@codedology/code-forge 0.14.0 → 0.15.0

package/src/review/fixloop.mjs

@@ -91,7 +91,7 @@ import { verifyRow } from '../state/signer.mjs';
 import { decisionProblem, grantCoverProblem } from './gate-check.mjs';
 import { contentHash, gitChildEnv } from '../worker/ticket.mjs';
 import { parseDiff } from './context.mjs';
-import { assemblePacket, assertPacketPath, diffOnlyTokens, readFileDiff } from './packet.mjs';
+import { assemblePacket, assertPacketPath, budgetFor, diffOnlyTokens, readFileDiff } from './packet.mjs';
 import { movedText, movesFor, peerDiffReader } from './moved.mjs';
 import { pairedContext } from './engine.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups, sectionOf } from './sections.mjs';
@@ -101,6 +101,7 @@ import { spawnWithTimeoutRetry } from './session-retry.mjs';
 import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallback.mjs';
 
 /** @typedef {import('./triage.mjs').Finding} Finding */
+/** @typedef {Finding & {repeated?: boolean}} LoopFinding */
 /** @typedef {import('./context.mjs').Hunk} Hunk */
 
 /**
@@ -121,12 +122,15 @@ import { afterSchemaMiss, logSecondLevelMiss, packetHash } from './schema-fallba
  * @property {number} round - rounds counted so far (patch_check rounds excluded).
  * @property {number} rounds_at_level
  * @property {number} [warn_rounds_at_level] - heavy rounds at the current level (rule 2c, B34); absent in a state saved before B34 ⇒ 0.
- * @property {Finding[]} open - the open `fix_now` set.
+ * @property {LoopFinding[]} open - the open `fix_now` set.
  * @property {Finding[]} late
+ * @property {string[]} [finding_history] - claim/evidence keys from earlier rounds of this file.
+ * @property {string[]} [finding_ids] - ids seen in earlier rounds, including closed findings.
  * @property {string | null} reviewed_content - the content the last counted round reviewed.
  * @property {boolean} l3_rung_used - the block's L3 rung (rule 5 or 6) was used — once per block.
  * @property {'open' | 'complete' | 'stopped'} status
  * @property {string} [stop_content_hash] - bytes reviewed by a stop (absent in legacy states).
+ * @property {string} [stop_lens] - the lens whose packet stopped before a round.
  * @property {NextStep | null} next
  * @property {{context_mode: string, context_lines: number} | null} [last_packet] - the last recheck round's context: one packet's, or over a Markdown recheck's section packets the summed lines and the one mode they share, else `mixed` (B54).
  * @property {'full' | 'recheck' | 'patch_check' | null} [pending_kind] - the round to re-run after a `retry`.
@@ -262,11 +266,24 @@ export function extraRoundsFor(rows, { runId, block, file, key }) {
 /**
  * B47: reopen a file stopped at `review_cap` when its raised cap leaves a round: the state goes
  * back to `open` with `next: fix` at its level (`trigger: autopilot_extra_round`); the next round
- * is a recheck. Any other state is left as it is.
+ * is a recheck. B132 also resumes a pre-round split stop when its packet budget changed,
+ * preserving the counted rounds and findings. Any other state is left as it is.
  * @param {FileState} state @param {number} extraRounds @param {Record<string, any> | undefined} cfg
  * @returns {boolean} whether the state was reopened.
  */
 export function reopenForExtraRound(state, extraRounds, cfg) {
+  // Only a recheck resumes as a fix; full and patch_check stops keep their round kind.
+  // Its packet is measured against full_in, so other lens budgets cannot reopen it.
+  if (state.status === 'stopped' && state.next?.reason === 'split_required' && state.stop_lens === 'recheck' &&
+      typeof state.next.budget === 'number' && Number.isFinite(state.next.budget) && state.next.budget > 0 &&
+      state.next.budget !== budgetFor(cfg, 'full_in')) {
+    state.status = 'open';
+    state.next = { action: 'fix', level: state.level, trigger: null };
+    state.pending_kind = null;
+    delete state.stop_content_hash;
+    delete state.stop_lens;
+    return true;
+  }
   if (state.status !== 'stopped' || state.next?.reason !== 'review_cap') return false;
   if (state.round >= roundCap(cfg, extraRounds)) return false;
   state.status = 'open';
@@ -349,8 +366,18 @@ const OPEN_FINDINGS_HEAD = '## open findings\n';
 /** @param {Finding} f @returns {string} the finding's line in a recheck packet's open-findings list. */
 export const openFindingLine = (f) => `- ${f.id} (${f.severity}, lines ${f.line_start}-${f.line_end}): ${f.claim ?? ''}`;
 
+/** @param {Finding} f @returns {string} compare BOTH fields, ignoring only surrounding whitespace. */
+const findingKey = (f) => JSON.stringify([(f.claim ?? '').trim(), (f.evidence ?? '').trim()]);
+
+/** @param {string} text @returns {string} */
+const normaliseWhitespace = (text) => text.trim().replace(/\s+/g, ' ');
+
 /** @param {ReadonlyArray<Finding>} open @returns {string} the open-findings list a recheck packet ends with. */
-const openFindingsText = (open) => `${OPEN_FINDINGS_HEAD}${open.length > 0 ? open.map(openFindingLine).join('\n') : '(none)'}\n`;
+const openFindingsText = (open) => {
+  // Keep the final id/claim list stable for section readers; evidence is keyed by id just before it.
+  const evidence = open.length > 0 ? `## finding evidence\n${open.map((f) => `${f.id}: ${(f.evidence ?? '').trim().replace(/\s+/g, ' ').slice(0, 300)}`).join('\n')}\n` : '';
+  return `${evidence}${OPEN_FINDINGS_HEAD}${open.length > 0 ? open.map(openFindingLine).join('\n') : '(none)'}\n`;
+};
 
 /**
  * The size a recheck packet is held to (B54): its diff-only `recheck` packet (the measure behind
@@ -631,10 +658,11 @@ async function stopBeforeRound(state, deps, kind, file, contentHash, packet) {
     typeof packet.tokensIn === 'number' && typeof packet.budget === 'number'
       ? { tokens_in: packet.tokensIn, budget: packet.budget, ...(typeof packet.section === 'string' ? { section: packet.section } : {}) }
       : {};
-  const row = { event: 'review.cap', file, round: state.round, reason, open: state.open.map((f) => f.id), ...size };
+  const row = { event: 'review.cap', file, round: state.round, reason, open: state.open.map((f) => f.id), ...size, lens: kind };
   if (!(await mustNote(deps, row))) return retry(state, kind, 'ledger_write_failed');
   state.status = 'stopped';
   state.stop_content_hash = contentHash;
+  state.stop_lens = kind;
   state.next = { action: 'stop', reason, ...size };
   state.pending_kind = null;
   return state;
@@ -661,6 +689,14 @@ export async function runRound(state, deps, opts = {}) {
   let newInHunks = 0;
   /** @type {Array<Record<string, any>>} */
   const lateRows = [];
+  /** @type {Array<Record<string, any>>} */
+  const staleRows = [];
+  const history = new Set([...(state.finding_history ?? []), ...state.open.map(findingKey), ...state.late.map(findingKey)]);
+  const knownIds = new Set([...(state.finding_ids ?? []), ...state.open.map((f) => f.id), ...state.late.map((f) => f.id)]);
+  const roundFindings = new Set();
+  const roundIds = new Set();
+  /** @type {Set<string>} */
+  const repeated = new Set();
   /** @type {number | null} */
   let tokensIn = null;
   /** @type {number | null} */
@@ -671,6 +707,10 @@ export async function runRound(state, deps, opts = {}) {
   if (kind === 'full') {
     const result = await deps.review();
     if (result?.status !== 'reviewed') return retry(state, kind, result?.reason ?? result?.status ?? 'unavailable');
+    for (const finding of result.findings ?? []) {
+      roundFindings.add(findingKey(finding));
+      roundIds.add(finding.id);
+    }
     const triaged = await triageFindings({ file: current.rel, findings: result.findings ?? [], fromJudge: cameFromJudge(result), cfg: deps.cfg, jev: deps.jev, rule: deps.rule, writeRow: deps.writeRow });
     draft.open = triaged.fix_now;
     newInHunks = triaged.fix_now.length;
@@ -727,6 +767,9 @@ export async function runRound(state, deps, opts = {}) {
         }
         /** @type {Set<Finding>} the pending findings a session that LISTED them resolved */
         const resolved = new Set();
+        /** @type {Set<Finding>} */
+        const stale = new Set();
+        const currentText = normaliseWhitespace(current.content);
         /** @type {Finding[]} */
         const inside = [];
         /** @type {Finding[]} */
@@ -742,11 +785,30 @@ export async function runRound(state, deps, opts = {}) {
             return retry(state, kind, session.verdict.reason ?? 'unavailable');
           }
           const review = /** @type {Record<string, any>} */ (session.verdict.review);
-          const resolvedIds = new Set((review.resolved ?? []).filter((/** @type {any} */ r) => r?.resolved === true).map((/** @type {any} */ r) => r.id));
-          // only the findings listed in THIS packet can be resolved by its session
-          for (const f of part.open) if (resolvedIds.has(f.id)) resolved.add(f);
+          // Only this packet's findings can close here. Legacy answers without a quote stay
+          // open; a nonempty quote that no longer exists in the file proves the answer stale.
+          for (const f of part.open) {
+            const answer = (review.resolved ?? []).find((/** @type {any} */ r) => r.id === f.id);
+            if (answer?.resolved === true) {
+              resolved.add(f);
+              continue;
+            }
+            const quote = normaliseWhitespace(answer?.current_lines ?? '');
+            const reason = quote.length > 0 && !currentText.includes(quote) ? 'current_lines_not_found' : null;
+            if (reason) {
+              stale.add(f);
+              staleRows.push({ event: 'review.stale_finding', file: current.rel, round: state.round + 1, finding: f.id, reason });
+            }
+          }
           const found = /** @type {Finding[]} */ (review.findings ?? []);
           for (const f of part.index === null ? found : sectionFindings(found, part.index)) {
+            const key = findingKey(f);
+            roundFindings.add(key);
+            roundIds.add(f.id);
+            if (kind === 'recheck' && !knownIds.has(f.id) && history.has(key)) {
+              Object.assign(f, { repeated: true });
+              repeated.add(f.id);
+            }
             if (insideHunks(f, diff.hunks)) {
               inside.push(f);
               continue;
@@ -756,8 +818,7 @@ export async function runRound(state, deps, opts = {}) {
             if (s.late === 'block' && f.severity !== 'nit') blocking.push(f);
           }
         }
-        // every pending finding stays open unless the session that listed it resolved it
-        const stillOpen = pending.filter((f) => !resolved.has(f));
+        const stillOpen = pending.filter((f) => !resolved.has(f) && !stale.has(f));
         closed += pending.length - stillOpen.length;
         const triaged = await triageFindings({ file: current.rel, findings: inside, fromJudge: false, diffText: diff.diffText, cfg: deps.cfg, jev: deps.jev, rule: deps.rule, writeRow: deps.writeRow });
         newInHunks = triaged.fix_now.length;
@@ -767,11 +828,12 @@ export async function runRound(state, deps, opts = {}) {
     // A patch_check with no fix hunks closed nothing: B73 still stops it.
   }
 
+  const unweighted = kind !== 'full' && (staleRows.length > 0 || repeated.size > 0 || draft.open.some((f) => f.repeated)) && draft.open.every((f) => f.repeated);
   if (kind !== 'patch_check') {
     draft.round += 1;
-    draft.rounds_at_level += 1;
+    if (!unweighted) draft.rounds_at_level += 1;
     // THIS round's open set, after triage: only the warnings still open count
-    if (heavyRound(draft.open, s.warnThreshold)) draft.warn_rounds_at_level = (draft.warn_rounds_at_level ?? 0) + 1;
+    if (!unweighted && heavyRound(draft.open, s.warnThreshold)) draft.warn_rounds_at_level = (draft.warn_rounds_at_level ?? 0) + 1;
   } else {
     // the block continues at L2 after the rung with a fresh round counter (§3.6) — also here, not
     // only in `converge`, because the worker runs the patch_check from its own ticket
@@ -779,6 +841,8 @@ export async function runRound(state, deps, opts = {}) {
     draft.warn_rounds_at_level = 0;
   }
   draft.reviewed_content = current.content;
+  if (history.size > 0 || roundFindings.size > 0) draft.finding_history = [...new Set([...history, ...roundFindings])];
+  if (knownIds.size > 0 || roundIds.size > 0) draft.finding_ids = [...new Set([...knownIds, ...roundIds])];
   draft.last_packet = packetInfo;
   const roundRow = {
     event: 'review.round',
@@ -794,6 +858,7 @@ export async function runRound(state, deps, opts = {}) {
     tokens_in: tokensIn,
     tokens_out: tokensOut,
     ...(packetInfo ? { context_mode: packetInfo.context_mode } : {}),
+    ...(repeated.size > 0 ? { repeated: [...repeated] } : {}),
   };
 
   if (draft.open.length === 0) {
@@ -805,13 +870,13 @@ export async function runRound(state, deps, opts = {}) {
     // closed one is fixed at L2 (B73). Closed = an id open before the round, not open after it.
     const after = new Set(draft.open.map((f) => f.id));
     const closedIds = new Set(state.open.map((f) => f.id).filter((id) => !after.has(id))).size;
-    draft.next = decideNext(draft, openBefore, s, kind, closedIds);
+    draft.next = unweighted && kind !== 'patch_check' ? { action: 'fix', level: draft.level, trigger: null } : decideNext(draft, openBefore, s, kind, closedIds);
     if (draft.next.action === 'stop') {
       draft.status = 'stopped';
       draft.stop_content_hash = current.hash;
     }
   }
-  const rows = [...lateRows, roundRow];
+  const rows = [...staleRows, ...lateRows, roundRow];
   if (draft.status === 'stopped') rows.push({ event: 'review.cap', file: current.rel, round: draft.round, reason: draft.next.reason, open: draft.open.map((f) => f.id) });
   for (const row of rows) {
     if (!(await mustNote(deps, row))) return retry(state, kind, 'ledger_write_failed');

package/src/review/gate-check.mjs

@@ -237,6 +237,24 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
   return { ok: refusals.length === 0, refusals, waivedAll: refusals.length === 0 ? waivedAll : [], ...(acceptedHits.length > 0 ? { acceptedHits } : {}) };
 }
 
+/** B138: delegation never turns a waived or answered file into an approval.
+ * @param {Parameters<typeof checkBlockReviews>[0]} opts
+ * @returns {string | null}
+ */
+export function routineCloseProblem(opts) {
+  const mine = opts.rows.filter((r) => r.block === opts.block && r.run === opts.runId);
+  if (mine.some((r) => typeof r.event === 'string' && r.event.includes('waiv'))) return 'waiver rows for block';
+  if (mine.some((r) => r.event === 'rule_break' || r.event === 'rule_break.accepted')) return 'rule_break or accepted hit for block';
+  const hits = acceptedTranscriptHits({ ...opts, transcript: opts.transcript ?? null, rows: [] }).remaining;
+  if (hits.length > 0) return `rule_break transcript line ${hits[0].line}: ${hits[0].id}`;
+  if (!mine.some((r) => r.event === 'gate.done' && r.all_ok === true && verified(r, opts.key))) return 'no signed green gate row';
+  const result = checkBlockReviews(opts);
+  if (!result.ok) return result.refusals.map((r) => `${r.code}${r.file ? ` ${r.file}` : ''}`).join('; ');
+  if (result.waivedAll.length > 0) return 'reviewed_by_waiver or answered-only file';
+  if (opts.files.length === 0) return 'no approved changed files';
+  return null;
+}
+
 /** B71: the signed row the worker writes for a finding a reviewer judged resolved by another owned file. */
 export const ANSWERED_EVENT = 'review.answered';
 
@@ -639,15 +657,16 @@ export function openFindings(findings) {
  * B52: the signed result files {@link denialOf} needs — one per `review.result` row of the block
  * that has no `approved` field (an old ledger) and is a verdict — keyed by ticket. A file that is
  * missing, unparsable, names another run or ticket, or fails its MAC is null.
- * @param {{repoRoot: string, runId: string, block: string, rows: Array<Record<string, any>>}} opts
+ * @param {{repoRoot: string, runId: string, block: string, rows: Array<Record<string, any>>, includeCurrent?: boolean}} opts
  *   `repoRoot`: the repository root the worker writes `.code-forge/reviews/` under.
+ *   `includeCurrent`: B138 decision lists also need claims from modern signed results.
  * @returns {Promise<Record<string, ResultFile>>}
  */
-export async function resultFilesFor({ repoRoot, runId, block, rows }) {
+export async function resultFilesFor({ repoRoot, runId, block, rows, includeCurrent = false }) {
   /** @type {Record<string, ResultFile>} */
   const out = {};
   for (const r of rows) {
-    if (r?.event !== 'review.result' || r.block !== block || Object.hasOwn(r, 'approved') || neverReviewed(r) || typeof r.ticket !== 'string' || Object.hasOwn(out, r.ticket)) continue;
+    if (r?.event !== 'review.result' || r.block !== block || (!includeCurrent && Object.hasOwn(r, 'approved')) || neverReviewed(r) || typeof r.ticket !== 'string' || Object.hasOwn(out, r.ticket)) continue;
     try {
       const checked = await verifyResult(repoRoot, runId, r.ticket);
       out[r.ticket] = checked.ok && checked.result ? { status: checked.result.status, approved: checked.result.approved, findings: checked.result.findings } : null;

package/src/review/lenses/recheck.md

@@ -10,6 +10,9 @@ that changed since that round, each with a window of the current file around it.
 - For every open finding, add one entry to `resolved`: `{id, resolved: true|false, why}`
   (`why` ≤ 200 chars). `resolved: true` only when the shown lines fix the problem without
   introducing a new one.
+- For `resolved: false`, you MUST add `current_lines` (≤ 300 chars): quote the exact current
+  line(s) from the packet that still show the problem, without line-number prefixes. Read the
+  changed lines; the old finding's claim and evidence alone cannot keep it open.
 - A new problem goes in `findings` ONLY when its `line_start..line_end` lies inside a shown fix
   hunk. Anything outside the hunks is not yours to report in this round.
 - `passed` is true only when every open finding is resolved and you raised no new `critical`

package/src/review/packet.mjs

@@ -223,6 +223,32 @@ export function assemblePacket({ diff, lens, rulesDigest = '', factsExcerpt = ''
   return { status: 'ok', text, hunkHeaders, contextMode: ctx.mode, contextLines: ctx.lineCount, digestLines: digest.length, tokensIn, budget: limit, overBudget: tokensIn > limit };
 }
 
+/** One full-budget packet for a light block; every diff and path heading is retained.
+ * @param {{diffs: FileDiff[], cfg?: Record<string, any>, rulesDigest?: string, factsExcerpt?: string}} opts
+ */
+export function assembleLightPacket({ diffs, cfg, rulesDigest = '', factsExcerpt = '' }) {
+  const lens = `${loadLens('full')}\nReview ALL files below in one round. Findings must name their exact file path. Echo every listed hunk in file order, including duplicates.`;
+  const diffText = diffs.map((diff) => `### ${diff.file}\n${diffSectionOf(diff)}`).join('\n\n');
+  const budget = budgetFor(cfg, 'full_in');
+  let digest = splitLines(rulesDigest).slice(0, DIGEST_MAX_LINES);
+  const context = (mode) => diffs.map((diff) => `### ${diff.file}\n${buildContext({ file: diff.file, content: diff.content, hunks: diff.hunks, cfg, mode }).text}`).join('\n\n');
+  let contextMode = 'auto';
+  let ctx = context(contextMode);
+  let text = render(lens, digest, factsExcerpt, ctx, diffText);
+  if (estimateTokens(text) > budget) {
+    contextMode = 'minimal';
+    ctx = context(contextMode);
+    text = render(lens, digest, factsExcerpt, ctx, diffText);
+  }
+  while (estimateTokens(text) > budget && digest.length > 0) {
+    digest = digest.slice(0, -1);
+    text = render(lens, digest, factsExcerpt, ctx, diffText);
+  }
+  const tokensIn = estimateTokens(text);
+  return { status: tokensIn > budget ? 'split_required' : 'ok', text, tokensIn, budget,
+    contextMode, hunkHeaders: diffs.flatMap((diff) => diff.hunks.map((h) => h.header)) };
+}
+
 /** Cap the entire section at full_in / 16 tokens, without cutting a UTF-8 character.
  * @param {string} paired @param {number} fullIn @returns {string}
  */

package/src/state/block.mjs

@@ -12,7 +12,7 @@
  */
 
 import { createHash, randomUUID } from 'node:crypto';
-import { createReadStream, existsSync, lstatSync, readlinkSync, realpathSync } from 'node:fs';
+import { createReadStream, existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { BLOCK_KINDS, blockKind, dispatchLevel } from '../decide/escalation.mjs';
@@ -25,6 +25,8 @@ import { StateError } from './paths.mjs';
 import { assertOwned, blocksOverlap, isExactEntry, ownsFile, scopeGate } from './registry.mjs';
 import { checkWorkerPin, readRun, saveRun, withRunLock, writeSigned } from './run.mjs';
 import { verifyRow, loadKey } from './signer.mjs';
+import * as reviewQueue from '../worker/queue.mjs';
+import { repoRootOf } from '../worker/ticket.mjs';
 
 /** @typedef {import('./run.mjs').WriteRow} WriteRow */
 
@@ -216,16 +218,18 @@ export function briefPointer(relPath, content) {
 
 /**
  * @param {unknown} clauses
- * @returns {{clause: string, tests: string[]}[]}
+ * @returns {import('../gates/acceptance.mjs').AcceptanceClause[]}
  */
 function assertAcceptance(clauses) {
   const ok =
     Array.isArray(clauses) &&
     clauses.length > 0 &&
     clauses.every(
-      (c) => typeof c?.clause === 'string' && c.clause.length > 0 && Array.isArray(c.tests) && c.tests.length > 0 && c.tests.every((t) => typeof t === 'string' && t.length > 0),
+      (c) => typeof c?.clause === 'string' && c.clause.length > 0 && (c.kind === 'human_check'
+        ? !Object.hasOwn(c, 'tests')
+        : Array.isArray(c.tests) && c.tests.length > 0 && c.tests.every((t) => typeof t === 'string' && t.length > 0)),
     );
-  if (!ok) throw new StateError('bad-acceptance', 'acceptance: a non-empty list of {clause, tests: [test ids…]} is required');
+  if (!ok) throw new StateError('bad-acceptance', 'acceptance: a non-empty list of {clause, tests: [test ids…]} or {clause, kind: human_check} without tests is required');
   return clauses;
 }
 
@@ -315,6 +319,7 @@ function refuseConfigOwner(owned, kinds, guarded) {
  * and the dispatch row carry the floor level, and the row adds `requested_level` and
  * `trigger: 'docs_floor'`. B52: the entry also records `tree_at_open` ({@link treeAtOpen}), the
  * tree's changes at open, which `block close` reads to tell the coder's changes from earlier ones.
+ * B134: `base_branch` is the workspace's current branch, or null when detached.
  * B58: with `review.external.required` set, an owned entry that owns the project's config is
  * refused (`config-owned`, {@link refuseConfigOwner}).
  * B59: `decision` (the rules lane of a brief-mode block) is written as a signed `decision` row
@@ -352,12 +357,13 @@ export async function openBlock(opts) {
   if (typeof level !== 'string' || !LEVEL.test(level)) throw new StateError('bad-level', 'level must be L0..L3');
   if (!Number.isInteger(attempt) || attempt < 1) throw new StateError('bad-attempt', 'attempt must be an integer >= 1');
   if (lines !== null && !(Number.isInteger(lines) && lines > 0)) throw new StateError('bad-lines', 'lines forecast must be a positive integer');
-  if (opts.kind !== undefined && !BLOCK_KINDS.includes(opts.kind)) throw new StateError('bad-kind', `kind must be one of ${BLOCK_KINDS.join(', ')}`);
+  if (opts.kind !== undefined && opts.kind !== 'light' && !BLOCK_KINDS.includes(opts.kind)) throw new StateError('bad-kind', `kind must be one of ${[...BLOCK_KINDS, 'light'].join(', ')}`);
   if (opts.decision && opts.decision.answer !== level) throw new StateError('bad-decision', `the decision answer ${opts.decision.answer} is not the requested level ${level}`);
   const owned = assertOwned(opts.owned);
   const acceptance = assertAcceptance(opts.acceptance);
+  const humanChecks = acceptance.filter((c) => c.kind === 'human_check').map((c) => c.clause);
   const tests = opts.tests === undefined ? null : [...assertOwned(opts.tests, { label: 'test files', code: 'bad-tests' })];
-  const kind = blockKind({ owned, declared: opts.kind });
+  const kind = opts.kind === 'light' ? 'light' : blockKind({ owned, declared: opts.kind });
   const dispatched = dispatchLevel({ lane: level, kind, cfg: opts.cfg });
   const pointer = opts.brief ? briefPointer(opts.brief.path, opts.brief.content) : null;
 
@@ -384,6 +390,7 @@ export async function openBlock(opts) {
   try {
     const { block, reused } = await mutateRun(runId, null, writeRow, async (record) => {
       if (record.blocks[id]?.status === 'open') throw new StateError('already-open', `block ${id} is already open`);
+      if (record.blocks[id]?.status === 'awaiting_human_check') throw new StateError('already-open', `block ${id} is awaiting a human check`);
       // B57: what each exact owned entry is on disk, under the lock (as `block claim`) — a regular
       // file owns only itself, here and in every later check
       const kinds = ownedKinds(record.workspace, owned);
@@ -391,6 +398,8 @@ export async function openBlock(opts) {
       const prior = previousTree(record);
       const baseSha = await resolveCommit(prior ? prior.base_sha : opts.base ?? 'HEAD', record.workspace);
       if (baseSha !== stampedBase || record.workspace !== workspace) throw new StateError('base-moved', `the base moved while block ${id} was being opened; run block open again`);
+      const branch = await git(['git', 'symbolic-ref', '--quiet', '--short', 'HEAD'], record.workspace, [0, 1]);
+      const baseBranch = branch.code === 0 ? branch.stdout.trim() : null;
       // B62a: the tree is planned (read-only checks) before the overlap check, which needs its path
       const planned = opts.worktree ? await opts.worktree({ baseSha, previous: prior }) : null;
       const self = { owned_files: owned, owned_kinds: kinds, worktree: planned ? { path: planned.path } : null };
@@ -402,7 +411,8 @@ export async function openBlock(opts) {
       // passed; a tree made here is rolled back below if the rows or the save then fail
       made = planned ? await planned.make() : null;
       const tree = made;
-      const entry = { block: id, base_sha: baseSha, owned_files: [...owned], owned_kinds: { ...kinds }, level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open', tree_at_open: treeOpen, ...(tests ? { test_files: tests } : {}), ...(tree ? { worktree: tree.worktree } : {}) };
+      const entry = { block: id, base_sha: baseSha, base_branch: baseBranch, owned_files: [...owned], owned_kinds: { ...kinds }, level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open', tree_at_open: treeOpen, ...(tests ? { test_files: tests } : {}), ...(tree ? { worktree: tree.worktree } : {}) };
+      if (humanChecks.length > 0) Object.assign(entry, { human_checks: humanChecks });
       record.blocks[id] = entry;
       const floor = dispatched.trigger === 'docs_floor' ? { requested_level: level, trigger: 'docs_floor' } : {};
       const created = tree?.created ? [{ event: 'worktree.created', block: id, path: tree.worktree.path, branch: tree.worktree.branch, base: tree.worktree.base_sha }] : [];
@@ -411,7 +421,7 @@ export async function openBlock(opts) {
         rows: [
           ...(opts.decision ? [{ ...opts.decision, event: 'decision', decision_id: opts.decisionId ?? randomUUID(), block: id }] : []),
           ...created,
-          { event: 'dispatch', block: id, level: dispatched.level, kind, ...floor, attempt, base_sha: baseSha, owned_files: entry.owned_files, lines_forecast: lines, ...(tests ? { test_files: tests } : {}) },
+          { event: 'dispatch', block: id, level: dispatched.level, kind, ...floor, attempt, base_sha: baseSha, base_branch: baseBranch, owned_files: entry.owned_files, lines_forecast: lines, ...(tests ? { test_files: tests } : {}) },
         ],
       };
     });
@@ -444,11 +454,14 @@ export async function attemptBlock({ runId, id, writeRow }) {
  * in between touched a file this block owns (that is a conflict ⇒ stop). Rename detection is OFF
  * (`--no-renames`): a rename lists both its old and its new path, so moving an owned file away
  * is a conflict too. Never silent. Owned means `ownsFile` (B57: a directory entry owns the files
- * below it). B62a: refused for a block with its own worktree (`worktree-rebase`).
+ * below it). B62a: refused for an open block with its own worktree (`worktree-rebase`).
+ * B134: a closed worktree block instead rebases its branch onto its recorded base branch,
+ * retaining every changed owned file's blob; a conflict or changed blob restores the old head.
  * @param {{runId: string, id: string, head?: string, writeRow: WriteRow}} opts
  * @returns {Promise<{old_base: string, new_base: string}>}
  */
 export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow }) {
+  if (['closed', 'awaiting_human_check'].includes((await readRun(runId)).blocks[id]?.status)) return rebaseClosedBlock({ runId, id, writeRow });
   return mutateRun(runId, id, writeRow, async (record, block) => {
     // B62a: a worktree block's base is the commit its tree started from; moving it would leave the
     // tree on its old base, so the rebase is refused
@@ -466,6 +479,75 @@ export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow }) {
   });
 }
 
+/**
+ * Hash committed paths, with null for a deletion. NUL-delimited tree entries preserve unusual
+ * file names; filter exact names because git's path selection may also return descendants.
+ * @param {string} cwd @param {string} ref @param {string[]} files
+ * @returns {Promise<Map<string, string | null>>}
+ */
+async function committedBlobs(cwd, ref, files) {
+  const hashes = new Map(files.map((file) => [file, /** @type {string | null} */ (null)]));
+  if (files.length === 0) return hashes;
+  const tree = await git(['git', 'ls-tree', '-r', '-z', '--full-tree', ref, '--', ...files], cwd);
+  for (const entry of tree.stdout.split('\0').filter(Boolean)) {
+    const tab = entry.indexOf('\t');
+    const file = entry.slice(tab + 1);
+    if (hashes.has(file)) hashes.set(file, entry.slice(0, tab).split(' ')[2]);
+  }
+  return hashes;
+}
+
+/**
+ * Closed blocks have a separate mutation path: check their status again under the lock,
+ * restore the branch on failure (including a failed signed write), and retain closed/awaiting status.
+ * @param {{runId: string, id: string, writeRow: WriteRow}} opts
+ * @returns {Promise<{old_base: string, new_base: string}>}
+ */
+async function rebaseClosedBlock({ runId, id, writeRow }) {
+  return withRunLock(runId, async () => {
+    const record = await readRun(runId);
+    if (record.status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
+    const block = record.blocks[id];
+    if (!['closed', 'awaiting_human_check'].includes(block?.status) || !block.worktree) throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
+    if (!block.base_branch) throw new StateError('rebase-no-base', `block ${id} has no recorded base branch`);
+    const tree = block.worktree.path;
+    const branch = await git(['git', 'symbolic-ref', '--quiet', 'HEAD'], tree, [0, 1]);
+    if (branch.stdout.trim() !== `refs/heads/${block.worktree.branch}`) throw new StateError('worktree-rebase', `block ${id}: its worktree is not on branch ${block.worktree.branch}`);
+    // A reset must never discard edits made after close, or abort an earlier rebase.
+    const status = await git(['git', 'status', '--porcelain'], tree);
+    if (status.stdout.length > 0) throw new StateError('rebase-conflict', 'rebase-conflict');
+    const oldHead = await resolveCommit('HEAD', tree);
+    const newBase = await resolveCommit(`refs/heads/${block.base_branch}`, record.workspace);
+    const top = await repoTop(record.workspace);
+    const prefix = path.relative(top, realpathSync(record.workspace)).split(path.sep).join('/');
+    const diff = await git(['git', 'diff', '--no-renames', '--name-only', '-z', block.base_sha, oldHead, '--'], tree);
+    const files = diff.stdout.split('\0').filter((file) => file.length > 0 && (
+      ownsFile(block.owned_files, file, block.owned_kinds) ||
+      (prefix !== '' && file.startsWith(`${prefix}/`) && ownsFile(block.owned_files, file.slice(prefix.length + 1), block.owned_kinds))
+    )).sort();
+    const before = await committedBlobs(tree, oldHead, files);
+    const moved = { old_base: block.base_sha, new_base: newBase };
+    try {
+      const rebased = await exec(['git', '-C', tree, 'rebase', newBase], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
+      if (rebased.result !== 'ok') throw new StateError('rebase-conflict', 'rebase-conflict');
+      const after = await committedBlobs(tree, 'HEAD', files);
+      const changed = files.filter((file) => before.get(file) !== after.get(file));
+      if (changed.length > 0) throw new StateError('rebase-changed-reviewed', `rebase-changed-reviewed ${changed.join(', ')}`);
+      block.base_sha = newBase;
+      block.worktree.base_sha = newBase;
+      await writeSigned(runId, writeRow, { event: 'block.rebase', block: id, ...moved, closed: true });
+      await saveRun(record);
+      return moved;
+    } catch (err) {
+      // --abort restores a conflicted rebase; after a completed rebase there is nothing to
+      // abort, and reset restores the old branch head. The tree was clean before either.
+      await exec(['git', '-C', tree, 'rebase', '--abort'], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
+      await git(['git', 'reset', '--hard', oldHead], tree);
+      throw err;
+    }
+  });
+}
+
 /**
  * `block claim` — assign one EXACT path (an orphan, or any unowned path) to `id`; refused for a
  * glob, and when another open block owns it — or anything it would own: the claimed path becomes an
@@ -513,13 +595,35 @@ export async function checkScope({ runId, id, files, writeRow }) {
 
 /** @param {{runId: string, id: string, reason: string, writeRow: WriteRow, event?: string}} opts */
 export async function stopBlock({ runId, id, reason, writeRow, event = 'block.stop' }) {
-  await mutateRun(runId, id, writeRow, (_record, block) => {
+  await mutateRun(runId, null, writeRow, (record) => {
+    const block = record.blocks[id];
+    if (!['open', 'awaiting_human_check'].includes(block?.status)) throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
     block.status = 'stopped';
     block.stop_reason = reason;
     return { result: undefined, rows: [{ event, block: id, reason }] };
   });
 }
 
+/**
+ * Called only after the CLI's terminal confirmation; recheck under the lock before signing.
+ * @param {{runId: string, id: string, note: string, proof?: string | null, writeRow: WriteRow, now?: Date}} opts
+ */
+export async function humanPassBlock({ runId, id, note, proof = null, writeRow, now = new Date() }) {
+  return mutateRun(runId, null, writeRow, (record) => {
+    const block = record.blocks[id];
+    if (block?.status !== 'awaiting_human_check') throw new StateError('not-awaiting', `block ${id} is not awaiting a human check`);
+    if (typeof note !== 'string' || note.trim().length === 0) throw new StateError('usage', 'block human-pass needs --note <text>');
+    if (proof !== null && (typeof proof !== 'string' || !existsSync(proof))) throw new StateError('usage', '--proof must name an existing directory or file');
+    const grant = record.autopilot;
+    if (grant && !['stopped', 'expired'].includes(grant.status) && !(now.getTime() >= Date.parse(grant.until))) {
+      throw new StateError('autopilot-active', `block human-pass is refused while an autopilot grant is active on run ${runId}`);
+    }
+    const row = { event: 'block.human_pass', block: id, note, proof, checks: [...block.human_checks], by: 'human' };
+    block.status = 'closed';
+    return { result: row, rows: [row] };
+  });
+}
+
 /**
  * B8's rows of the block gate, in order: worker pin ⇒ `worker.replaced`/`worker.down` (block
  * stopped); the block's signed `dispatch` row must exist and verify, and every other
@@ -533,16 +637,44 @@ export async function stopBlock({ runId, id, reason, writeRow, event = 'block.st
  *   livePid?: number, probe?: import('./run.mjs').StartTimeProbe,
  *   extraChecks?: Array<() => Promise<{ok: boolean, reason?: string}>>,
  *   closeRows?: Record<string, any>[],
+ *   dryRun?: boolean,
  * }} opts
- * @returns {Promise<{ok: boolean, status: 'closed' | 'stopped' | 'open', reason?: string, event?: string}>}
+ * @returns {Promise<{ok: boolean, status: 'closed' | 'awaiting_human_check' | 'stopped' | 'open', reason?: string, event?: string}>}
  */
-export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, extraChecks = [], closeRows = [] }) {
+export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, extraChecks = [], closeRows = [], dryRun = false }) {
   const record = await readRun(runId);
   if (record.blocks[id]?.status !== 'open') throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
 
-  const pin = await checkWorkerPin(record, { livePid, probe });
+  let pin = await checkWorkerPin(record, { livePid, probe });
+  const pins = record.workers ?? (record.worker ? [record.worker] : []);
+  const counted = rows.filter((row) => row.block === id && (row.run === undefined || row.run === runId) && row.event === 'review.result' && !['stale', 'unavailable', 'answers'].includes(row.status) && !(row.status === 'refused' && row.reason === 'other-run'));
+  // Ledgers written before B107 omit worker identity and use the run's pin check above.
+  if (counted.some((row) => row.worker !== undefined && !pins.some((p) => p.pid === row.worker?.pid && p.started_at === row.worker?.started_at))) {
+    pin = { ok: false, event: 'worker.replaced', reason: 'a counted review result does not name a pinned worker' };
+  }
+  if (pin.ok) {
+    const repoRoot = await repoRootOf(record.workspace);
+    let names;
+    try { names = readdirSync(reviewQueue.queueDir(repoRoot)); }
+    catch (err) { if (err.code !== 'ENOENT') throw err; names = []; }
+    for (const name of names.filter((n) => /^[0-9a-f]{24}\.json$/.test(n))) {
+      const ticket = name.slice(0, 24);
+      const queued = reviewQueue.readTicket(repoRoot, ticket);
+      if (queued.run !== runId || queued.block !== id) continue;
+      const claimKey = `ticket\0${runId}\0${ticket}`;
+      const file = path.join(os.homedir(), '.code-forge', 'locks', `${createHash('sha256').update(claimKey).digest('hex')}.lock`);
+      let claim;
+      try { claim = JSON.parse(readFileSync(file, 'utf8')); }
+      catch (err) { if (err.code === 'ENOENT') continue; throw err; }
+      const owner = pins.find((p) => p.pid === claim.pid && p.started_at === claim.start);
+      if (owner && !(await checkWorkerPin({ worker: owner }, { probe })).ok) {
+        pin = { ok: false, event: 'worker.down', reason: `dead pinned worker pid ${owner.pid} holds ticket ${ticket}` };
+        break;
+      }
+    }
+  }
   if (!pin.ok) {
-    await stopBlock({ runId, id, reason: pin.reason, writeRow, event: pin.event });
+    if (!dryRun) await stopBlock({ runId, id, reason: pin.reason, writeRow, event: pin.event });
     return { ok: false, status: 'stopped', event: pin.event, reason: pin.reason };
   }
 
@@ -555,25 +687,35 @@ export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, ex
     const reasons = bad.map((x) => `${x.row.event}: ${x.result.reason}`);
     if (!dispatchOk) reasons.push('no verified dispatch row');
     const reason = reasons.join('; ');
-    await stopBlock({ runId, id, reason, writeRow, event: 'ledger.tamper' });
+    if (!dryRun) await stopBlock({ runId, id, reason, writeRow, event: 'ledger.tamper' });
     return { ok: false, status: 'stopped', event: 'ledger.tamper', reason };
   }
 
+  const failures = [];
   for (const check of extraChecks) {
     const result = await check();
-    if (!result.ok) return { ok: false, status: 'open', reason: result.reason ?? 'check failed' };
+    if (!result.ok) {
+      if (!dryRun) return { ok: false, status: 'open', reason: result.reason ?? 'check failed' };
+      failures.push(result.reason ?? 'check failed');
+    }
+  }
+  if (dryRun) {
+    if (record.orphans.length > 0) failures.push(`orphans: ${record.orphans.join(', ')}`);
+    return { ok: failures.length === 0, status: 'open', ...(failures.length ? { reason: failures.join('; ') } : {}) };
   }
 
-  /** @typedef {{ok: boolean, status: 'closed' | 'stopped' | 'open', reason?: string, event?: string}} CloseResult */
+  /** @typedef {{ok: boolean, status: 'closed' | 'awaiting_human_check' | 'stopped' | 'open', reason?: string, event?: string}} CloseResult */
   return mutateRun(runId, id, writeRow, (current, block) => {
     if (current.orphans.length > 0) {
       /** @type {CloseResult} */
       const refused = { ok: false, status: 'open', reason: `orphans: ${current.orphans.join(', ')}` };
       return { result: refused, rows: [] };
     }
-    block.status = 'closed';
+    const checks = block.human_checks ?? [];
+    block.status = checks.length > 0 ? 'awaiting_human_check' : 'closed';
     /** @type {CloseResult} */
-    const closed = { ok: true, status: 'closed' };
-    return { result: closed, rows: [...closeRows, { event: 'block.close', block: id, status: 'complete' }] };
+    const closed = { ok: true, status: block.status };
+    return { result: closed, rows: [...closeRows, { event: 'block.close', block: id, status: 'complete' },
+      ...(checks.length > 0 ? [{ event: 'block.awaiting_human_check', block: id, checks }] : [])] };
   });
 }