@codedology/code-forge 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@codedology/code-forge` are recorded here. Format loosel
 [Keep a Changelog](https://keepachangelog.com/); versions follow semver ahead of a 1.0.0 that
 waits on a second real consumer (plan §10.4, Q17).
 
+## [Unreleased]
+
+## [0.2.0] — 2026-09-26
+
+### Added
+
+- **`code-forge review`** — review only: runs the review engine on changes you already have (your
+  branch against the merge base with the default branch, your uncommitted work, or `--files`), with
+  no plan, coder or proof, and never closes a block. One verdict per file, a fix list, totals or one
+  JSON document (`--json`); exit 0 only when every file is approved. The run and its worker are
+  always ended, also on Ctrl-C, SIGTERM and timeouts. See `docs/review-only.md`.
+- **Release tools:** `npm run release -- <patch|minor|major|x.y.z>` bumps every version location,
+  moves the changelog, runs every check (with rollback), commits and tags; `npm run changelog --
+  <type> "text"` records changes as you go. See `docs/releasing.md`.
+- **GitHub Releases:** a tag push publishes to npm and then creates the GitHub Release from the
+  changelog, with links to the npm version and the changelog.
+
+### Changed
+
+- **Reviewers see the acceptance clauses.** Every review packet now carries the block's acceptance
+  clauses (redacted, cut to fit the packet budget); a block without readable clauses is still
+  reviewed, with `(acceptance unavailable)`.
+
+### Fixed
+
+- CI is green on Linux: a macOS-only case-insensitivity test now skips on case-sensitive
+  filesystems, and the Node 22/24 matrix no longer cancels one job when the other fails.
+
 ## [0.1.0] — first release
 
 The `plan` → `harden` → `code` → `review` pipeline for cross-model, parallel, evidence-gated

package/README.md

@@ -10,8 +10,8 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 ## What ships
 
-- A CLI (`code-forge`), installed globally via `npx @codedology/code-forge init` into every detected
-  harness (Claude Code, Codex, Grok, …).
+- A CLI (`code-forge`), installed globally with `npm install -g @codedology/code-forge`; `code-forge
+  init` then links the skill into every detected harness (Claude Code, Codex, Grok, …).
 - One Agent Skill (`skill/SKILL.md` + `references/`) that is prose only — every fact (model ids,
   efforts, commands, thresholds, paths) lives in config or in the CLI, never in the skill text.
 - A JSON Schema for `.code-forge.yml` (`schema/code-forge.schema.json`), documented in
@@ -23,14 +23,18 @@ policy and security model; `docs/reference/blocks.json` lists the build blocks.
 ## Install
 
 ```bash
-npx @codedology/code-forge init
+npm install -g @codedology/code-forge
+code-forge init
 ```
 
+The scoped name is used only to install; the command is `code-forge`. The unscoped npm package
+`code-forge` is a different, unrelated tool.
+
 The wizard asks nine short questions (tools, harnesses, provider matrix, multimodel, keys, engine,
 gates, proof, doctor), every one with a default on Enter. Non-interactively:
 
 ```bash
-npx @codedology/code-forge init --no-interaction --no-jev
+code-forge init --no-interaction --no-jev
 ```
 
 `--no-jev` skips the System-1 key for a first try; drop it and pass `--jev-ref op://vault/item/field`
@@ -51,6 +55,20 @@ code-forge --help                    # every verb, one per line
 code-forge version
 ```
 
+## Review only
+
+To review code you already wrote — no plan, no coder, no proof — run this in the repository:
+
+```bash
+code-forge review                    # verdict + fix list per changed file; exit 0 only if all approved
+```
+
+It reviews your branch against the merge base with the default branch (on the default branch: your
+uncommitted work), with the same fresh, closed-book reviewer sessions a block gets. Narrow it with
+`--files <path…>`, state the change with `--intent "<text>"`, pick the base with `--base <ref>`, or
+get one JSON document with `--json`. Exit codes: `0` all approved or nothing to review, `1` any
+finding, stop or unavailable review, `2` usage. See [docs/review-only.md](docs/review-only.md).
+
 ## The verbs
 
 Verbs are discovered from `src/cli/*.mjs` — adding one never touches the router
@@ -66,6 +84,7 @@ usage line.
 | `run` | `code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]` · `run start --reattach --run <id>` · `run status --run <id>` · `run end --run <id>` |
 | `block` | `code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file>` · `block attempt\|rebase\|claim\|close\|stop\|waive …` (§4.9; `waive` is human-only) |
 | `worker` | `code-forge worker --run <id> [--cwd <dir>] [--poll-ms <n>] [--once]` — started detached by `run start`, never by a coder |
+| `review` | `code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> \| --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]` — review only: no coder, no proof, never closes a block |
 | `review-file` | `code-forge review-file <path> --block <id> [--run <id>]` (enqueue) · `review-file --wait <ticket> [--max <seconds>s]` (poll) |
 | `spawn` | `code-forge spawn --level L<n> --role <role> --brief <file> [--schema <file>] [--cwd <dir>] [--run <id>] [--block <id>] [--timeout <s>] [--background]` |
 | `s2` | `code-forge s2 --packet <file.json> [--run <id>] [--block <id>] [--timeout <s>]` |
@@ -125,3 +144,5 @@ npm run typecheck     # tsc --checkJs --noEmit
 Node >= 22 required (ruling R7). No build step — the package ships plain ESM `.mjs`, run directly
 by Node. `docs/reference/blocks.json` maps each build block to the files it owns and what it
 depends on, kept in sync with the maintainer's design plan.
+
+Releasing: record changes with `npm run changelog -- <type> "<text>"`, then `npm run release -- <patch|minor|major|x.y.z> [--dry-run]` bumps, commits and tags (it never pushes or publishes). See [docs/releasing.md](docs/releasing.md).

package/docs/README.md

@@ -13,10 +13,12 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block, and see who does what and where state lives |
 | 4 | [getting-started.md](getting-started.md) | install it, answer `init`, run `doctor`, and try the first commands |
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
+| 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
 | 6 | [examples/marketing-site/brief.md](examples/marketing-site/brief.md) | copy the brief the tutorial uses |
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 
-New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary.
+New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary. Only want reviews? Read 4,
+then 5a.
 
 ## Reference pages (already in the repo)
 
@@ -25,6 +27,7 @@ New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary.
 | [reference/config.md](reference/config.md) | every `.code-forge.yml` key, its type and default. Generated from `schema/code-forge.schema.json` |
 | [reference/blocks.json](reference/blocks.json) | the build blocks of this package and what each one owns |
 | [marketing/code-forge-story.md](marketing/code-forge-story.md) | the marketing content bank (copy, lessons, what not to claim) |
+| [releasing.md](releasing.md) | for maintainers: record changes (`npm run changelog`), cut a release with one command (`npm run release`), GitHub Releases, what stays manual |
 | [`skill/SKILL.md`](../skill/SKILL.md) and [`skill/references/`](../skill/references/) | the Agent Skill the orchestrator follows. The deepest and most exact description of the rules |
 
 ## Conventions in these pages

package/docs/reference/blocks.json

@@ -1,10 +1,10 @@
 {
-  "$comment": "hand-maintained; checked against plan §10.4 + NIGHT-LOG by test/docs-blocks.test.mjs. Ids = every `| **Bxx** |` row in plans/code-forge-plan-v1.3.md §10.4 Waves 2-6 (19 ids), plus the blocks the root orchestrator added during the night run of 2026-09-25 that are not in that table (plans/NIGHT-LOG.md): B1.2, B4.1, B11.1, B12c (B3.1 was already in the v1.3 §10.4 table). Wave 0-1 blocks (B0-B8) are the pre-v1.3 baseline landed before this plan revision; they have no entry under blocks and are listed in baseline_ids so every depends_on id resolves; see plans/code-forge-plan-v1.3.md §10.2-§10.3 for their record. B10c is listed with deleted:true — the maintainer answered Q16 'cut' on 2026-09-25, so B10c (consumer-facing mutation-testing tools) never lands.",
+  "$comment": "hand-maintained; checked against plan §10.4 + NIGHT-LOG by test/docs-blocks.test.mjs. Ids = every `| **Bxx** |` row in plans/code-forge-plan-v1.3.md §10.4 Waves 2-6 (19 ids), plus the blocks the root orchestrator added during the night run of 2026-09-25 that are not in that table (plans/NIGHT-LOG.md): B1.2, B4.1, B11.1, B12c (B3.1 was already in the v1.3 §10.4 table); plus B22 (the review-only verb), which the root added on 2026-09-26 after the night run. Wave 0-1 blocks (B0-B8) are the pre-v1.3 baseline landed before this plan revision; they have no entry under blocks and are listed in baseline_ids so every depends_on id resolves; see plans/code-forge-plan-v1.3.md §10.2-§10.3 for their record. B10c is listed with deleted:true — the maintainer answered Q16 'cut' on 2026-09-25, so B10c (consumer-facing mutation-testing tools) never lands.",
   "checked_against": [
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 23,
+  "block_count": 24,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -283,6 +283,17 @@
         "src/proof/tools/**", "src/proof/nightly.mjs", "ci/nightly-proof.yml", "test/proof/tools/**", "test/proof/nightly.test.mjs"
       ],
       "depends_on": ["B10a", "B10b"]
+    },
+    "B22": {
+      "title": "Review-only verb: code-forge review (base/file discovery, run start -> block open -> review-file -> block stop -> run end) and its docs",
+      "wave": 6,
+      "level": "L2",
+      "status": "in_review",
+      "owned": [
+        "src/cli/review.mjs", "test/cli/review.test.mjs", "docs/review-only.md"
+      ],
+      "depends_on": ["B11", "B12a", "B12c"],
+      "note": "root-added 2026-09-26 (after the night run); not in the v1.3 §10.4 table"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",
@@ -29,13 +29,17 @@
     "docs/reference",
     "examples",
     "scripts",
+    "!scripts/release.mjs",
+    "!scripts/changelog.mjs",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
     "test": "CODE_FORGE_NO_LEAK=snapshot node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs && node --import ./test/helpers/isolate.mjs --experimental-test-module-mocks --test 'test/**/*.test.mjs' && CODE_FORGE_NO_LEAK=final node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs",
-    "typecheck": "tsc --checkJs --noEmit"
+    "typecheck": "tsc --checkJs --noEmit",
+    "release": "node scripts/release.mjs",
+    "changelog": "node scripts/changelog.mjs"
   },
   "dependencies": {
     "@clack/prompts": "1.8.1",

package/skill/references/review.md

@@ -40,3 +40,7 @@ Two L2 reviewers, one per effective provider (`resolve(L2)` and `review.second_l
 ## §7 The review budget per block
 
 `review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
+
+## §8 Review only
+
+A human who wants a review and nothing else runs `forge review`: it reviews the changed files in one `R-<timestamp>` block at L2, prints the verdicts, then stops the block and ends the run — no plan, no coder, no proof, never a close. Inside a block the orchestrator keeps using `forge review-file`.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.1.0"
+PINNED_VERSION="0.2.0"
 set -eu
 
 self="$0"

package/src/cli/review.mjs

@@ -0,0 +1,610 @@
+/**
+ * `code-forge review` (block B22) — review-only: the review engine on changes you already have,
+ * with no plan, no coder, no proof and no block close.
+ *
+ *   review [--base <ref>] [--files <path…>] [--acceptance <file> | --intent "<text>"]
+ *          [--run <id>] [--max <seconds>] [--json] [--keep-run]
+ *
+ * 1. Base: `git merge-base HEAD <default>`, where `<default>` is `origin/HEAD`'s branch, else
+ *    `main`, else `master`; when that is HEAD itself (you are on the default branch), the base is
+ *    HEAD and the uncommitted changes are reviewed. `--base <ref>` overrides. Resolved to a sha.
+ * 2. Files: `git diff --name-only <base>` (committed, staged and unstaged changes against the
+ *    working tree) plus untracked files git does not ignore. Deleted, binary, symlinked and
+ *    secret-like files are skipped, and so is code-forge's own state (`.code-forge/`,
+ *    `.code-forge.yml`). `--files` replaces the list; each path is checked before anything starts.
+ * 3. Acceptance: `--acceptance <file>` as given; `--intent` becomes one clause; neither ⇒ one
+ *    default clause. A generated file lives in this command's temp root, never in the tree.
+ * 4. Flow, every step a `code-forge` child with a `GIT_*`-free env: `run start` (launches the
+ *    worker) → `block open R-<stamp> --level L2 --base <sha> --owned <files…>` → `review-file`
+ *    per file → `review-file --wait` per ticket (`--max`, default 900 s per file) → summary →
+ *    `block stop` (a review never closes a block) → `run end` unless `--keep-run`. The cleanup runs
+ *    in a `finally`, on SIGINT/SIGTERM and after a timeout, and no worker outlives the command.
+ *    Each cleanup step is independent (a failed or throwing step is reported on stderr and the
+ *    next one still runs), and a cleanup error never replaces the review's own exit code.
+ *    `--run <id>` names the run: an active run with that id is reused (and never ended here);
+ *    otherwise a new run starts with that id.
+ * Exit codes: 0 every file approved (or nothing to review); 1 any file with findings, stopped,
+ * unavailable or timed out, or the flow failed; 2 usage, not a git repository, a bad base, a bad
+ * path, or no `.code-forge.yml`.
+ *
+ * `--files` paths go through `review-file`'s own path rule (`normalizeRequestPath`) before anything
+ * starts, and `review-file` re-checks each one when it enqueues it.
+ */
+
+import { randomBytes } from 'node:crypto';
+import { closeSync, lstatSync, openSync, readFileSync, readSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parse as parseYAML } from 'yaml';
+import { loadProjectConfig } from '../config/load.mjs';
+import { computeFileSet } from '../gates/scope.mjs';
+import { parseFlags } from '../state/cli-args.mjs';
+import { assertRunId, newRunId, StateError } from '../state/paths.mjs';
+import { processStartTime, readRun } from '../state/run.mjs';
+import { exec } from '../util/exec.mjs';
+import { writeSafe } from '../util/redact.mjs';
+import { isAlive, listEntries, readStartTime, UNKNOWN_START_TIME } from '../util/reaper.mjs';
+import { pidsDir, runRoot, setRunRoot, tmpBase } from '../util/tmp.mjs';
+import { readWorker } from '../worker/queue.mjs';
+import { gitChildEnv, normalizeRequestPath, repoRootOf, WorkerError } from '../worker/ticket.mjs';
+
+const BIN = fileURLToPath(new URL('../../bin/code-forge.mjs', import.meta.url));
+
+export const USAGE =
+  'usage: code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> | --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]\n';
+
+export const DEFAULT_MAX_S = 900;
+export const DEFAULT_CLAUSE = 'Review for correctness, security and test quality; no intent was stated.';
+const GIT_TIMEOUT_MS = 30_000;
+const STEP_TIMEOUT_MS = 120_000;
+
+/** Never sent to a reviewer (the packet refuses them too): env files, keys, certificates, credentials. */
+const SECRET_LIKE = [/(^|\/)\.env[^/]*$/i, /\.pem$/i, /\.key$/i, /\.p12$/i, /(^|\/)id_(rsa|ed25519|ecdsa)[^/]*$/i, /(^|\/)credentials[^/]*$/i];
+
+/** A refusal that exits 2 (usage, not a repo, bad base, bad path, no config). */
+class UsageError extends Error {}
+/** The run was interrupted (signal). */
+class Interrupted extends Error {}
+
+/** `process.env` minus every inherited `GIT_*` (a hook's `GIT_DIR` must never redirect a child). */
+export function scrubbedEnv() {
+  /** @type {Record<string, string>} */
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) if (!key.startsWith('GIT_') && value !== undefined) env[key] = value;
+  return env;
+}
+
+/**
+ * @param {string[]} args @param {string} cwd @param {number[]} [ok]
+ * @returns {Promise<import('../util/exec.mjs').ExecResult>}
+ */
+const git = (args, cwd, ok) => exec(['git', ...args], { cwd, env: gitChildEnv(), timeoutMs: GIT_TIMEOUT_MS, ...(ok ? { okExitCodes: ok } : {}) });
+
+/** @param {string} ref @param {string} cwd @returns {Promise<string | null>} the commit sha, or null. */
+async function commitOf(ref, cwd) {
+  if (ref.length === 0 || ref.startsWith('-')) return null;
+  const res = await git(['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], cwd);
+  const sha = res.stdout.trim();
+  return res.result === 'ok' && /^[0-9a-f]{40,64}$/.test(sha) ? sha : null;
+}
+
+/**
+ * The base sha and how it was chosen.
+ * @param {string} repoRoot @param {string | undefined} given
+ * @returns {Promise<{sha: string, from: string}>}
+ * @throws {UsageError}
+ */
+export async function resolveBase(repoRoot, given) {
+  if (given !== undefined) {
+    const sha = await commitOf(given, repoRoot);
+    if (sha === null) throw new UsageError(`--base ${JSON.stringify(given)} is not a commit of this repository`);
+    return { sha, from: given };
+  }
+  const head = await commitOf('HEAD', repoRoot);
+  if (head === null) throw new UsageError('the repository has no commit yet — commit once, or pass --base');
+  const candidates = [];
+  const originHead = await git(['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], repoRoot, [0, 1]);
+  if (originHead.result === 'ok' && originHead.code === 0 && originHead.stdout.trim().length > 0) candidates.push(originHead.stdout.trim());
+  candidates.push('main', 'master');
+  for (const name of candidates) {
+    const tip = await commitOf(name, repoRoot);
+    if (tip === null) continue;
+    const mb = await git(['merge-base', 'HEAD', tip], repoRoot);
+    const sha = mb.stdout.trim();
+    if (mb.result !== 'ok' || sha.length === 0) throw new UsageError(`HEAD and ${name} share no history — pass --base <ref>`);
+    return sha === head ? { sha: head, from: 'HEAD (uncommitted changes)' } : { sha, from: `merge-base HEAD ${name}` };
+  }
+  return { sha: head, from: 'HEAD (uncommitted changes; no main, master or origin/HEAD)' };
+}
+
+/**
+ * A `--files` path through `review-file`'s own rule (`normalizeRequestPath`: relative to `cwd`, no
+ * `..` segment, not absolute, inside the repository after resolving the directory's real path,
+ * never under `.git/` or `.code-forge/`, never a symlink).
+ * @param {string} raw @param {string} cwd @param {string} repoRoot - realpath'd
+ * @returns {string} the repo-root-relative POSIX path
+ * @throws {UsageError}
+ */
+export function checkRequestPath(raw, cwd, repoRoot) {
+  try {
+    return normalizeRequestPath(raw, cwd, repoRoot);
+  } catch (err) {
+    if (err instanceof WorkerError) throw new UsageError(`--files ${JSON.stringify(raw)}: ${err.message}`);
+    throw err;
+  }
+}
+
+/**
+ * Why a candidate file is not sent for review, or null when it is.
+ * @param {string} repoRoot @param {string} rel @param {{discovered: boolean}} opts
+ * @returns {string | null}
+ */
+export function skipReason(repoRoot, rel, { discovered }) {
+  const top = rel.split('/')[0].toLowerCase();
+  if (top === '.code-forge' || top === '.git') return 'code-forge state';
+  if (discovered && rel === '.code-forge.yml') return 'code-forge config';
+  if (rel.startsWith('-') || rel.includes('\\')) return 'unsupported file name';
+  if (SECRET_LIKE.some((re) => re.test(rel))) return 'secret-like name, never sent to a reviewer';
+  let st;
+  try {
+    st = lstatSync(path.join(repoRoot, rel));
+  } catch {
+    return 'deleted';
+  }
+  if (st.isSymbolicLink()) return 'symlink';
+  if (!st.isFile()) return 'not a regular file';
+  // git's own heuristic: a NUL byte in the first 8000 bytes means binary
+  let fd;
+  try {
+    fd = openSync(path.join(repoRoot, rel), 'r');
+    const head = Buffer.alloc(8000);
+    const n = readSync(fd, head, 0, head.length, 0);
+    if (head.subarray(0, n).includes(0)) return 'binary';
+  } catch {
+    return 'unreadable';
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+  return null;
+}
+
+/**
+ * The acceptance clauses from a file the user gave.
+ * @param {string} file @returns {Array<{clause: string, tests: string[]}>}
+ * @throws {UsageError}
+ */
+function readAcceptance(file) {
+  let parsed;
+  try {
+    parsed = parseYAML(readFileSync(file, 'utf8'), { prettyErrors: false });
+  } catch {
+    throw new UsageError(`--acceptance ${file}: not a readable YAML or JSON file`);
+  }
+  const ok =
+    Array.isArray(parsed) &&
+    parsed.length > 0 &&
+    parsed.every((c) => typeof c?.clause === 'string' && c.clause.length > 0 && Array.isArray(c.tests) && c.tests.length > 0 && c.tests.every((/** @type {unknown} */ t) => typeof t === 'string' && t.length > 0));
+  if (!ok) throw new UsageError(`--acceptance ${file}: must be a non-empty list of {clause, tests: [test ids…]}`);
+  return parsed;
+}
+
+/** @param {string} text @returns {any} the last line of `text` as JSON, or null. */
+function lastJSON(text) {
+  try {
+    return JSON.parse(text.trim().split('\n').at(-1) ?? '');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @typedef {{file: string, result: 'approved' | 'unchanged' | 'findings' | 'stopped' | 'unavailable', reason: string | null,
+ *   findings: Array<{id: unknown, severity: unknown, lines: string, claim: string, fix: string}>}} FileOutcome
+ */
+
+/**
+ * One file's outcome from its `review-file --wait` answer (or null when there was none).
+ * @param {string} file @param {Record<string, any> | null} waited
+ * @returns {FileOutcome}
+ */
+export function classify(file, waited) {
+  const findings = Array.isArray(waited?.fix_list) ? waited.fix_list : [];
+  const out = (/** @type {FileOutcome['result']} */ result, /** @type {string | null} */ reason) => ({ file, result, reason, findings });
+  if (!waited) return out('unavailable', 'no answer');
+  if (waited.status === 'pending') return out('stopped', 'timeout');
+  if (waited.status !== 'done') return out('unavailable', String(waited.reason ?? waited.status ?? 'no answer'));
+  const r = waited.result;
+  if (!r || typeof r !== 'object') return out('unavailable', 'unreadable result');
+  if (r.approved === true) return out('approved', null);
+  if (r.status === 'no_change') return out('unchanged', null);
+  if (r.status === 'stopped') return out('stopped', String(r.stopped ?? 'stopped'));
+  if (r.status === 'split_required') return out('stopped', 'split_required');
+  if (r.status === 'reviewed' && findings.length > 0) return out('findings', null);
+  return out('unavailable', String(r.reason ?? r.status ?? 'not approved'));
+}
+
+/** @param {FileOutcome} o @returns {string} */
+function label(o) {
+  if (o.result === 'findings') return `${o.findings.length} finding${o.findings.length === 1 ? '' : 's'}`;
+  if (o.result === 'stopped' || o.result === 'unavailable') return `${o.result}: ${o.reason}`;
+  return o.result;
+}
+
+/** @param {FileOutcome[]} outcomes */
+export function totals(outcomes) {
+  const count = (/** @type {string} */ r) => outcomes.filter((o) => o.result === r).length;
+  return {
+    files: outcomes.length,
+    approved: count('approved'),
+    unchanged: count('unchanged'),
+    with_findings: count('findings'),
+    findings: outcomes.reduce((n, o) => n + (o.result === 'findings' ? o.findings.length : 0), 0),
+    stopped: count('stopped'),
+    unavailable: count('unavailable'),
+  };
+}
+
+/** @param {FileOutcome[]} outcomes @returns {string} the human summary. */
+export function renderText(outcomes) {
+  const width = Math.max(...outcomes.map((o) => o.file.length));
+  const lines = outcomes.map((o) => `${o.file.padEnd(width)}  ${label(o)}`);
+  for (const o of outcomes) {
+    if (o.result === 'approved' || o.result === 'unchanged' || o.findings.length === 0) continue;
+    lines.push('', `fix list: ${o.file}`);
+    for (const f of o.findings) lines.push(`  ${f.id} · ${f.severity} · lines ${f.lines}`, `    claim: ${f.claim}`, `    fix:   ${f.fix}`);
+  }
+  const t = totals(outcomes);
+  lines.push(
+    '',
+    `totals: ${t.files} file${t.files === 1 ? '' : 's'} · ${t.approved} approved · ${t.with_findings} with findings (${t.findings} finding${t.findings === 1 ? '' : 's'}) · ${t.stopped} stopped · ${t.unavailable} unavailable${t.unchanged > 0 ? ` · ${t.unchanged} unchanged` : ''}`,
+  );
+  return `${lines.join('\n')}\n`;
+}
+
+/**
+ * The worker pids this run left, each with the start time that proves it is still the same
+ * process: the pin in the run record and the queue's announcement for this run.
+ * @param {string} repoRoot @param {string} runId
+ * @returns {Promise<Array<{pid: number, same: () => Promise<boolean>}>>}
+ */
+async function runWorkers(repoRoot, runId) {
+  const found = [];
+  try {
+    const pin = (await readRun(runId)).worker;
+    if (Number.isInteger(pin?.pid) && pin.pid > 1) found.push({ pid: pin.pid, same: async () => (await processStartTime(pin.pid)) === pin.started_at });
+  } catch {
+    // no record: nothing pinned
+  }
+  const w = readWorker(repoRoot);
+  if (w?.run === runId && !found.some((f) => f.pid === w.pid)) {
+    found.push({ pid: w.pid, same: async () => w.start_time === UNKNOWN_START_TIME || readStartTime(w.pid) === w.start_time });
+  }
+  return found;
+}
+
+/**
+ * After `run end` (which sends SIGTERM and returns): wait up to 5 s for this run's worker to be
+ * gone, then SIGKILL its process group. Also catches a worker a `run start` launched but never
+ * pinned because it was interrupted.
+ * @param {string} repoRoot @param {string} runId @returns {Promise<number>} workers killed here
+ */
+async function reapWorkers(repoRoot, runId) {
+  let killed = 0;
+  for (const w of await runWorkers(repoRoot, runId)) {
+    if (!isAlive(w.pid) || !(await w.same())) continue;
+    try {
+      process.kill(w.pid, 'SIGTERM');
+    } catch {
+      continue;
+    }
+    const until = Date.now() + 5000;
+    while (isAlive(w.pid) && Date.now() < until) await new Promise((r) => setTimeout(r, 100));
+    if (isAlive(w.pid) && (await w.same())) {
+      try {
+        process.kill(-w.pid, 'SIGKILL');
+      } catch {
+        try {
+          process.kill(w.pid, 'SIGKILL');
+        } catch {
+          // gone
+        }
+      }
+      killed += 1;
+    }
+  }
+  return killed;
+}
+
+/** @param {unknown} err @returns {string} */
+const messageOf = (err) => (err instanceof Error ? err.message : String(err));
+
+/**
+ * @param {string[]} args
+ * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, cwd?: string, exec?: typeof exec}} [deps] -
+ *   `exec` runs every `code-forge` child of this command (the flow steps, the cleanup and the
+ *   second-signal exit); a test seam, the real `exec` otherwise.
+ * @returns {Promise<number>}
+ */
+export async function runReview(args, deps = {}) {
+  const stdout = deps.stdout ?? process.stdout;
+  const stderr = deps.stderr ?? process.stderr;
+  const out = (/** @type {string} */ s) => writeSafe(stdout, s);
+  const note = (/** @type {string} */ s) => writeSafe(stderr, `review: ${s}\n`);
+  const cwd = deps.cwd ?? process.cwd();
+  const execChild = deps.exec ?? exec;
+
+  /** @type {Record<string, any>} */
+  let flags;
+  try {
+    ({ flags } = parseReviewArgs(args));
+  } catch (err) {
+    writeSafe(stderr, `review: ${err instanceof Error ? err.message : String(err)}\n${USAGE}`);
+    return 2;
+  }
+  if (flags.help === true) {
+    out(USAGE);
+    return 0;
+  }
+  const json = flags.json === true;
+  const maxS = flags.max === undefined ? DEFAULT_MAX_S : Number(String(flags.max).replace(/s$/, ''));
+
+  // ---- everything below until `run start` only reads: a refusal here exits 2 with no child started
+  let repoRoot;
+  let base;
+  /** @type {string[]} */
+  let files = [];
+  /** @type {Array<{file: string, reason: string}>} */
+  const skipped = [];
+  let cfg;
+  let acceptanceFile = null;
+  try {
+    repoRoot = await repoRootOf(cwd).catch(() => {
+      throw new UsageError('not inside a git repository');
+    });
+    base = await resolveBase(repoRoot, typeof flags.base === 'string' ? flags.base : undefined);
+
+    const given = Array.isArray(flags.files) ? flags.files.map((raw) => checkRequestPath(raw, cwd, repoRoot)) : null;
+    const candidates = given ? [...new Set(given)] : (await computeFileSet({ cwd: repoRoot, base: base.sha })).all;
+    for (const file of candidates) {
+      const why = skipReason(repoRoot, file, { discovered: given === null });
+      if (why === null) files.push(file);
+      else skipped.push({ file, reason: why });
+    }
+    files = files.sort();
+
+    if (files.length > 0) {
+      const loaded = await loadProjectConfig(repoRoot);
+      if (!loaded.ok) throw new UsageError(loaded.error === 'not-found' ? 'no .code-forge.yml at the repository root — run `code-forge init` first' : `.code-forge.yml does not load (${loaded.error}) — run \`code-forge validate\``);
+      cfg = loaded.config;
+      if (typeof flags.acceptance === 'string') {
+        acceptanceFile = path.resolve(cwd, flags.acceptance);
+        readAcceptance(acceptanceFile);
+      }
+    }
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    note(err.message);
+    return 2;
+  }
+  for (const s of skipped) note(`skipped ${s.file} (${s.reason})`);
+
+  if (files.length === 0) {
+    if (json) out(`${JSON.stringify({ ok: true, base: base.sha, base_from: base.from, run: null, block: null, files: [], skipped, totals: totals([]), nothing_to_review: true })}\n`);
+    else out('nothing to review\n');
+    return 0;
+  }
+
+  // ---- the run
+  const runId = typeof flags.run === 'string' ? flags.run : newRunId();
+  let reuse = false;
+  if (typeof flags.run === 'string') {
+    try {
+      const record = await readRun(runId);
+      if (record.status !== 'active') {
+        note(`run ${runId} has ended — give another --run or none`);
+        return 2;
+      }
+      reuse = true;
+    } catch (err) {
+      if (/** @type {any} */ (err)?.code !== 'no-run') throw err;
+    }
+  }
+  const blockId = `R-${new Date().toISOString().replace(/[-:]/g, '').replace('T', '-').slice(0, 15)}-${randomBytes(2).toString('hex')}`;
+  const tmpRootCfg = typeof cfg?.tmp?.root === 'string' ? path.resolve(repoRoot, cfg.tmp.root) : undefined;
+  const tmp = runRoot(`review-${runId}`, { root: tmpBase(tmpRootCfg) });
+  setRunRoot(tmp);
+
+  let started = false;
+  let blockOpen = false;
+  const keepRun = flags['keep-run'] === true;
+
+  // Signals. The FIRST SIGINT/SIGTERM kills the in-flight `code-forge` child (its process group,
+  // found in this command's pid registry, start time re-checked) and rejects the step's promise at
+  // once, so control reaches the `finally` cleanup without waiting for a `review-file --wait` to
+  // run out its `--max`. Once the cleanup has started (`inCleanup`), a first signal only counts:
+  // it kills nothing and aborts nothing, so the block stop and `run end` it would otherwise cut
+  // short complete. A SECOND signal stops waiting for that cleanup: a best-effort block stop,
+  // `run end` and worker reap (10 s each at most), then a hard exit.
+  const abort = new AbortController();
+  /** @type {Promise<never>} */
+  const aborted = new Promise((_, reject) => {
+    abort.signal.addEventListener('abort', () => reject(new Interrupted(String(abort.signal.reason))), { once: true });
+  });
+  aborted.catch(() => {});
+  let signals = 0;
+  let inCleanup = false;
+  const killInFlight = () => {
+    for (const entry of listEntries(pidsDir(tmp))) {
+      if (entry.start_time !== UNKNOWN_START_TIME && readStartTime(entry.pid) !== entry.start_time) continue;
+      try {
+        process.kill(-entry.pid, 'SIGTERM');
+      } catch {
+        try {
+          process.kill(entry.pid, 'SIGTERM');
+        } catch {
+          // already gone
+        }
+      }
+    }
+  };
+  const hardExit = async (/** @type {NodeJS.Signals} */ signal) => {
+    note(`second ${signal}: ending the run and exiting now`);
+    const quick = (/** @type {string[]} */ a) => Promise.resolve().then(() => execChild([process.execPath, BIN, ...a], { cwd: repoRoot, env: scrubbedEnv(), timeoutMs: 10_000 })).catch(() => null);
+    if (blockOpen) await quick(['block', 'stop', blockId, '--run', runId, '--reason', 'review only: interrupted']);
+    if (started && !keepRun) {
+      await quick(['run', 'end', '--run', runId]);
+      await reapWorkers(repoRoot, runId).catch(() => 0);
+    }
+    rmSync(tmp, { recursive: true, force: true });
+    process.exit(1);
+  };
+  const onSignal = (/** @type {NodeJS.Signals} */ signal) => {
+    signals += 1;
+    if (signals === 1) {
+      if (inCleanup) {
+        note(`${signal} during cleanup: finishing it (a second ${signal} exits at once)`);
+        return;
+      }
+      killInFlight();
+      abort.abort(signal);
+    } else if (signals === 2) {
+      void hardExit(signal);
+    }
+  };
+  process.on('SIGINT', onSignal);
+  process.on('SIGTERM', onSignal);
+
+  /** @param {string[]} cfArgs @param {number} [timeoutMs] */
+  const cf = async (cfArgs, timeoutMs = STEP_TIMEOUT_MS) => {
+    if (abort.signal.aborted) throw new Interrupted(String(abort.signal.reason));
+    const res = await Promise.race([execChild([process.execPath, BIN, ...cfArgs], { cwd: repoRoot, env: scrubbedEnv(), timeoutMs }), aborted]);
+    if (abort.signal.aborted) throw new Interrupted(String(abort.signal.reason));
+    return res;
+  };
+  /** @param {import('../util/exec.mjs').ExecResult} res @param {string} what */
+  const must = (res, what) => {
+    if (res.code !== 0) throw new Error(`${what} exited ${res.code ?? res.signal}: ${(res.stderr || res.stdout).trim().split('\n').at(-1) ?? ''}`);
+    return res;
+  };
+
+  let code = 1;
+  /** @type {FileOutcome[]} */
+  const outcomes = [];
+  try {
+    if (!acceptanceFile) {
+      const clause = typeof flags.intent === 'string' ? flags.intent : DEFAULT_CLAUSE;
+      acceptanceFile = path.join(tmp, 'acceptance.json');
+      writeFileSync(acceptanceFile, JSON.stringify([{ clause, tests: ['review-only'] }]), { mode: 0o600 });
+    }
+    note(`base ${base.sha.slice(0, 12)} (${base.from}) · ${files.length} file${files.length === 1 ? '' : 's'} · run ${runId}${reuse ? ' (reused)' : ''}`);
+    if (!reuse) {
+      started = true;
+      must(await cf(['run', 'start', '--cwd', repoRoot, '--run', runId]), 'run start');
+    }
+    blockOpen = true; // before the call: an interrupted `block open` may still have opened it (a stop of an unopened block only fails)
+    must(await cf(['block', 'open', blockId, '--run', runId, '--level', 'L2', '--base', base.sha, '--acceptance', acceptanceFile, '--owned', ...files]), 'block open');
+
+    /** @type {Array<{file: string, ticket: string | null, answer: any}>} */
+    const queued = [];
+    for (const file of files) {
+      const res = await cf(['review-file', file, '--block', blockId, '--run', runId]);
+      const answer = lastJSON(res.stdout);
+      queued.push({ file, ticket: typeof answer?.ticket === 'string' ? answer.ticket : null, answer });
+    }
+    for (const q of queued) {
+      if (q.ticket === null) {
+        outcomes.push(classify(q.file, { status: q.answer?.status ?? 'refused', reason: q.answer?.reason ?? q.answer?.status ?? 'not queued' }));
+        continue;
+      }
+      const res = await cf(['review-file', '--wait', q.ticket, '--max', `${maxS}s`], maxS * 1000 + 60_000);
+      outcomes.push(classify(q.file, lastJSON(res.stdout)));
+    }
+    const allOk = outcomes.every((o) => o.result === 'approved' || o.result === 'unchanged');
+    code = allOk ? 0 : 1;
+    if (json) out(`${JSON.stringify({ ok: allOk, base: base.sha, base_from: base.from, run: runId, block: blockId, files: outcomes, skipped, totals: totals(outcomes) })}\n`);
+    else out(renderText(outcomes));
+  } catch (err) {
+    note(err instanceof Interrupted ? `interrupted by ${err.message}; stopping the review` : `failed: ${err instanceof Error ? err.message : String(err)}`);
+    code = 1;
+  } finally {
+    // Every step below is independent: a step that fails or throws is reported and the next one
+    // still runs; the nested `finally` always detaches the handlers and removes the temp root. The
+    // exit code is the review's own whatever the cleanup does.
+    inCleanup = true;
+    try {
+      /**
+       * One cleanup child. `exec` forwards every signal it receives to its live children, so a
+       * first signal during the cleanup still cuts the running step short; a step that died of a
+       * signal (not of its timeout) is run once more, so the block is stopped and the run ends.
+       * @param {string[]} a
+       */
+      const cleanup = async (a) => {
+        const run = () => execChild([process.execPath, BIN, ...a], { cwd: repoRoot, env: scrubbedEnv(), timeoutMs: 60_000 });
+        const res = await run();
+        return res.code === null && res.signal !== null && !res.timedOut && signals > 0 ? run() : res;
+      };
+      if (blockOpen) {
+        try {
+          const stopped = await cleanup(['block', 'stop', blockId, '--run', runId, '--reason', 'review only: never closed, no proof']);
+          if (stopped.code !== 0) note(`block stop exited ${stopped.code ?? stopped.signal}`);
+        } catch (err) {
+          note(`block stop failed: ${messageOf(err)}`);
+        }
+      }
+      if (started && !keepRun) {
+        try {
+          const ended = await cleanup(['run', 'end', '--run', runId]);
+          if (ended.code !== 0) note(`run end exited ${ended.code ?? ended.signal}: ${ended.stderr.trim()}`);
+        } catch (err) {
+          note(`run end failed: ${messageOf(err)}`);
+        }
+        try {
+          await reapWorkers(repoRoot, runId);
+        } catch (err) {
+          note(`worker reap failed: ${messageOf(err)}`);
+        }
+      } else if (started) {
+        note(`run ${runId} kept (--keep-run): reuse it with --run ${runId}; end it with \`code-forge run end --run ${runId}\``);
+      }
+    } finally {
+      process.off('SIGINT', onSignal);
+      process.off('SIGTERM', onSignal);
+      setRunRoot(null);
+      try {
+        rmSync(tmp, { recursive: true, force: true });
+      } catch (err) {
+        note(`temp root not removed: ${messageOf(err)}`);
+      }
+    }
+  }
+  return code;
+}
+
+/**
+ * @param {string[]} args
+ * @returns {{flags: Record<string, any>}}
+ * @throws {StateError} `usage`
+ */
+function parseReviewArgs(args) {
+  const { flags, positionals } = parseFlags(args, { values: ['base', 'acceptance', 'intent', 'run', 'max'], multi: ['files'], booleans: ['json', 'keep-run', 'help'] });
+  if (positionals.length > 0) throw new StateError('usage', `unexpected argument ${JSON.stringify(positionals[0])}`);
+  if (flags.acceptance !== undefined && flags.intent !== undefined) throw new StateError('usage', 'give --acceptance or --intent, not both');
+  if (typeof flags.intent === 'string' && flags.intent.trim().length === 0) throw new StateError('usage', '--intent needs text');
+  if (flags.max !== undefined && !/^[1-9]\d{0,5}s?$/.test(String(flags.max))) throw new StateError('usage', '--max must be whole seconds, like 900 or 900s');
+  if (typeof flags.run === 'string') assertRunIdUsage(flags.run);
+  return { flags };
+}
+
+/** @param {string} id */
+function assertRunIdUsage(id) {
+  try {
+    assertRunId(id);
+  } catch {
+    throw new StateError('usage', '--run must match ^[a-z0-9][a-z0-9-]{0,63}$');
+  }
+}
+
+/** @param {string[]} args @returns {Promise<number>} */
+export default async function review(args) {
+  return runReview(args);
+}

package/src/worker/engine.mjs

@@ -21,6 +21,10 @@
  * else `findings` = the open fix list, `next` = what the orchestrator does (`fix` at `level`,
  * `trigger: review_stall | review_rounds`, `patch`), `stopped` = the stop reason.
  * Without `ctx.key` (a direct call) the hook is the engine alone and writes no approval row.
+ * Every packet (round 1, recheck, patch check) carries the block's acceptance clauses from the run
+ * record in its facts slot, labelled `Acceptance clauses` (`acceptanceExcerpt`): redacted, capped
+ * at an eighth of `review.budgets.full_in` with a truncation marker, and `(acceptance unavailable)`
+ * when the record has none — a missing acceptance never fails the review.
  * The first keyed ticket of a block (no `review.budget` row for it in the run yet) records the
  * block's review budget (§4.10, B19): the forecast over the block's changed owned files (tier from
  * the path floors, before S1), one `review.budget` row per block; a failure there never fails the
@@ -34,6 +38,7 @@ import { rmSync } from 'node:fs';
 import path from 'node:path';
 import { askJev } from '../decide/jev-client.mjs';
 import { planAndRecord, tierOf } from '../review/budget.mjs';
+import { budgetFor } from '../review/packet.mjs';
 import { reviewFile, rulesRisk } from '../review/engine.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
 import { newFileState, runRound } from '../review/fixloop.mjs';
@@ -84,14 +89,14 @@ import { assertTicketId } from './ticket.mjs';
  * `block-unknown`; a record that cannot be read or parsed throws `run-record-unreadable`, and a
  * block entry without a base `block-base-missing` — a guessed base could let a change escape review.
  * @param {string} runId @param {string} block
- * @returns {Promise<{base: string | null, level: string, owned: string[]}>}
+ * @returns {Promise<{base: string | null, level: string, owned: string[], acceptance?: unknown}>}
  */
 export async function blockEntryFor(runId, block) {
   let record;
   try {
     record = await readRun(runId);
   } catch (err) {
-    if (/** @type {any} */ (err)?.code === 'no-run') return { base: null, level: 'L2', owned: [] };
+    if (/** @type {any} */ (err)?.code === 'no-run') return { base: null, level: 'L2', owned: [], acceptance: undefined };
     throw new Error('run-record-unreadable');
   }
   if (!record || typeof record !== 'object' || !record.blocks || typeof record.blocks !== 'object') throw new Error('run-record-unreadable');
@@ -100,7 +105,43 @@ export async function blockEntryFor(runId, block) {
   const sha = entry?.base_sha;
   if (typeof sha !== 'string' || sha.length === 0) throw new Error('block-base-missing');
   const owned = Array.isArray(entry.owned_files) ? entry.owned_files.filter((f) => typeof f === 'string') : [];
-  return { base: sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned };
+  return { base: sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, acceptance: entry.acceptance };
+}
+
+/** The acceptance line written when the block's clauses cannot be read. */
+export const ACCEPTANCE_UNAVAILABLE = '(acceptance unavailable)';
+const ACCEPTANCE_HEAD = 'Acceptance clauses (what the change must do):';
+
+/**
+ * The block's acceptance clauses as the packet's facts-slot text: one `- <clause>` line each
+ * (whitespace folded, so a clause can never open a packet section), redacted, cut at an eighth of
+ * the `full_in` budget (bytes = tokens × 4) with a marker naming how many clauses were left out.
+ * Not a list of `{clause}` objects with text ⇒ `(acceptance unavailable)`.
+ * @param {unknown} acceptance - the run record's `blocks.<id>.acceptance`
+ * @param {Record<string, any> | undefined} cfg
+ * @returns {string}
+ */
+export function acceptanceExcerpt(acceptance, cfg) {
+  const clauses = Array.isArray(acceptance)
+    ? acceptance.map((c) => (typeof c?.clause === 'string' ? /** @type {string} */ (redact(c.clause.replace(/\s+/g, ' ').trim())) : '')).filter((c) => c.length > 0)
+    : [];
+  if (clauses.length === 0) return `${ACCEPTANCE_HEAD}\n${ACCEPTANCE_UNAVAILABLE}`;
+  const maxBytes = Math.max(256, Math.floor((budgetFor(cfg, 'full_in') * 4) / 8));
+  const lines = [ACCEPTANCE_HEAD];
+  let used = Buffer.byteLength(ACCEPTANCE_HEAD) + 1;
+  for (let i = 0; i < clauses.length; i += 1) {
+    const line = `- ${clauses[i]}`;
+    const size = Buffer.byteLength(line) + 1;
+    if (used + size > maxBytes) {
+      if (lines.length === 1) lines.push(`${Buffer.from(line).subarray(0, Math.max(0, maxBytes - used - 4)).toString('utf8')} …`);
+      const left = clauses.length - (lines.length - 1);
+      if (left > 0) lines.push(`(acceptance truncated: ${left} more clause(s) over the packet budget)`);
+      break;
+    }
+    lines.push(line);
+    used += size;
+  }
+  return lines.join('\n');
 }
 
 /**
@@ -151,11 +192,11 @@ export async function reviewTicket(ticket, ctx) {
   try {
     if (!ctx.key) {
       return await reviewFile(
-        { repoRoot: ctx.repoRoot, file: ticket.file, base: entry.base, cfg: ctx.cfg, workDir },
+        { repoRoot: ctx.repoRoot, file: ticket.file, base: entry.base, cfg: ctx.cfg, workDir, factsExcerpt: acceptanceExcerpt(entry.acceptance, ctx.cfg) },
         { spawn: ctx.spawn, ...(ctx.writeRow ? { writeRow: ctx.writeRow } : {}) },
       );
     }
-    return await fixLoopRound(ticket, ctx, { base: entry.base, level: entry.level, owned: entry.owned, key: ctx.key, workDir });
+    return await fixLoopRound(ticket, ctx, { base: entry.base, level: entry.level, owned: entry.owned, key: ctx.key, workDir, factsExcerpt: acceptanceExcerpt(entry.acceptance, ctx.cfg) });
   } finally {
     rmSync(workDir, { recursive: true, force: true });
   }
@@ -164,10 +205,10 @@ export async function reviewTicket(ticket, ctx) {
 /**
  * One fix-loop round for the ticket (see the module doc).
  * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
- * @param {{base: string | null, level: string, owned: string[], key: Buffer, workDir: string}} opts
+ * @param {{base: string | null, level: string, owned: string[], key: Buffer, workDir: string, factsExcerpt: string}} opts
  * @returns {Promise<ReviewOutcome>}
  */
-async function fixLoopRound(ticket, ctx, { base, level, owned, key, workDir }) {
+async function fixLoopRound(ticket, ctx, { base, level, owned, key, workDir, factsExcerpt }) {
   if (!ctx.readRows || !ctx.writeRow) return { status: 'unavailable', reason: 'no-ledger', approved: false, engine: 'adaptive', sessions: [] };
   let rows;
   try {
@@ -232,9 +273,10 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, key, workDir }) {
         workDir,
         base,
         writeRow,
+        factsExcerpt,
         ...(jev ? { jev } : {}),
         review: async () => {
-          engineOutcome = await reviewFile({ repoRoot: ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, workDir }, { spawn: ctx.spawn, writeRow });
+          engineOutcome = await reviewFile({ repoRoot: ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, workDir, factsExcerpt }, { spawn: ctx.spawn, writeRow });
           return engineOutcome;
         },
         spawn: async (opts) => {