@codedology/code-forge 0.10.0 → 0.12.0

package/src/review/gate-check.mjs

@@ -47,7 +47,7 @@
  *    not repeated. B73: this detail, and an `unreviewed` detail for a file with a cap row, ends
  *    with the stop's ways out (`exits: block reopen, block waive, review-file --answers,
  *    re-decompose`, `stop-exits.mjs`);
- *  - `unproven`:   a changed owned file of tier `high` (B20, Ricardo 2026-09-25) has no covering
+ *  - `unproven`:   a changed owned file of tier `high` (B20, the owner 2026-09-25) has no covering
  *    red→green proof (`checkBlockProof`, below). Light-tier files need no proof row.
  * B71 (answers): a finding is also cleared — wherever a waiver clears it, by the one rule set
  * ({@link reviewRules}: `waiverOf`, so `reviewed_by_waiver` reads "waived or answered") — by a
@@ -803,7 +803,7 @@ export function closeTier({ file, rows, key, highPaths }) {
 }
 
 /**
- * B20 (Ricardo 2026-09-25): every changed owned file of tier `high` needs a covering red→green
+ * B20 (the owner 2026-09-25): every changed owned file of tier `high` needs a covering red→green
  * proof, checked PER FILE. A file is covered by a `proof` row of this run and block (`rows` must
  * already be the block's rows) with `step: 'red-green'`, `proven: true`, `red_kind: 'assertion'`,
  * whose MAC verifies and whose `covers` list (written by `proof red-green`: the sources the

package/src/review/lenses/A.md

@@ -11,9 +11,14 @@ You work blind: you do not see the other reviewer's answer.
 - State: ordering, concurrency, partial writes, values that can be stale.
 - Arithmetic and units: rounding, overflow, bytes versus characters, time zones.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/B.md

@@ -12,9 +12,14 @@ You work blind: you do not see the other reviewer's answer.
   that can escape a root (`..`, absolute, symlinks); missing authorization; unsafe defaults.
 - Facts: a flag, path or API the change relies on that the facts excerpt contradicts.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/full.md

@@ -12,9 +12,14 @@ You are a code reviewer doing a FULL review of one changed file.
 
 Report each real defect once, at the lines where it lives.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
 - Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).

package/src/review/lenses/judge.md

@@ -13,6 +13,10 @@ their two answers, the list of hunk headers, and the diff only when the packet i
 - Your `findings` list is final: nothing you drop is fixed, everything you keep is.
 - `passed` is true only when you keep no `critical` and no `warning`.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.

package/src/review/lenses/quick.md

@@ -10,6 +10,10 @@ You are a code reviewer doing a QUICK pass on one small, low-risk change.
 
 Skip style, naming and structure unless it hides a bug. Keep `findings` short.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.

package/src/review/lenses/recheck.md

@@ -15,9 +15,14 @@ that changed since that round, each with a window of the current file around it.
 - `passed` is true only when every open finding is resolved and you raised no new `critical`
   or `warning`.
 
+Never ask for hand mutations or for tests beyond the acceptance clauses.
+The fix for a weak assertion is a stronger assertion.
+Code or tests beyond what the change needs (unused options, extra layers, speculative generality) is at most a `nit` unless it hides a bug.
+
 ## Rules for every answer
 
 - Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- A test named in `## paired` exists; do not report it as unseen; use `needs_file` when its body matters.
 - You have no tools and no project files. The packet is everything you get.
 - `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order.
 - Answer with ONE JSON object that matches the answer schema.

package/src/review/packet.mjs

@@ -10,6 +10,7 @@
  *   ## project rules   the rules digest (≤ 60 lines)
  *   ## facts           the facts-sheet excerpt
  *   ## context         the current file (whole, or hunk windows — `context.mjs`)
+ *   ## paired          optional paired-file names and summary (B97), dropped first over budget
  *   ## moved code      only when code moved to/from another file of the block (`moved.mjs`, B56)
  *   ## diff            `file:`, the `hunks:` list the reviewer must echo, then the diff
  *
@@ -20,7 +21,7 @@
  * Budget (§4.3): `review.budgets.full_in` (`quick_in` for the quick lens), in tokens estimated as
  * bytes / 4. A diff that alone exceeds it ⇒ `split_required` (a Markdown file is then reviewed
  * section by section — `sections.mjs`, B54). Otherwise over budget ⇒ the context shrinks to
- * ± `min_context_lines` (`minimal`) FIRST, then the digest is trimmed from the end; the diff is
+ * ± `min_context_lines` (`minimal`) after dropping paired, then the digest is trimmed from the end; the diff is
  * never cut. The `## moved code` section (B56) is part of that measure: it is counted in the diff-only
  * size (`diffOnlyTokens`, `split_required`) and never trimmed.
  *
@@ -190,11 +191,11 @@ export async function readFileDiff({ repoRoot, file, base }) {
  * Assemble a reviewer packet (pure).
  * @param {{
  *   diff: FileDiff, lens: string, rulesDigest?: string, factsExcerpt?: string,
- *   cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', budget?: number, moved?: string,
+ *   cfg?: Record<string, any>, contextMode?: 'auto' | 'recheck', budget?: number, moved?: string, paired?: string,
  * }} opts - `moved`: the file's `## moved code` section (`moved.mjs`), '' for none.
  * @returns {Packet | {status: 'split_required', tokensIn: number, budget: number}}
  */
-export function assemblePacket({ diff, lens, rulesDigest = '', factsExcerpt = '', cfg, contextMode = 'auto', budget, moved = '' }) {
+export function assemblePacket({ diff, lens, rulesDigest = '', factsExcerpt = '', cfg, contextMode = 'auto', budget, moved = '', paired = '' }) {
   const lensText = loadLens(lens);
   const limit = budget ?? budgetFor(cfg, lens === 'quick' ? 'quick_in' : 'full_in');
   const hunkHeaders = diff.hunks.map((h) => h.header);
@@ -204,7 +205,12 @@ export function assemblePacket({ diff, lens, rulesDigest = '', factsExcerpt = ''
 
   let digest = splitLines(rulesDigest).slice(0, DIGEST_MAX_LINES);
   let ctx = buildContext({ file: diff.file, content: diff.content, hunks: diff.hunks, cfg, mode: contextMode });
-  let text = render(lensText, digest, factsExcerpt, ctx.text, diffSection, moved);
+  let pairedSection = boundedPaired(paired, budgetFor(cfg, 'full_in'));
+  let text = render(lensText, digest, factsExcerpt, ctx.text, diffSection, moved, pairedSection);
+  if (estimateTokens(text) > limit && pairedSection.length > 0) {
+    pairedSection = '';
+    text = render(lensText, digest, factsExcerpt, ctx.text, diffSection, moved);
+  }
   if (estimateTokens(text) > limit) {
     ctx = buildContext({ file: diff.file, content: diff.content, hunks: diff.hunks, cfg, mode: 'minimal' });
     text = render(lensText, digest, factsExcerpt, ctx.text, diffSection, moved);
@@ -217,6 +223,22 @@ export function assemblePacket({ diff, lens, rulesDigest = '', factsExcerpt = ''
   return { status: 'ok', text, hunkHeaders, contextMode: ctx.mode, contextLines: ctx.lineCount, digestLines: digest.length, tokensIn, budget: limit, overBudget: tokensIn > limit };
 }
 
+/** Cap the entire section at full_in / 16 tokens, without cutting a UTF-8 character.
+ * @param {string} paired @param {number} fullIn @returns {string}
+ */
+function boundedPaired(paired, fullIn) {
+  if (paired.trim().length === 0) return '';
+  const heading = '## paired\n';
+  let left = Math.floor(fullIn / 16) * 4 - Buffer.byteLength(heading) - 1;
+  let body = '';
+  for (const char of paired) {
+    left -= Buffer.byteLength(char);
+    if (left < 0) break;
+    body += char;
+  }
+  return body.length > 0 ? heading + body.trimEnd() : '';
+}
+
 /**
  * The tokens of the diff-only packet (lens + moved code + diff, no digest, facts or context): what
  * `assemblePacket` holds against the budget before it says `split_required`. Pass the SAME `moved`
@@ -244,8 +266,9 @@ function diffSectionOf(diff) {
 /**
  * @param {string} lensText @param {string[]} digest @param {string} facts @param {string} context
  * @param {string} diffSection @param {string} [moved] - the `## moved code` section (heading included), '' for none.
+ * @param {string} [paired] - the bounded `## paired` section (heading included).
  */
-function render(lensText, digest, facts, context, diffSection, moved = '') {
+function render(lensText, digest, facts, context, diffSection, moved = '', paired = '') {
   return [
     '# code-forge review packet',
     '## lens',
@@ -256,6 +279,7 @@ function render(lensText, digest, facts, context, diffSection, moved = '') {
     facts.trim().length > 0 ? facts.trimEnd() : '(none)',
     '## context',
     context.length > 0 ? context : '(none)',
+    ...(paired.length > 0 ? [paired] : []),
     ...(moved.length > 0 ? [moved] : []),
     '## diff',
     diffSection,
@@ -319,9 +343,10 @@ function readRepoText(repoRoot, rel) {
 
 /**
  * Why `rel` may not be attached, or null.
- * @param {string} repoRoot @param {string} rel @returns {Promise<string | null>}
+ * @param {string} repoRoot @param {string} rel @param {ReadonlyArray<string>} ownedFiles
+ * @param {ReadonlyArray<string>} changedFiles @returns {Promise<string | null>}
  */
-async function attachRefusal(repoRoot, rel) {
+async function attachRefusal(repoRoot, rel, ownedFiles, changedFiles) {
   if (isSecretLike(rel)) return 'refused: secret-like path';
   let st;
   try {
@@ -330,20 +355,29 @@ async function attachRefusal(repoRoot, rel) {
     return 'missing';
   }
   if (!st.isFile()) return 'not a file';
-  const res = await exec(['git', 'ls-files', '-z', '--error-unmatch', '--', rel], { cwd: repoRoot, env: reviewGitEnv(), timeoutMs: GIT_TIMEOUT_MS });
-  if (res.result !== 'ok' || res.stdout.length === 0) return 'refused: not tracked by git';
+  const res = await exec(['git', 'ls-files', '-z', '--', rel], { cwd: repoRoot, env: reviewGitEnv(), timeoutMs: GIT_TIMEOUT_MS });
+  if (res.result !== 'ok') return 'refused: git failed';
+  if (res.stdout === `${rel}\0`) return null;
+  if (res.stdout.length > 0) return 'refused: git failed';
+  if (!ownedFiles.includes(rel)) return 'refused: untracked, not owned by this block';
+  if (!changedFiles.includes(rel)) return 'refused: untracked, not changed in this block';
+  const ignored = await exec(['git', 'check-ignore', '-q', '--', rel], { cwd: repoRoot, env: plainGitEnv(), timeoutMs: GIT_TIMEOUT_MS, okExitCodes: [0, 1] });
+  if (ignored.result !== 'ok' || (ignored.code !== 0 && ignored.code !== 1)) return 'refused: git failed';
+  if (ignored.code === 0) return 'refused: gitignored';
   return null;
 }
 
 /**
  * The `needs_file` follow-up (§4.2): the requested files, read-only, appended AFTER the packet
- * (the stable prefix stays stable). Only regular files git TRACKS are attached — an untracked or
- * ignored file (`.env`, a key) never reaches a provider — and secret-like paths are refused even
+ * (the stable prefix stays stable). Regular tracked files, or untracked files present in BOTH
+ * concrete path lists of this block, are attached. Ignored untracked files never reach a provider,
+ * and secret-like paths are refused even
  * when tracked; every refusal is named in the section. The attachment is trimmed to `budgetTokens`.
- * @param {{repoRoot: string, paths: ReadonlyArray<unknown>, budgetTokens: number}} opts
+ * @param {{repoRoot: string, paths: ReadonlyArray<unknown>, budgetTokens: number, ownedFiles?: ReadonlyArray<string>, changedFiles?: ReadonlyArray<string>}} opts
+ * `ownedFiles` and `changedFiles`: resolved paths from the SAME block in this repoRoot; no globs.
  * @returns {Promise<string>} the section to append.
  */
-export async function attachFiles({ repoRoot, paths, budgetTokens }) {
+export async function attachFiles({ repoRoot, paths, budgetTokens, ownedFiles = [], changedFiles = [] }) {
   const out = ['## attached files (read-only, requested in needs_file)'];
   let left = budgetTokens * 4;
   for (const raw of paths.slice(0, 10)) {
@@ -356,7 +390,7 @@ export async function attachFiles({ repoRoot, paths, budgetTokens }) {
       out.push(notFile ? `### ${String(raw)} (not a file)` : '### (refused: not a repo-relative path)');
       continue;
     }
-    const refusal = await attachRefusal(repoRoot, rel);
+    const refusal = await attachRefusal(repoRoot, rel, ownedFiles, changedFiles);
     if (refusal) {
       out.push(`### ${rel} (${refusal})`);
       continue;

package/src/review/paired.mjs

@@ -0,0 +1,81 @@
+/** Stem pairs and bounded names for closed-book review packets (B97). No file reads. */
+import path from 'node:path';
+import { findSecret } from '../util/gh.mjs';
+import { redact } from '../util/redact.mjs';
+
+/** @param {string} file */
+function identity(file) {
+  if (typeof file !== 'string' || file.startsWith('/') || /[\\\x00-\x1f]/.test(file) || file.split('/').some((s) => s === '.' || s === '..' || s === '')) return null;
+  const ext = path.posix.extname(file);
+  let stem = path.posix.basename(file, ext);
+  let test = /(^|\/)(?:test|tests)\//.test(file);
+  if (ext === '.mjs' || ext === '.ts') {
+    if (/\.(test|spec)$/.test(stem)) { test = true; stem = stem.replace(/\.(test|spec)$/, ''); }
+  } else if (ext === '.php') {
+    if (stem.endsWith('Test')) { test = true; stem = stem.slice(0, -4); }
+  } else if (ext === '.go') {
+    if (stem.endsWith('_test')) { test = true; stem = stem.slice(0, -5); }
+  } else if (ext === '.py') {
+    if (stem.startsWith('test_')) { test = true; stem = stem.slice(5); }
+    else if (stem.endsWith('_test')) { test = true; stem = stem.slice(0, -5); }
+  } else if (ext === '.swift') {
+    if (stem.endsWith('Tests')) { test = true; stem = stem.slice(0, -5); }
+  } else return null;
+  return { ext, stem, test };
+}
+
+/** @param {string} file @param {ReadonlyArray<string>} candidates @returns {string[]} */
+export function pairsFor(file, candidates) {
+  const source = identity(file);
+  if (!source) return [];
+  return [...new Set(candidates)].filter((candidate) => {
+    const other = identity(candidate);
+    return candidate !== file && other?.ext === source.ext && other.stem === source.stem && other.test !== source.test;
+  });
+}
+
+/**
+ * A best-effort list, not a parser or proof of coverage. Names only, never function bodies.
+ * Redact before truncating so a token crossing the 120-character boundary cannot leak.
+ * @param {string} text @param {string} file @returns {string[]}
+ */
+export function summarize(text, file) {
+  const id = identity(file);
+  if (!id) return [];
+  /** @type {Set<string>} */
+  const names = new Set();
+  for (const line of text.split(/\r?\n/)) {
+    /** @type {RegExpMatchArray | null} */
+    let match = null;
+    if (id.test) {
+      if (id.ext === '.mjs' || id.ext === '.ts' || id.ext === '.php') {
+        match = line.match(/^\s*(?:await\s+)?(?:test|it)(?:\.(?:only|skip|todo))?\(\s*(['"`])([^\r\n]+?)\1/);
+        if (match) { names.add(match[2]); match = null; }
+        else if (id.ext === '.php') match = line.match(/^\s*(?:(?:public|protected)\s+)?function\s+(test\w+)\s*\(/);
+        else continue;
+      } else if (id.ext === '.go') match = line.match(/^\s*func\s+(Test\w+)\s*\(/);
+      else if (id.ext === '.py') match = line.match(/^\s*(?:async\s+)?def\s+(test_\w+)\s*\(/);
+      else if (id.ext === '.swift') match = line.match(/^\s*func\s+(test\w+)\s*\(/);
+    } else {
+      if (id.ext === '.mjs' || id.ext === '.ts') {
+        match = line.match(/^\s*export\s+(?:default\s+)?(?:async\s+)?(?:function\*?|class|const|let|var|interface|type|enum)\s+(\w+)/);
+        const list = line.match(/^\s*export\s*\{([^}]+)\}/);
+        if (list) {
+          for (const item of list[1].split(',')) {
+            const symbol = item.trim().match(/^(?:type\s+)?(\w+)(?:\s+as\s+(\w+))?$/);
+            if (symbol) names.add(symbol[2] ?? symbol[1]);
+          }
+        }
+      } else if (id.ext === '.php') match = line.match(/^\s*(?:(?:public|protected|private|static|final|abstract)\s+)*(?:function|class|interface|trait)\s+(\w+)/);
+      else if (id.ext === '.go') match = line.match(/^\s*(?:func\s+(?:\([^)]*\)\s+)?|(?:type|var|const)\s+)([A-Z]\w*)/);
+      else if (id.ext === '.py') match = line.match(/^\s*(?:async\s+)?(?:def|class)\s+([a-zA-Z]\w*)/);
+      else if (id.ext === '.swift') match = line.match(/^\s*(?:public|open)\s+(?:final\s+)?(?:func|class|struct|enum|protocol|let|var)\s+(\w+)/);
+    }
+    if (match) names.add(match[1]);
+    if (names.size >= 40) break;
+  }
+  return [...names].slice(0, 40).map((name) => {
+    const safe = redact(name);
+    return Array.from(findSecret(safe) ? '[REDACTED]' : safe).slice(0, 120).join('');
+  });
+}

package/src/review/reopen.mjs

@@ -18,7 +18,7 @@
  *  - `reopen-not-stopped` — no state, or a state that is open or complete;
  *  - `reopen-same-content` — a stopped file whose current content is the content its stop
  *    reviewed (no free re-roll: the human waives the findings instead), or a stop whose content
- *    is unknown;
+ *    is unknown and the current hash already has a verified review round;
  *  - `reopen-already-recorded` — a verified human row already names the file's latest anchor seq
  *    for other content (run `review-file`, or the content changed since that reopen);
  *  - `reopen-write-failed` — the signed row was not written.
@@ -32,7 +32,8 @@
  * which the worker sets on every stop (`src/worker/engine.mjs`) and which is signed through the
  * anchor. A state from before B72 has none: then the latest verified `review.cap` row of THIS
  * stop counts — written after the file's latest verified `review.reopened` row, with the state's
- * round and stop reason — else the content is unknown and the reopen is refused.
+ * round and stop reason — else the content is unknown. B114: unknown content can restart only
+ * when no verified review.round of this run/block/file names the current hash (from_hash: null).
  *
  * The worker (`fixLoopRound`) asks `reopenRowFor`: a verified human row of this run for the block
  * and file whose `at_seq` is the file's latest anchor seq starts a new state (round 1, a FULL
@@ -102,6 +103,15 @@ export function stopContentHash(state, rows, { runId, block, file, key }) {
   return null;
 }
 
+/**
+ * A legacy stop with unknown content can restart only on bytes with no verified round here.
+ * @param {ReadonlyArray<Record<string, any>>} rows
+ * @param {{runId: string, block: string, file: string, key: Buffer, contentHash: string}} at
+ */
+function hasReviewedHash(rows, { runId, block, file, key, contentHash }) {
+  return rows.some((r) => r?.event === 'review.round' && r.run === runId && r.block === block && r.file === file && r.content_hash === contentHash && verified(r, key));
+}
+
 /**
  * The block checks every reopen runs first, before any config, key or ledger read: the run must
  * know the block (`unknown_block`, the code `block waive` uses) and the block must be open.
@@ -138,7 +148,8 @@ function latestRowAt(rows, { runId, block, file, key, seq }) {
  * verifies with the run key, of this run, block and file, `by: human`, and whose `at_seq` is the
  * file's latest anchor seq counts (the latest such row). A `lost` state needs `from: lost`; a
  * stopped state needs `from: stopped` AND current content that is neither the row's `from_hash`
- * nor the content the stop reviewed (`stopContentHash`; unknown ⇒ no restart).
+ * nor the content the stop reviewed (`stopContentHash`). Unknown content requires a null
+ * from_hash, the row's to_hash equal to current content, and no verified round at that hash.
  * @param {ReadonlyArray<Record<string, any>>} rows
  * @param {{runId: string, block: string, file: string, key: Buffer, status: string, state: Record<string, any> | null, seq: number, contentHash: string}} at
  * @returns {Record<string, any> | null}
@@ -149,7 +160,8 @@ export function reopenRowFor(rows, { runId, block, file, key, status, state, seq
   if (status === 'lost') return row.from === 'lost' ? row : null;
   if ((status === 'ok' || status === 'restored') && state?.status === 'stopped' && row.from === 'stopped') {
     const stopHash = stopContentHash(state, rows, { runId, block, file, key });
-    if (stopHash === null || contentHash === stopHash || contentHash === row.from_hash) return null;
+    if (contentHash === stopHash || contentHash === row.from_hash) return null;
+    if (stopHash === null && (row.from_hash !== null || row.to_hash !== contentHash || hasReviewedHash(rows, { runId, block, file, key, contentHash }))) return null;
     return row;
   }
   return null;
@@ -200,8 +212,8 @@ export async function reopenFile({ runId, id, file, reason, record, rows, key, w
     from = 'stopped';
     stopReason = typeof loaded.state.next?.reason === 'string' ? loaded.state.next.reason : 'stopped';
     fromHash = stopContentHash(loaded.state, runRows, { runId, block: id, file, key });
-    if (fromHash === null) {
-      throw new StateError('reopen-same-content', `reopen-same-content: the content the stop of ${file} reviewed is unknown, so a change cannot be shown; waive its findings instead (block waive); nothing was recorded`);
+    if (fromHash === null && hasReviewedHash(runRows, { runId, block: id, file, key, contentHash: current })) {
+      throw new StateError('reopen-same-content', `reopen-same-content: the content the stop of ${file} reviewed is unknown and its current content has already been reviewed; change the file and run block reopen, or the owner can run block close --no-require-reviews; nothing was recorded`);
     }
     if (fromHash === current) {
       throw new StateError('reopen-same-content', `reopen-same-content: ${file} still has the content its stop (${stopReason}) reviewed; change the file first, or waive its findings (block waive); nothing was recorded`);

package/src/review/reviewed-lines.mjs

@@ -0,0 +1,94 @@
+/**
+ * B96 (E1): the close report is built by the tool. After the review gate passed (`reviewGateCheck`
+ * over `checkBlockReviews`), every file the gate checked is accepted at its current hash, either
+ * by a signed `review.approved` row or — the gate's `waivedAll` list (B70/B71) — because every
+ * finding its review left open was waived or answered. This module turns that verdict into one
+ * line per file: `{file, ticket, via}`, `via` one of `approved`, `waiver`, `answered`, and
+ * `ticket` the queue's ticket for that file and hash (the caller passes `ticketOf`, the queue's
+ * own rule: `src/review` never imports the worker). It never re-decides the acceptance: the gate
+ * is the only judge, and a file the gate did not accept is never passed here.
+ *
+ * It also reads the coder's hand lines (`reviewed <path> ticket <id>`), to name a hand line that
+ * names another ticket (D1: a warning, the tool lines are the record).
+ *
+ * Its warnings (`onNoTicket`, `onBadTicket`) are callbacks: the close holds what they report and
+ * prints it only when the block closes (src/cli/block.mjs).
+ */
+
+/** @typedef {'approved' | 'waiver' | 'answered'} Via */
+/** @typedef {{file: string, ticket: string, via: Via}} ReviewedLine */
+
+/**
+ * The `via` of a file the gate accepted, read from the gate's own record (`WaivedAll`, built by
+ * `waivedAllOf` in gate-check.mjs): no record at the same hash ⇒ `approved` (a signed approval);
+ * a record whose `by` is null ⇒ `answered` (the gate sets `by` to null exactly when every open
+ * finding was answered); any other `by` (`human` or `autopilot`) ⇒ `waiver` — also for a file
+ * with some findings answered and at least one waived (the waiver is what a human or a grant
+ * decided, so the line names it).
+ * @param {import('./gate-check.mjs').WaivedAll | undefined} record @returns {Via}
+ */
+export function viaOf(record) {
+  if (record === undefined) return 'approved';
+  return record.by === null ? 'answered' : 'waiver';
+}
+
+/** A ticket id as the queue gives it: 24 lowercase hex characters (`assertTicketId`). */
+const TICKET_ID = /^[0-9a-f]{24}$/;
+
+/**
+ * The tool's reviewed lines, sorted by file. Pure but for `onNoTicket` and `onBadTicket`.
+ * @param {{
+ *   files: ReadonlyArray<{file: string, content_hash: string}>,
+ *   waivedAll: ReadonlyArray<import('./gate-check.mjs').WaivedAll>,
+ *   ticketOf: (file: {file: string, content_hash: string}) => unknown,
+ *   onNoTicket?: (file: string) => void,
+ *   onBadTicket?: (file: string) => void,
+ * }} opts `files`: the files the review gate checked and ACCEPTED (it passed); `waivedAll`: the
+ *   gate's `reviewed_by_waiver` files ({@link viaOf}); every other file passed through a signed
+ *   approval. `ticketOf`: the queue's ticket for that file at that hash, or null (or undefined)
+ *   when it cannot be given — then the file has no line (fail closed) and `onNoTicket(file)` is
+ *   called once. Any other value that is not 24 lowercase hex characters (a string of another
+ *   shape, a number…) is a bad ticket: the file has no line either and `onBadTicket(file)` is
+ *   called once instead.
+ * @returns {ReviewedLine[]}
+ */
+export function reviewedLines({ files, waivedAll, ticketOf, onNoTicket = () => {}, onBadTicket = () => {} }) {
+  /** @type {ReviewedLine[]} */
+  const lines = [];
+  for (const f of files) {
+    const via = viaOf(waivedAll.find((w) => w.file === f.file && w.content_hash === f.content_hash));
+    const ticket = ticketOf(f);
+    if (ticket === null || ticket === undefined) onNoTicket(f.file);
+    else if (typeof ticket === 'string' && TICKET_ID.test(ticket)) lines.push({ file: f.file, ticket, via });
+    else onBadTicket(f.file);
+  }
+  return lines.sort((x, y) => (x.file < y.file ? -1 : x.file > y.file ? 1 : 0));
+}
+
+/**
+ * A hand line: exactly `reviewed <path> ticket <id>` once trimmed, with backticks dropped and an
+ * optional leading list marker (`- `, `* ` or a number and a dot, `1. `). The id is 24 hex
+ * characters of either case: a ticket id is lowercase, so an id in capitals is read here and then
+ * never equals the tool's ticket ({@link reportMismatches} compares exactly).
+ */
+const HAND_LINE = /^(?:(?:[-*]|\d{1,9}\.)\s+)?reviewed\s+(\S+)\s+ticket\s+([0-9a-fA-F]{24})$/;
+
+/**
+ * D1: the files whose hand line in `report` names a ticket id other than the tool's (compared
+ * exactly, so an id in capitals is another ticket). Only a `reviewed <path> ticket <id>` line
+ * counts ({@link HAND_LINE}); a hash of another length, or a line of any other shape that names
+ * the file, never does.
+ * @param {string} report @param {ReadonlyArray<ReviewedLine>} lines
+ * @returns {string[]} the files with a mismatched hand line, in the order of `lines`.
+ */
+export function reportMismatches(report, lines) {
+  /** @type {Set<string>} */
+  const other = new Set();
+  for (const raw of report.split('\n')) {
+    const m = HAND_LINE.exec(raw.replaceAll('`', '').trim());
+    if (m === null) continue;
+    const line = lines.find((l) => l.file === m[1]);
+    if (line !== undefined && line.ticket !== m[2]) other.add(line.file);
+  }
+  return lines.filter((l) => other.has(l.file)).map((l) => l.file);
+}

package/src/state/block-end.mjs

@@ -54,11 +54,13 @@ function safeId(id) {
  * @param {{
  *   block: string, runId: string, status: 'closed' | 'stopped', event: string, reason?: string | null,
  *   commit: string | null, spend: {usd: number, unknown: number} | null, findings: number | null, at: Date,
- * }} facts
+ *   reviewed?: ReadonlyArray<{file: string, ticket: string, via: string}>,
+ * }} facts `reviewed` (B96): the close's reviewed lines, sorted by file; the key is added last, and only when given.
  * @returns {{block: string, run_id: string, status: string, event: string, reason: string | null, commit: string | null,
- *   spent_usd: number | null, unknown_usd_sessions: number | null, findings: number | null, at: string}}
+ *   spent_usd: number | null, unknown_usd_sessions: number | null, findings: number | null, at: string,
+ *   reviewed?: Array<{file: string, ticket: string, via: string}>}}
  */
-export function doneFileContent({ block, runId, status, event, reason = null, commit, spend, findings, at }) {
+export function doneFileContent({ block, runId, status, event, reason = null, commit, spend, findings, at, reviewed }) {
   return {
     block,
     run_id: runId,
@@ -71,6 +73,7 @@ export function doneFileContent({ block, runId, status, event, reason = null, co
     unknown_usd_sessions: spend && Number.isInteger(spend.unknown) ? spend.unknown : null,
     findings: Number.isInteger(findings) ? findings : null,
     at: at.toISOString(),
+    ...(Array.isArray(reviewed) ? { reviewed: reviewed.map((r) => ({ file: r.file, ticket: r.ticket, via: r.via })).sort((x, y) => (x.file < y.file ? -1 : x.file > y.file ? 1 : 0)) } : {}),
   };
 }
 
@@ -97,12 +100,13 @@ async function headCommit(cwd) {
  * @param {{
  *   record: Record<string, any>, id: string, status: 'closed' | 'stopped', event: string, reason?: string | null,
  *   openFindings: (rows: Record<string, any>[]) => Promise<number>, err: (s: string) => unknown, now?: Date,
+ *   reviewed?: ReadonlyArray<{file: string, ticket: string, via: string}>,
  * }} opts - `record` is the run record read before the end (its `workspace` and the block's
  *   `worktree` do not change at an end); `openFindings` counts the block's open findings exactly
- *   as `code-forge status` does.
+ *   as `code-forge status` does. `reviewed` (B96): the close's reviewed lines, kept as the last key.
  * @returns {Promise<string | null>} the done file's absolute path, or null when it was not written.
  */
-export async function writeDoneFile({ record, id, status, event, reason = null, openFindings, err, now = new Date() }) {
+export async function writeDoneFile({ record, id, status, event, reason = null, openFindings, err, now = new Date(), reviewed }) {
   const runId = String(record?.run_id);
   try {
     const file = doneFilePath(runId, id);
@@ -127,7 +131,7 @@ export async function writeDoneFile({ record, id, status, event, reason = null,
     }
     const tree = record.blocks?.[id]?.worktree?.path;
     const commit = await headCommit(typeof tree === 'string' && tree.length > 0 ? tree : record.workspace);
-    const content = doneFileContent({ block: id, runId, status, event, reason, commit, spend, findings, at: now });
+    const content = doneFileContent({ block: id, runId, status, event, reason, commit, spend, findings, at: now, ...(reviewed === undefined ? {} : { reviewed }) });
     const dir = path.dirname(file);
     await mkdir(dir, { recursive: true, mode: 0o700 });
     const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);

package/src/util/exec.mjs

@@ -139,6 +139,7 @@ function untrackChild(pid) {
  * @param {object} [opts]
  * @param {string} [opts.cwd]
  * @param {NodeJS.ProcessEnv} [opts.env]
+ * @param {BufferEncoding} [opts.stdoutEncoding] - stdout encoding (default UTF-8); base64 preserves binary git blobs.
  * @param {number} [opts.timeoutMs] - Kill the child (and its process group) if it runs longer
  *   than this. Must be a finite number > 0 when given.
  * @param {number[]} [opts.okExitCodes] - Exit codes treated as `result: "ok"` (default `[0]`).
@@ -212,7 +213,7 @@ export function exec(argv, opts = {}) {
       child.kill(signal);
     };
 
-    const stdoutText = () => Buffer.concat(stdoutChunks).toString('utf8');
+    const stdoutText = () => Buffer.concat(stdoutChunks).toString(opts.stdoutEncoding ?? 'utf8');
     const stderrText = () => Buffer.concat(stderrChunks).toString('utf8');
 
     /** @param {ExecResult} result */

package/src/util/gate-token.mjs

@@ -6,3 +6,6 @@
 
 /** A gate argv item that is EXACTLY this string expands to the block's test files. */
 export const TEST_FILES_TOKEN = '{test_files}';
+
+/** A whole argv item for lint/format paths, never a command. */
+export const CHANGED_FILES_TOKEN = '{changed_files}';