v0.5.7

Token counts mean one thing on every runtime, and both spend ceilings hold at every door into a send.

Counting

• The usage parser names exact types instead of accepting subclasses. A subclass slipping past the parse ran its own __lt__, is_integer or __int__ inside helpers whose first promise is that they do not raise, and was returned in place of an int; the shape reporter would have written a name somebody else chose into a durable column.
• record_turn refuses a non-int or negative count rather than letting SQLite coerce it. A caller passing "1" and "2" derived "12" and stored a row contradicting its own columns, stamped as counted the current way. Breaking for a caller that passed numeric strings, which never stored what it looked like it stored.
• The codex cache caveat says what the two figures cannot both mean, instead of asserting which one is wrong.

Rollups

• Caveat chunks are sorted before tallying, so two refreshes of rows that did not change no longer return the same caveats in a different order.
• The legacy-semantics note fires on any group containing a legacy turn. It previously reported only mixed groups, leaving the commonest legacy group of all -- every turn legacy -- saying nothing.
• Workflow usage no longer borrows a consultation's step id for a review belonging to another workflow, and says so in the total when a workflow's spend names no step.

Links and ceilings

• The reviewer upsert keeps the first consultation link. A failure reported before the consultation existed carried nothing and erased the only pointer to a consultation already written and paid for: its turns stopped joining to the review, and deleting the review walked past its prompt and answer.
• A workflow step reads the workflow ceiling under the lease it is deciding with, and asks the review's ceiling before spending the step token a review step shares with its review.
• Running or retrying a workflow-owned review directly now checks the owning workflow's ceiling and holds that workflow's lease across the read and the send. A host holding the shared token could otherwise buy reviewer turns the workflow was charged for and never got to refuse. A direct run can now return SESSION_BUSY while its workflow is busy elsewhere.

Historical rows are not migrated. Rows written under the old per-runtime meanings keep their numbers and carry the caveats that say so.

1149 tests passing.