@codedology/code-forge 0.10.0 → 0.12.0

package/src/gates/expand.mjs

@@ -1,6 +1,7 @@
 /**
  * B60 (issue #13 item 3): run only the block's related tests, and give a gate its own environment.
- * Pure — no filesystem, no child process. A gate argv item that is EXACTLY {@link TEST_FILES_TOKEN}
+ * Scope and argv rules are pure; B99's fileBaseline reads bounded hashes from the workspace.
+ * A gate argv item that is EXACTLY {@link TEST_FILES_TOKEN}
  * (one whole item, never a substring, never a shell string) stands for the block's test files:
  *
  *  - the block's `test_files` (`block open --tests`), else its owned entries that are concrete
@@ -20,8 +21,14 @@
  * `CI=1` or `MODE=test` would otherwise mask unrelated text (`npm test`).
  */
 
-import { isExactEntry } from '../state/registry.mjs';
-import { TEST_FILES_TOKEN } from '../util/gate-token.mjs';
+import { createHash } from 'node:crypto';
+import { access, lstat, readFile, realpath } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { isExactEntry, ownsFile } from '../state/registry.mjs';
+import { pairsFor } from '../review/paired.mjs';
+import { exec } from '../util/exec.mjs';
+import { TEST_FILES_TOKEN, CHANGED_FILES_TOKEN } from '../util/gate-token.mjs';
 
 export { TEST_FILES_TOKEN };
 
@@ -67,6 +74,7 @@ const isConcreteFile = (p) => typeof p === 'string' && p.length > 0 && isExactEn
 
 /**
  * @typedef {{scope: 'related', files: string[]} | {scope: 'full', reason: 'threshold' | 'no_tests'}} TestScope
+ * @typedef {{scope: 'changed', files: string[], changedFiles: string[], reason?: 'no_baseline'|'unpaired'|'threshold'|'no_changes'}} ChangedScope
  */
 
 /** A gate run with no block: no test file is known. */
@@ -108,30 +116,115 @@ export function hasTestFilesItem(gates) {
   return Object.values(gates ?? {}).some((command) => argvOf(command)?.includes(TEST_FILES_TOKEN) === true);
 }
 
+/** @param {Record<string, unknown> | null | undefined} gates @returns {boolean} */
+export function hasScopeItem(gates) {
+  return hasTestFilesItem(gates) || Object.values(gates ?? {}).some((command) => argvOf(command)?.includes(CHANGED_FILES_TOKEN));
+}
+
+/** A safe repo-relative path that cannot turn into an argv option. @param {string} file */
+function safeFile(file) {
+  return file.length > 0 && !file.startsWith('-') && !path.isAbsolute(file) && !/[\\\x00-\x1f]/.test(file) && !file.split('/').some((s) => s === '' || s === '.' || s === '..');
+}
+
+/**
+ * Bounded content baseline. Missing listed files are omitted from hashes and candidates; an
+ * owned entry with no current file has no hash. More than 200 owned files, a symlink, a
+ * non-regular owned file, a path outside the root or another read error means no record;
+ * callers retain the old scope. Git sees only argv and an isolated git environment.
+ * @param {string} cwd @param {string[]} owned @param {Record<string, string>} [kinds]
+ * @returns {Promise<{files: Record<string, string>, candidates: string[]} | null>}
+ */
+export async function fileBaseline(cwd, owned, kinds) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_')));
+  env.GIT_CONFIG_NOSYSTEM = '1';
+  env.GIT_CONFIG_GLOBAL = os.devNull;
+  const listed = await exec(['git', 'ls-files', '-z', '--cached', '--others', '--exclude-standard'], { cwd, env, timeoutMs: 30000 });
+  if (listed.result !== 'ok') return null;
+  const listedFiles = [...new Set(listed.stdout.split('\0').filter(Boolean))].sort();
+  const candidates = [];
+  const files = /** @type {Record<string, string>} */ (Object.create(null));
+  try {
+    const root = await realpath(cwd);
+    for (const file of listedFiles) {
+      const isOwned = ownsFile(owned, file, kinds);
+      if (isOwned && !safeFile(file)) return null;
+      const absolute = path.join(root, file);
+      if (!isOwned) {
+        const exists = await access(absolute).then(() => true).catch((error) => {
+          if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return false;
+          throw error;
+        });
+        if (exists) candidates.push(file);
+        continue;
+      }
+      const stat = await lstat(absolute).catch((error) => {
+        if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return null;
+        throw error;
+      });
+      if (stat === null) continue;
+      candidates.push(file);
+      if (Object.keys(files).length >= 200 || !stat.isFile() || !(await realpath(absolute)).startsWith(root + path.sep)) return null;
+      files[file] = createHash('sha256').update(await readFile(absolute)).digest('hex');
+    }
+  } catch { return null; }
+  return { files, candidates };
+}
+
+/**
+ * Compare the last green record. A source without a stem pair cannot narrow the test gate.
+ * @param {{baseline: unknown, current: Awaited<ReturnType<typeof fileBaseline>>, fallback: TestScope, threshold?: number, owned?: string[], kinds?: Record<string, string>}} opts
+ * @returns {ChangedScope}
+ */
+export function changedScope({ baseline, current, fallback, threshold = DEFAULT_FULL_SUITE_THRESHOLD, owned, kinds }) {
+  const old = /** @type {Record<string, string> | null} */ (baseline);
+  const candidates = new Set(current?.candidates);
+  const fallbackFiles = fallback.scope === 'related' ? fallback.files.filter((file) => !current || candidates.has(file)) : [];
+  if (!current || !old || typeof old !== 'object' || Array.isArray(old) || Object.keys(old).length > 200 ||
+      Object.entries(old).some(([file, hash]) => !safeFile(file) || (owned && !ownsFile(owned, file, kinds)) || typeof hash !== 'string' || !/^[a-f0-9]{64}$/.test(hash))) {
+    return { scope: 'changed', files: fallbackFiles, changedFiles: [], reason: 'no_baseline' };
+  }
+  const changes = [...new Set([...Object.keys(old), ...Object.keys(current.files)])].filter((file) => old[file] !== current.files[file]).sort();
+  if (changes.length > threshold) return { scope: 'changed', files: [], changedFiles: [], reason: 'threshold' };
+  const changedFiles = changes.filter((file) => candidates.has(file));
+  // B97 also pairs Swift Tests names outside lowercase test directories.
+  const isChangedTest = (/** @type {string} */ file) => isTestPath(file) || file.endsWith('Tests.swift');
+  const tests = new Set(changedFiles.filter(isChangedTest));
+  for (const file of changes.filter((f) => !isChangedTest(f))) {
+    const pairs = pairsFor(file, current.candidates).filter(isChangedTest);
+    if (pairs.length === 0) return { scope: 'changed', files: fallbackFiles, changedFiles, reason: 'unpaired' };
+    for (const paired of pairs) tests.add(paired);
+  }
+  if (tests.size === 0) return { scope: 'changed', files: fallbackFiles, changedFiles, reason: 'no_changes' };
+  return { scope: 'changed', files: [...tests].sort(), changedFiles };
+}
+
 /**
  * One gate argv with every item that is exactly {@link TEST_FILES_TOKEN} replaced by the related
  * test files, or dropped for a full run. Always a new array; `scoped` is false (and the items
  * unchanged) when the gate has no such item.
- * @param {ReadonlyArray<string>} argv @param {TestScope} scope
+ * @param {ReadonlyArray<string>} argv @param {TestScope | ChangedScope} scope
  * @returns {{argv: string[], scoped: boolean}}
  * @throws {TypeError} a test path that starts with `-` (it would be read as an option; `block
  *   open --tests` refuses one too).
  */
 export function expandArgv(argv, scope) {
-  if (!argv.includes(TEST_FILES_TOKEN)) return { argv: [...argv], scoped: false };
-  const files = scope.scope === 'related' ? scope.files : [];
+  if (!argv.includes(TEST_FILES_TOKEN) && !argv.includes(CHANGED_FILES_TOKEN)) return { argv: [...argv], scoped: false };
+  const files = scope.scope === 'full' ? [] : scope.files;
+  const changed = scope.scope === 'changed' ? scope.changedFiles : [];
+  if (changed.some((file) => !safeFile(file))) throw new TypeError('expandArgv: unsafe changed path');
   const dashed = files.find((f) => f.startsWith('-'));
   if (dashed !== undefined) throw new TypeError(`expandArgv: test path ${JSON.stringify(dashed)} starts with "-"`);
-  return { argv: argv.flatMap((item) => (item === TEST_FILES_TOKEN ? files : [item])), scoped: true };
+  return { argv: argv.flatMap((item) => item === TEST_FILES_TOKEN ? files : item === CHANGED_FILES_TOKEN ? changed : [item]), scoped: true };
 }
 
 /**
  * The fields a scoped gate's result and ledger row carry: `scope`, plus `test_count` when related
  * or `reason` when full.
- * @param {TestScope} scope
- * @returns {{scope: 'related', test_count: number} | {scope: 'full', reason: 'threshold' | 'no_tests'}}
+ * @param {TestScope | ChangedScope} scope
+ * @returns {{scope: 'changed', test_count: number, reason?: 'no_baseline'|'unpaired'|'threshold'|'no_changes'} | {scope: 'related', test_count: number} | {scope: 'full', reason: 'threshold'|'no_tests'}}
  */
 export function scopeFields(scope) {
+  if (scope.scope === 'changed') return { scope: 'changed', test_count: scope.files.length, ...(scope.reason ? { reason: scope.reason } : {}) };
   return scope.scope === 'related' ? { scope: 'related', test_count: scope.files.length } : { scope: 'full', reason: scope.reason };
 }
 

package/src/gates/run.mjs

@@ -8,6 +8,7 @@
 
 import { exec } from '../util/exec.mjs';
 import { registerSecret } from '../util/redact.mjs';
+import { CHANGED_FILES_TOKEN } from '../util/gate-token.mjs';
 import { NO_BLOCK_SCOPE, envOf, expandArgv, maskableEnvValues, scopeFields } from './expand.mjs';
 
 /** @typedef {import('./detect.mjs').Gate} Gate */
@@ -25,9 +26,9 @@ import { NO_BLOCK_SCOPE, envOf, expandArgv, maskableEnvValues, scopeFields } fro
  * @property {number | null} code
  * @property {string} stdout
  * @property {string} stderr
- * @property {'related'|'full'} [scope] - B60: only on a gate whose argv has the `{test_files}` item.
+ * @property {'related'|'full'|'changed'} [scope] - only on a gate with a scope token.
  * @property {number} [test_count] - B60: with `scope: related`, how many test files it ran.
- * @property {'threshold'|'no_tests'} [reason] - B60: with `scope: full`, why the item was dropped.
+ * @property {'threshold'|'no_tests'|'no_baseline'|'unpaired'|'no_changes'} [reason] - why narrowing fell back.
  * @property {string[]} [env_keys] - B60: only on a gate given with a non-empty `env`: the variable
  *   NAMES, sorted (the values are never in a result).
  */
@@ -53,7 +54,7 @@ function normalizeCommand(command) {
  * no test file is known (`scope: full, reason: no_tests`). A gate with `env` runs with those
  * variables added to the inherited environment; a gate with neither runs exactly as before B60.
  * @param {{test?: Gate, lint?: Gate, types?: Gate, format?: Gate}} gates
- * @param {{cwd: string, timeoutMs?: number, scope?: TestScope}} opts
+ * @param {{cwd: string, timeoutMs?: number, scope?: TestScope | import('./expand.mjs').ChangedScope}} opts
  * @returns {Promise<{results: GateResult[], allOk: boolean}>}
  */
 export async function runGates(gates, opts) {
@@ -77,8 +78,9 @@ export async function runGates(gates, opts) {
     const command = gates[gate] ?? null;
     if (command === null) return { gate, command: null };
     const normalized = normalizeCommand(command);
+    if (normalized.argv[0] === CHANGED_FILES_TOKEN) throw new TypeError(`gates.${gate}: '{changed_files}' cannot be the command (argv[0])`);
     const { argv, scoped } = expandArgv(normalized.argv, scope);
-    if (argv.length === 0 && normalized.argv.length > 0) throw new TypeError(`gates.${gate}: the argv is empty once '{test_files}' is dropped for the full suite — put the test command before it`);
+    if (argv.length === 0 && normalized.argv.length > 0) throw new TypeError(`gates.${gate}: the argv is empty once ${normalized.argv.map((item) => `'${item}'`).join(' and ')} is dropped for the full suite — put the test command before it`);
     return { gate, command: { argv, scoped, failOnStdout: normalized.failOnStdout, env: normalized.env } };
   });
   /** @type {GateResult[]} */

package/src/install/wizard/flags.mjs

@@ -3,7 +3,7 @@
  * wizard answer (`ANSWER_FLAGS` maps flag -> answer key); `--no-interaction` is a mode switch and
  * overrides no answer.
  *
- * **Q16 = cut (Ricardo, 2026-09-25):** step 8 asks no mutation-tool or nightly question, so the
+ * **Q16 = cut (the owner, 2026-09-25):** step 8 asks no mutation-tool or nightly question, so the
  * v1.2 `--no-nightly` flag is gone and `--proof` takes only the keys the schema still has
  * (`isolation`, `high`, `link_dirs`, `copy_untracked`). With `-g` and `-p` counted as two flags
  * (two tokens that each set the scope answer) there are 21 answer flags: B65 added

package/src/proof/lock.mjs

@@ -16,7 +16,8 @@
  * with `isolation: lock` through the B6 writer.
  */
 
-import { hasTestFilesItem, testScope } from '../gates/expand.mjs';
+import { changedScope, fileBaseline, hasScopeItem, testScope } from '../gates/expand.mjs';
+import { readAllRows } from '../ledger/write.mjs';
 import { ownedFileCount } from '../gates/owned-count.mjs';
 import { runGates } from '../gates/run.mjs';
 import { StateError } from '../state/paths.mjs';
@@ -139,23 +140,35 @@ export async function withGateSlot({ runId, blockId, fn, pid = process.pid }) {
  * run record once the slot is taken). The full suite runs instead when the block owns more than
  * `threshold` (`gates.full_suite_threshold_files`) files, or when no test file is known. The
  * owned files are counted by `ownedFileCount` over the tracked and new (not ignored) files at
- * `cwd`. Gates with no `{test_files}` item run exactly as before B60: the run record is not read
- * and nothing is counted.
- * @param {{runId: string, blockId: string, gates: Parameters<typeof runGates>[0], cwd: string, timeoutMs?: number, threshold?: number}} opts
+ * `cwd`. Plain gates without --changed retain the old path. B99 records bounded owned hashes
+ * after green scoped runs; --changed uses the last green record and B97's stem pairs.
+ * @param {{runId: string, blockId: string, gates: Parameters<typeof runGates>[0], cwd: string, timeoutMs?: number, threshold?: number, changed?: boolean, slug?: string}} opts
  */
-export async function runGatesGuarded({ runId, blockId, gates, cwd, timeoutMs, threshold }) {
+export async function runGatesGuarded({ runId, blockId, gates, cwd, timeoutMs, threshold, changed = false, slug }) {
   return withGateSlot({
     runId,
     blockId,
     fn: async () => {
-      // plain gates (no `{test_files}` item) run exactly as before B60: no scope is worked out
-      if (!hasTestFilesItem(gates)) return runGates(gates, { cwd, ...(timeoutMs ? { timeoutMs } : {}) });
+      // Plain gates without --changed need no scope or baseline.
+      if (!hasScopeItem(gates) && !changed) return runGates(gates, { cwd, ...(timeoutMs ? { timeoutMs } : {}) });
       // the slot checked the block is open; it may still be gone by the time it is read again
-      const block = (await readRun(runId)).blocks?.[blockId];
+      const record = await readRun(runId);
+      const block = record.blocks?.[blockId];
       if (!block) throw new StateError('no-block', `block ${blockId} is not in run ${runId}`);
       const ownedFiles = await ownedFileCount(cwd, block.owned_files, block.owned_kinds);
-      const scope = testScope({ testFiles: block.test_files, owned: block.owned_files, ownedFiles, ...(threshold === undefined ? {} : { threshold }) });
-      return runGates(gates, { cwd, ...(timeoutMs ? { timeoutMs } : {}), scope });
+      const fallback = testScope({ testFiles: block.test_files, owned: block.owned_files, ownedFiles, ...(threshold === undefined ? {} : { threshold }) });
+      const current = await fileBaseline(cwd, block.owned_files, block.owned_kinds);
+      let baseline;
+      if (changed) {
+        const rows = await readAllRows(slug ?? record.project);
+        baseline = rows.filter((row) => row.event === 'gate.done' && row.run === runId && row.block === blockId && row.all_ok === true && row.worktree === block.worktree?.path).at(-1)?.files;
+      }
+      const scope = changed ? changedScope({ baseline, current, fallback, owned: block.owned_files, kinds: block.owned_kinds, ...(threshold === undefined ? {} : { threshold }) }) : fallback;
+      const ran = await runGates(gates, { cwd, ...(timeoutMs ? { timeoutMs } : {}), scope });
+      // A command that changed an input did not measure the resulting bytes. Do not baseline it.
+      const after = ran.allOk && current ? await fileBaseline(cwd, block.owned_files, block.owned_kinds) : null;
+      const files = after && JSON.stringify(current?.files) === JSON.stringify(after.files) ? after.files : undefined;
+      return { ...ran, ledger_slug: slug ?? record.project, ...(files ? { files } : {}), ...(changed ? { changed_scope: scope } : {}) };
     },
   });
 }

package/src/proof/rule.mjs

@@ -0,0 +1,9 @@
+/** The built-in proof rule carried by every coder context pack. */
+export const PROOF_RULE = [
+  "## proof rule (code-forge)",
+  "- Red→green: each new or changed test must FAIL on the old code first (red), then PASS on the new code (green). A red caused by an import, compile or crash error proves nothing; the red must be an assertion failure. `code-forge proof red-green` does this with the block's base code.",
+  "- No hand mutations. Do not break the code on purpose to test the tests. Red→green is the proof.",
+  "- One exact test per acceptance clause, plus one negative or boundary test where the clause can fail. Assertions say which element and how many, never only \"it exists\".",
+  "- Proof scales with risk: a light-tier file needs red→green per new test; a high-tier file must have it at the gate. Do not add tests, mutants, layers, options or abstractions that the acceptance does not ask for.",
+  "- A weak assertion is fixed by a stronger assertion, not by more tests or mutants.",
+].join('\n');

package/src/proof/tiers.mjs

@@ -5,9 +5,8 @@
  *   high  ⇐ risk ≥ 2, or the path matches `proof.tiers.high.paths`, or `security_sensitive`
  *   light ⇐ everything else (the review-depth band `1 ≤ risk < 2` does NOT raise the proof tier)
  *
- * The light tier's proof is red→green (B10b). The high tier's extra proof — tool-made mutants on
- * changed lines — is held on Q16 (block B10c), so `proofRequirements('high')` reports it as
- * `held` and the gate enforces red→green only until Ricardo answers. Pure: no I/O.
+ * The light tier needs red→green per new or changed test. The high tier must have red→green
+ * at the gate. Mutation testing was cut by the owner (Q16). Pure: no I/O.
  */
 
 import { ownsFile } from '../state/registry.mjs';
@@ -50,14 +49,3 @@ export function blockTier(fileTiers) {
   if (!Array.isArray(fileTiers)) throw new TypeError('blockTier: fileTiers must be an array');
   return fileTiers.some((t) => t?.tier === 'high') ? 'high' : 'light';
 }
-
-/**
- * What the gate requires for a tier. `mutants: 'held'` = the high tier's mutation proof is
- * specified but not enforced until Q16 is answered (B10c).
- * @param {Tier} tier
- * @returns {{red_green: true, mutants: 'none' | 'held'}}
- */
-export function proofRequirements(tier) {
-  if (!TIERS.includes(tier)) throw new TypeError(`proofRequirements: tier must be one of ${TIERS.join(', ')}`);
-  return { red_green: true, mutants: tier === 'high' ? 'held' : 'none' };
-}

package/src/review/engine.mjs

@@ -29,7 +29,8 @@
  *     The summary then carries `schema_fallback: {level, provider, model}` (`level`:
  *     `review.second_levels.<level>`), the second level's own provider/model, and `tokens_in` /
  *     `tokens_out` summed over both sessions;
- *  7. a diff alone over the packet budget is `split_required` (with `tokens_in` and `budget`) —
+ *  7. a non-Markdown quick packet over budget first steps up to one full L2 session (B109).
+ *     A diff alone still over the packet budget is `split_required` (with `tokens_in` and `budget`) —
  *     except a Markdown file (B54), which is reviewed SECTION BY SECTION (`sections.mjs`): every
  *     section packet runs the whole plan above (its own sessions, judge and stub guard, its own
  *     `review.plan` row with `section`), in file order, stopping at the first one that is not
@@ -64,15 +65,17 @@ import { blockKind, isDocsKind } from '../decide/escalation.mjs';
 import { fallbackRisk } from '../decide/fallback-rules.mjs';
 import { isMigrationPath, isPolicyPath } from '../decide/lane-facts.mjs';
 import { tierFor } from '../proof/tiers.mjs';
-import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, readFileDiff } from './packet.mjs';
+import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, isSecretLike, readFileDiff } from './packet.mjs';
 import { movedText, movesFor, peerDiffReader } from './moved.mjs';
 import { deletionNote, renderDeletionNote } from './deletion.mjs';
 import { testQualityNote } from './test-quality.mjs';
+import { pairsFor, summarize } from './paired.mjs';
+import { redact } from '../util/redact.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups } from './sections.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
 import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallback.mjs';
-import { assertRowPath } from '../worker/ticket.mjs';
+import { assertRowPath, readRegularFileNoFollow } from '../worker/ticket.mjs';
 
 /**
  * @typedef {{lens: 'quick' | 'full' | 'A' | 'B' | 'judge', role: 'reviewer' | 'judge', level: 'L2' | 'L3', slot: 'A' | 'B' | null, cfg?: Record<string, any>}} SessionSpec -
@@ -185,6 +188,9 @@ export function rulesRisk({ file, plusCount, cfg }) {
  *   code moved between this file and one of them is named in every packet (`## moved code`).
  * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader
  *   of those files' diffs (`peerDiffReader`), shared by the caller across the round; wins over `peers`.
+ * @property {ReadonlyArray<string>} [ownedFiles] - concrete paths owned by this block.
+ * @property {ReadonlyArray<string>} [changedFiles] - concrete changed paths of the same block.
+ * @property {ReadonlyArray<string>} [testFiles] - the block's explicit test_files, regardless of stem.
  */
 
 /**
@@ -224,6 +230,31 @@ function safeNeeds(needs) {
   }
 }
 
+/**
+ * B98: names only, from owned changed peers and explicit tests in the reviewed tree.
+ * Missing, unsafe or unreadable pairs give no hint, never a failed review.
+ * @param {{repoRoot: string, file: string, peers?: ReadonlyArray<string>, ownedFiles?: ReadonlyArray<string>, changedFiles?: ReadonlyArray<string>, testFiles?: ReadonlyArray<string>}} input
+ * @returns {string}
+ */
+export function pairedContext({ repoRoot, file, peers = [], ownedFiles = [], changedFiles = peers, testFiles = [] }) {
+  if (ownedFiles.length === 0) return '';
+  const owned = new Set(ownedFiles);
+  const candidates = [...new Set([...pairsFor(file, changedFiles), ...testFiles])].filter((p) => p !== file && owned.has(p));
+  const lines = [];
+  for (const candidate of candidates) {
+    try {
+      const rel = assertRowPath(candidate);
+      if (isSecretLike(rel)) continue;
+      const bytes = readRegularFileNoFollow(repoRoot, rel);
+      if (bytes === null) continue;
+      lines.push(`- ${redact(rel)}`, ...summarize(bytes.toString('utf8'), rel).map((name) => `  - ${name}`));
+    } catch {
+      // The summary is optional; never follow a symlink or substitute another file.
+    }
+  }
+  return lines.join('\n');
+}
+
 /**
  * @param {ReviewInput} input @param {ReviewDeps} deps
  * @returns {Promise<{status: string, approved: boolean, engine: string, sessions: Array<Record<string, any>>} & Record<string, any>>}
@@ -234,8 +265,8 @@ export async function reviewFile(input, deps) {
   const risk = input.risk ?? rulesRisk({ file: diff.file, plusCount: diff.plusCount, cfg });
   // no recorded kind ⇒ the reviewed file's own kind (a lone `.md` is a docs review), never a blind `code`
   const kind = typeof input.kind === 'string' ? input.kind : blockKind({ owned: [diff.file] });
-  const plan = planSessions({ risk, cfg, kind });
-  const head = { engine: plan.mode, depth: plan.depth, risk, file: diff.file };
+  let plan = planSessions({ risk, cfg, kind });
+  let head = { engine: plan.mode, depth: plan.depth, risk, file: diff.file };
   if (plan.refused) return { status: 'refused', reason: plan.refused, approved: false, ...head, sessions: [] };
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
@@ -265,6 +296,7 @@ export async function reviewFile(input, deps) {
   // B92: a test that reads a source file and asserts on its text gets the `## test-quality` hint
   // (line numbers only), read once from the current content; '' for none
   const quality = testQualityNote(diff.file, diff.content);
+  const paired = pairedContext(input);
   /** @param {ReadonlyArray<number> | null} keys - a Markdown section's group keys; null ⇒ the whole file. */
   const movedOf = (keys) => [deleted, movedText(moves, diff.content, keys), quality].filter((t) => typeof t === 'string' && t.length > 0).join('\n');
   const min = minTokensOut(cfg);
@@ -280,7 +312,7 @@ export async function reviewFile(input, deps) {
       const paths = safeNeeds(needs);
       let extra = null;
       try {
-        extra = paths ? await attachFiles({ repoRoot, paths, budgetTokens: budgetFor(cfg, 'full_in') }) : null;
+        extra = paths ? await attachFiles({ repoRoot, paths, budgetTokens: budgetFor(cfg, 'full_in'), ownedFiles: input.ownedFiles, changedFiles: input.changedFiles ?? input.peers ?? [] }) : null;
       } catch {
         extra = null;
       }
@@ -290,10 +322,10 @@ export async function reviewFile(input, deps) {
     return summary;
   };
 
-  const reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
-  const judgeSpec = plan.sessions.find((s) => s.role === 'judge');
+  let reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
+  let judgeSpec = plan.sessions.find((s) => s.role === 'judge');
   /** @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<number> | null} [keys] */
-  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys) }));
+  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys), paired }));
 
   /**
    * The plan on one packet set (the whole file, or one Markdown section): reviewers, then the judge.
@@ -327,10 +359,25 @@ export async function reviewFile(input, deps) {
     return { status: 'reviewed', approved, summary: final.review.summary, findings, sessions };
   };
 
-  const packets = packetsFor(diff);
-  const split = /** @type {{status: 'split_required', tokensIn: number, budget: number} | undefined} */ (packets.find((p) => p.status === 'split_required'));
+  let packets = packetsFor(diff);
+  let split = /** @type {{status: 'split_required', tokensIn: number, budget: number} | undefined} */ (packets.find((p) => p.status === 'split_required'));
+  /** @type {Record<string, any>} */
+  let stepUp = {};
+  if (split && plan.depth === 'quick' && !isMarkdownFile(diff.file)) {
+    const full = planSessions({ risk: 1, cfg, kind });
+    // A configured consensus/refusal is not the single full session this step permits.
+    if (full.depth === 'full') {
+      stepUp = { step_up: { from: 'quick', tokens_in: split.tokensIn, budget: split.budget } };
+      plan = full;
+      head = { ...head, engine: plan.mode, depth: plan.depth };
+      reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
+      judgeSpec = plan.sessions.find((s) => s.role === 'judge');
+      packets = packetsFor(diff);
+      split = /** @type {typeof split} */ (packets.find((p) => p.status === 'split_required'));
+    }
+  }
   if (!split) {
-    const { status, reason, approved, summary, findings, sessions } = await reviewPart(diff, packets);
+    const { status, reason, approved, summary, findings, sessions } = await reviewPart(diff, packets, stepUp);
     if (status !== 'reviewed') return { status, reason, approved: false, ...head, sessions };
     return { status, approved, ...head, summary, findings, sessions };
   }

package/src/review/fixloop.mjs

@@ -93,6 +93,7 @@ import { contentHash, gitChildEnv } from '../worker/ticket.mjs';
 import { parseDiff } from './context.mjs';
 import { assemblePacket, assertPacketPath, diffOnlyTokens, readFileDiff } from './packet.mjs';
 import { movedText, movesFor, peerDiffReader } from './moved.mjs';
+import { pairedContext } from './engine.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups, sectionOf } from './sections.mjs';
 import { cameFromJudge, resolvedBand, triageFindings } from './triage.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
@@ -125,6 +126,7 @@ import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallba
  * @property {string | null} reviewed_content - the content the last counted round reviewed.
  * @property {boolean} l3_rung_used - the block's L3 rung (rule 5 or 6) was used — once per block.
  * @property {'open' | 'complete' | 'stopped'} status
+ * @property {string} [stop_content_hash] - bytes reviewed by a stop (absent in legacy states).
  * @property {NextStep | null} next
  * @property {{context_mode: string, context_lines: number} | null} [last_packet] - the last recheck round's context: one packet's, or over a Markdown recheck's section packets the summed lines and the one mode they share, else `mixed` (B54).
  * @property {'full' | 'recheck' | 'patch_check' | null} [pending_kind] - the round to re-run after a `retry`.
@@ -144,6 +146,9 @@ import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallba
  * @property {(req: {file: string, level: 'L3', open: Finding[]}) => Promise<unknown>} [patch] - the L3 patch rung (≤ 80 lines, owned files only).
  * @property {string | null} [base] - the block base (`recheck_scope: file`, and the B56 moved-code diff).
  * @property {ReadonlyArray<string>} [peers] - B56: the block's other changed files (moved-code hints).
+ * @property {ReadonlyArray<string>} [ownedFiles] - concrete paths owned by this block.
+ * @property {ReadonlyArray<string>} [changedFiles] - concrete changed paths of the same block.
+ * @property {ReadonlyArray<string>} [testFiles] - the block's explicit test_files.
  * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader of their diffs (`peerDiffReader`); wins over `peers`.
  * @property {string} [rulesDigest] @property {string} [factsExcerpt]
  * @property {number} [extraRounds] - B47: rounds past `review.max_rounds_per_file` granted by autopilot (`extraRoundsFor`).
@@ -362,11 +367,11 @@ export function recheckTokens(diff, open, moved = '') {
 /**
  * The recheck packet: the `recheck` lens on the fix hunks (hunk form, never the whole file), then
  * the open findings by id. Over budget ⇒ `minimal` (see the module doc).
- * @param {{diff: import('./packet.mjs').FileDiff, open: Finding[], cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', rulesDigest?: string, factsExcerpt?: string, moved?: string}} opts -
+ * @param {{diff: import('./packet.mjs').FileDiff, open: Finding[], cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', rulesDigest?: string, factsExcerpt?: string, moved?: string, paired?: string}} opts -
  *   `moved`: the file's `## moved code` section (B56), '' for none.
  */
-export function buildRecheckPacket({ diff, open, cfg, contextMode = 'recheck', rulesDigest, factsExcerpt, moved = '' }) {
-  const packet = assemblePacket({ diff, lens: 'recheck', cfg, contextMode, rulesDigest, factsExcerpt, moved });
+export function buildRecheckPacket({ diff, open, cfg, contextMode = 'recheck', rulesDigest, factsExcerpt, moved = '', paired = '' }) {
+  const packet = assemblePacket({ diff, lens: 'recheck', cfg, contextMode, rulesDigest, factsExcerpt, moved, paired });
   if (packet.status !== 'ok') return packet;
   const text = `${packet.text}${openFindingsText(open)}`;
   return { ...packet, text, tokensIn: packet.tokensIn + Math.ceil(Buffer.byteLength(text.slice(packet.text.length)) / 4) };
@@ -436,12 +441,21 @@ export function insideHunks(f, hunks) {
  * (`schema-fallback.mjs`; rechecks and the patch_check alike).
  * @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string}} packet
  * @param {LoopDeps} deps
+ * @param {ReadonlyArray<Finding>} open - only the findings listed in this packet.
  */
-async function recheckSession(packet, deps) {
+async function recheckSession(packet, deps, open) {
   mkdirSync(deps.workDir, { recursive: true, mode: 0o700 });
   const promptPath = path.join(deps.workDir, `recheck-${randomBytes(6).toString('hex')}.md`);
   writeFileSync(promptPath, packet.text, { mode: 0o600 });
   const min = minTokensOut(deps.cfg);
+  /** @param {Record<string, any> | null} result @returns {import('./validate-review.mjs').Verdict} */
+  const validate = (result) => {
+    const verdict = validateReview(result, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    if (!verdict.ok) return verdict;
+    const ids = new Set((verdict.review?.resolved ?? []).map((/** @type {{id: string}} */ entry) => entry.id));
+    if (open.some((finding) => !ids.has(finding.id))) return { ok: false, reason: 'schema', detail: 'resolved does not cover the packet open findings' };
+    return verdict;
+  };
   const session = { lens: 'recheck', role: 'reviewer', level: 'L2' };
   // no ledger writer ⇒ nothing logged, nothing tried; every row goes through the same writer
   // (each helper handles its own failed write)
@@ -485,7 +499,7 @@ async function recheckSession(packet, deps) {
     } catch {
       res = null; // the helper never throws; if it ever did, it is still an `exit` failure
     }
-    verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    verdict = validate(res);
     if (first?.to) {
       // B91: a timed-out attempt was the packet's second broken result; the second level ran. The
       // verdict is already set: whatever throws after it leaves that verdict, never an exception
@@ -510,7 +524,7 @@ async function recheckSession(packet, deps) {
         const second = await tryNext(res, 'schema');
         if (second) {
           // compute everything first, then assign together, so a throw never leaves a mixed state
-          const secondVerdict = validateReview(second.res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+          const secondVerdict = validate(second.res);
           const sumIn = sum(tokensIn, second.res?.usage?.tokens_in);
           const sumOut = sum(tokensOut, second.res?.usage?.tokens_out);
           res = second.res;
@@ -607,11 +621,11 @@ function retry(state, kind, reason) {
  * not written, the open set stays as it was, and the gate-relevant `review.cap` row goes through
  * the must-write path — a failed write is a `retry`, never a silent stop.
  * @param {FileState} state @param {LoopDeps} deps
- * @param {'full' | 'recheck' | 'patch_check'} kind @param {string} file
+ * @param {'full' | 'recheck' | 'patch_check'} kind @param {string} file @param {string} contentHash
  * @param {{status: string, tokensIn?: number, budget?: number, section?: string | null}} packet - the non-ok packet (a Markdown section names its heading).
  * @returns {Promise<FileState>}
  */
-async function stopBeforeRound(state, deps, kind, file, packet) {
+async function stopBeforeRound(state, deps, kind, file, contentHash, packet) {
   const reason = packet.status;
   const size =
     typeof packet.tokensIn === 'number' && typeof packet.budget === 'number'
@@ -620,6 +634,7 @@ async function stopBeforeRound(state, deps, kind, file, packet) {
   const row = { event: 'review.cap', file, round: state.round, reason, open: state.open.map((f) => f.id), ...size };
   if (!(await mustNote(deps, row))) return retry(state, kind, 'ledger_write_failed');
   state.status = 'stopped';
+  state.stop_content_hash = contentHash;
   state.next = { action: 'stop', reason, ...size };
   state.pending_kind = null;
   return state;
@@ -664,6 +679,11 @@ export async function runRound(state, deps, opts = {}) {
       s.scope === 'file'
         ? await readFileDiff({ repoRoot: deps.repoRoot, file: current.rel, base: deps.base ?? null })
         : await fixHunkDiff({ file: current.rel, previous: state.reviewed_content ?? '', current: current.content, workDir: deps.workDir });
+    if (kind === 'recheck' && (current.content === state.reviewed_content || diff.hunks.length === 0)) {
+      state.next = { action: 'fix', level: state.level, trigger: null, reason: 'no-fix-hunks' };
+      state.pending_kind = null;
+      return state;
+    }
     if (diff.hunks.length > 0) {
       /** @type {Finding[]} */
       const pending = [];
@@ -676,7 +696,8 @@ export async function runRound(state, deps, opts = {}) {
       if (pending.length > 0) {
         const contextMode = s.scope === 'file' ? 'auto' : 'recheck';
         const moves = await recheckMoves(deps, current.rel, s.scope === 'file' ? diff : null);
-        const whole = buildRecheckPacket({ diff, open: pending, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved: movedText(moves, diff.content, null) });
+        const paired = pairedContext({ ...deps, file: current.rel });
+        const whole = buildRecheckPacket({ diff, open: pending, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved: movedText(moves, diff.content, null), paired });
         /** @type {Array<{index: number | null, heading: string | null, diff: import('./packet.mjs').FileDiff, open: Finding[], keys: number[] | null}>} */
         let parts = [{ index: null, heading: null, diff, open: pending, keys: null }];
         if (whole.status !== 'ok') {
@@ -684,7 +705,7 @@ export async function runRound(state, deps, opts = {}) {
           // a Markdown file whose packet is `split_required`, rechecked section by section (B54);
           // any other status stops as it always did
           const packed = whole.status === 'split_required' && isMarkdownFile(current.rel) ? packRecheck(diff, pending, whole.budget, moves) : null;
-          if (!packed || packed.status !== 'ok') return stopBeforeRound(state, deps, kind, current.rel, packed ?? whole);
+          if (!packed || packed.status !== 'ok') return stopBeforeRound(state, deps, kind, current.rel, current.hash, packed ?? whole);
           parts = packed.sections.map((sec) => ({ index: sec.index, heading: sec.headings[0], diff: sec.diff, open: sec.open, keys: sec.keys }));
         }
         // EVERY packet is built and held to the budget BEFORE any session runs: a section over it
@@ -697,11 +718,11 @@ export async function runRound(state, deps, opts = {}) {
             continue;
           }
           const moved = movedText(moves, diff.content, part.keys);
-          const packet = buildRecheckPacket({ diff: part.diff, open: part.open, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved });
+          const packet = buildRecheckPacket({ diff: part.diff, open: part.open, cfg: deps.cfg, contextMode, rulesDigest: deps.rulesDigest, factsExcerpt: deps.factsExcerpt, moved, paired });
           // a packet that fails to build stops with ITS status (and size, when it has one)
-          if (packet.status !== 'ok') return stopBeforeRound(state, deps, kind, current.rel, { ...packet, section: part.heading });
+          if (packet.status !== 'ok') return stopBeforeRound(state, deps, kind, current.rel, current.hash, { ...packet, section: part.heading });
           const size = recheckTokens(part.diff, part.open, moved);
-          if (size > whole.budget) return stopBeforeRound(state, deps, kind, current.rel, { status: 'split_required', tokensIn: size, budget: whole.budget, section: part.heading });
+          if (size > whole.budget) return stopBeforeRound(state, deps, kind, current.rel, current.hash, { status: 'split_required', tokensIn: size, budget: whole.budget, section: part.heading });
           built.push(packet);
         }
         /** @type {Set<Finding>} the pending findings a session that LISTED them resolved */
@@ -713,7 +734,7 @@ export async function runRound(state, deps, opts = {}) {
         for (const [i, part] of parts.entries()) {
           const packet = /** @type {any} */ (built[i]);
           packetInfo = mergePacketInfo(packetInfo, packet);
-          const session = await recheckSession(packet, deps);
+          const session = await recheckSession(packet, deps, part.open);
           tokensIn = sum(tokensIn, session.tokens_in);
           tokensOut = sum(tokensOut, session.tokens_out);
           if (!session.verdict.ok) {
@@ -743,7 +764,7 @@ export async function runRound(state, deps, opts = {}) {
         draft.open = [...stillOpen, ...triaged.fix_now, ...blocking];
       }
     }
-    // no fix hunks (the content did not change): nothing closes — the round stalls
+    // A patch_check with no fix hunks closed nothing: B73 still stops it.
   }
 
   if (kind !== 'patch_check') {
@@ -785,7 +806,10 @@ export async function runRound(state, deps, opts = {}) {
     const after = new Set(draft.open.map((f) => f.id));
     const closedIds = new Set(state.open.map((f) => f.id).filter((id) => !after.has(id))).size;
     draft.next = decideNext(draft, openBefore, s, kind, closedIds);
-    if (draft.next.action === 'stop') draft.status = 'stopped';
+    if (draft.next.action === 'stop') {
+      draft.status = 'stopped';
+      draft.stop_content_hash = current.hash;
+    }
   }
   const rows = [...lateRows, roundRow];
   if (draft.status === 'stopped') rows.push({ event: 'review.cap', file: current.rel, round: draft.round, reason: draft.next.reason, open: draft.open.map((f) => f.id) });
@@ -828,6 +852,7 @@ export async function converge(state, deps) {
     }
     await deps.fix?.({ file: state.file, round: state.round + 1, level: state.level, open: [...state.open], l3_patch: state.l3_rung_used });
     await runRound(state, deps);
+    if (state.next?.reason === 'no-fix-hunks') return state;
   }
   return state;
 }