@zq-silk/yui 0.11.2 → 0.12.0

package/dist/task/nextAction.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { changeSetDeliverySettled, governingChangeSets } from "../integration/deliveryObligation.js";
-import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
-import { classifyReviewRoundOutcome, isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
+import { isAcceptedTaskReviewBaselineFromEvidence } from "../review/reviewAcceptance.js";
+import { classifyReviewRoundOutcome } from "../review/reviewOutcomeClassifier.js";
 import { actionableExecutionLaneRecoveries } from "../execution/executionHealth.js";
 import { candidateConvergenceDisagreement, candidateConvergenceEvidenceSufficient, candidateConvergenceStageResultsValid } from "../execution/candidateConvergence.js";
 import { executionStageSpendClosed, routeExecutionStage } from "../execution/resourceBroker.js";
+import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
 import { currentWorkItemCandidate, currentWorkItemExecutionGroup, governingWorkItemCandidate } from "../workItem/workItem.js";
 const OPEN_WORK_ITEM_STATUSES = new Set(["pending", "running", "awaiting_acceptance"]);
@@ -232,13 +234,15 @@ export function projectNextAction(facts) {
             judgmentRequired: `Leader must judge Candidate ${candidateReady.id}/${candidate?.id ?? "unknown"} against the Task objective, acceptance criteria, and delivery risk.`
         });
     }
-    const activeWorkers = facts.activeRuns.filter((run) => run.roleName !== "leader");
-    if (activeWorkers.length > 0) {
+    // AgentRun purpose owns routing. Review Runs remain attached to their exact
+    // ReviewRound branches below instead of being mistaken for Worker delivery.
+    const activeDelegatedExecutions = facts.activeRuns.filter((run) => (run.purpose === "execution" && run.roleName !== "leader"));
+    if (activeDelegatedExecutions.length > 0) {
         return buildAction(facts, {
             kind: "wait-for-owned-execution",
-            reason: `${activeWorkers.length} delegated Run(s) are active; wait for their delivery.`,
-            refs: activeWorkers.map((run) => ref("agent-run", run.id)),
-            preconditions: activeWorkers.map((run) => ({ fact: `Delegated Run ${run.id} is active`, satisfied: true, ref: ref("agent-run", run.id) }))
+            reason: `${activeDelegatedExecutions.length} delegated execution Run(s) are active; wait for their delivery.`,
+            refs: activeDelegatedExecutions.map((run) => ref("agent-run", run.id)),
+            preconditions: activeDelegatedExecutions.map((run) => ({ fact: `Execution Run ${run.id} is active`, satisfied: true, ref: ref("agent-run", run.id) }))
         });
     }
     const failedWork = facts.workItems.find((item) => item.status === "failed");
@@ -386,7 +390,8 @@ export function projectNextAction(facts) {
         });
     }
     const finalReviewRequired = taskFinalReviewRequired(facts);
-    const failedFinal = latestTaskFinalReview(facts.reviewRounds);
+    const finalReviewContract = taskFinalReviewContract(facts);
+    const failedFinal = latestTaskFinalReview(facts.reviewRounds, finalReviewContract);
     const failedFinalOutcome = failedFinal === undefined
         ? null
         : classifyReviewRoundOutcome(failedFinal, nextActionReviewOutcomeEvidence(facts));
@@ -414,11 +419,38 @@ export function projectNextAction(facts) {
             ]
         });
     }
+    if (finalReviewRequired
+        && failedFinal !== undefined
+        && failedFinalOutcome?.kind === "semantic"
+        && failedFinal.deltaRecheck?.disposition === "requires-full-review") {
+        return buildAction(facts, {
+            kind: "request-final-review",
+            reason: `Delta Recheck ${failedFinal.id} could not establish equivalence; Yui recorded the result and left the next Review action to the Leader.`,
+            refs: [ref("review-round", failedFinal.id)],
+            preconditions: [
+                { fact: "Current frozen head has accepting final Review evidence", satisfied: false }
+            ],
+            alternatives: [
+                {
+                    kind: "request-full-review",
+                    reason: "Request a full Review when independent evidence is still required.",
+                    recommendedCommand: `yui task review request ${task.id} --role ${failedFinal.reviewerRoleName}`,
+                    refs: [ref("review-round", failedFinal.id)]
+                },
+                {
+                    kind: "continue-leader-work",
+                    reason: "Inspect directly, change the candidate, or choose another Reviewer as Task risk requires.",
+                    refs: [ref("review-round", failedFinal.id)]
+                }
+            ],
+            judgmentRequired: "Leader must choose full Review, another Reviewer, direct inspection, or more development; Core will not auto-escalate."
+        });
+    }
     if (finalReviewRequired
         && failedFinal !== undefined
         && failedFinalOutcome?.kind === "semantic"
         && ((failedFinal.checks ?? []).some(({ outcome }) => outcome === "failed")
-            || deltaRecheckBlocksAcceptance(failedFinal))) {
+            || failedFinal.deltaRecheck?.disposition === "finding")) {
         return buildAction(facts, {
             kind: "route-review-findings",
             reason: `Task-final Review ${failedFinal.id} delivered semantic negative evidence; route its open findings into a repair wave on one frozen head.`,
@@ -429,7 +461,7 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review finding repair-wave ${task.id} --create`
         });
     }
-    const activeFinal = latestTaskFinalReview(facts.reviewRounds);
+    const activeFinal = latestTaskFinalReview(facts.reviewRounds, finalReviewContract);
     if (activeFinal !== undefined
         && (activeFinal.status === "pending" || activeFinal.status === "running")) {
         const reviewRef = ref("review-round", activeFinal.id);
@@ -475,12 +507,26 @@ export function projectNextAction(facts) {
             }
             return buildAction(facts, {
                 kind: "wait-for-owned-execution",
-                reason: `Reviewer Run ${reviewRun.id} is executing Task-final Review ${activeFinal.id}.`,
+                reason: `Reviewer Run ${reviewRun.id} is executing frozen Task-final Review ${activeFinal.id}; this Review does not globally pause Leader decisions on newer facts.`,
                 refs: [reviewRef, ref("agent-run", reviewRun.id)],
                 preconditions: [
                     { fact: "Task-final ReviewRound is running", satisfied: true, ref: reviewRef },
                     { fact: "Reviewer Run is active", satisfied: true, ref: ref("agent-run", reviewRun.id) }
-                ]
+                ],
+                alternatives: [
+                    {
+                        kind: "continue-leader-work",
+                        reason: "Process new user input or advance a later candidate while preserving this frozen Review.",
+                        refs: [reviewRef]
+                    },
+                    {
+                        kind: "request-another-reviewer",
+                        reason: "Use another available Reviewer slot when an independent view adds value.",
+                        recommendedCommand: `yui task review request ${task.id} --role <other-reviewer-role>`,
+                        refs: [reviewRef]
+                    }
+                ],
+                judgmentRequired: "Leader decides whether the current facts justify waiting, continuing development, direct review, or another Reviewer."
             });
         }
         if (activeFinal.reviewerRunId !== undefined) {
@@ -530,11 +576,16 @@ export function projectNextAction(facts) {
     }
     const finalReviewOptional = !finalReviewRequired
         && !hasValidFinalReview(facts);
-    const finalReviewAlternative = finalReviewOptional && facts.reviewConfig !== null
+    const unresolvedDelta = failedFinal?.deltaRecheck?.disposition === "requires-full-review";
+    const optionalReviewer = facts.reviewConfig?.roleName
+        ?? (unresolvedDelta ? failedFinal?.reviewerRoleName : undefined);
+    const finalReviewAlternative = finalReviewOptional && optionalReviewer !== undefined
         ? [{
                 kind: "request-final-review",
-                reason: "Request an independent Task-final Review when the Leader wants extra assurance before completion.",
-                recommendedCommand: `yui task review request ${task.id} --role ${facts.reviewConfig.roleName}`,
+                reason: unresolvedDelta
+                    ? `Delta Recheck ${failedFinal.id} returned requires-full-review; request full independent evidence when the Leader judges it necessary.`
+                    : "Request an independent Task-final Review when the Leader wants extra assurance before completion.",
+                recommendedCommand: `yui task review request ${task.id} --role ${optionalReviewer}`,
                 refs: [ref("task", task.id)]
             }]
         : [];
@@ -564,7 +615,9 @@ export function projectNextAction(facts) {
         ...(!finalReviewOptional
             ? {}
             : {
-                judgmentRequired: "Leader must decide whether the frozen Task result is safe to complete or needs one optional Task-final Review."
+                judgmentRequired: unresolvedDelta
+                    ? "Leader must route the non-accepting Delta result: full Review, another Reviewer, direct inspection, more development, or completion when policy permits."
+                    : "Leader must decide whether the frozen Task result is safe to complete or needs one optional Task-final Review."
             }),
         recommendedCommand: `yui task complete ${task.id} --summary-file -`
     });
@@ -1013,10 +1066,11 @@ function latestFailedReviewFor(rounds, workItemId) {
         .reverse()
         .find((round) => round.workItemId === workItemId && round.status === "failed");
 }
-function latestTaskFinalReview(rounds) {
+function latestTaskFinalReview(rounds, contract) {
     return [...rounds]
         .reverse()
-        .find((round) => (round.scope ?? "work-item") === "task");
+        .find((round) => ((round.scope ?? "work-item") === "task"
+        && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
 }
 function needsChangeSetCapture(facts, item) {
     if (item.status !== "completed")
@@ -1036,13 +1090,17 @@ function needsChangeSetCapture(facts, item) {
     return candidate.workspace !== undefined || candidate.gitSnapshot !== undefined;
 }
 function hasValidFinalReview(facts) {
-    const final = latestTaskFinalReview(facts.reviewRounds);
-    if (final === undefined
-        || !isSemanticReviewRound(final, nextActionReviewOutcomeEvidence(facts)))
-        return false;
-    if ((final.checks ?? []).some(({ outcome }) => outcome === "failed")
-        || deltaRecheckBlocksAcceptance(final))
+    const contract = taskFinalReviewContract(facts);
+    const final = [...facts.reviewRounds]
+        .reverse()
+        .find((round) => ((round.scope ?? "work-item") === "task"
+        && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
+    if (final === undefined || !isAcceptedTaskReviewBaselineFromEvidence(final, nextActionReviewOutcomeEvidence(facts)))
         return false;
+    if (facts.currentTaskReviewCandidate !== undefined) {
+        return facts.currentTaskReviewCandidate !== null
+            && isDeepStrictEqual(final.taskCandidate, facts.currentTaskReviewCandidate);
+    }
     const reviewedCommits = new Set((final.taskCandidate?.projects ?? []).map((project) => project.commit));
     if (reviewedCommits.size === 0)
         return false;

package/dist/telemetry/sqliteTelemetryStore.js

@@ -246,7 +246,7 @@ export class SqliteTelemetryStore {
             db.pragma("foreign_keys = ON");
             db.pragma("busy_timeout = 5000");
             db.pragma("wal_autocheckpoint = 1000");
-            migrateSqliteSchema(db);
+            migrateSqliteSchema(db, { mode: "validate" });
             this.#db = db;
             return db;
         }

package/dist/web/assets/client/components.js

@@ -114,9 +114,9 @@ export function executionBand(projection, t, locale) {
   head.append(pill(t, "exec.status", projection.status));
   head.append(node("span", "exec-band-owner",
     t("exec.owner." + projection.owner) + " · " + t("exec.action." + projection.action)));
-  if (projection.activeExecutorCount > 0) {
+  if (projection.activeRuns && projection.activeRuns.length > 0) {
     head.append(node("span", "exec-band-executors",
-      projection.activeExecutorCount + " " + t("exec.executors")));
+      projection.activeRuns.length + " " + t("exec.executors")));
   }
   if (projection.monitoring === "stopped") {
     head.append(node("span", "exec-band-stopped", t("exec.monitoring.stopped")));
@@ -242,7 +242,6 @@ export function observabilityMetricCard(observability, t) {
   card.append(metricTile(t("detail.wallClock"), cost.wallClockSeconds + "s"));
   card.append(metricTile(t("detail.ready"), (observability.dag?.readyIds || []).length, { hot: true }));
   card.append(metricTile(t("detail.contextSnapshots"), context.snapshotCount));
-  card.append(metricTile(t("detail.contextPeak"), context.observedInputPeakTokens));
   const contextMeta = node("div", "record-meta observability-context-meta");
   contextMeta.append(node("span", "", t("detail.contextBytes") + " · "
     + (context.totalBytes === null ? t("detail.partial") : context.totalBytes + " B")));
@@ -775,6 +774,17 @@ export function roleCard(role, task, t, locale, actions) {
     card.append(eff);
   }
 
+  if (role.sessionTokens) {
+    const tokenMeta = node("div", "record-meta");
+    const cumulative = role.sessionTokens.cumulativeTotal || {};
+    const maximum = role.sessionTokens.maximumRequestInput || {};
+    tokenMeta.append(node("span", "", t("detail.sessionTotalTokens") + " · "
+      + (cumulative.status === "observed" ? cumulative.totalTokens : t("detail.unobserved"))));
+    tokenMeta.append(node("span", "", t("detail.maximumRequestInputTokens") + " · "
+      + (maximum.status === "observed" ? maximum.inputTokens : t("detail.unobserved"))));
+    card.append(tokenMeta);
+  }
+
   if (role.description) card.append(richText(null, role.description, t, { muted: true }));
 
   const cols = node("div", "record-cols");

package/dist/web/assets/client/i18n.js

@@ -61,17 +61,19 @@ const messages = {
     "detail.stageAttempt": "Attempt",
     "detail.cost": "Cost",
     "detail.tokens": "Tokens",
+    "detail.sessionTotalTokens": "Session total tokens",
+    "detail.maximumRequestInputTokens": "Maximum request input",
     "detail.toolCalls": "Tool calls",
     "detail.wallClock": "Wall clock",
     "detail.ready": "Ready",
     "detail.quorum": "Quorum",
     "detail.contextSnapshots": "Context snapshots",
-    "detail.contextPeak": "Context peak",
     "detail.contextBytes": "Context bytes",
     "detail.compression": "Compression",
     "detail.marginalValue": "Marginal value",
     "detail.partial": "partial",
     "detail.unavailable": "unavailable",
+    "detail.unobserved": "unobserved",
     "detail.openFindings": "Open findings",
     "detail.desired": "Desired launch",
     "detail.desiredAgent": "Desired Agent",
@@ -397,17 +399,19 @@ const messages = {
     "detail.stageAttempt": "阶段尝试",
     "detail.cost": "成本",
     "detail.tokens": "Token",
+    "detail.sessionTotalTokens": "Session 累计 Token",
+    "detail.maximumRequestInputTokens": "单次请求最大输入",
     "detail.toolCalls": "工具调用",
     "detail.wallClock": "墙钟时间",
     "detail.ready": "可就绪",
     "detail.quorum": "法定数量",
     "detail.contextSnapshots": "上下文快照",
-    "detail.contextPeak": "上下文峰值",
     "detail.contextBytes": "上下文字节",
     "detail.compression": "压缩",
     "detail.marginalValue": "边际价值",
     "detail.partial": "部分可见",
     "detail.unavailable": "不可用",
+    "detail.unobserved": "未观测",
     "detail.openFindings": "未解决发现",
     "detail.desired": "期望启动配置",
     "detail.desiredAgent": "期望 Agent",

package/dist/web/webSnapshot.js

@@ -7,6 +7,7 @@ import { classifyRuntimeHealth, projectRuntimeTaskEvents } from "../runtime/runt
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
 import { resolveRuntimeHealth } from "../config/yuiConfig.js";
+import { projectSessionTokenMetrics, resolveSessionTokenIdentity } from "../runtime/sessionTokenMetrics.js";
 export function buildWebDashboardSnapshot(store, now = new Date()) {
     return store.transaction((reader) => {
         const statusCounts = {
@@ -97,6 +98,9 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
             const effectiveLaunch = activeRun?.effective ?? activeSession?.effective ?? null;
             return {
                 ...role,
+                sessionTokens: projectSessionTokenMetrics(events, resolveSessionTokenIdentity(activeSession === undefined
+                    ? null
+                    : { taskId, roleName: role.name, ...activeSession })),
                 effectiveLaunch,
                 effectiveLaunchSource: activeRun === undefined
                     ? activeSession === undefined ? null : "session"

package/i18n/README.zh-CN.md

@@ -308,7 +308,7 @@ yui task work group resolve <task-id>/<work-item-id> \
 
 每个新阶段还会冻结一份 Resource Broker 契约：token、工具调用和墙钟预算，
 quorum 与 deadline，straggler 窗口，以及继续增加 Lane 所需的最低边际价值。
-省略这些参数时复用现有 context budget 与 runtime-health 时间窗；同一阶段的 retry
+省略这些参数时使用独立的执行成本默认值与 runtime-health 时间窗；同一阶段的 retry
 累计原有花费并共享绝对 deadline。执行、Lane retry 和 Reviewer panel 准入统一核算
 Home、Task、WorkItem、Group、Provider、Agent 和模型层级的活动 Lane；容量不足的
 Lane 会耐久保留为 pending，不会把整个 Group 判失败。容量释放或 deadline 到达会沿
@@ -484,7 +484,7 @@ yui task input request <task-id> --question "默认使用哪种格式？" \
 
 推荐项会明确展示给用户；如果截止时间前没有回答，独立的最近 deadline timer 会唤醒 Controller，原子采用这个确定选项，并排队恢复固定的 Leader session。自由文本和必须由用户回答的请求永远不会自动解决。
 
-`task input list` 是权威的全局开放输入 Inbox；可附加 Task ID 限定范围，或使用 `--all` 查看已回答和已取消的请求。Controller 还会尝试向已有且结构化状态为 ready 的 Operator process 投递一次带回执的提示；它不会为了通知而启动或打断 Operator。process 不可用或 pane fence 已变化时，请求仍保留在 Inbox，并在后续 Controller 定向处理中重新尝试。该路径不会读取或分类 Agent 终端文本。用户和 Operator 都可回答。存在开放请求时，无关的 pending wake 不会绕过等待，Task 也不能 complete 或 archive。原 Leader 也可执行 `yui task input cancel <task-id> <input-id> --reason "..."`，取消会排队恢复该固定 Leader session。
+`task input list` 是权威的全局开放输入 Inbox；可附加 Task ID 限定范围，或使用 `--all` 查看已回答和已取消的请求。Task 完成、退役、Leader attention、stall 和开放输入只以不可变 TaskEvent 或 InputRequest 引用进入全局 Operator mailbox。Controller 把一个待处理 batch 合并成一条带回执的 `[Yui updates]` user message，仅投递给已有且 ready 的 Operator；Operator 再通过 CLI 读取引用记录，判断哪些信息值得呈现。Operator 正在运行或不可用时，Yui 不启动也不打断它，整批引用保持持久化，并在原生 turn 完成或后续 Controller 处理中重试。该路径是 user message，不是 tool call，也不会读取或分类 Agent 终端文本。用户和 Operator 都可回答。存在开放请求时，无关的 pending wake 不会绕过等待，Task 也不能 complete 或 archive。原 Leader 也可执行 `yui task input cancel <task-id> <input-id> --reason "..."`，取消会排队恢复该固定 Leader session。
 
 ```sh
 yui task context <task-id>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -323,12 +323,14 @@ Choose before creating the WorkItem:
 Keep review execution separate from implementation. No global Reviewer is
 required: when review is disabled, inspect and decide directly or delegate a
 bounded review to a native subagent or ordinary Worker. When a managed
-ReviewRound is explicitly configured, its reviewer uses the single built-in
-write-capable `reviewer` Profile, but Yui grants that capability only inside a
-fresh ReviewRound-owned worktree created from its exact frozen scope:
+ReviewRound is explicitly requested, its reviewer uses the single built-in
+write-capable `reviewer` Profile. Each Task Reviewer Role keeps one stable,
+isolated Session and physical workspace slot; every ReviewRound updates that
+slot to its exact frozen scope and records a new immutable ownership snapshot:
 the assigned WorkItem Candidate or the committed Integration heads of a
 Task-final Review. Never reuse the Candidate/Worker workspace or its
-implementation Role Session. Codex and Claude may use their normal configured
+implementation Role Session. Multiple Reviewer Roles use independent slots
+and may run in parallel. Codex and Claude may use their normal configured
 full capability in that isolated worktree; the behavioral boundary forbids
 push, Integration, Task mutation, other workspaces, stable checkouts, and the
 real Yui control-plane home. When
@@ -526,8 +528,8 @@ authorized expansions.
   bounded evidence-gathering review to a native subagent or ordinary Worker,
   then make the Leader-owned accept/reject decision. Do not create a Reviewer
   Role merely to satisfy an old setup convention.
-- `always`: wait for the automatically requested ReviewRound to become
-  terminal. Never bypass an active round.
+- `always`: keep the Candidate decision pending until its required ReviewRound
+  is terminal. The Review does not globally pause unrelated Leader work.
 - `leader`: decide whether the existing evidence is sufficient. Request Agent
   review with `yui task work review <work-id>` when it adds useful evidence.
 - `final`: keep WorkItem acceptance and integration independent. After all
@@ -535,10 +537,39 @@ authorized expansions.
   Task-final ReviewRound over the frozen Task candidate. A Task contract may
   require it. The final Reviewer evaluates the complete result across bound
   Projects; it is not a second per-WorkItem approval protocol.
-- A changed Task head creates a new semantic Task-final Round. Reuse the same
-  compatible Reviewer Role Session and stable workspace when Yui offers it;
-  do not create a new Role or native Session for every Round. Round identity
-  still binds each Run to the exact frozen head.
+- Before choosing a Task-final Review action, read `task context` or
+  `task next-action` and inspect every active AgentRun's purpose and exact
+  WorkItem/ReviewRound binding, the current durable heads, active Reviews,
+  each Reviewer's availability, the latest accepted baseline, candidate
+  relation, and Delta facts. These are decision support, not an autopilot;
+  a Review Run is evidence in progress, not a global Task lock.
+- A changed Task head may justify a new semantic Task-final Round. Reuse the
+  same Reviewer Role Session and stable workspace; Round id, full versus Delta
+  mode, desired revision, and frozen commit do not require a replacement
+  Session. Round identity still binds each Run to the exact frozen head.
+- An active Task-final Review freezes candidate A only. Continue handling new
+  user input and, when appropriate, advance candidate B. Always consume A's
+  result, then route it as exact evidence for A, a baseline for descendant B,
+  or historical evidence for a diverged candidate. Do not cancel or discard A
+  merely because Task main moved.
+- Read active Review facts directly from its ReviewRound: frozen Project
+  commits define that Review's evidence boundary; current candidate relation,
+  active Run, and workspace references describe current execution. Do not infer
+  a Task lock or wait for a synthetic freeze lifecycle before advancing Task
+  main.
+- If Yui reports a Reviewer `busy`, wait for the suggested interval, select a
+  different Reviewer, review directly, or continue other work. Busy is a
+  scheduling fact, not a failed Review and not a reason to reset the Session.
+- Prefer Delta Recheck for a technically available, contiguous change over an
+  accepted baseline when the semantic risk is bounded. Use the exact changed
+  files, line counts, diff, previous evidence, Task intent, and Project Policy
+  to choose full Review, Delta, direct Review, another Reviewer, or no Review;
+  Yui does not choose the mode from generic thresholds.
+- Delta `requires-full-review` returns control to the Leader. Decide whether a
+  full Review, another Reviewer, direct inspection, or more development is
+  useful; Yui must not auto-create the next Round. `repeated-full-review` is a
+  cost advisory for an unchanged candidate/Reviewer intent, never an exhausted
+  budget or a prohibition on new evidence.
 - A completed review is advice. Decide whether to accept, reject, review again,
   or ask the user.
 - Route a reachable final-Review finding to the original Worker while that
@@ -563,11 +594,16 @@ authorized expansions.
   full Round over the identical frozen heads. It fails closed for every
   semantic or ambiguous prior result; target the new failed Round explicitly
   if another non-semantic failure occurs.
+- For `review.failed-to-start`, open the referenced ReviewRound and inspect its
+  exact reason, frozen candidate, and workspace when present. Decide whether to
+  retry, explicitly clean a conflicting workspace, select another Reviewer, or
+  continue other work. Preserve the failed Round as request history and do not
+  turn these choices into an automatic retry or cleanup loop.
 - Use `task next-action`'s derived Review outcome literally: non-semantic means
   recover the same frozen head with `force-fresh`; ambiguous means diagnose the
   inconsistent evidence without creating a Repair WorkItem; only semantic
-  negative evidence may create a repair wave. Non-semantic and ambiguous
-  attempts do not consume the full semantic Review budget.
+  negative evidence may create a repair wave. There is no semantic Review
+  budget; exact candidate/Reviewer/intent retries reuse existing evidence.
 - If the same non-resource user choice or unavailable external fact repeats,
   persist context and create an InputRequest instead of looping. Never use an
   InputRequest to solicit authorization for an unrequested real-resource test;
@@ -612,10 +648,11 @@ accept an isolated result while any writable Project's latest ChangeSet is
 unintegrated.
 
 Workspace ownership is not Role ownership. The WorkItem owns its Develop
-workspace even when a Task Role executes there; each ReviewRound owns a fresh
-workspace from the Candidate's frozen commit, and each IntegrationAttempt owns
-its candidate worktree. Dispatch attaches snapshots only. Review workspace
-cleanup is explicit, and review edits can never feed WorkItem ChangeSet capture.
+workspace even when a Task Role executes there; a Task Reviewer Role keeps one
+stable physical workspace while each ReviewRound owns the exact frozen
+workspace evidence for its Run, and each IntegrationAttempt owns its candidate
+worktree. Dispatch attaches snapshots only. Review workspace cleanup is
+explicit, and review edits can never feed WorkItem ChangeSet capture.
 
 Yui validates a candidate and advances the target with compare-and-swap. A
 failed candidate does not advance the target. Inspect and resolve semantic

package/skills/yui-operator/SKILL.md

@@ -46,6 +46,15 @@ mind and avoid imposing a fixed heading, field, section, or character
 template; one semantic event should have one concise summary unless a later
 role adds a genuinely new decision or impact.
 
+A `[Yui updates]` user message is only a wake envelope containing durable
+InputRequest or TaskEvent references. Read those exact records through `yui`
+before responding, merge related references into one user-level update, and
+then end the turn normally. Never create or keep a Codex Goal, automatic
+self-continuation, polling loop, or private follow-up task merely to monitor
+Yui work. Future durable updates will wake the Operator with another user
+message after the current Operator turn is ready; unchanged state needs no
+response.
+
 ## Configure Yui through conversation
 
 Treat configuration as an Operator-owned conversation, not a list of commands

package/skills/yui-reviewer/SKILL.md

@@ -18,13 +18,18 @@ reinterpret its scope:
   anchor.
 
 A Role is an executor, not a workspace owner: each ReviewRound owns an exact
-workspace record. Consecutive Task-final Rounds for the same Reviewer may
-reassign one clean physical workspace and continue the same compatible native
-Session. Treat the new Run Context Pack and frozen head as the authority even
-when the conversation continues; never reuse an earlier verdict. Review edits
-are confined to that workspace, never modify the
+workspace record. Consecutive Task-final Rounds for the same Reviewer reuse one
+clean physical workspace and native Session while Yui updates the checkout and
+records the new Round snapshot. Treat the new Run Context Pack and frozen head
+as the authority even when the conversation continues; never reuse an earlier
+verdict. Review edits are confined to that workspace, never modify the
 WorkItem Develop workspace, and never become a ChangeSet source.
 
+For a dispatched Review, the Run Context Pack identifies the ReviewRound,
+frozen Project commits, and assigned workspace. Inspect those exact commits.
+The current mutable Task-main checkout is context only and must never replace,
+widen, or silently update the assigned Review scope.
+
 ## Separate infrastructure failure from review judgment
 
 Verify the exact Run identity, Context Pack, frozen head, and ReviewRound-owned
@@ -44,10 +49,26 @@ binding fails before review begins:
 
 Yui derives `semantic`, `non-semantic`, or `ambiguous` from the immutable
 Round, Run receipt, completion Event, and finding evidence. Never write or
-simulate a classification field. A non-semantic attempt consumes no semantic
-Review budget and cannot satisfy acceptance; an ambiguous attempt requires
+simulate a classification field. A non-semantic attempt cannot satisfy
+acceptance; an ambiguous attempt requires
 Leader diagnosis before another review or repair decision.
 
+The Review scope remains the current Run's frozen candidate even if the Leader
+handles new user input or advances Task main while this Review is running. Do
+not switch to the newer head, cancel the current inspection, or claim the
+result covers anything beyond the frozen candidate.
+
+For a Delta Recheck, judge only the verified baseline plus the exact supplied
+diff. Return exactly one explicit disposition with reasoning:
+
+- `equivalent-and-accepted` when the new candidate preserves the accepted
+  semantics and evidence;
+- `finding` for a reachable material defect;
+- `requires-full-review` when equivalence cannot be established.
+
+Never create or request a follow-up Round yourself: `requires-full-review`, a
+finding, and every uncertainty return to the Leader for routing.
+
 Keep the context layers distinct. Yui Core owns ReviewRound identity,
 lifecycle, access, workspace, and exact-yield safety; this generic Skill owns
 portable review behavior; Agent-native Project Skills and Project Policy and

package/dist/context/sessionContextBudget.js

@@ -1,71 +0,0 @@
-import { resolveContextBudget } from "../config/yuiConfig.js";
-import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
-export function evaluateSessionContextBudget(events, session, configured) {
-    const budget = resolveContextBudget(configured);
-    const peak = observedPeakInputTokens(events, session);
-    const state = peak >= budget.hardTokens
-        ? "hard"
-        : peak >= budget.softTokens
-            ? "soft"
-            : "within";
-    return Object.freeze({ state, peakTokens: peak, budget });
-}
-/**
- * Largest per-request input peak observed for one Session generation. Usage
- * observations carry cumulative session totals; consecutive deltas bound the
- * per-request input of the window between them. The first observation for a
- * generation is treated as one full request so a long-lived resumed Session
- * that was only sampled late still counts its inherited context.
- */
-export function observedPeakInputTokens(events, session) {
-    let previous = 0;
-    let peak = 0;
-    for (const event of events) {
-        const observation = runtimeObservationFromTaskEvent(event);
-        if (observation === null)
-            continue;
-        if (!matchesSession(observation.fence, session))
-            continue;
-        const usage = usageTotal(observation.payload.usage);
-        if (usage === null)
-            continue;
-        const delta = Math.max(0, usage - previous);
-        if (delta > peak)
-            peak = delta;
-        previous = usage;
-    }
-    return peak;
-}
-function matchesSession(fence, session) {
-    if (fence.taskId !== undefined && fence.taskId !== session.taskId)
-        return false;
-    if (fence.roleName !== session.roleName)
-        return false;
-    if (session.nativeSessionId !== undefined
-        && fence.nativeSessionId !== undefined
-        && fence.nativeSessionId !== session.nativeSessionId) {
-        return false;
-    }
-    if (session.launchId !== undefined
-        && fence.launchId !== undefined
-        && fence.launchId !== session.launchId) {
-        return false;
-    }
-    return true;
-}
-function usageTotal(usage) {
-    if (typeof usage !== "object" || usage === null || Array.isArray(usage))
-        return null;
-    const record = usage;
-    const inputTokens = integer(record.inputTokens);
-    if (inputTokens === null)
-        return null;
-    // RuntimeUsageSnapshot.inputTokens is the normalized processed input total.
-    // cachedInputTokens is an informational breakdown of that total, matching
-    // runtimeProjection and the Driver documentation; adding it again would
-    // fabricate context pressure and trigger premature Session rollover.
-    return inputTokens;
-}
-function integer(value) {
-    return Number.isSafeInteger(value) && value >= 0 ? value : null;
-}