@zq-silk/yui 0.11.3 → 0.12.0

package/dist/storage/upgrade/sqliteMigrationTarget.js

@@ -149,6 +149,12 @@ export function createSqliteMigrationTarget(options) {
             }
             const stamp = now().toISOString().replace(/[:.]/g, "-");
             let backupPath;
+            const schemaPath = join(home, STORAGE_SCHEMA_FILE);
+            const sourceSchemaText = readFileSync(schemaPath, "utf8");
+            const receiptPath = migrationReceiptPath(home);
+            const sourceReceiptText = existsSync(receiptPath)
+                ? readFileSync(receiptPath, "utf8")
+                : null;
             // Phase 1: back up any existing yui.db, then promote the sidecar.
             try {
                 if (existsSync(committedDbPath)) {
@@ -185,7 +191,7 @@ export function createSqliteMigrationTarget(options) {
             // Phase 2: advance schema.json to layout 7 in the same critical section.
             try {
                 if (stagedSchemaManifest !== null) {
-                    writeTextFileAtomically(join(home, STORAGE_SCHEMA_FILE), `${JSON.stringify(stagedSchemaManifest, null, 2)}\n`);
+                    writeTextFileAtomically(schemaPath, `${JSON.stringify(stagedSchemaManifest, null, 2)}\n`);
                 }
                 // Certify the dual-copy state (Issue 01): the 6→7 migration retains
                 // state.json read-only, so the Home legitimately holds both copies.
@@ -204,9 +210,22 @@ export function createSqliteMigrationTarget(options) {
                 }
             }
             catch (error) {
-                // The database is promoted but schema.json could not be advanced.
-                // Attempt to restore the original database; if that fails, the Home
-                // is ambiguous and must be recovered manually.
+                // A sidecar or receipt writer can fail after an atomic rename. Restore
+                // the exact source metadata as well as the database before claiming the
+                // layout switch did not commit.
+                let rollbackError;
+                try {
+                    writeTextFileAtomically(schemaPath, sourceSchemaText);
+                    if (sourceReceiptText === null) {
+                        rmSync(receiptPath, { force: true });
+                    }
+                    else {
+                        writeTextFileAtomically(receiptPath, sourceReceiptText);
+                    }
+                }
+                catch (restoreError) {
+                    rollbackError = restoreError;
+                }
                 try {
                     if (backupPath !== undefined && existsSync(backupPath)) {
                         removeSqliteFileSet(committedDbPath);
@@ -216,14 +235,17 @@ export function createSqliteMigrationTarget(options) {
                         removeSqliteFileSet(committedDbPath);
                     }
                 }
-                catch {
+                catch (restoreError) {
+                    rollbackError ??= restoreError;
+                }
+                if (rollbackError !== undefined) {
                     throw new AmbiguousSwitchError({
                         homePath: home,
                         backupPath: backupPath ?? committedDbPath,
                         stagingPath: stagedDbPath,
-                        detail: `SQLite database was promoted but schema.json could not be advanced (${messageOf(error)}), ` +
-                            `and the automatic rollback also failed. The database is at ${committedDbPath}; ` +
-                            `recover by advancing schema.json storageVersion to ${latest.layout} or restoring the backup.`
+                        detail: `SQLite database was promoted but schema.json or its receipt could not be durably advanced (${messageOf(error)}), ` +
+                            `and the database/metadata rollback also failed (${messageOf(rollbackError)}). ` +
+                            `Inspect ${committedDbPath}, ${schemaPath}, ${receiptPath}, and the backup before recovery.`
                     });
                 }
                 throw error;

package/dist/storage/upgrade/sqliteRecordMigrationTarget.js

@@ -38,7 +38,7 @@ import { AmbiguousSwitchError } from "../migration/index.js";
 import { describeActiveRuntime, homeRuntimeIsActive, inspectHomeRuntime, inspectSourceVersionState, inspectSnapshotVersionState } from "./homeMigrationTarget.js";
 import { writeSwitchProgress } from "./switchProgress.js";
 import { moveSqliteFileSet, removeSqliteFileSet } from "./sqliteFileSet.js";
-import { COMMITTED_DATABASE_FILENAME, STAGED_DATABASE_FILENAME, copySqlitePassthroughState, computeDbFamilyChecksums, computeStateFamilyChecksums, populateSqliteFromState, readStateFromSqlite } from "./sqliteStateMigration.js";
+import { COMMITTED_DATABASE_FILENAME, STAGED_DATABASE_FILENAME, copySqlitePassthroughState, computeDbFamilyChecksums, computeStateFamilyChecksums, populateSqliteFromState, readMigrationSourceStateFromSqlite } from "./sqliteStateMigration.js";
 /** Build the SQLite-backed record-migration target. */
 export function createSqliteRecordMigrationTarget(options) {
     const home = options.home;
@@ -70,7 +70,7 @@ export function createSqliteRecordMigrationTarget(options) {
         readSource() {
             const manifestRaw = readFileSync(join(home, STORAGE_SCHEMA_FILE), "utf8");
             const schemaManifest = parseJsonObject(manifestRaw, STORAGE_SCHEMA_FILE);
-            const state = readStateFromSqlite(home);
+            const state = readMigrationSourceStateFromSqlite(home);
             return Object.freeze({ schemaManifest, state });
         },
         writeFreshOutput(snapshot) {
@@ -129,6 +129,8 @@ export function createSqliteRecordMigrationTarget(options) {
             }
             const stamp = now().toISOString().replace(/[:.]/g, "-");
             let backupPath;
+            const schemaPath = join(home, STORAGE_SCHEMA_FILE);
+            const sourceSchemaText = readFileSync(schemaPath, "utf8");
             // Phase 1: back up the existing yui.db, then promote the sidecar.
             try {
                 if (existsSync(committedDbPath)) {
@@ -167,13 +169,20 @@ export function createSqliteRecordMigrationTarget(options) {
             // critical section. The layout version is unchanged.
             try {
                 if (stagedSchemaManifest !== null) {
-                    writeTextFileAtomically(join(home, STORAGE_SCHEMA_FILE), `${JSON.stringify(stagedSchemaManifest, null, 2)}\n`);
+                    writeTextFileAtomically(schemaPath, `${JSON.stringify(stagedSchemaManifest, null, 2)}\n`);
                 }
             }
             catch (error) {
-                // The database is promoted but schema.json could not be advanced.
-                // Attempt to restore the original database; if that fails, the Home
-                // is ambiguous and must be recovered manually.
+                // A durable writer can report an fsync failure after its atomic rename,
+                // so "write threw" does not prove schema.json stayed old. Restore both
+                // the exact source sidecar and database before claiming no switch.
+                let rollbackError;
+                try {
+                    writeTextFileAtomically(schemaPath, sourceSchemaText);
+                }
+                catch (restoreError) {
+                    rollbackError = restoreError;
+                }
                 try {
                     if (backupPath !== undefined && existsSync(backupPath)) {
                         removeSqliteFileSet(committedDbPath);
@@ -183,15 +192,18 @@ export function createSqliteRecordMigrationTarget(options) {
                         removeSqliteFileSet(committedDbPath);
                     }
                 }
-                catch {
+                catch (restoreError) {
+                    rollbackError ??= restoreError;
+                }
+                if (rollbackError !== undefined) {
                     writeInterruptedMarker(home, backupPath ?? committedDbPath, stagedDbPath, now);
                     throw new AmbiguousSwitchError({
                         homePath: home,
                         backupPath: backupPath ?? committedDbPath,
                         stagingPath: stagedDbPath,
-                        detail: `SQLite database was promoted but schema.json could not be advanced (${messageOf(error)}), ` +
-                            `and the automatic rollback also failed. The database is at ${committedDbPath}; ` +
-                            `recover by advancing schema.json recordVersions or restoring the backup.`
+                        detail: `SQLite database was promoted but schema.json could not be durably advanced (${messageOf(error)}), ` +
+                            `and the database/schema rollback also failed (${messageOf(rollbackError)}). ` +
+                            `Inspect ${committedDbPath}, ${schemaPath}, and the backup before recovery.`
                     });
                 }
                 throw error;
@@ -214,7 +226,7 @@ export function createSqliteRecordMigrationTarget(options) {
     function readSourceFresh() {
         const manifestRaw = readFileSync(join(home, STORAGE_SCHEMA_FILE), "utf8");
         const schemaManifest = parseJsonObject(manifestRaw, STORAGE_SCHEMA_FILE);
-        const state = readStateFromSqlite(home);
+        const state = readMigrationSourceStateFromSqlite(home);
         return Object.freeze({ schemaManifest, state });
     }
     /**

package/dist/storage/upgrade/sqliteStateMigration.js

@@ -22,6 +22,7 @@
  * dropped, duplicated, or mutated record.
  */
 import { createHash } from "node:crypto";
+import { existsSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import Database from "better-sqlite3";
 import { mailboxTargetKey } from "../../coordination/workMailbox.js";
@@ -33,6 +34,50 @@ import { CURRENT_STORED_TASK_SCHEMA_VERSION } from "../taskStore.js";
 export const STAGED_DATABASE_FILENAME = "yui.db.staged";
 /** The committed database filename. */
 export const COMMITTED_DATABASE_FILENAME = "yui.db";
+/** Disposable, schema-current snapshot used to reconstruct an older source. */
+export const MIGRATION_SOURCE_DATABASE_FILENAME = "yui.db.migration-source";
+/**
+ * Reconstruct a migration snapshot without advancing the authoritative DB.
+ *
+ * `VACUUM INTO` takes a consistent SQLite snapshot, including committed WAL
+ * state, without writing the source. Pending physical migrations are then
+ * applied only to that disposable copy before the current reader enumerates
+ * record families that may not exist in the older source schema.
+ */
+export function readMigrationSourceStateFromSqlite(home) {
+    const sourcePath = join(home, COMMITTED_DATABASE_FILENAME);
+    const snapshotPath = join(home, MIGRATION_SOURCE_DATABASE_FILENAME);
+    if (existsSync(snapshotPath)) {
+        throw new Error(`Refusing to overwrite an existing SQLite migration-source snapshot: ${snapshotPath}. `
+            + "Discard it and retry.");
+    }
+    try {
+        const source = new Database(sourcePath, { readonly: true });
+        try {
+            source.prepare("VACUUM INTO ?").run(snapshotPath);
+        }
+        finally {
+            source.close();
+        }
+        // Physical migration 14 rewrites the WorkMailbox family while adding its
+        // current columns. Preserve the source rows before applying it so the
+        // logical record migration still sees and transforms v1 exactly once.
+        const sourceMailboxes = readWorkMailboxesFromSqlite(snapshotPath);
+        const stagedStore = new SqliteTaskStore(home, {
+            databaseFilename: MIGRATION_SOURCE_DATABASE_FILENAME,
+            migration: true
+        });
+        stagedStore.close();
+        const state = readStateFromSqlite(home, MIGRATION_SOURCE_DATABASE_FILENAME);
+        state.mailboxes = sourceMailboxes;
+        return state;
+    }
+    finally {
+        rmSync(snapshotPath, { force: true });
+        rmSync(`${snapshotPath}-wal`, { force: true });
+        rmSync(`${snapshotPath}-shm`, { force: true });
+    }
+}
 /**
  * Preserve SQLite-owned durable state that intentionally sits outside the
  * state.json-shaped Task aggregate snapshot. Volatile coordination locks and
@@ -351,9 +396,6 @@ export function populateSqliteFromState(home, state, databaseFilename) {
                 if (stored.leaderFailure !== null) {
                     store.saveLeaderFailure(stored.leaderFailure);
                 }
-                if (stored.operatorNotification !== null) {
-                    store.saveOperatorNotification(stored.operatorNotification);
-                }
                 // Per-task ID high-water marks.
                 for (const [kind, highWater] of Object.entries(stored.idHighWaterMarks)) {
                     if (typeof highWater === "number" && Number.isFinite(highWater)) {
@@ -595,6 +637,20 @@ function readWorkMailboxRows(db) {
     const hasInputDelivery = db.prepare("PRAGMA table_info(mailboxes)").all().some(({ name }) => name === "input_delivery");
     return db.prepare(`SELECT target_kind, task_id, role_name, next_sequence, processing, pending${hasInputDelivery ? ", input_delivery" : ""} FROM mailboxes ORDER BY target_key`).all();
 }
+function readWorkMailboxesFromSqlite(dbPath) {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+        const mailboxes = {};
+        for (const row of readWorkMailboxRows(db)) {
+            const mailbox = rowToMailbox(row);
+            mailboxes[mailboxTargetKey(mailbox.target)] = mailbox;
+        }
+        return mailboxes;
+    }
+    finally {
+        db.close();
+    }
+}
 /**
  * Compute per-family checksums from the SQLite database. The database is
  * opened read-only; this is the independent verification read.
@@ -692,8 +748,8 @@ export function verifySqliteChecksums(state, home, databaseFilename) {
  *
  * The database is opened read-only; this function never writes.
  */
-export function readStateFromSqlite(home) {
-    const dbPath = join(home, COMMITTED_DATABASE_FILENAME);
+export function readStateFromSqlite(home, databaseFilename = COMMITTED_DATABASE_FILENAME) {
+    const dbPath = join(home, databaseFilename);
     const db = new Database(dbPath, { readonly: true });
     try {
         const manifest = readStorageSchemaManifest(home);
@@ -737,7 +793,7 @@ export function readStateFromSqlite(home) {
         const tasks = state.tasks;
         const taskRows = db.prepare("SELECT task_id, payload, brief FROM task_records").all();
         for (const row of taskRows) {
-            tasks[row.task_id] = {
+            const aggregate = {
                 schemaVersion: storedTaskVersion,
                 task: JSON.parse(row.payload),
                 brief: row.brief === null ? null : JSON.parse(row.brief),
@@ -761,12 +817,14 @@ export function readStateFromSqlite(home) {
                 events: {},
                 wakes: {},
                 leaderFailure: null,
-                operatorNotification: null,
                 idHighWaterMarks: {},
                 capabilityGrants: {},
                 releaseWorkflows: {},
                 publicationReferences: {}
             };
+            if (storedTaskVersion <= 17)
+                aggregate.operatorNotification = null;
+            tasks[row.task_id] = aggregate;
         }
         // Per-task record families, keyed by their state.json map keys.
         loadTaskPayloadMap(db, "task_roles", tasks, "roles", (record) => record.name);
@@ -808,7 +866,7 @@ export function readStateFromSqlite(home) {
             if (row.kind === "leader-failure") {
                 stored.leaderFailure = JSON.parse(row.payload);
             }
-            else {
+            else if (storedTaskVersion <= 17) {
                 stored.operatorNotification = JSON.parse(row.payload);
             }
         }

package/dist/task/completionReadiness.js

@@ -4,6 +4,7 @@ import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
 import { isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
 import { reviewFindingLedgerWriteFailedFromEvents } from "../review/reviewFindingLedger.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
+import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
 import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
 const ACTIVE_JOB_STATUSES = new Set([
     "queued",
@@ -22,7 +23,8 @@ export function projectCompletionReadiness(facts, options = {}) {
     const advisories = [];
     const { task } = facts;
     const findingsGate = options.findingsGate ?? true;
-    const taskFinalReviewRequired = resolveRecordedTaskFinalReviewContract(task.id, facts.workItems, facts.reviewRounds, facts.taskFinalReviewContractEvents) !== undefined;
+    const taskFinalReviewContract = resolveRecordedTaskFinalReviewContract(task.id, facts.workItems, facts.reviewRounds, facts.taskFinalReviewContractEvents)?.effective;
+    const taskFinalReviewRequired = taskFinalReviewContract !== undefined;
     // A pending/running Task-final Review must be resumed or blocked first.
     for (const round of facts.reviewRounds) {
         if ((round.scope ?? "work-item") !== "task")
@@ -43,11 +45,13 @@ export function projectCompletionReadiness(facts, options = {}) {
     // escalations remain audit evidence, but a later completed full Review (or
     // accepted delta) supersedes them instead of blocking completion forever.
     const latestCompletedTaskReview = facts.reviewRounds
-        .filter((round) => ((round.scope ?? "work-item") === "task" && isSemanticReviewRound(round, {
-        listAgentRuns: () => facts.agentRuns,
-        listReviewFindings: () => facts.reviewFindings,
-        listEvents: () => facts.events
-    })))
+        .filter((round) => ((round.scope ?? "work-item") === "task"
+        && (taskFinalReviewContract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, taskFinalReviewContract))
+        && isSemanticReviewRound(round, {
+            listAgentRuns: () => facts.agentRuns,
+            listReviewFindings: () => facts.reviewFindings,
+            listEvents: () => facts.events
+        })))
         .slice()
         .sort((left, right) => (left.createdAt.localeCompare(right.createdAt)
         || left.id.localeCompare(right.id, undefined, { numeric: true })))

package/dist/task/nextAction.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { changeSetDeliverySettled, governingChangeSets } from "../integration/deliveryObligation.js";
-import { deltaRecheckBlocksAcceptance } from "../review/reviewRound.js";
-import { classifyReviewRoundOutcome, isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
+import { isAcceptedTaskReviewBaselineFromEvidence } from "../review/reviewAcceptance.js";
+import { classifyReviewRoundOutcome } from "../review/reviewOutcomeClassifier.js";
 import { actionableExecutionLaneRecoveries } from "../execution/executionHealth.js";
 import { candidateConvergenceDisagreement, candidateConvergenceEvidenceSufficient, candidateConvergenceStageResultsValid } from "../execution/candidateConvergence.js";
 import { executionStageSpendClosed, routeExecutionStage } from "../execution/resourceBroker.js";
+import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractRebind.js";
 import { currentWorkItemCandidate, currentWorkItemExecutionGroup, governingWorkItemCandidate } from "../workItem/workItem.js";
 const OPEN_WORK_ITEM_STATUSES = new Set(["pending", "running", "awaiting_acceptance"]);
@@ -232,13 +234,15 @@ export function projectNextAction(facts) {
             judgmentRequired: `Leader must judge Candidate ${candidateReady.id}/${candidate?.id ?? "unknown"} against the Task objective, acceptance criteria, and delivery risk.`
         });
     }
-    const activeWorkers = facts.activeRuns.filter((run) => run.roleName !== "leader");
-    if (activeWorkers.length > 0) {
+    // AgentRun purpose owns routing. Review Runs remain attached to their exact
+    // ReviewRound branches below instead of being mistaken for Worker delivery.
+    const activeDelegatedExecutions = facts.activeRuns.filter((run) => (run.purpose === "execution" && run.roleName !== "leader"));
+    if (activeDelegatedExecutions.length > 0) {
         return buildAction(facts, {
             kind: "wait-for-owned-execution",
-            reason: `${activeWorkers.length} delegated Run(s) are active; wait for their delivery.`,
-            refs: activeWorkers.map((run) => ref("agent-run", run.id)),
-            preconditions: activeWorkers.map((run) => ({ fact: `Delegated Run ${run.id} is active`, satisfied: true, ref: ref("agent-run", run.id) }))
+            reason: `${activeDelegatedExecutions.length} delegated execution Run(s) are active; wait for their delivery.`,
+            refs: activeDelegatedExecutions.map((run) => ref("agent-run", run.id)),
+            preconditions: activeDelegatedExecutions.map((run) => ({ fact: `Execution Run ${run.id} is active`, satisfied: true, ref: ref("agent-run", run.id) }))
         });
     }
     const failedWork = facts.workItems.find((item) => item.status === "failed");
@@ -386,7 +390,8 @@ export function projectNextAction(facts) {
         });
     }
     const finalReviewRequired = taskFinalReviewRequired(facts);
-    const failedFinal = latestTaskFinalReview(facts.reviewRounds);
+    const finalReviewContract = taskFinalReviewContract(facts);
+    const failedFinal = latestTaskFinalReview(facts.reviewRounds, finalReviewContract);
     const failedFinalOutcome = failedFinal === undefined
         ? null
         : classifyReviewRoundOutcome(failedFinal, nextActionReviewOutcomeEvidence(facts));
@@ -414,11 +419,38 @@ export function projectNextAction(facts) {
             ]
         });
     }
+    if (finalReviewRequired
+        && failedFinal !== undefined
+        && failedFinalOutcome?.kind === "semantic"
+        && failedFinal.deltaRecheck?.disposition === "requires-full-review") {
+        return buildAction(facts, {
+            kind: "request-final-review",
+            reason: `Delta Recheck ${failedFinal.id} could not establish equivalence; Yui recorded the result and left the next Review action to the Leader.`,
+            refs: [ref("review-round", failedFinal.id)],
+            preconditions: [
+                { fact: "Current frozen head has accepting final Review evidence", satisfied: false }
+            ],
+            alternatives: [
+                {
+                    kind: "request-full-review",
+                    reason: "Request a full Review when independent evidence is still required.",
+                    recommendedCommand: `yui task review request ${task.id} --role ${failedFinal.reviewerRoleName}`,
+                    refs: [ref("review-round", failedFinal.id)]
+                },
+                {
+                    kind: "continue-leader-work",
+                    reason: "Inspect directly, change the candidate, or choose another Reviewer as Task risk requires.",
+                    refs: [ref("review-round", failedFinal.id)]
+                }
+            ],
+            judgmentRequired: "Leader must choose full Review, another Reviewer, direct inspection, or more development; Core will not auto-escalate."
+        });
+    }
     if (finalReviewRequired
         && failedFinal !== undefined
         && failedFinalOutcome?.kind === "semantic"
         && ((failedFinal.checks ?? []).some(({ outcome }) => outcome === "failed")
-            || deltaRecheckBlocksAcceptance(failedFinal))) {
+            || failedFinal.deltaRecheck?.disposition === "finding")) {
         return buildAction(facts, {
             kind: "route-review-findings",
             reason: `Task-final Review ${failedFinal.id} delivered semantic negative evidence; route its open findings into a repair wave on one frozen head.`,
@@ -429,7 +461,7 @@ export function projectNextAction(facts) {
             recommendedCommand: `yui task review finding repair-wave ${task.id} --create`
         });
     }
-    const activeFinal = latestTaskFinalReview(facts.reviewRounds);
+    const activeFinal = latestTaskFinalReview(facts.reviewRounds, finalReviewContract);
     if (activeFinal !== undefined
         && (activeFinal.status === "pending" || activeFinal.status === "running")) {
         const reviewRef = ref("review-round", activeFinal.id);
@@ -475,12 +507,26 @@ export function projectNextAction(facts) {
             }
             return buildAction(facts, {
                 kind: "wait-for-owned-execution",
-                reason: `Reviewer Run ${reviewRun.id} is executing Task-final Review ${activeFinal.id}.`,
+                reason: `Reviewer Run ${reviewRun.id} is executing frozen Task-final Review ${activeFinal.id}; this Review does not globally pause Leader decisions on newer facts.`,
                 refs: [reviewRef, ref("agent-run", reviewRun.id)],
                 preconditions: [
                     { fact: "Task-final ReviewRound is running", satisfied: true, ref: reviewRef },
                     { fact: "Reviewer Run is active", satisfied: true, ref: ref("agent-run", reviewRun.id) }
-                ]
+                ],
+                alternatives: [
+                    {
+                        kind: "continue-leader-work",
+                        reason: "Process new user input or advance a later candidate while preserving this frozen Review.",
+                        refs: [reviewRef]
+                    },
+                    {
+                        kind: "request-another-reviewer",
+                        reason: "Use another available Reviewer slot when an independent view adds value.",
+                        recommendedCommand: `yui task review request ${task.id} --role <other-reviewer-role>`,
+                        refs: [reviewRef]
+                    }
+                ],
+                judgmentRequired: "Leader decides whether the current facts justify waiting, continuing development, direct review, or another Reviewer."
             });
         }
         if (activeFinal.reviewerRunId !== undefined) {
@@ -530,11 +576,16 @@ export function projectNextAction(facts) {
     }
     const finalReviewOptional = !finalReviewRequired
         && !hasValidFinalReview(facts);
-    const finalReviewAlternative = finalReviewOptional && facts.reviewConfig !== null
+    const unresolvedDelta = failedFinal?.deltaRecheck?.disposition === "requires-full-review";
+    const optionalReviewer = facts.reviewConfig?.roleName
+        ?? (unresolvedDelta ? failedFinal?.reviewerRoleName : undefined);
+    const finalReviewAlternative = finalReviewOptional && optionalReviewer !== undefined
         ? [{
                 kind: "request-final-review",
-                reason: "Request an independent Task-final Review when the Leader wants extra assurance before completion.",
-                recommendedCommand: `yui task review request ${task.id} --role ${facts.reviewConfig.roleName}`,
+                reason: unresolvedDelta
+                    ? `Delta Recheck ${failedFinal.id} returned requires-full-review; request full independent evidence when the Leader judges it necessary.`
+                    : "Request an independent Task-final Review when the Leader wants extra assurance before completion.",
+                recommendedCommand: `yui task review request ${task.id} --role ${optionalReviewer}`,
                 refs: [ref("task", task.id)]
             }]
         : [];
@@ -564,7 +615,9 @@ export function projectNextAction(facts) {
         ...(!finalReviewOptional
             ? {}
             : {
-                judgmentRequired: "Leader must decide whether the frozen Task result is safe to complete or needs one optional Task-final Review."
+                judgmentRequired: unresolvedDelta
+                    ? "Leader must route the non-accepting Delta result: full Review, another Reviewer, direct inspection, more development, or completion when policy permits."
+                    : "Leader must decide whether the frozen Task result is safe to complete or needs one optional Task-final Review."
             }),
         recommendedCommand: `yui task complete ${task.id} --summary-file -`
     });
@@ -1013,10 +1066,11 @@ function latestFailedReviewFor(rounds, workItemId) {
         .reverse()
         .find((round) => round.workItemId === workItemId && round.status === "failed");
 }
-function latestTaskFinalReview(rounds) {
+function latestTaskFinalReview(rounds, contract) {
     return [...rounds]
         .reverse()
-        .find((round) => (round.scope ?? "work-item") === "task");
+        .find((round) => ((round.scope ?? "work-item") === "task"
+        && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
 }
 function needsChangeSetCapture(facts, item) {
     if (item.status !== "completed")
@@ -1036,13 +1090,17 @@ function needsChangeSetCapture(facts, item) {
     return candidate.workspace !== undefined || candidate.gitSnapshot !== undefined;
 }
 function hasValidFinalReview(facts) {
-    const final = latestTaskFinalReview(facts.reviewRounds);
-    if (final === undefined
-        || !isSemanticReviewRound(final, nextActionReviewOutcomeEvidence(facts)))
-        return false;
-    if ((final.checks ?? []).some(({ outcome }) => outcome === "failed")
-        || deltaRecheckBlocksAcceptance(final))
+    const contract = taskFinalReviewContract(facts);
+    const final = [...facts.reviewRounds]
+        .reverse()
+        .find((round) => ((round.scope ?? "work-item") === "task"
+        && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
+    if (final === undefined || !isAcceptedTaskReviewBaselineFromEvidence(final, nextActionReviewOutcomeEvidence(facts)))
         return false;
+    if (facts.currentTaskReviewCandidate !== undefined) {
+        return facts.currentTaskReviewCandidate !== null
+            && isDeepStrictEqual(final.taskCandidate, facts.currentTaskReviewCandidate);
+    }
     const reviewedCommits = new Set((final.taskCandidate?.projects ?? []).map((project) => project.commit));
     if (reviewedCommits.size === 0)
         return false;

package/dist/telemetry/sqliteTelemetryStore.js

@@ -246,7 +246,7 @@ export class SqliteTelemetryStore {
             db.pragma("foreign_keys = ON");
             db.pragma("busy_timeout = 5000");
             db.pragma("wal_autocheckpoint = 1000");
-            migrateSqliteSchema(db);
+            migrateSqliteSchema(db, { mode: "validate" });
             this.#db = db;
             return db;
         }

package/dist/web/assets/client/components.js

@@ -114,9 +114,9 @@ export function executionBand(projection, t, locale) {
   head.append(pill(t, "exec.status", projection.status));
   head.append(node("span", "exec-band-owner",
     t("exec.owner." + projection.owner) + " · " + t("exec.action." + projection.action)));
-  if (projection.activeExecutorCount > 0) {
+  if (projection.activeRuns && projection.activeRuns.length > 0) {
     head.append(node("span", "exec-band-executors",
-      projection.activeExecutorCount + " " + t("exec.executors")));
+      projection.activeRuns.length + " " + t("exec.executors")));
   }
   if (projection.monitoring === "stopped") {
     head.append(node("span", "exec-band-stopped", t("exec.monitoring.stopped")));
@@ -242,7 +242,6 @@ export function observabilityMetricCard(observability, t) {
   card.append(metricTile(t("detail.wallClock"), cost.wallClockSeconds + "s"));
   card.append(metricTile(t("detail.ready"), (observability.dag?.readyIds || []).length, { hot: true }));
   card.append(metricTile(t("detail.contextSnapshots"), context.snapshotCount));
-  card.append(metricTile(t("detail.contextPeak"), context.observedInputPeakTokens));
   const contextMeta = node("div", "record-meta observability-context-meta");
   contextMeta.append(node("span", "", t("detail.contextBytes") + " · "
     + (context.totalBytes === null ? t("detail.partial") : context.totalBytes + " B")));
@@ -775,6 +774,17 @@ export function roleCard(role, task, t, locale, actions) {
     card.append(eff);
   }
 
+  if (role.sessionTokens) {
+    const tokenMeta = node("div", "record-meta");
+    const cumulative = role.sessionTokens.cumulativeTotal || {};
+    const maximum = role.sessionTokens.maximumRequestInput || {};
+    tokenMeta.append(node("span", "", t("detail.sessionTotalTokens") + " · "
+      + (cumulative.status === "observed" ? cumulative.totalTokens : t("detail.unobserved"))));
+    tokenMeta.append(node("span", "", t("detail.maximumRequestInputTokens") + " · "
+      + (maximum.status === "observed" ? maximum.inputTokens : t("detail.unobserved"))));
+    card.append(tokenMeta);
+  }
+
   if (role.description) card.append(richText(null, role.description, t, { muted: true }));
 
   const cols = node("div", "record-cols");

package/dist/web/assets/client/i18n.js

@@ -61,17 +61,19 @@ const messages = {
     "detail.stageAttempt": "Attempt",
     "detail.cost": "Cost",
     "detail.tokens": "Tokens",
+    "detail.sessionTotalTokens": "Session total tokens",
+    "detail.maximumRequestInputTokens": "Maximum request input",
     "detail.toolCalls": "Tool calls",
     "detail.wallClock": "Wall clock",
     "detail.ready": "Ready",
     "detail.quorum": "Quorum",
     "detail.contextSnapshots": "Context snapshots",
-    "detail.contextPeak": "Context peak",
     "detail.contextBytes": "Context bytes",
     "detail.compression": "Compression",
     "detail.marginalValue": "Marginal value",
     "detail.partial": "partial",
     "detail.unavailable": "unavailable",
+    "detail.unobserved": "unobserved",
     "detail.openFindings": "Open findings",
     "detail.desired": "Desired launch",
     "detail.desiredAgent": "Desired Agent",
@@ -397,17 +399,19 @@ const messages = {
     "detail.stageAttempt": "阶段尝试",
     "detail.cost": "成本",
     "detail.tokens": "Token",
+    "detail.sessionTotalTokens": "Session 累计 Token",
+    "detail.maximumRequestInputTokens": "单次请求最大输入",
     "detail.toolCalls": "工具调用",
     "detail.wallClock": "墙钟时间",
     "detail.ready": "可就绪",
     "detail.quorum": "法定数量",
     "detail.contextSnapshots": "上下文快照",
-    "detail.contextPeak": "上下文峰值",
     "detail.contextBytes": "上下文字节",
     "detail.compression": "压缩",
     "detail.marginalValue": "边际价值",
     "detail.partial": "部分可见",
     "detail.unavailable": "不可用",
+    "detail.unobserved": "未观测",
     "detail.openFindings": "未解决发现",
     "detail.desired": "期望启动配置",
     "detail.desiredAgent": "期望 Agent",

package/dist/web/webSnapshot.js

@@ -7,6 +7,7 @@ import { classifyRuntimeHealth, projectRuntimeTaskEvents } from "../runtime/runt
 import { builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
 import { resolveRuntimeHealth } from "../config/yuiConfig.js";
+import { projectSessionTokenMetrics, resolveSessionTokenIdentity } from "../runtime/sessionTokenMetrics.js";
 export function buildWebDashboardSnapshot(store, now = new Date()) {
     return store.transaction((reader) => {
         const statusCounts = {
@@ -97,6 +98,9 @@ export function buildWebTaskDetail(store, taskId, now = new Date()) {
             const effectiveLaunch = activeRun?.effective ?? activeSession?.effective ?? null;
             return {
                 ...role,
+                sessionTokens: projectSessionTokenMetrics(events, resolveSessionTokenIdentity(activeSession === undefined
+                    ? null
+                    : { taskId, roleName: role.name, ...activeSession })),
                 effectiveLaunch,
                 effectiveLaunchSource: activeRun === undefined
                     ? activeSession === undefined ? null : "session"