@giamme/forge 0.10.0 → 0.11.0

package/scripts/forge_registry.py

@@ -49,15 +49,19 @@ def registry_dir() -> Path:
     """The ``runs`` directory under forge's config home.
 
     Resolved the same way ``forge_jev.config_path()`` resolves ``jev.json``:
-    ``XDG_CONFIG_HOME`` when set and not empty, otherwise ``~/.config``, then
-    ``expanduser()``. An empty value counts as unset, as the XDG spec says and as
-    forge-ui's run list reads it; taken literally it named a directory below the
-    current one, usually the user's repo. ``config_path()`` is
-    ``<that>/forge/jev.json``; the registry is the sibling ``runs`` directory.
+    ``XDG_CONFIG_HOME`` (``~`` expanded) when it is an absolute path, otherwise
+    ``~/.config``. An empty or relative value counts as unset, as the XDG spec says
+    ("If an implementation encounters a relative path in any of these variables it
+    should consider the path invalid and ignore it") and as forge-ui's run list reads
+    it; taken literally it named a directory below the current one, usually the
+    user's repo. ``config_path()`` is ``<that>/forge/jev.json``; the registry is the
+    sibling ``runs`` directory.
     """
-    config = (Path(os.environ.get('XDG_CONFIG_HOME') or str(Path.home() / '.config')).expanduser()
-              / 'forge/jev.json')
-    return config.parent / 'runs'
+    value = os.environ.get('XDG_CONFIG_HOME') or ''
+    base = Path(value).expanduser() if value else None
+    if base is None or not base.is_absolute():
+        base = Path.home() / '.config'
+    return base / 'forge' / 'runs'
 
 
 def repo_key(repo) -> str:
@@ -118,8 +122,9 @@ def register_run_dir(repo: Path, run_dir: Path) -> None:
     it went to.
     """
     try:
-        # A relative XDG_CONFIG_HOME resolves below the current directory -- for a runner or
-        # `forge ui open`, usually the user's repo. Forge does not write into the user's tree.
+        # A relative HOME (registry_dir already ignores a relative XDG_CONFIG_HOME) would resolve
+        # below the current directory -- for a runner, usually the user's repo. Forge does not
+        # write into the user's tree.
         if not registry_dir().is_absolute():
             return
         registry = runs_registry(repo)

package/ui/README.md

@@ -96,7 +96,7 @@ Sources are checked in this order:
 2. `--root DIR` itself, its children and grandchildren. Scanning stops when a plan
    directory is found; hidden children and symlinked child directories are skipped.
 3. Forge's registry: `*.txt` files in `$XDG_CONFIG_HOME/forge/runs/`, defaulting
-   to `~/.config/forge/runs/` when XDG_CONFIG_HOME is unset or empty. Each file
+   to `~/.config/forge/runs/` when XDG_CONFIG_HOME is unset, empty or relative. Each file
    supplies absolute paths, one per line; blank lines and `#` comments are ignored.
    `--registry-dir` replaces this location; `--no-registry` disables it.
 
@@ -189,8 +189,9 @@ keep one meaning everywhere (amber running, green merged or passed, red failed,
 - **Models (`#/models`):** a leaderboard of the models forge used. Implementers: tasks, first-attempt
   pass rate with its 95% Wilson interval, censored attempts, retries, escalations away from the
   model, timeouts, gate and human accepts, median model time and tokens. Reviewers: primary,
-  shadow and final reviews, the PASS/FAIL split, findings per review by severity, and how often a
-  shadow review agreed with the primary. Filter by project, difficulty, kind and period, or keep
+  shadow and final reviews, the PASS/FAIL split, findings per review by severity, how often a
+  shadow review agreed with the primary, and how often work it PASSed did not hold (later
+  reverted or rewritten, from `forge dataset reviewers`; "not enough data" below 10 outcomes). Filter by project, difficulty, kind and period, or keep
   only exploratory picks; open a difficulty for its own table. Routing is not random, so the
   numbers compare what happened, not what would have: the page says so. A model's name opens the
   run cloud filtered to its runs.

package/ui/docs/api.md

@@ -50,7 +50,7 @@ written), and the reader must never raise because of one.
 | `deferrals.txt` | one line per task the wave planner deferred |
 | `integration.base`, `accepted.integration` | one commit each: where the integration branch started, the revision the run accepted |
 | `attempts/<role>-<uuid>/` | one *execution* (below) of the run itself: `parallel` (a `run`) or `verification` |
-| `final-review-<epoch>-<pid>/` | one whole-run review: `qa.input`, `qa.last`, `verdict` (`PASS FAIL UNKNOWN INVALIDATED ACCEPTED`; absent while it runs or when nothing was judged), `qa.infra`, `qa.gate`, `known_issues.md`, `review.meta` (`key=value`: `base tip source spec threshold`, `threshold=none` when unset), `tasks.summary`, `attempts/qa-<uuid>/` |
+| `final-review-<epoch>-<pid>/` | one whole-run review: `qa.input`, `qa.last`, `verdict` (`PASS FAIL UNKNOWN INVALIDATED ACCEPTED`; absent while it runs or when nothing was judged), `qa.infra`, `qa.gate`, `known_issues.md`, `review.meta` (`key=value`: `base tip source spec threshold integration`, `threshold=none` when unset; `integration` is the integration-branch commit the reviewed result contains and is absent on older runs), `tasks.summary`, `attempts/qa-<uuid>/` |
 | `final-review` | a symlink to the newest *published* review dir; `final-review.verdict` a copy of its verdict |
 | `integrate-<epoch>-<pid>/` | one `integrate`: `setup.log`, `merge.log`, `verification.*`, `attempts/verification-<uuid>/`, and `final-review/` (a review dir as above) when it ran one |
 | `tasks/<id>/merged` | exists when the task was merged; its mtime is when |
@@ -60,7 +60,7 @@ written), and the reader must never raise because of one.
 | `tasks/<id>/escalations.tsv` | `epoch<TAB>attempt<TAB>from_spec<TAB>to_spec[<TAB>source]` per line; `source` (who decided: `policy`, a human's `retry --dwarf` as `retry`, or a `pin`) is missing on older rows, which read as `policy` |
 | `tasks/<id>/qa.last` | the reviewer's final message; its last line matching `FORGE_VERDICT: PASS` or `FORGE_VERDICT: FAIL` is the verdict |
 | `tasks/<id>/prompt.md`, `approach.md`, `retry_findings.md` | free text |
-| `tasks/<id>/accepted.by` | who accepted a task over a reviewer's FAIL, and why (`key=value` lines in current forge; returned as text) |
+| `tasks/<id>/accepted.by` | who accepted a task over a reviewer's FAIL, and why (`key=value`: `task`, `status`, `reason`, `by`, `at`, `epoch`, `attempt`, `reviewed_commit`; older runs are free text; returned as text) |
 | `tasks/<id>/qa.gate` | `threshold<TAB>decision<TAB>worst<TAB>n_confirmed<TAB>n_unlabelled<TAB>n_below` (`decision` is `accept` or `keep`, `-` for none) |
 | `tasks/<id>/known_issues.md` | the confirmed findings a threshold tolerated |
 | `tasks/<id>/dwarf.input`, `qa.input` | the prompts forge assembled; `<role>.delivered`, `<role>.resolved` the live dispatch files |
@@ -233,6 +233,7 @@ its last 20,000 behind a leading `…`. Their `truncated` lists the field names
 | `POST /api/runs/<key>/issues` | file GitHub issues for chosen findings; authenticated, 300 s timeout |
 | `POST /api/runs/<key>/issues/dismiss` | dismiss or (`undo`) restore findings; authenticated |
 | `POST /api/runs/<key>/delete` | dry-run or delete a run with `forge runs rm`; authenticated, 900 s timeout; later requests for the key answer `404` |
+| `GET /api/models/reviewers` | `200` the `forge dataset reviewers --json` report (how each reviewer's PASSed work held up); no parameters |
 | `GET /api/config?run=<key>` | `200` the `forge config show --json` of that run's repo |
 | `POST /api/config` | set or unset one allowed key (`repo.verify`, `repo.setup`, `repo.verify-subset`, `jev.enabled`); authenticated |
 | `GET /api/runs/<key>/export?texts=0\|1&paths=0\|1` | `200` the run as one HTML file (see Export), `Content-Disposition: attachment`, `Content-Security-Policy: default-src 'none'; sandbox`; `404` for an unknown run |
@@ -286,18 +287,20 @@ nothing when there is none. Every other response keeps
   "counts": {"MERGED": 3, "RUNNING": 1, "PENDING": 1},
   "verification_status": "PASS",
   "created": 1760619000.0,
-  "task_statuses": [{"id": "reader", "status": "MERGED", "difficulty": "high", "title": "Read plan dirs"},
-                    {"id": "page", "status": "RUNNING", "difficulty": "medium", "title": "Draw the page"}],
+  "task_statuses": [{"id": "reader", "status": "MERGED", "difficulty": "high", "title": "Read plan dirs", "accepted": true},
+                    {"id": "page", "status": "RUNNING", "difficulty": "medium", "title": "Draw the page", "accepted": false}],
   "models": ["opus", "sol:xhigh"],
   "dwarf_models": ["sol:xhigh"],
   "qa_models": ["opus"],
-  "final_review": "FAIL"
+  "final_review": "FAIL",
+  "final_review_outdated": false
 }
 ```
 
-- `task_statuses`: every task in `tasks.tsv` order, with its `difficulty` (`null` when empty) and
-  `title` (its first 160 characters, then `…`). A solo run: `[{"id": "solo", "status": <solo status>,
-  "difficulty": null, "title": <goal or "Solo run">}]`.
+- `task_statuses`: every task in `tasks.tsv` order, with its `difficulty` (`null` when empty),
+  `title` (its first 160 characters, then `…`) and `accepted` (`true` when `tasks/<id>/accepted.by`
+  is a non-empty file). A solo run: `[{"id": "solo", "status": <solo status>, "difficulty": null,
+  "title": <goal or "Solo run">, "accepted": false}]`. `accepted` does not change `status` or `counts`.
 - `created`: when the run began: the earliest birth time (else mtime) of the files a run writes
   once at its start (plan: `run_id`, `repo`, `request.md`, `goal.txt`, `tasks.tsv`; solo: `prompt.md`,
   `repo`, `request.md`, `goal.txt`), else `null`. These are stat'ed only, and never move `updated`.
@@ -306,6 +309,11 @@ nothing when there is none. Every other response keeps
   and `qa` specs as its task has them), nulls left out.
 - `final_review`: the first word of `final-review.verdict`, else `null`; always `null` for a
   solo run. (RunDetail replaces it with an object, below.)
+- `final_review_outdated`: `true`, `false` or `null`, for the published review only (the dir the
+  `final-review` link points to, when that link stays inside the plan). The same rule as
+  FinalReviewSummary `outdated`, below. `null` when there is no such review, it has no verdict, or
+  `accepted.integration` is missing; always `null` for a solo run. RunDetail keeps this field
+  (it is not replaced by the newest review's `outdated`).
 
 `kind` is `"plan"` or `"solo"`. `updated` is the newest mtime (epoch seconds, float) among
 the run dir and the files the reader read. Any field it cannot determine is `null`
@@ -316,7 +324,11 @@ are `null`, `task_count` is 1, and `counts` is `{<status>: 1}` using the solo st
 The summary reads only `repo`, `goal.txt`, `status`, `verdict`, `dwarf.spec`, `qa.spec` and,
 when a spec file is missing, `*.resolved`. It also stats `dwarf.log` and `qa.log` without
 reading them, so `updated` moves while a model is writing a log. A plan summary reads
-`final-review.verdict` besides the files it always read.
+`final-review.verdict` besides the files it always read. For `final_review_outdated` it also
+reads `accepted.integration` and, through the `final-review` link, that dir's `verdict` and
+`review.meta`, and stats each task's `merged` marker. Those reads count toward `updated`, the
+same way as every other file the summary reads, so a newer `accepted.integration` moves the
+run's activity time. It does not open a review's attempts or scan the other review dirs.
 
 ## RunDetail
 
@@ -370,7 +382,9 @@ Every RunSummary field, plus:
   path of its review dir or `null`, `ended` the latest end of its verification and review
   executions (`null` while one is unfinished or there is none).
 - `final_review` is the newest FinalReviewSummary (review and integrate dirs together, by the
-  epoch in the name), or `null`; `final_reviews` lists the newest 20, newest first.
+  epoch in the name), or `null`; `final_reviews` lists the newest 20, newest first. That newest
+  review's `outdated` is its own. `final_review_outdated` stays the published review's flag, so
+  the two differ when a newer review exists than the one `final-review` links to.
 - `deferrals`: the non-empty lines of `deferrals.txt`, `[]` when it is missing.
 - `findings_available`: whether `scripts/forge-contract.py` could be loaded.
 - `fractal`: `null` without `fractal-selection.json`, else `{"enabled", "run", "available", "reason"}`
@@ -403,6 +417,9 @@ Every RunSummary field, plus:
   "escalations": [{"at": 1760620500.0, "attempt": 2, "from": "luna", "to": "sol", "source": "policy"}],
   "verdict": "PASS",
   "accepted_by": null,
+  "accepted": false,
+  "accepted_attempt": null,
+  "accepted_over": null,
   "explored": true,
   "route": [{"at": 1760619000.0, "task": "reader", "tier": "high", "epsilon": 0.5,
              "candidates": ["astra", "opus"], "default": "opus", "chosen": "astra",
@@ -437,6 +454,14 @@ Every RunSummary field, plus:
 - `infra` in an attempt: `null` for empty, `-` or missing.
 - `source` in an escalation: the 5th column of `escalations.tsv` (`policy`, `retry` or `pin`, as forge wrote it); `policy` when the row has only 4 columns or the cell is empty.
 - `verdict`: `"PASS"`, `"FAIL"` or `null`, from `qa.last` as described above.
+- `accepted`: `true` when `accepted.by` is a non-empty file, on `task_statuses` and on the task.
+  `status` stays what the merged marker or `status` file says (`MERGED` when the marker is there)
+  and `counts` do not change.
+- `accepted_attempt`: the integer `attempt=` of `accepted.by`, or `null` when the key is missing
+  or not an integer (not an integer is warned). On the task, not on `task_statuses`.
+- `accepted_over`: `"FAIL"` or `"UNKNOWN"` when `status=` in `accepted.by` says so; `null` for any
+  other or missing value, including `PASS` (the panel then says plain "accepted"). On the task,
+  not on `task_statuses`. A free-text `accepted.by` from an older forge has both null.
 - `dwarf_tail`: the last 4,000 characters of `dwarf.last` (`tasks/<id>/dwarf.last` for a
   plan task, the run dir's `dwarf.last` for a solo run), or `null` when the file is missing.
   Capped like `qa_tail`.
@@ -468,8 +493,9 @@ it is missing or `<harness default>`). `wave` is 1, `branch` is `null`, and `att
 from the run dir's `attempts.tsv`. `status` is the solo status; `attempt` is the highest `n`
 in `attempts.tsv`, or `null`. `escalations`, `route` and `shadow` are empty. `verdict` and
 `qa_tail` come from `qa.last`, and `prompt` comes from `prompt.md`. `deps` and `files` are
-`[]`; `difficulty`, `accepted_by`, `approach` and `retry_findings` are `null`; `explored` is
-false; `clef` is `{first_pass: null, retry_pass: {}}`. `request` on the detail is `request.md`.
+`[]`; `difficulty`, `accepted_by`, `approach` and `retry_findings` are `null`; `accepted` is
+false; `accepted_attempt` and `accepted_over` are `null`; `explored` is false; `clef` is
+`{first_pass: null, retry_pass: {}}`. `request` on the detail is `request.md`.
 
 ## Execution
 
@@ -538,6 +564,7 @@ block's 1-based line in the reply. Lists of Findings keep the first 200.
 ```json
 {"name": "final-review-1760622000-4242", "source": "review", "at": 1760622000.0, "published": true,
  "verdict": "FAIL", "state": "done", "spec": "opus", "threshold": "P2", "base": "1a2b...", "tip": "3c4d...",
+ "integration": "3c4d...", "outdated": false, "merged_since": [],
  "gate": {...}, "findings": FindingsSummary, "execution": "qa-...",
  "started": 1760622010.0, "ended": 1760622400.0, "duration_s": 390.0}
 ```
@@ -548,7 +575,29 @@ block's 1-based line in the reply. Lists of Findings keep the first 200.
   publishes nothing).
 - `state`: `done` with a verdict, `infra` with `qa.infra`, `running` when it is the newest
   review and has `qa.input`, else `orphaned`.
-- `spec`, `threshold`, `base`, `tip` come from `review.meta` (`threshold=none` is `null`).
+- `spec`, `threshold`, `base`, `tip`, `integration` come from `review.meta` (`threshold=none` is
+  `null`). `integration` is the integration-branch commit the reviewed result contains, or `null`
+  when missing, empty, or not a commit. A commit is the object name `git rev-parse` writes: 40
+  or 64 lowercase hex digits. Any other `integration=` value is warned on that
+  `review.meta` (`integration is not a commit`; the summary's read of the published dir
+  warns `final-review/review.meta`) and is not a known commit, so freshness uses the next rule.
+  `source` on this object is the dir kind, `review` or `integrate`, not `review.meta`'s
+  `source=` (a worktree path).
+- `outdated`: whether the plan's integration branch has moved since this review. `null` when the
+  review has no verdict, or when `accepted.integration` is missing. Otherwise the first rule that
+  applies:
+  1. `integration` is a commit: `true` when it differs from `accepted.integration`.
+  2. Else, for `source` `review`: `true` when `tip` differs from `accepted.integration`.
+  3. Else (an integrate review from an older forge, which has no `integration=` commit): `true`
+     when any task merged after the review started.
+- `merged_since`: the ids of tasks merged after the review started, oldest merge first. `[]` when
+  the review is not outdated. It may also be `[]` for an outdated review whose only later merge
+  fell inside the review's starting second.
+- A task merged after the review when the mtime of its `merged` marker is `>= at + 1`, where `at`
+  is the whole-second epoch in the review dir's name. A merge inside that starting second is
+  ambiguous and is not counted. The execution's `started` is not used.
+- `outdated` means tasks merged into the plan's integration branch since the review. Changes on
+  the user's own branch after an integrate are not tracked.
 - `execution` is its newest `attempts/qa-*`; `started`, `ended`, `duration_s` are that
   execution's.
 
@@ -662,13 +711,15 @@ lists, for all tasks and final reviews at once, without `text` or `line`.
             "verdict": "FAIL", "findings": [{"id": "qa-…:0", "severity": "P1", "status": "CONFIRMED",
                                              "location": "ui/reader.py:42", "summary": "…"}]}]}],
  "final_reviews": [{"name": "final-review-…", "execution": "qa-…", "spec": "sol", "verdict": "FAIL",
+                    "outdated": true, "merged_since": ["reader"],
                     "findings": [{"id": "qa-…:0", "severity": "P2", "status": "CONFIRMED", "location": null, "summary": "…"}]}],
  "truncated": [], "warnings": []}
 ```
 
 A task's `reviews` are every primary and shadow review of every attempt that listed a Finding
-(a solo run has one task, `solo`); `final_reviews` the newest 20 final reviews that did. A
-Finding's `id` is `<execution>:<n>`, `n` its 0-based place in the reply (`primary:<n>` or
+(a solo run has one task, `solo`); `final_reviews` the newest 20 final reviews that did. Each
+of those carries `outdated` and `merged_since`, the same values as that review's
+FinalReviewSummary. A Finding's `id` is `<execution>:<n>`, `n` its 0-based place in the reply (`primary:<n>` or
 `final:<n>` for a reply without an execution); the DiffDetail that pins it gives it the same
 `id`, so a mark on the stage opens that Finding in the diff. `available` is `false` without the
 contract module, and the lists are then empty.
@@ -1061,6 +1112,15 @@ deletion) `500`. Deletion holds the run's write lock and a server-wide lock on t
 directory (`409 busy` when either is held). The run key is looked up again under the lock, and
 once the directory is gone every later request for that key is `404`. Timeout 900 s.
 
+### `GET /api/models/reviewers`
+
+Runs `dataset reviewers --json` and answers with its object: `horizon_days`, `min_landed`,
+`survives_at`, `reviewers` (per reviewer alias: `landed`, `reverted`, `rewritten`,
+`did_not_hold`, `enough`, and `rate` and `ci` only when `enough`, else `null` with a `note`),
+`unattributed`, `skipped` and `other_horizons`. Any query parameter is a `400`. Not cached: every
+request runs the CLI, and the page asks once per change of `/api/models`. Advisory: it feeds the
+Reviewers table's Did not hold column and nothing else. Timeout 60 s.
+
 ### `GET /api/config?run=<key>` and `POST /api/config`
 
 The repository is the run's own `repo` file (first line, an existing absolute directory; else

package/ui/forge_ui/control.py

@@ -538,6 +538,17 @@ def _config_set(ctx):
 
 # (method, path pattern, handler(ctx) -> (status, body)); group 1 of the pattern is the run key
 # (the config routes name it in the query or body instead). New routes are added here.
+def _reviewer_outcomes(ctx):
+    # How the work each reviewer PASSed held up afterwards (`forge dataset reviewers`): advisory,
+    # read from the run dataset through the CLI, so forge_ui never opens the store itself.
+    ctx.route = 'reviewers'
+    try:
+        _query_params(ctx.query, ())
+    except BadBody as exc:
+        return _invalid(str(exc))
+    return ctx.call('dataset', 'reviewers', '--json')
+
+
 ROUTES = [
     ('GET', re.compile(r'/api/runs/([0-9a-f]{12})/controls'), _show),
     ('POST', re.compile(r'/api/runs/([0-9a-f]{12})/controls'), _change),
@@ -547,6 +558,7 @@ ROUTES = [
     ('POST', re.compile(r'/api/runs/([0-9a-f]{12})/delete'), _delete),
     ('GET', re.compile(r'/api/config()'), _config_get),
     ('POST', re.compile(r'/api/config()'), _config_set),
+    ('GET', re.compile(r'/api/models/reviewers()'), _reviewer_outcomes),
 ]
 
 

package/ui/forge_ui/reader.py

@@ -42,6 +42,21 @@ def _kind(path):
     return None
 
 
+def _default_registry_dir():
+    """forge's run registry, resolved the way forge writes it (scripts/forge_registry.registry_dir).
+
+    ``XDG_CONFIG_HOME`` (``~`` expanded) when it is an absolute path, otherwise ``~/.config``: an
+    empty or relative value counts as unset (XDG spec), as it does when forge registers a run.
+    None only when even that is not absolute (a relative HOME): forge never registers a run
+    there, so reading it would only pick up whatever the current directory happens to hold.
+    """
+    value = os.environ.get('XDG_CONFIG_HOME') or ''
+    base = Path(value).expanduser() if value else None
+    if base is None or not base.is_absolute():
+        base = Path.home() / '.config'
+    return base / 'forge' / 'runs' if base.is_absolute() else None
+
+
 def discover(plans=(), roots=(), registry=True, registry_dir=None):
     found, seen = [], set()
 
@@ -76,10 +91,9 @@ def discover(plans=(), roots=(), registry=True, registry_dir=None):
     for path in roots:
         scan(Path(path))
     if registry:
-        base = Path(registry_dir) if registry_dir is not None else Path(
-            os.environ.get('XDG_CONFIG_HOME') or Path.home() / '.config') / 'forge' / 'runs'
+        base = Path(registry_dir) if registry_dir is not None else _default_registry_dir()
         try:
-            entries = sorted(base.glob('*.txt'))
+            entries = sorted(base.glob('*.txt')) if base is not None else []
         except OSError:
             entries = []
         for entry in entries:
@@ -310,10 +324,14 @@ def _tasks(reader):
             reader.warn(label, 'invalid task id')
             continue
         prefix = f'tasks/{ident}'
-        status = 'MERGED' if reader.exists(prefix + '/merged') else reader.word(prefix + '/status') or 'PENDING'
+        # One stat: the run list needs the mtime, and detail reads the same marker again.
+        merged = reader.stat(prefix + '/merged')
+        status = 'MERGED' if merged is not None else reader.word(prefix + '/status') or 'PENDING'
         tasks.append(dict(id=ident, title='\t'.join(row[6:]), deps=_list(deps),
                           difficulty=difficulty, files=_list(files), dwarf=_nullable(dwarf),
-                          qa=_nullable(qa), status=status))
+                          qa=_nullable(qa), status=status,
+                          merged_at=float(merged.st_mtime) if merged is not None else None,
+                          accepted=_nonempty(reader, prefix + '/accepted.by')))
     return tasks
 
 
@@ -353,12 +371,15 @@ def _summary(reader, source):
     final_review = reader.word('final-review.verdict')
     dwarf_models = sorted({task['dwarf'] for task in tasks if task['dwarf']})
     qa_models = sorted({task['qa'] for task in tasks if task['qa']})
+    # Before snapshotting `updated`: these reads are files the summary read, so a newer
+    # accepted.integration (or the published verdict / review.meta) moves the activity time.
+    final_review_outdated = _published_outdated(reader, tasks)
     result.update(updated=reader.updated, created=_created(reader.path, _PLAN_START_FILES),
                   task_count=len(tasks), counts=counts,
                   task_statuses=[dict(id=task['id'], status=task['status'], difficulty=task['difficulty'] or None,
-                                      title=_brief(task['title'])) for task in tasks],
+                                      title=_brief(task['title']), accepted=task['accepted']) for task in tasks],
                   models=sorted(set(dwarf_models) | set(qa_models)), dwarf_models=dwarf_models, qa_models=qa_models,
-                  final_review=final_review)
+                  final_review=final_review, final_review_outdated=final_review_outdated)
     return result, tasks
 
 
@@ -389,9 +410,10 @@ def _solo_summary(reader, source):
                 decompose_level=None, verification_status=None, updated=reader.updated,
                 created=_created(reader.path, _SOLO_START_FILES),
                 task_count=1, counts={status: 1},
-                task_statuses=[dict(id='solo', status=status, difficulty=None, title=_brief(goal or 'Solo run'))],
+                task_statuses=[dict(id='solo', status=status, difficulty=None, title=_brief(goal or 'Solo run'),
+                                    accepted=False)],
                 models=sorted({dwarf, qa} - {None}), dwarf_models=[dwarf] if dwarf else [],
-                qa_models=[qa] if qa else [], final_review=None)
+                qa_models=[qa] if qa else [], final_review=None, final_review_outdated=None)
 
 
 def summarize(path, source='plan') -> dict:
@@ -502,6 +524,26 @@ def _shadows(reader, ident, task_execs):
     return result
 
 
+def _accepted_fields(reader, name, text):
+    """(attempt, over) from an accepted.by body. A non-integer attempt= is null and warned.
+
+    status= FAIL or UNKNOWN is what was accepted over; any other or missing value is null
+    (a PASS record is an acceptance with nothing to say beyond "accepted").
+    """
+    if not text:
+        return None, None
+    fields = executions.parse_resolved(text)
+    attempt = None
+    raw = fields.get('attempt')
+    if raw:
+        try:
+            attempt = int(raw)
+        except (ValueError, OverflowError):
+            reader.warn(name, 'attempt is not an integer')
+    status = fields.get('status')
+    return attempt, status if status in ('FAIL', 'UNKNOWN') else None
+
+
 def _task_detail(reader, task, run_id, waves, branches):
     """Fill in a plan task; returns every execution it read (its own and its shadows')."""
     ident = task['id']
@@ -520,6 +562,8 @@ def _task_detail(reader, task, run_id, waves, branches):
     task['qa_tail'] = reader.cap(qa, prefix + '/qa_tail', 4000, True)
     task['dwarf_tail'] = reader.cap(reader.text(prefix + '/dwarf.last'), prefix + '/dwarf_tail', 4000, True)
     task['accepted_by'] = reader.text(prefix + '/accepted.by')
+    task['accepted_attempt'], task['accepted_over'] = _accepted_fields(
+        reader, prefix + '/accepted.by', task['accepted_by'])
     for field, filename in [('prompt', 'prompt.md'), ('approach', 'approach.md'), ('retry_findings', 'retry_findings.md')]:
         task[field] = reader.cap(reader.text(prefix + '/' + filename), prefix + '/' + field)
     task['route'] = []
@@ -606,6 +650,120 @@ def _published(reader):
     return real if executions.inside(reader.path, real) else None
 
 
+def _review_clock(reader, name):
+    """(source, at) of a `final-review-<e>-<p>` or `integrate-<e>-<p>` dir name, else None.
+
+    `at` is the whole-second epoch in the name. The same clock `executions.review_dirs` uses,
+    so a summary does not have to scan the plan to know when the published review started.
+    """
+    match = executions._KIND.fullmatch(name)
+    if not match:
+        return None
+    kind, epoch, _pid = match.groups()
+    if len(epoch) > 15:
+        reader.warn(name, 'invalid epoch')
+        return None
+    try:
+        at = float(epoch)
+        if not math.isfinite(at):
+            raise ValueError()
+    except (ValueError, OverflowError):
+        reader.warn(name, 'invalid epoch')
+        return None
+    return ('review' if kind == 'final-review' else 'integrate'), at
+
+
+def _published_identity(reader):
+    """(source, at) of the dir `final-review` links to, when the link stays inside the plan."""
+    real = _published(reader)
+    if real is None:
+        return None
+    path = Path(real)
+    # An integrate review is `<integrate-dir>/final-review`; a final-review dir is named itself.
+    if path.name == 'final-review':
+        found = _review_clock(reader, path.parent.name)
+        return found if found is not None and found[0] == 'integrate' else None
+    found = _review_clock(reader, path.name)
+    return found if found is not None and found[0] == 'review' else None
+
+
+def _merge_pairs(tasks):
+    """(id, merged_at) of every merged task, oldest merge first, then id."""
+    pairs = [(task['id'], task['merged_at']) for task in tasks if task.get('merged_at') is not None]
+    pairs.sort(key=lambda item: (item[1], item[0]))
+    return pairs
+
+
+# What `git rev-parse` writes for a commit: sha1 (40) or sha256 (64), lowercase hex.
+_COMMIT = re.compile(r'(?:[0-9a-f]{40}|[0-9a-f]{64})')
+
+
+def _meta_integration(reader, name, meta):
+    """The `integration=` commit of a review.meta, or None.
+
+    Missing or empty is absent (older runs record no integration commit). Any other value
+    that is not a commit object name is malformed: null, and a warning, so freshness uses
+    the next rule instead of treating the text as the commit the review judged.
+    """
+    value = meta.get('integration') or None
+    if not value:
+        return None
+    if _COMMIT.fullmatch(value):
+        return value
+    reader.warn(name, 'integration is not a commit')
+    return None
+
+
+def _review_freshness(accepted, integration, tip, source, at, merges, verdict):
+    """(outdated, merged_since) for one final review.
+
+    Null when the review has no verdict or there is no `accepted.integration` to compare with.
+    Otherwise the first rule that applies: a known `integration` commit, else `tip` when
+    `source` is `review`, else (an older integrate review) any task merged after `at`.
+    `integration` is a commit object name or None (a malformed value is None). A merge counts
+    when its marker mtime is `>= at + 1`. `merged_since` is those ids, oldest first, and is
+    empty unless the review is outdated.
+    """
+    later = []
+    if at is not None:
+        later = [item for item in merges if item[1] is not None and item[1] >= at + 1]
+        later.sort(key=lambda item: (item[1], item[0]))
+    ids = [task_id for task_id, _merged_at in later]
+    if not verdict or not accepted:
+        return None, []
+    if integration:
+        moved = integration != accepted
+    elif source == 'review':
+        moved = tip != accepted
+    else:
+        moved = bool(ids)
+    return (True, ids) if moved else (False, [])
+
+
+def _stamp_review(summary, accepted, merges):
+    summary['outdated'], summary['merged_since'] = _review_freshness(
+        accepted, summary['integration'], summary['tip'], summary['source'], summary['at'], merges,
+        summary['verdict'])
+    return summary
+
+
+def _published_outdated(reader, tasks):
+    """final_review_outdated for the published review only.
+
+    Reads `accepted.integration` and, through the `final-review` link, that dir's `verdict`
+    and `review.meta`. Does not scan other review dirs or open a review's attempts.
+    """
+    found = _published_identity(reader)
+    if found is None:
+        return None
+    source, at = found
+    verdict = reader.word('final-review/verdict')
+    meta = executions.parse_resolved(reader.text('final-review/review.meta'))
+    return _review_freshness(reader.line('accepted.integration'),
+                             _meta_integration(reader, 'final-review/review.meta', meta),
+                             meta.get('tip') or None, source, at, _merge_pairs(tasks), verdict)[0]
+
+
 def _final_review(reader, item, newest, published):
     """(FinalReviewSummary, its executions, review.meta) of one review dir."""
     name, source, at, rel = item
@@ -630,6 +788,8 @@ def _final_review(reader, item, newest, published):
                    verdict=verdict, state=state, spec=meta.get('spec') or None,
                    threshold=None if threshold == 'none' else threshold,
                    base=meta.get('base') or None, tip=meta.get('tip') or None,
+                   integration=_meta_integration(reader, rel + '/review.meta', meta),
+                   outdated=None, merged_since=[],
                    gate=_gate(reader, rel + '/qa.gate'), findings=executions.qa_result(reader, rel + '/qa.last')[1],
                    execution=run['id'] if run else None, started=run['started'] if run else None,
                    ended=run['ended'] if run else None, duration_s=run['duration_s'] if run else None)
@@ -701,6 +861,7 @@ def _solo_detail(reader, source):
                 dwarf=_role_spec(reader, 'dwarf'), qa=_role_spec(reader, 'qa'), wave=1, status=status,
                 branch=None, attempt=max((item['attempt'] for item in attempts), default=None),
                 attempts=attempts, escalations=[], verdict=_verdict(qa), accepted_by=None,
+                accepted=False, accepted_attempt=None, accepted_over=None,
                 explored=False, route=[], clef={'first_pass': None, 'retry_pass': {}}, shadow=[],
                 prompt=reader.cap(reader.text('prompt.md'), 'tasks/solo/prompt'), approach=None,
                 retry_findings=None, qa_tail=reader.cap(qa, 'tasks/solo/qa_tail', 4000, True),
@@ -767,6 +928,10 @@ def detail(path, source='plan') -> dict:
     result['timeline'] = _timeline(pool + run_execs, [item for item in run_execs if item['role'] == 'parallel'],
                                    [item for item in run_execs if item['role'] == 'verification'])
     result['integration'] = _integration(reader, tasks, integrations, reviews, published)
+    accepted = result['integration']['accepted'] if result['integration'] is not None else None
+    merges = [(item['id'], item['at']) for item in result['integration']['merged']] if result['integration'] else []
+    for summary in reviews:
+        _stamp_review(summary, accepted, merges)
     result['final_review'] = reviews[0] if reviews else None
     result['final_reviews'] = reviews
     result['deferrals'] = [line.strip() for line in (reader.text('deferrals.txt') or '').splitlines() if line.strip()]
@@ -943,6 +1108,7 @@ def final_review_detail(path, name, source='plan'):
     if index is None:
         return None
     summary, _, meta = _final_review(reader, items[index], index == 0, _published(reader))
+    _stamp_review(summary, reader.line('accepted.integration'), _merge_pairs(_tasks(reader)))
     rel = items[index][3]
     qa_last = reader.text(rel + '/qa.last')
     result = dict(summary)
@@ -1215,8 +1381,13 @@ def run_findings(path, source='plan'):
     if kind is None:
         return None
     keys = ('kind', 'execution', 'attempt', 'spec', 'verdict')
+    if kind == 'solo':
+        task_ids, merges, accepted = ['solo'], [], None
+    else:
+        rows = _tasks(reader)
+        task_ids, merges, accepted = [task['id'] for task in rows], _merge_pairs(rows), reader.line('accepted.integration')
     tasks = []
-    for task_id in ['solo'] if kind == 'solo' else [task['id'] for task in _tasks(reader)]:
+    for task_id in task_ids:
         ctx = _diff_task(reader, task_id)
         reviews = [dict({key: review[key] for key in keys}, findings=found)
                    for review in (ctx['reviews'] if ctx else []) for found in [_findings_of(reader, review)] if found]
@@ -1227,13 +1398,15 @@ def run_findings(path, source='plan'):
         items, published = executions.review_dirs(reader)[0], _published(reader)
         for index, item in enumerate(items[:_MAX_REVIEWS]):
             summary = _final_review(reader, item, index == 0, published)[0]
+            _stamp_review(summary, accepted, merges)
             # the same review final_review_diff pins, so a Finding's id opens it there
             review = _diff_review('final', None, None, summary['spec'], summary['verdict'], item[3] + '/qa.last', [],
                                   summary['execution'])
             found = _findings_of(reader, review)
             if found:
                 finals.append(dict(name=item[0], execution=summary['execution'], spec=summary['spec'],
-                                   verdict=summary['verdict'], findings=found))
+                                   verdict=summary['verdict'], outdated=summary['outdated'],
+                                   merged_since=summary['merged_since'], findings=found))
     return dict(run=run_key(reader.path), available=findings.available(), tasks=tasks, final_reviews=finals,
                 truncated=reader.truncated, warnings=reader.warnings)