconciliation or owned-cleanup uncertainty.
+      const request = prepareManagedSpawnRequest(task, runId, nodeId, attemptId);
+      const { spawnKey, owner } = request;
       const requestSignal =
         signal && sessionSignal ? AbortSignal.any([signal, sessionSignal]) : (signal ?? sessionSignal);
       let data: unknown;
       try {
-        data = await call<unknown>(
-          "subagents:rpc:spawn-managed",
-          {
-            requestId: requestId(),
-            spawnKey,
-            type: task.subagent_type,
-            prompt: task.prompt,
-            description: task.description,
-            ...(task.tier === undefined ? {} : { tier: task.tier }),
-            ...(task.toolset === undefined ? {} : { toolset: task.toolset }),
-            ...(task.thread === undefined ? {} : { thread: task.thread }),
-            ...(task.excludeTools === undefined ? {} : { excludeTools: task.excludeTools }),
-            ...(task.isolation === undefined ? {} : { isolation: task.isolation }),
-            owner: { extension: "pi-workflows", runId, nodeId, attemptId: effectiveAttemptId },
-          },
-          requestSignal,
-        );
+        data = await call<unknown>("subagents:rpc:spawn-managed", { ...request }, requestSignal);
       } catch (error: unknown) {
         // Reconciliation must not inherit the signal that caused the original
         // request to fail: shutdown/abort can happen after allocation but before
@@ -357,7 +370,7 @@ export function createManagedSpawnClient(
           {
             requestId: requestId(),
             spawnKey,
-            owner: { extension: "pi-workflows", runId, nodeId, attemptId: effectiveAttemptId },
+            owner,
           },
           undefined,
           5_000,

package/src/runtime.ts

@@ -25,7 +25,7 @@ import type { ManagedRoutingPolicy } from "@signalridge/pi-subagents-protocol";
 import { agentTierPolicyIdentity, isManagedAgentTier } from "@signalridge/pi-subagents-protocol";
 import { parse } from "acorn";
 import { checkRuntimeBindings } from "./capabilities.js";
-import { WorkflowError, WorkflowErrorCode, wrapError } from "./errors.js";
+import { AllocationFreeDispatchError, WorkflowError, WorkflowErrorCode, wrapError } from "./errors.js";
 import {
   executeOrchestration,
   normalizeOrchestration,
@@ -1038,31 +1038,34 @@ async function withTimeout<T>(
 
 /** Extract the first balanced JSON value ({...} or [...]) from text. */
 export function findJsonBlock(text: string): string | undefined {
-  for (let start = 0; start < text.length; start += 1) {
-    if (text[start] !== "{" && text[start] !== "[") continue;
-    const stack: string[] = [];
-    let inString = false;
-    let escaped = false;
-    for (let i = start; i < text.length; i += 1) {
-      const char = text[i];
-      if (inString) {
-        if (escaped) escaped = false;
-        else if (char === "\\") escaped = true;
-        else if (char === '"') inString = false;
-        continue;
-      }
-      if (char === '"') {
-        inString = true;
-        continue;
-      }
-      if (char === "{" || char === "[") stack.push(char === "{" ? "}" : "]");
-      else if (char === "}" || char === "]") {
-        if (stack.pop() !== char) break;
-        if (stack.length === 0) return text.slice(start, i + 1);
-      }
-    }
+  // Suffix summaries avoid rescanning after every malformed opening bracket.
+  // stringEnd[i] is the position after a closing quote when already in a string
+  // at i; contentEnd[i] is the first unconsumed closing bracket after skipping
+  // balanced children/strings, or -1 for an incomplete/mismatched suffix.
+  // Compute candidates even inside strings: an unmatched/malformed outer prefix
+  // must still allow a later, independently balanced candidate, as before.
+  const stringEnd = new Int32Array(text.length + 2);
+  const contentEnd = new Int32Array(text.length + 1);
+  stringEnd[text.length] = stringEnd[text.length + 1] = contentEnd[text.length] = -1;
+  let start = -1;
+  let end = -1;
+  for (let i = text.length - 1; i >= 0; i--) {
+    const char = text[i];
+    stringEnd[i] = char === '"' ? i + 1 : stringEnd[i + (char === "\\" ? 2 : 1)];
+    if (char === "}" || char === "]") contentEnd[i] = i;
+    else if (char === '"') {
+      const after = stringEnd[i + 1];
+      contentEnd[i] = after < 0 ? -1 : contentEnd[after];
+    } else if (char === "{" || char === "[") {
+      const close = contentEnd[i + 1];
+      if (close >= 0 && text[close] === (char === "{" ? "}" : "]")) {
+        start = i;
+        end = close + 1;
+        contentEnd[i] = contentEnd[end];
+      } else contentEnd[i] = -1;
+    } else contentEnd[i] = contentEnd[i + 1];
   }
-  return undefined;
+  return start < 0 ? undefined : text.slice(start, end);
 }
 
 // ── Minimal plain-JSON-Schema validator ──────────────────────────────────────
@@ -1078,13 +1081,11 @@ function validateValue(value: unknown, schema: SchemaNode, path: string): string
   if (schema.const !== undefined) {
     if (JSON.stringify(value) !== JSON.stringify(schema.const))
       errors.push(`${path}: expected const ${JSON.stringify(schema.const)}`);
-    return errors;
   }
   if (schema.enum !== undefined) {
     if (!(schema.enum as unknown[]).some((e) => JSON.stringify(e) === JSON.stringify(value))) {
       errors.push(`${path}: value not in enum`);
     }
-    return errors;
   }
   const type = schema.type;
   if (type !== undefined) {
@@ -1790,12 +1791,34 @@ export async function runWorkflow<T = unknown>(
           ? `\n\nReply with a single raw JSON value (object or array) matching exactly this JSON Schema:\n${JSON.stringify(schema)}\nDo not wrap it in prose or markdown fences.`
           : "";
       let repairFeedback = "";
+      let previousAttempt: { tokens: number; tokenUsage?: AgentUsage; tier?: string } | undefined;
 
       try {
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
           // Outside the attempt catch: a rejected admission is not a provider
           // attempt and must not be charged an estimated failure or retried.
-          checkBudget();
+          try {
+            checkBudget();
+          } catch (error) {
+            const workflowError = wrapError(error, { agentLabel: label });
+            // A between-attempt denial ends the logical call, but it neither
+            // starts nor charges another physical child. Preserve the previous
+            // attempt's observations; the engine independently requires exact
+            // settled-generation facts before making a durable terminal result.
+            if (previousAttempt && !isAborted() && workflowError.code === WorkflowErrorCode.TOKEN_BUDGET_EXHAUSTED) {
+              options.onAgentEnd?.({
+                id: deltaKey,
+                label,
+                ...phaseObservation(assignedPhase),
+                result: null,
+                ...previousAttempt,
+                error: workflowError.message,
+                errorCode: workflowError.code,
+                recoverable: workflowError.recoverable,
+              });
+            }
+            throw error;
+          }
           usage = undefined;
           const externalSignal = options.signal;
           let onExternalAbort: (() => void) | undefined;
@@ -1964,7 +1987,12 @@ export async function runWorkflow<T = unknown>(
             if (isAborted()) throw error;
 
             const workflowError = wrapError(error, { agentLabel: label });
-            const tokens = recordTokens(null);
+            const allocationFree = error instanceof AllocationFreeDispatchError;
+            // Only trusted local preflight proves this attempt never submitted.
+            // A rejected repair still owns the logical call's earlier dispatch;
+            // neither transport text nor a lost reply can refund that lease.
+            if (allocationFree && attempt === 1) shared.physicalAgentCount--;
+            const tokens = allocationFree ? 0 : recordTokens(null);
             // This attempt's store writes must not survive it — a failed attempt
             // shares this call's deltaKey with every other attempt, so without
             // rolling back here its writes would stay live in the store and merge
@@ -1977,6 +2005,7 @@ export async function runWorkflow<T = unknown>(
                 `agent "${label}" attempt ${attempt}/${maxAttempts} failed: ${workflowError.code} ${workflowError.message}; retrying`,
               );
               options.onRetrySpend?.(tokens);
+              previousAttempt = { tokens, tokenUsage: usage, tier: resolvedTier };
               continue;
             }
 

package/src/ui-overview.ts

@@ -0,0 +1,97 @@
+import type { Theme } from "@earendil-works/pi-coding-agent";
+import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import type { WorkflowUiRunSummary } from "@signalridge/pi-subagents-protocol";
+import type { ScriptRun } from "./journal.js";
+import { sanitizeDisplayText } from "./safe-text.js";
+import { callIndexes, isTerminal, statusMark } from "./ui-presentation.js";
+
+export const OVERVIEW_LINGER_MS = 4_000;
+
+/** Terminal history remains in /workflows, not an indefinitely growing passive list. */
+export function overviewRuns(runs: readonly ScriptRun[], now = Date.now()): ScriptRun[] {
+  return runs.filter((run) => !isTerminal(run.status) || now - run.updatedAt < OVERVIEW_LINGER_MS);
+}
+
+function statusColor(status: string): "success" | "error" | "warning" | "accent" | "muted" {
+  if (status === "completed") return "success";
+  if (status === "failed") return "error";
+  if (["paused", "pausing", "interrupted", "stopping", "stopped"].includes(status)) return "warning";
+  return status === "running" ? "accent" : "muted";
+}
+
+function tokens(count: number): string {
+  if (count >= 1_000_000) return `${(count / 1_000_000).toFixed(1)}M`;
+  if (count >= 1_000) return `${(count / 1_000).toFixed(1)}k`;
+  return String(count);
+}
+
+/**
+ * The workflow owner's passive overview. Authority/phase/settled usage come from
+ * its existing projection, never from child records or in-flight usage polling.
+ * No keyboard listener: /workflows is the sole workflow navigator.
+ */
+export function workflowOverviewLines(
+  runs: readonly ScriptRun[],
+  summaries: readonly WorkflowUiRunSummary[],
+  theme: Pick<Theme, "fg" | "bold">,
+  width: number,
+  maxRows: number,
+  mode: "compact" | "detailed" = "compact",
+  maxAgentsShown = 6,
+  now = Date.now(),
+): string[] {
+  if (!Number.isFinite(width) || width < 1 || !Number.isFinite(maxRows) || maxRows < 1) return [];
+  const columns = Math.floor(width);
+  const rows = Math.min(32, Math.floor(maxRows));
+  const max = Number.isFinite(maxAgentsShown) ? Math.max(1, Math.min(32, Math.floor(maxAgentsShown))) : 6;
+  const available = new Map(overviewRuns(runs, now).map((run) => [run.runId, run]));
+  const entries = summaries.filter((summary) => available.has(summary.runId));
+  if (!available.size) return [];
+  // The peer bridge caps publication at 256 summaries. It supplies bounded row
+  // metadata, never authority over how many owner-side runs exist or are live.
+  const active = [...available.values()].filter((run) => !isTerminal(run.status)).length;
+  const lines = [theme.fg("muted", `Workflows · ${active} active · /workflows`)];
+  if (rows === 1) return lines.map((line) => truncateToWidth(line, columns));
+  let shown = Math.min(max, entries.length, rows - 1);
+  if (available.size > shown && shown + 2 > rows) shown = Math.max(0, shown - 1);
+  const hidden = available.size - shown;
+  for (const [index, summary] of entries.slice(0, shown).entries()) {
+    const run = available.get(summary.runId);
+    if (!run) continue;
+    const color = statusColor(summary.status);
+    const phase = summary.currentPhase ? ` · ${sanitizeDisplayText(summary.currentPhase, 80)}` : "";
+    const stats = `${summary.runningCalls}/${summary.callCount} in flight · ${summary.completedCalls} done · ${summary.failedCalls} failed`;
+    // These are settled-call totals (including explicit zero), NOT live usage.
+    const usage = summary.tokenCount === undefined ? "" : ` · ${tokens(summary.tokenCount)} settled tokens`;
+    const metadata = `${phase} · ${stats}${summary.restored ? " · restored" : ""}`;
+    const left = `  ${theme.fg(color, "▸")} ${theme.bold(sanitizeDisplayText(summary.name, 80))} · ${theme.fg(color, summary.status)}${theme.fg("muted", metadata)}`;
+    const right = theme.fg("muted", `${Math.floor(summary.elapsedMs / 1_000)}s${usage}`);
+    const runLine = lines.length;
+    if (columns >= 48) {
+      // Preserve elapsed/settled usage on ordinary terminals, but never let
+      // secondary stats consume the primary name on a narrow viewport.
+      const boundedRight = truncateToWidth(right, Math.floor(columns / 3));
+      const boundedLeft = truncateToWidth(left, columns - visibleWidth(boundedRight) - 1);
+      const gap = Math.max(1, columns - visibleWidth(boundedLeft) - visibleWidth(boundedRight));
+      lines.push(boundedLeft + " ".repeat(gap) + boundedRight);
+    } else lines.push(`${left} ${right}`);
+    if (mode !== "detailed") continue;
+    const calls = callIndexes(run);
+    const live = calls.filter((id) => run.callStatus[id] === "running");
+    const liveIds = new Set(live);
+    const prioritized = [...live, ...calls.filter((id) => !liveIds.has(id))];
+    const reserved = shown - index - 1 + (hidden > 0 ? 1 : 0);
+    const callRows = Math.max(0, Math.min(max, rows - lines.length - reserved));
+    const visible = prioritized.slice(0, callRows);
+    for (const id of visible) {
+      const status = run.callStatus[id] ?? run.callResults[id]?.status ?? "unknown";
+      lines.push(`    ${theme.fg(statusColor(status), statusMark(status))} ${theme.fg("muted", `${id}: ${status}`)}`);
+    }
+    const omitted = calls.length - visible.length;
+    if (omitted > 0)
+      lines[visible.length ? lines.length - 1 : runLine] += theme.fg("muted", ` · ${omitted} more calls`);
+  }
+  if (hidden > 0) lines.push(theme.fg("muted", `  ${hidden} more workflows · /workflows`));
+  if (lines.length < rows) lines.push(""); // One separator before the next dock/footer surface.
+  return lines.map((line) => truncateToWidth(line, columns));
+}