@codedology/code-forge 0.10.0 → 0.11.0

package/src/cli/block.mjs

@@ -70,6 +70,21 @@
  * FAILED: no review-file ticket id for <files>` (skipped under `--no-require-reviews`, the human's
  * way out). It runs after the review rows and reuses their file set (listed once).
  *
+ * B96 (E1): the tool builds the close report. After the review gate passed, the close prints
+ * `reviewed <path> ticket <id>` for every file the gate accepted, sorted by path, before the
+ * `reviewed_by_waiver` lines and the closed line; the id is the queue's ticket for that file at the
+ * hash the gate accepted (`resolveTicket`: the tree of a worktree block is part of it). `--json`
+ * and the done file get `reviewed: [{file, ticket, via}]` (`via`: approved, waiver or answered —
+ * the gate's own verdict, `review/reviewed-lines.mjs`), only when there is a line. So `--report`
+ * needs no ticket line: a missing hand line refuses only for a file the tool has no line for, and a
+ * hand line that names another ticket prints `WARN report ticket mismatch <path>` on stderr while
+ * the close goes on (D1). A gate-accepted file with no ticket prints `WARN no ticket for <path>`
+ * (`WARN bad ticket for <path>` when the ticket is not 24 lowercase hex) and has no line; lines that
+ * cannot be built at all give no line and `WARN reviewed lines unavailable: <message>` — then
+ * `--report` needs a hand line for every file the gate accepted, as before B96. All four warnings
+ * are held and print only when the block closes. A waived or external-review close is unchanged:
+ * no line, no key.
+ *
  * B58 (issue #11): `review.external.required: true` in the run's config snapshot (the owner set it
  * before `run start`; `run reload` refuses to change it) is the owner's non-interactive way out
  * when an outside reviewer reviews the block: the per-file review checks and the `--report` ticket
@@ -200,12 +215,13 @@ import { validateConfig } from '../config/validate.mjs';
 import { migrateConfig } from '../config/migrate.mjs';
 import { exec } from '../util/exec.mjs';
 import { contentHash, gitChildEnv } from '../worker/ticket.mjs';
-import { clearDone } from '../worker/queue.mjs';
+import { clearDone, resolveTicket } from '../worker/queue.mjs';
 import { loadState } from '../worker/review-state.mjs';
 import { openBlockEntry, reopenFile } from '../review/reopen.mjs';
 import { checkFileForm, checkFindingId } from '../review/verb-forms.mjs';
 import { runRootPath } from '../util/tmp.mjs';
 import { missingReviewTickets, parseSentinel } from '../engines/sentinel.mjs';
+import { reportMismatches, reviewedLines } from '../review/reviewed-lines.mjs';
 import { blockEndHook, runBlockEndHook, writeDoneFile } from '../state/block-end.mjs';
 import { blockOpenFindings } from '../review/open-findings.mjs';
 import { hookForbidden, scanTranscript } from '../util/forbidden.mjs';
@@ -281,11 +297,14 @@ const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', '
  *   isTTY?: boolean, stdinIsTTY?: boolean, stdoutIsTTY?: boolean,
  *   ui?: {confirm: (o: {message: string, initialValue?: boolean}) => Promise<unknown>, isCancel: (v: unknown) => boolean},
  *   removeBlockTree?: typeof removeBlockTree,
+ *   resolveTicket?: typeof resolveTicket, reviewedLines?: typeof reviewedLines,
  * }} [deps] - `now` (B48): the clock of the autopilot expiry checks. `stdinIsTTY` / `stdoutIsTTY`
  *   (default `process.stdin.isTTY` / `process.stdout.isTTY`; `isTTY` sets both) and `ui` (default
  *   `@clack/prompts`): the human's confirmation (B52 `--no-require-reviews`, B80 `block waive` and
  *   `block reopen`), which needs both to be TTYs.
  *   `removeBlockTree` (B64b, tests only): the `--remove-worktree` step, default the real one.
+ *   `resolveTicket` / `reviewedLines` (B96, tests only): the queue's ticket rule and the reviewed
+ *   lines builder of the close, default the real ones.
  * @returns {Promise<number>}
  */
 export async function runBlock(args, deps = {}) {
@@ -344,7 +363,8 @@ export async function runBlock(args, deps = {}) {
     // then the owner's `hooks.on_block_end` from the run-start snapshot. Without the hook key the
     // done file is the only addition: no row, and every output stays exactly as before.
     const hook = blockEndHook(record);
-    const ended = async (/** @type {'closed' | 'stopped'} */ status, /** @type {string} */ event, /** @type {string | null} */ reason) => {
+    // B96: `reviewed` (the close's tool lines) joins the done file only when there is one
+    const ended = async (/** @type {'closed' | 'stopped'} */ status, /** @type {string} */ event, /** @type {string | null} */ reason, /** @type {import('../review/reviewed-lines.mjs').ReviewedLine[]} */ reviewed = []) => {
       // ruling (e): `ended` never throws — any failure here is the done-file warning and a null
       // `doneFile`, so the caller's try/finally still reaches the hook
       /** @type {string | null} */
@@ -358,6 +378,7 @@ export async function runBlock(args, deps = {}) {
           reason: typeof reason === 'string' ? redact(reason) : null,
           openFindings: (rows) => blockOpenFindings(record, rows, id),
           err,
+          ...(reviewed.length > 0 ? { reviewed } : {}),
         });
       } catch (thrown) {
         const code = /** @type {any} */ (thrown)?.code;
@@ -568,6 +589,9 @@ export async function runBlock(args, deps = {}) {
       // B70: a file whose review left only waived findings passes as `reviewed_by_waiver`; its signed
       // `gate.review_waived_all` row joins the close rows (written just before `block.close`, only
       // when the block closes — a refused close writes none)
+      // B96: whether the review gate passed — set from the gate's own result (below), so the files
+      // it checked are the ones it accepted and the tool can give their reviewed lines
+      let reviewsPassed = false;
       const onWaivedAll = (/** @type {import('../review/gate-check.mjs').WaivedAll[]} */ files) => {
         // idempotent: the waived rows are rebuilt from the final list, never appended per call
         // (closeBlock reads closeRows only after every extra check passed)
@@ -575,7 +599,7 @@ export async function runBlock(args, deps = {}) {
         const others = closeRows.filter((r) => r.event !== 'gate.review_waived_all');
         closeRows.splice(0, closeRows.length, ...others, ...files.map((f) => ({ event: 'gate.review_waived_all', block: id, file: f.file, content_hash: f.content_hash, findings: f.findings, by: f.by, ...(f.answered?.length ? { answered: f.answered } : {}) })));
       };
-      const reviews = reviewGateCheck(async () => {
+      const gate = reviewGateCheck(async () => {
         const transcript = await findTranscript(record, id, typeof flags.transcript === 'string' ? flags.transcript : null);
         if (transcript === null) {
           await writeSigned(runId, writeRow, { event: 'gate.transcript_missing', block: id });
@@ -625,7 +649,63 @@ export async function runBlock(args, deps = {}) {
           highPaths,
         };
       }, { onWaivedAll });
-      // B36: the coder's report names a review-file ticket for every changed file, or it is FAILED
+      // B96: `reviewsPassed` comes from the gate's own result, not from the onWaivedAll call. Each
+      // extra check runs at most once per close (`closeBlock`'s one loop, src/state/block.mjs:562,
+      // and `closeBlock` is called once below), so the gate's one pass is its final one.
+      const reviews = async () => {
+        const result = await gate();
+        reviewsPassed = result.ok;
+        return result;
+      };
+      // B96: the stderr warnings of the reviewed lines (`WARN no ticket for <path>`, `WARN bad
+      // ticket for <path>`, `WARN reviewed lines unavailable: <message>`, `WARN report ticket
+      // mismatch <path>`): kept here and printed only when the block closes, before the reviewed
+      // lines — a refused close prints none
+      /** @type {string[]} */
+      const lineWarnings = [];
+      // B96: the tool's reviewed lines — one per file the review gate accepted, with the queue's
+      // ticket for that file at the hash the gate accepted (`resolveTicket`, the queue's own rule:
+      // the same path check, tree resolution and ticket id); a file whose content moved since the
+      // gate hashed it, or whose ticket cannot be given, has no line (fail closed, `WARN no ticket
+      // for <path>`), and so has a file whose ticket is not 24 lowercase hex (`WARN bad ticket for
+      // <path>`). None when the reviews were waived (the human flag or `review.external`) or the
+      // gate has not passed — and that empty answer is never memoised: the lines are built once,
+      // from the gate's pass (its file set and hashes, its waivedAll). It never throws: an error
+      // gives no lines and one held `WARN reviewed lines unavailable: <message>`, so the done file
+      // and the on_block_end hook of a closed block always follow.
+      /** @type {Promise<import('../review/reviewed-lines.mjs').ReviewedLine[]> | undefined} */
+      let linesOnce;
+      const toolLines = async () => {
+        if (!reviewsPassed || reviewsWaived || external !== null) return [];
+        linesOnce ??= (async () => {
+          try {
+            const { mainTop, top, inTree, fileSet } = await tree();
+            const resolve = deps.resolveTicket ?? resolveTicket;
+            const ticketOf = (/** @type {{file: string, content_hash: string}} */ f) => {
+              try {
+                const t = resolve({ repoRoot: mainTop, run: runId, block: id, file: f.file, tree: inTree ? top : null });
+                return t.content_hash === f.content_hash ? t.ticket : null;
+              } catch {
+                return null;
+              }
+            };
+            return await (deps.reviewedLines ?? reviewedLines)({
+              files: fileSet,
+              waivedAll,
+              ticketOf,
+              onNoTicket: (file) => lineWarnings.push(`WARN no ticket for ${file}\n`),
+              onBadTicket: (file) => lineWarnings.push(`WARN bad ticket for ${file}\n`),
+            });
+          } catch (thrown) {
+            lineWarnings.push(`WARN reviewed lines unavailable: ${thrown instanceof Error ? thrown.message : String(thrown)}\n`);
+            return [];
+          }
+        })();
+        return linesOnce;
+      };
+      // B36 → B96: the coder's report. The tool gives the reviewed lines, so a missing hand line is
+      // a refusal only for a file the tool has no line for; a hand line that names another ticket
+      // is a warning and the close goes on (D1: the tool lines are the record)
       const report = async () => {
         if (typeof flags.report !== 'string' || reviewsWaived || external !== null) return { ok: true };
         let text;
@@ -635,8 +715,12 @@ export async function runBlock(args, deps = {}) {
           return { ok: false, reason: 'coder report FAILED: --report cannot be read' };
         }
         const { fileSet } = await tree();
-        const missing = missingReviewTickets(text, fileSet.map((f) => f.file));
-        return missing.length === 0 ? { ok: true } : { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
+        const lines = await toolLines();
+        const given = new Set(lines.map((l) => l.file));
+        const missing = missingReviewTickets(text, fileSet.map((f) => f.file)).filter((f) => !given.has(f));
+        if (missing.length > 0) return { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
+        for (const file of reportMismatches(text, lines)) lineWarnings.push(`WARN report ticket mismatch ${file}\n`);
+        return { ok: true };
       };
       /** @type {Array<() => Promise<{ok: boolean, reason?: string}>>} */
       const extraChecks = [reviews, report];
@@ -666,14 +750,19 @@ export async function runBlock(args, deps = {}) {
       const result = await closeBlock({ runId, id, rows, writeRow, livePid: intFlag(flags['worker-pid'], 'worker-pid'), probe, extraChecks, closeRows });
       // B64b: the block ended (closed, or stopped by a worker pin event or ledger.tamper) — its rows
       // are written and the run lock released; the done file is written before the tree is removed
-      const end = result.status === 'closed' || result.status === 'stopped' ? await ended(result.status, result.event ?? (result.status === 'stopped' ? 'block.stop' : 'block.close'), result.reason ?? null) : null;
+      // B96: the tool's reviewed lines of a block that closed (also kept in its done file)
+      const reviewedJson = result.ok ? await toolLines() : [];
+      const end = result.status === 'closed' || result.status === 'stopped' ? await ended(result.status, result.event ?? (result.status === 'stopped' ? 'block.stop' : 'block.close'), result.reason ?? null, reviewedJson) : null;
       // B64b ruling (e): the hook runs exactly once for this end, after everything else the verb
       // does — also when a later step (the output, `--remove-worktree`) throws; it never changes
       // the exit code or stdout (`runHook` never throws)
       try {
+        // B96: the reviewed lines (sorted by path) come first, then the reviewed_by_waiver lines
         // B70: each file that passed as reviewed_by_waiver is named before the closed line
         // B71: an answered finding is named as answered; a file with only answered findings has no `by`
         if (result.ok) {
+          for (const w of lineWarnings) err(w);
+          for (const l of reviewedJson) say(`reviewed ${l.file} ticket ${l.ticket}\n`);
           for (const f of waivedAll) {
             const parts = f.findings.length > 0 ? [`${f.findings.join(', ')}; by ${f.by}`] : [];
             if (f.answered?.length) parts.push(`answered ${f.answered.join(', ')}`);
@@ -692,6 +781,8 @@ export async function runBlock(args, deps = {}) {
           ...(end?.json ?? {}),
           // B70: only when a file passed as reviewed_by_waiver (otherwise the output is unchanged)
           ...(result.ok && waivedAll.length > 0 ? { reviewed_by_waiver: waivedAll.map((f) => ({ file: f.file, content_hash: f.content_hash, status: f.status, findings: f.findings, by: f.by, ...(f.answered?.length ? { answered: f.answered } : {}) })) } : {}),
+          // B96: only when the tool gave reviewed lines (a waived or external close is unchanged)
+          ...(reviewedJson.length > 0 ? { reviewed: reviewedJson } : {}),
         };
         if (!result.ok || !removeTree) {
           if (json && result.ok) emit(closedJson);

package/src/cli/review-file.mjs

@@ -10,8 +10,8 @@
  *                                                  status, kind: answers, file: source, by_file, answers}
  *   review-file <path> --block <id> --fresh        B75: re-run a cached result that never counted
  *
- * The same content enqueued again after an `unavailable` result is a fresh attempt (`retry: true`),
- * not the old result.
+ * The same content enqueued again after an `unavailable` or round-1 `split_required` result is a
+ * fresh attempt (`retry: true`), not the old result.
  * A done result that is not approved and carries open findings adds `fix_list` (what the coder
  * fixes before re-running `review-file <path>`, which is then a round-2 recheck of the fix hunks,
  * §4.11); a result the loop stopped adds `stop` with the reason (`review_cap`, …) and (B73)
@@ -28,8 +28,9 @@
  * down on two polls in a row, and a worker whose pid is alive with a fresh heartbeat is never down
  * (`liveWorker`, B30). Output is one JSON line on stdout.
  * B75: `--fresh` drops the cached done marker of the file's current content and queues the ticket
- * again ONLY when that result never counted as a review: `stale`, `unavailable`, or `refused` with
- * `other-run`, `context-unreadable` or a `worktree-*` reason (an allow-list, fail closed). Any
+ * again ONLY when that result never counted as a review: `stale`, `unavailable`, round-1
+ * `split_required`, or `refused` with `other-run`, `context-unreadable` or a `worktree-*` reason
+ * (an allow-list, fail closed). Any
  * other cached result — a round ran (findings, approved, stopped), `review-state-lost`, an answers
  * result, an unknown status or reason, an unreadable marker — is refused `fresh-needs-reopen`
  * (exit 1, `exits: [block reopen, block waive]`, the marker kept byte-for-byte); a
@@ -129,8 +130,9 @@ const FRESH_REFUSED = new Set(['other-run', 'context-unreadable']);
 
 /**
  * B75: may `--fresh` drop this cached result? An allow-list, fail closed: `rerun` only for a
- * result that never counted as a review — `stale`, `unavailable`, or `refused` with a reason that
- * is not a verdict (`other-run`, `context-unreadable`, `worktree-*`) — whose marker names the same
+ * result that never counted as a review — `stale`, `unavailable`, round-1 `split_required`, or
+ * `refused` with a reason that is not a verdict (`other-run`, `context-unreadable`, `worktree-*`)
+ * — whose marker names the same
  * status. `tampered` for `refused review-state-tampered`; `counted` for everything else (a round
  * ran, `review-state-lost`, an answers result, an unknown status or reason, an unreadable marker or
  * result).
@@ -145,7 +147,7 @@ export function freshVerdict(text, result) {
     return 'counted';
   }
   if (result === null || marker === null || typeof marker !== 'object' || marker.status !== result.status) return 'counted';
-  if (result.status === 'stale' || result.status === 'unavailable') return 'rerun';
+  if (result.status === 'stale' || result.status === 'unavailable' || result.status === 'split_required') return 'rerun';
   if (result.status !== 'refused' || typeof result.reason !== 'string') return 'counted';
   if (result.reason === 'review-state-tampered') return 'tampered';
   return FRESH_REFUSED.has(result.reason) || result.reason.startsWith('worktree-') ? 'rerun' : 'counted';
@@ -166,10 +168,11 @@ export const FRESH_EXITS = Object.freeze(['block reopen', 'block waive']);
  * crash between the drop and the enqueue leaves only a re-runnable pending ticket. Anything else is refused and the marker kept byte-for-byte:
  * `fresh-needs-reopen` (names `block reopen` and `block waive`) or `fresh-tampered` (names only
  * the owner's `block close --no-require-reviews`; reopen refuses a tampered state).
- * @param {{repoRoot: string, run: string, block: string, file: string, where: {tree?: string}, say: (obj: Record<string, any>) => unknown, dropDone?: typeof dropDoneIf}} opts
+ * B110: a plain cached round-1 `split_required` uses the same claim, with `retry: true`.
+ * @param {{repoRoot: string, run: string, block: string, file: string, where: {tree?: string}, say: (obj: Record<string, any>) => unknown, dropDone?: typeof dropDoneIf, retry?: boolean}} opts
  * @returns {number} the exit code.
  */
-function freshTicket({ repoRoot, run, block, file, where, say, dropDone = dropDoneIf }) {
+function freshTicket({ repoRoot, run, block, file, where, say, dropDone = dropDoneIf, retry = false }) {
   const { ticket } = resolveTicket({ repoRoot, run, block, file, tree: where.tree ?? null });
   const markerPath = path.join(queueDir(repoRoot), `${ticket}.done`);
   /** @type {'rerun' | 'tampered' | 'counted'} */
@@ -210,7 +213,7 @@ function freshTicket({ repoRoot, run, block, file, where, say, dropDone = dropDo
     // dropped: queue it again now (a crash right here leaves a pending ticket with no marker, which
     // the next review-file queues anyway); gone: another caller took the marker, a normal enqueue
     const queued = enqueue({ repoRoot, run, block, file, ...where });
-    say(outcome === 'dropped' ? { ...queued, fresh: true } : queued);
+    say(outcome === 'dropped' ? { ...queued, ...(retry ? { retry: true } : { fresh: true }) } : queued);
     return 0;
   }
   if (verdict === 'tampered') {
@@ -223,7 +226,7 @@ function freshTicket({ repoRoot, run, block, file, where, say, dropDone = dropDo
     ticket,
     file,
     exits: [...FRESH_EXITS],
-    message: `fresh-needs-reopen: the cached result of ${file} counts as a review (or cannot be read, or kept changing under the claim); --fresh re-runs only stale, unavailable or refused other-run/worktree-*/context-unreadable results; the human's ways out are block reopen and block waive; the cached result was kept`,
+    message: `fresh-needs-reopen: the cached result of ${file} counts as a review (or cannot be read, or kept changing under the claim); --fresh re-runs only stale, unavailable, round-1 split_required or refused other-run/worktree-*/context-unreadable results; the human's ways out are block reopen and block waive; the cached result was kept`,
   });
   return 1;
 }
@@ -410,6 +413,9 @@ export async function runReviewFile(args, deps = {}) {
     const where = realpathSync(tree) === realpathSync(repoRoot) ? {} : { tree };
     if (flags.fresh === true) return freshTicket({ repoRoot, run: worker.run, block, file, where, say, ...(deps.dropDone ? { dropDone: deps.dropDone } : {}) });
     const queued = enqueue({ repoRoot, run: worker.run, block, file, ...where });
+    if (queued.status === 'done' && doneResult(repoRoot, queued.ticket)?.status === 'split_required') {
+      return freshTicket({ repoRoot, run: worker.run, block, file, where, say, retry: true, ...(deps.dropDone ? { dropDone: deps.dropDone } : {}) });
+    }
     if (queued.status === 'done' && doneResult(repoRoot, queued.ticket)?.status === 'unavailable') {
       // `unavailable` is never approval AND never final: drop the done marker so the worker runs
       // the ticket again (the fix loop re-runs its pending round); the signed result is replaced.

package/src/review/engine.mjs

@@ -29,7 +29,8 @@
  *     The summary then carries `schema_fallback: {level, provider, model}` (`level`:
  *     `review.second_levels.<level>`), the second level's own provider/model, and `tokens_in` /
  *     `tokens_out` summed over both sessions;
- *  7. a diff alone over the packet budget is `split_required` (with `tokens_in` and `budget`) —
+ *  7. a non-Markdown quick packet over budget first steps up to one full L2 session (B109).
+ *     A diff alone still over the packet budget is `split_required` (with `tokens_in` and `budget`) —
  *     except a Markdown file (B54), which is reviewed SECTION BY SECTION (`sections.mjs`): every
  *     section packet runs the whole plan above (its own sessions, judge and stub guard, its own
  *     `review.plan` row with `section`), in file order, stopping at the first one that is not
@@ -64,15 +65,17 @@ import { blockKind, isDocsKind } from '../decide/escalation.mjs';
 import { fallbackRisk } from '../decide/fallback-rules.mjs';
 import { isMigrationPath, isPolicyPath } from '../decide/lane-facts.mjs';
 import { tierFor } from '../proof/tiers.mjs';
-import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, readFileDiff } from './packet.mjs';
+import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, isSecretLike, readFileDiff } from './packet.mjs';
 import { movedText, movesFor, peerDiffReader } from './moved.mjs';
 import { deletionNote, renderDeletionNote } from './deletion.mjs';
 import { testQualityNote } from './test-quality.mjs';
+import { pairsFor, summarize } from './paired.mjs';
+import { redact } from '../util/redact.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups } from './sections.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
 import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallback.mjs';
-import { assertRowPath } from '../worker/ticket.mjs';
+import { assertRowPath, readRegularFileNoFollow } from '../worker/ticket.mjs';
 
 /**
  * @typedef {{lens: 'quick' | 'full' | 'A' | 'B' | 'judge', role: 'reviewer' | 'judge', level: 'L2' | 'L3', slot: 'A' | 'B' | null, cfg?: Record<string, any>}} SessionSpec -
@@ -185,6 +188,9 @@ export function rulesRisk({ file, plusCount, cfg }) {
  *   code moved between this file and one of them is named in every packet (`## moved code`).
  * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader
  *   of those files' diffs (`peerDiffReader`), shared by the caller across the round; wins over `peers`.
+ * @property {ReadonlyArray<string>} [ownedFiles] - concrete paths owned by this block.
+ * @property {ReadonlyArray<string>} [changedFiles] - concrete changed paths of the same block.
+ * @property {ReadonlyArray<string>} [testFiles] - the block's explicit test_files, regardless of stem.
  */
 
 /**
@@ -224,6 +230,31 @@ function safeNeeds(needs) {
   }
 }
 
+/**
+ * B98: names only, from owned changed peers and explicit tests in the reviewed tree.
+ * Missing, unsafe or unreadable pairs give no hint, never a failed review.
+ * @param {{repoRoot: string, file: string, peers?: ReadonlyArray<string>, ownedFiles?: ReadonlyArray<string>, changedFiles?: ReadonlyArray<string>, testFiles?: ReadonlyArray<string>}} input
+ * @returns {string}
+ */
+export function pairedContext({ repoRoot, file, peers = [], ownedFiles = [], changedFiles = peers, testFiles = [] }) {
+  if (ownedFiles.length === 0) return '';
+  const owned = new Set(ownedFiles);
+  const candidates = [...new Set([...pairsFor(file, changedFiles), ...testFiles])].filter((p) => p !== file && owned.has(p));
+  const lines = [];
+  for (const candidate of candidates) {
+    try {
+      const rel = assertRowPath(candidate);
+      if (isSecretLike(rel)) continue;
+      const bytes = readRegularFileNoFollow(repoRoot, rel);
+      if (bytes === null) continue;
+      lines.push(`- ${redact(rel)}`, ...summarize(bytes.toString('utf8'), rel).map((name) => `  - ${name}`));
+    } catch {
+      // The summary is optional; never follow a symlink or substitute another file.
+    }
+  }
+  return lines.join('\n');
+}
+
 /**
  * @param {ReviewInput} input @param {ReviewDeps} deps
  * @returns {Promise<{status: string, approved: boolean, engine: string, sessions: Array<Record<string, any>>} & Record<string, any>>}
@@ -234,8 +265,8 @@ export async function reviewFile(input, deps) {
   const risk = input.risk ?? rulesRisk({ file: diff.file, plusCount: diff.plusCount, cfg });
   // no recorded kind ⇒ the reviewed file's own kind (a lone `.md` is a docs review), never a blind `code`
   const kind = typeof input.kind === 'string' ? input.kind : blockKind({ owned: [diff.file] });
-  const plan = planSessions({ risk, cfg, kind });
-  const head = { engine: plan.mode, depth: plan.depth, risk, file: diff.file };
+  let plan = planSessions({ risk, cfg, kind });
+  let head = { engine: plan.mode, depth: plan.depth, risk, file: diff.file };
   if (plan.refused) return { status: 'refused', reason: plan.refused, approved: false, ...head, sessions: [] };
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
@@ -265,6 +296,7 @@ export async function reviewFile(input, deps) {
   // B92: a test that reads a source file and asserts on its text gets the `## test-quality` hint
   // (line numbers only), read once from the current content; '' for none
   const quality = testQualityNote(diff.file, diff.content);
+  const paired = pairedContext(input);
   /** @param {ReadonlyArray<number> | null} keys - a Markdown section's group keys; null ⇒ the whole file. */
   const movedOf = (keys) => [deleted, movedText(moves, diff.content, keys), quality].filter((t) => typeof t === 'string' && t.length > 0).join('\n');
   const min = minTokensOut(cfg);
@@ -280,7 +312,7 @@ export async function reviewFile(input, deps) {
       const paths = safeNeeds(needs);
       let extra = null;
       try {
-        extra = paths ? await attachFiles({ repoRoot, paths, budgetTokens: budgetFor(cfg, 'full_in') }) : null;
+        extra = paths ? await attachFiles({ repoRoot, paths, budgetTokens: budgetFor(cfg, 'full_in'), ownedFiles: input.ownedFiles, changedFiles: input.changedFiles ?? input.peers ?? [] }) : null;
       } catch {
         extra = null;
       }
@@ -290,10 +322,10 @@ export async function reviewFile(input, deps) {
     return summary;
   };
 
-  const reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
-  const judgeSpec = plan.sessions.find((s) => s.role === 'judge');
+  let reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
+  let judgeSpec = plan.sessions.find((s) => s.role === 'judge');
   /** @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<number> | null} [keys] */
-  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys) }));
+  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys), paired }));
 
   /**
    * The plan on one packet set (the whole file, or one Markdown section): reviewers, then the judge.
@@ -327,10 +359,25 @@ export async function reviewFile(input, deps) {
     return { status: 'reviewed', approved, summary: final.review.summary, findings, sessions };
   };
 
-  const packets = packetsFor(diff);
-  const split = /** @type {{status: 'split_required', tokensIn: number, budget: number} | undefined} */ (packets.find((p) => p.status === 'split_required'));
+  let packets = packetsFor(diff);
+  let split = /** @type {{status: 'split_required', tokensIn: number, budget: number} | undefined} */ (packets.find((p) => p.status === 'split_required'));
+  /** @type {Record<string, any>} */
+  let stepUp = {};
+  if (split && plan.depth === 'quick' && !isMarkdownFile(diff.file)) {
+    const full = planSessions({ risk: 1, cfg, kind });
+    // A configured consensus/refusal is not the single full session this step permits.
+    if (full.depth === 'full') {
+      stepUp = { step_up: { from: 'quick', tokens_in: split.tokensIn, budget: split.budget } };
+      plan = full;
+      head = { ...head, engine: plan.mode, depth: plan.depth };
+      reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
+      judgeSpec = plan.sessions.find((s) => s.role === 'judge');
+      packets = packetsFor(diff);
+      split = /** @type {typeof split} */ (packets.find((p) => p.status === 'split_required'));
+    }
+  }
   if (!split) {
-    const { status, reason, approved, summary, findings, sessions } = await reviewPart(diff, packets);
+    const { status, reason, approved, summary, findings, sessions } = await reviewPart(diff, packets, stepUp);
     if (status !== 'reviewed') return { status, reason, approved: false, ...head, sessions };
     return { status, approved, ...head, summary, findings, sessions };
   }

package/src/review/fixloop.mjs

@@ -93,6 +93,7 @@ import { contentHash, gitChildEnv } from '../worker/ticket.mjs';
 import { parseDiff } from './context.mjs';
 import { assemblePacket, assertPacketPath, diffOnlyTokens, readFileDiff } from './packet.mjs';
 import { movedText, movesFor, peerDiffReader } from './moved.mjs';
+import { pairedContext } from './engine.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups, sectionOf } from './sections.mjs';
 import { cameFromJudge, resolvedBand, triageFindings } from './triage.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
@@ -144,6 +145,9 @@ import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallba
  * @property {(req: {file: string, level: 'L3', open: Finding[]}) => Promise<unknown>} [patch] - the L3 patch rung (≤ 80 lines, owned files only).
  * @property {string | null} [base] - the block base (`recheck_scope: file`, and the B56 moved-code diff).
  * @property {ReadonlyArray<string>} [peers] - B56: the block's other changed files (moved-code hints).
+ * @property {ReadonlyArray<string>} [ownedFiles] - concrete paths owned by this block.
+ * @property {ReadonlyArray<string>} [changedFiles] - concrete changed paths of the same block.
+ * @property {ReadonlyArray<string>} [testFiles] - the block's explicit test_files.
  * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader of their diffs (`peerDiffReader`); wins over `peers`.
  * @property {string} [rulesDigest] @property {string} [factsExcerpt]
  * @property {number} [extraRounds] - B47: rounds past `review.max_rounds_per_file` granted by autopilot (`extraRoundsFor`).
@@ -362,11 +366,11 @@ export function recheckTokens(diff, open, moved = '') {
 /**
  * The recheck packet: the `recheck` lens on the fix hunks (hunk form, never the whole file), then
  * the open findings by id. Over budget ⇒ `minimal` (see the module doc).
- * @param {{diff: import('./packet.mjs').FileDiff, open: Finding[], cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', rulesDigest?: string, factsExcerpt?: string, moved?: string}} opts -
+ * @param {{diff: import('./packet.mjs').FileDiff, open: Finding[], cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', rulesDigest?: string, factsExcerpt?: string, moved?: string, paired?: string}} opts -
  *   `moved`: the file's `## moved code` section (B56), '' for none.
  */
-export function buildRecheckPacket({ diff, open, cfg, contextMode = 'recheck', rulesDigest, factsExcerpt, moved = '' }) {
-  const packet = assemblePacket({ diff, lens: 'recheck', cfg, contextMode, rulesDigest, factsExcerpt, moved });
+export function buildRecheckPacket({ diff, open, cfg, contextMode = 'recheck', rulesDigest, factsExcerpt, moved = '', paired = '' }) {
+  const packet = assemblePacket({ diff, lens: 'recheck', cfg, contextMode, rulesDigest, factsExcerpt, moved, paired });
   if (packet.status !== 'ok') return packet;
   const text = `${packet.text}${openFindingsText(open)}`;
   return { ...packet, text, tokensIn: packet.tokensIn + Math.ceil(Buffer.byteLength(text.slice(packet.text.length)) / 4) };
@@ -436,12 +440,21 @@ export function insideHunks(f, hunks) {
  * (`schema-fallback.mjs`; rechecks and the patch_check alike).
  * @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string}} packet
  * @param {LoopDeps} deps
+ * @param {ReadonlyArray<Finding>} open - only the findings listed in this packet.
  */
-async function recheckSession(packet, deps) {
+async function recheckSession(packet, deps, open) {
   mkdirSync(deps.workDir, { recursive: true, mode: 0o700 });
   const promptPath = path.join(deps.workDir, `recheck-${randomBytes(6).toString('hex')}.md`);
   writeFileSync(promptPath, packet.text, { mode: 0o600 });
   const min = minTokensOut(deps.cfg);
+  /** @param {Record<string, any> | null} result @returns {import('./validate-review.mjs').Verdict} */
+  const validate = (result) => {
+    const verdict = validateReview(result, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    if (!verdict.ok) return verdict;
+    const ids = new Set((verdict.review?.resolved ?? []).map((/** @type {{id: string}} */ entry) => entry.id));
+    if (open.some((finding) => !ids.has(finding.id))) return { ok: false, reason: 'schema', detail: 'resolved does not cover the packet open findings' };
+    return verdict;
+  };
   const session = { lens: 'recheck', role: 'reviewer', level: 'L2' };
   // no ledger writer ⇒ nothing logged, nothing tried; every row goes through the same writer
   // (each helper handles its own failed write)
@@ -485,7 +498,7 @@ async function recheckSession(packet, deps) {
     } catch {
       res = null; // the helper never throws; if it ever did, it is still an `exit` failure
     }
-    verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    verdict = validate(res);
     if (first?.to) {
       // B91: a timed-out attempt was the packet's second broken result; the second level ran. The
       // verdict is already set: whatever throws after it leaves that verdict, never an exception
@@ -510,7 +523,7 @@ async function recheckSession(packet, deps) {
         const second = await tryNext(res, 'schema');
         if (second) {
           // compute everything first, then assign together, so a throw never leaves a mixed state
-          const secondVerdict = validateReview(second.res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+          const secondVerdict = validate(second.res);
           const sumIn = sum(tokensIn, second.res?.usage?.tokens_in);
           const sumOut = sum(tokensOut, second.res?.usage?.tokens_out);
           res = second.res;
@@ -664,6 +677,11 @@ export async function runRound(state, deps, opts = {}) {
       s.scope === 'file'
         ? await readFileDiff({ repoRoot: deps.repoRoot, file: current.rel, base: deps.base ?? null })
         : await fixHunkDiff({ file: current.rel, previous: state.reviewed_content ?? '', current: current.content, workDir: deps.workDir });
+    if (kind === 'recheck' && (current.content === state.reviewed_content || diff.hunks.length === 0)) {
+      state.next = { action: 'fix', level: state.level, trigger: null, reason: 'no-fix-hunks' };
+      state.pending_kind = null;
+      return state;
+    }
     if (diff.hunks.length > 0) {
       /** @type {Finding[]} */
       const pending = [];
@@ -676,7 +694,8 @@ export async function runRound(state, deps, opts = {}) {
       if (pending.length > 0) {
         const contextMode = s.scope === 'file' ? 'auto' : 'recheck';
         const moves = await recheckMoves(deps, current.rel, s.scope === 'file' ? diff : null);
-        const whole = buildRecheckPacket({ diff, open: pending, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved: movedText(moves, diff.content, null) });
+        const paired = pairedContext({ ...deps, file: current.rel });
+        const whole = buildRecheckPacket({ diff, open: pending, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved: movedText(moves, diff.content, null), paired });
         /** @type {Array<{index: number | null, heading: string | null, diff: import('./packet.mjs').FileDiff, open: Finding[], keys: number[] | null}>} */
         let parts = [{ index: null, heading: null, diff, open: pending, keys: null }];
         if (whole.status !== 'ok') {
@@ -697,7 +716,7 @@ export async function runRound(state, deps, opts = {}) {
             continue;
           }
           const moved = movedText(moves, diff.content, part.keys);
-          const packet = buildRecheckPacket({ diff: part.diff, open: part.open, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved });
+          const packet = buildRecheckPacket({ diff: part.diff, open: part.open, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved, paired });
           // a packet that fails to build stops with ITS status (and size, when it has one)
           if (packet.status !== 'ok') return stopBeforeRound(state, deps, kind, current.rel, { ...packet, section: part.heading });
           const size = recheckTokens(part.diff, part.open, moved);
@@ -713,7 +732,7 @@ export async function runRound(state, deps, opts = {}) {
         for (const [i, part] of parts.entries()) {
           const packet = /** @type {any} */ (built[i]);
           packetInfo = mergePacketInfo(packetInfo, packet);
-          const session = await recheckSession(packet, deps);
+          const session = await recheckSession(packet, deps, part.open);
           tokensIn = sum(tokensIn, session.tokens_in);
           tokensOut = sum(tokensOut, session.tokens_out);
           if (!session.verdict.ok) {
@@ -743,7 +762,7 @@ export async function runRound(state, deps, opts = {}) {
         draft.open = [...stillOpen, ...triaged.fix_now, ...blocking];
       }
     }
-    // no fix hunks (the content did not change): nothing closes — the round stalls
+    // A patch_check with no fix hunks closed nothing: B73 still stops it.
   }
 
   if (kind !== 'patch_check') {
@@ -828,6 +847,7 @@ export async function converge(state, deps) {
     }
     await deps.fix?.({ file: state.file, round: state.round + 1, level: state.level, open: [...state.open], l3_patch: state.l3_rung_used });
     await runRound(state, deps);
+    if (state.next?.reason === 'no-fix-hunks') return state;
   }
   return state;
 }

package/src/review/lenses/A.md

@@ -14,6 +14,7 @@ You work blind: you do not see the other reviewer's answer.
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/B.md

@@ -15,6 +15,7 @@ You work blind: you do not see the other reviewer's answer.
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/full.md

@@ -15,6 +15,7 @@ Report each real defect once, at the lines where it lives.
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/recheck.md

@@ -18,6 +18,7 @@ that changed since that round, each with a window of the current file around it.
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order.
 - Answer with ONE JSON object that matches the answer schema.