@codedology/code-forge 0.14.1 → 0.15.1

package/src/util/forbidden.mjs

@@ -282,6 +282,7 @@ export const FORBIDDEN = Object.freeze(
  *  - `--no-require-reviews` — the human's way out of `block close`'s per-file review check;
  *  - `--remove-worktree` (B62a) — `block close` removing the block's worktree, the orchestrator's
  *    alone. `block close` itself is not on this list, so the flag is listed on its own.
+ *  - `code-forge block human-pass` (B137) — passing a human device check is human-only.
  * @type {ReadonlyArray<ForbiddenEntry>}
  */
 export const CODER_ONLY_FORBIDDEN = Object.freeze(
@@ -346,6 +347,25 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
       prefixes: [['code-forge', 'block', 'ack-waivers'], ['forge', 'block', 'ack-waivers']],
       description: 'Acknowledge agent waivers — human-only, confirmed in the human terminal (B124b)',
     },
+    {
+      id: 'code-forge-block-human-pass-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [['code-forge', 'block', 'human-pass'], ['forge', 'block', 'human-pass']],
+      description: 'Pass a human device check — human-only, confirmed in the human terminal (B137)',
+    },
+    {
+      id: 'code-forge-add-worker-from-coder',
+      kind: 'commandFlag',
+      command: ['code-forge', 'run', 'start'],
+      groups: [{ anyOf: ['--add-worker'] }],
+      description: 'Add a review worker to a run — the orchestrator only (B107)',
+    },
+    {
+      id: 'code-forge-block-amend-acceptance-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [['code-forge', 'block', 'amend-acceptance'], ['forge', 'block', 'amend-acceptance']],
+      description: 'Correct a block acceptance list — human-only, confirmed in the human terminal (B143)',
+    },
   ].map(freezeEntry),
 );
 
@@ -805,6 +825,194 @@ export function renderForCodex(list = FORBIDDEN) {
 
 // ── Transcripts ──────────────────────────────────────────────────────────────
 
+/**
+ * Mask inert, non-shell interpreter bodies for command/contains rules only. Walk shell
+ * words and queued heredocs once; unknown commands, malformed quotes and unfinished
+ * heredocs stay fail closed. Decode at most one shell -c wrapper; deeper wrappers
+ * stay whole. This deliberately does not evaluate shell expansions.
+ * @param {string} command
+ * @param {boolean} [unwrapShell]
+ * @returns {string}
+ */
+function transcriptCommandText(command, unwrapShell = true) {
+  if (unwrapShell) {
+    const wrapper = /^\s*(?:[^\s'"\\;|&()<>`$]+\/)?(?:sh|bash|zsh|dash|ksh)(?:[ \t]+-[li]+)*[ \t]+-[li]*c[ \t]+(['"])/.exec(command);
+    if (wrapper) {
+      let quote = wrapper[1];
+      const parts = [];
+      let i = wrapper[0].length;
+      while (i < command.length) {
+        const char = command[i++];
+        if (char === quote) {
+          // A shell word can splice opposite-quoted text into its enclosing
+          // quotes, as in "script"'literal'"rest". Require the enclosing
+          // quote again at the end; uncertain suffixes still scan whole.
+          if (command[i] === (quote === '"' ? "'" : '"')) {
+            quote = command[i++];
+            continue;
+          }
+          if (quote !== wrapper[1] || command.slice(i).trim() !== '') return command;
+          const prefix = command.slice(0, wrapper[0].length - 1);
+          return prefix + transcriptCommandText(parts.join(''), false);
+        }
+        // Within double quotes, other backslashes are literal; single quotes
+        // preserve every character. A backslash-newline pair disappears.
+        if (quote === '"' && char === '\\' && /["\\$`\n]/.test(command[i] ?? '')) {
+          const escaped = command[i++];
+          if (escaped !== '\n') parts.push(escaped);
+        } else {
+          // Keep the source segment's quote context until after this check:
+          // the parent shell expands these even inside an inner quoted heredoc.
+          // Single-quoted splices and the escaped characters above are literal.
+          // Unquoted splices already fail closed at the closing-quote check.
+          if (quote === '"' && (char === '`' || (char === '$' && command[i] === '('))) return command;
+          parts.push(char);
+        }
+      }
+      return command;
+    }
+  }
+  const spawnWord = /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|fork|system|popen|subprocess|child_process|Popen)\b/;
+  const interpreter = /^(node|python|python3|ruby|perl)(?:\d+(?:\.\d+)*)?$/;
+  /** @param {string} body */
+  const hasShellSubstitution = (body) => {
+    for (let i = 0; i < body.length; i += 1) {
+      // Skip escaped characters in pairs so even backslash runs still expand.
+      if (body[i] === '\\') { i += 1; continue; }
+      if (body[i] === '`' || (body[i] === '$' && body[i + 1] === '(')) return true;
+    }
+    return false;
+  };
+  /** @param {string} body @param {string} language @param {boolean} shellExpands */
+  const hasSpawn = (body, language, shellExpands) => spawnWord.test(body)
+    || (shellExpands && hasShellSubstitution(body))
+    || ((language === 'ruby' || language === 'perl') && /`|\$\(|%x/.test(body))
+    || (language === 'perl' && /\bqx\b/.test(body));
+  const evalFlags = new Set(['-e', '-c', '--eval', '-p', '--print']);
+  /** @type {{start: number, end: number}[]} */
+  const inert = [];
+  /** @type {{delimiter: string, tabs: boolean, language: string, shellExpands: boolean}[]} */
+  let heredocs = [];
+  let state = 'command';
+  let language = '';
+  let evalNext = false;
+  let envValue = false;
+  let redirect = '';
+  let i = 0;
+  while (i < command.length) {
+    const char = command[i];
+    if (char === '\n') {
+      i += 1;
+      for (const doc of heredocs) {
+        const start = i;
+        let closed = false;
+        while (i < command.length) {
+          const newline = command.indexOf('\n', i);
+          const end = newline < 0 ? command.length : newline;
+          const line = command.slice(i, end);
+          if ((doc.tabs ? line.replace(/^\t+/, '') : line) === doc.delimiter) {
+            if (doc.language && !hasSpawn(command.slice(start, i), doc.language, doc.shellExpands)) inert.push({ start, end: i });
+            i = newline < 0 ? end : end + 1;
+            closed = true;
+            break;
+          }
+          i = newline < 0 ? end : end + 1;
+        }
+        if (!closed) return command;
+      }
+      heredocs = [];
+      state = 'command';
+      evalNext = false;
+      redirect = '';
+      continue;
+    }
+    if (/\s/.test(char)) { i += 1; continue; }
+    if (char === '#') {
+      const newline = command.indexOf('\n', i);
+      i = newline < 0 ? command.length : newline;
+      continue;
+    }
+    if (';|&()'.includes(char)) {
+      state = 'command';
+      evalNext = false;
+      i += 1;
+      continue;
+    }
+    if (char === '<' || char === '>') {
+      redirect = char;
+      i += 1;
+      if (command[i] === char) { redirect += char; i += 1; }
+      if (redirect === '<<' && command[i] === '-') { redirect += '-'; i += 1; }
+      // Here-strings and other uncertain shell syntax are never exempted.
+      if (command[i] === '<') return command;
+      continue;
+    }
+    const start = i;
+    const parts = [];
+    let quotes = 0;
+    let quote = '';
+    let escaped = false;
+    let unquoted = false;
+    while (i < command.length && !/[\s;|&()<>]/.test(command[i])) {
+      const next = command[i++];
+      if (next === "'" || next === '"') {
+        quotes += 1;
+        quote = next;
+        let closed = false;
+        while (i < command.length) {
+          const inside = command[i++];
+          if (inside === next) { closed = true; break; }
+          if (inside === '\\' && next === '"' && i < command.length) parts.push(command[i++]);
+          else parts.push(inside);
+        }
+        if (!closed) return command;
+      } else {
+        unquoted = true;
+        if (next === '\\') escaped = true;
+        parts.push(next === '\\' && i < command.length ? command[i++] : next);
+      }
+    }
+    const word = parts.join('');
+    if (redirect) {
+      if (redirect.startsWith('<<')) heredocs.push({
+        delimiter: word, tabs: redirect === '<<-', language: state === 'interpreter' ? language : '',
+        shellExpands: quotes === 0 && !escaped,
+      });
+      redirect = '';
+      continue;
+    }
+    if (state === 'env') {
+      if (envValue) { envValue = false; continue; }
+      if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(word) || ['-i', '--ignore-environment'].includes(word)) continue;
+      if (['-u', '--unset', '-C', '--chdir'].includes(word)) { envValue = true; continue; }
+      if (word === '--') { state = 'command'; continue; }
+      if (word.startsWith('-')) { state = 'other'; continue; }
+      state = 'command';
+    }
+    if (state === 'command') {
+      if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(word)) continue;
+      const name = word.slice(word.lastIndexOf('/') + 1);
+      language = interpreter.exec(name)?.[1] ?? '';
+      state = name === 'env' ? 'env' : language ? 'interpreter' : 'other';
+    } else if (state === 'interpreter') {
+      if (evalNext) {
+        if (quotes === 1 && !unquoted && !hasSpawn(command.slice(start, i), language, quote === '"')) inert.push({ start, end: i });
+        evalNext = false;
+      } else if (evalFlags.has(word)) evalNext = true;
+      else if (!word.startsWith('-') || word === '--') state = 'other';
+    }
+  }
+  if (heredocs.length > 0) return command;
+  const chunks = [];
+  let end = 0;
+  for (const span of inert) {
+    chunks.push(command.slice(end, span.start), ' ');
+    end = span.end;
+  }
+  chunks.push(command.slice(end));
+  return chunks.join('');
+}
+
 /**
  * Scan captured coder output (subprocess stdout, Solo `search_output` text, a harness log) for
  * any entry of `list`, line by line: each line is split into shell-ish tokens (whitespace,
@@ -815,7 +1023,18 @@ export function renderForCodex(list = FORBIDDEN) {
  * Codex `exec --json` logs (every non-empty line an object with a string `type`, first event
  * `thread.started`) scan command_execution commands and file_change paths as writes. Other
  * items scan whole, except agent_message and reasoning; a command_execution's aggregated_output
- * is never scanned; non-item events are skipped. Any other log uses the plain-text grep above, unchanged.
+ * is never scanned; non-item events are skipped. For string commands, node/python/ruby/perl
+ * heredocs and quoted -e/-c/--eval/-p/--print bodies without a process-spawn word are omitted
+ * from command and contains rules only; path rules still scan the whole command. Backticks and
+ * $( count when unescaped and the shell expands the body (unquoted heredoc delimiter or double-quoted inline
+ * script), or for Ruby/Perl; %x counts for Ruby/Perl, and qx for Perl. Quoted or backslash-escaped
+ * heredoc delimiters and single-quoted inline scripts prevent shell expansion. One sh/bash/zsh/
+ * dash/ksh -c wrapper (including -lc/-ic and -l -c) with a single quoted script (including
+ * opposite-quoted splices) is decoded first; its prefix remains scanned. Unescaped parent-shell
+ * substitutions in double-quoted wrapper segments keep the entire command scanned; single-quoted
+ * splices are literal at that layer. Unquoted splices, nested wrappers,
+ * malformed wrappers, shell/unknown heredocs and
+ * unterminated bodies scan whole. Any other log uses the plain-text grep above, unchanged.
  *
  * Linear in the line length: `contains` and `path` entries are evaluated ONCE per line over its
  * tokens (a `write` path entry hits when a write command starts before a token naming the path);
@@ -850,13 +1069,17 @@ export function scanTranscript(text, list = FORBIDDEN) {
   const hits = [];
   lines
     .forEach((lineText, index) => {
+      let commandText;
       if (events !== null) {
         const event = events[index];
         if (!event?.type.startsWith('item.') || !event.item) return;
         const item = event.item;
         if (item.type === 'agent_message' || item.type === 'reasoning') return;
         // a command that is not a string is scanned with the rest of its item (fail closed), its output left out
-        if (item.type === 'command_execution') lineText = typeof item.command === 'string' ? item.command : JSON.stringify({ ...item, aggregated_output: undefined });
+        if (item.type === 'command_execution') {
+          lineText = typeof item.command === 'string' ? item.command : JSON.stringify({ ...item, aggregated_output: undefined });
+          if (typeof item.command === 'string') commandText = transcriptCommandText(lineText);
+        }
         else if (item.type === 'file_change') {
           lineText = (Array.isArray(item.changes) ? item.changes : [])
             .filter((change) => typeof change?.path === 'string')
@@ -864,20 +1087,21 @@ export function scanTranscript(text, list = FORBIDDEN) {
         } else lineText = JSON.stringify(item);
       }
       const tokens = lineText.split(/(>>?)|[\s'"`;|&(),{}[\]]+/).filter((t) => typeof t === 'string' && t.length > 0);
+      const commandTokens = commandText === undefined ? tokens : commandText.split(/(>>?)|[\s'"`;|&(),{}[\]]+/).filter((t) => typeof t === 'string' && t.length > 0);
       const ids = new Set();
       let firstWrite = -1;
       for (let i = 0; i < tokens.length && firstWrite < 0; i += 1) {
         if (writeStarts.has(commandName(tokens[i])) && isWriteCommand(tokens.slice(i, i + TRANSCRIPT_WINDOW))) firstWrite = i;
       }
       for (const entry of list) {
-        if (entry.kind === 'contains' && matchesEntry([], tokens, entry)) ids.add(entry.id);
+        if (entry.kind === 'contains' && matchesEntry([], commandTokens, entry)) ids.add(entry.id);
         if (entry.kind !== 'path') continue;
         const named = tokens.findIndex((t, i) => (entry.access === 'readwrite' || (firstWrite >= 0 && i > firstWrite)) && namesPath(t, entry));
         if (named >= 0) ids.add(entry.id);
       }
-      for (let i = 0; i < tokens.length; i += 1) {
-        if (!firstWords.has(commandName(tokens[i])) && !tokens[i].includes('code-forge')) continue;
-        const window = tokens.slice(i, i + TRANSCRIPT_WINDOW);
+      for (let i = 0; i < commandTokens.length; i += 1) {
+        if (!firstWords.has(commandName(commandTokens[i])) && !commandTokens[i].includes('code-forge')) continue;
+        const window = commandTokens.slice(i, i + TRANSCRIPT_WINDOW);
         for (const entry of commandEntries) {
           if (!ids.has(entry.id) && isForbidden(window, [entry])) ids.add(entry.id);
         }

package/src/util/reaper.mjs

@@ -27,7 +27,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 
@@ -85,7 +85,7 @@ export function isAlive(pid) {
 export function readStartTime(pid) {
   if (!isValidPid(pid)) return null;
   try {
-    const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+    const out = execFileSync(existsSync('/bin/ps') ? '/bin/ps' : 'ps', ['-o', 'lstart=', '-p', String(pid)], {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
@@ -165,7 +165,7 @@ export function groupMembers(pgid) {
   const members = new Map();
   let out = '';
   try {
-    out = execFileSync('ps', ['-A', '-o', 'pid=,pgid=,lstart='], {
+    out = execFileSync(existsSync('/bin/ps') ? '/bin/ps' : 'ps', ['-A', '-o', 'pid=,pgid=,lstart='], {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       env: { ...process.env, LC_ALL: 'C', LANG: 'C' },

package/src/worker/engine.mjs

@@ -95,13 +95,13 @@ import { askJev } from '../decide/jev-client.mjs';
 import { planAndRecord, tierOf } from '../review/budget.mjs';
 import { budgetFor } from '../review/packet.mjs';
 import { ContextError, reviewDigest } from '../context/pack.mjs';
-import { reviewFile, rulesRisk } from '../review/engine.mjs';
+import { reviewFile, reviewLightBatch, rulesRisk } from '../review/engine.mjs';
 import { reviewAnswers } from '../review/answers.mjs';
 import { peerDiffReader } from '../review/moved.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
 import { extraRoundsFor, newFileState, reopenForExtraRound, runRound } from '../review/fixloop.mjs';
 import { reopenRowFor } from '../review/reopen.mjs';
-import { readRun } from '../state/run.mjs';
+import { processStartTime, readRun } from '../state/run.mjs';
 import { StateError } from '../state/paths.mjs';
 import { blockTree, worktreeRecord } from '../proof/worktree.mjs';
 import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
@@ -109,7 +109,7 @@ import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
 import { withLock } from '../util/file-locks.mjs';
 import { blockAnchors, blockRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
-import { assertAnswers } from './queue.mjs';
+import { assertAnswers, enqueueHash, isDone, writeResult } from './queue.mjs';
 import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } from './ticket.mjs';
 
 /**
@@ -127,6 +127,8 @@ import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } fro
  *   the worker's and a per-call `cfg` wins).
  * @property {(row: Record<string, any>) => Promise<unknown>} [writeRow] - a signed ledger row
  *   (the worker adds `run`, `block`, `file`, `content_hash`).
+ * @property {(row: Record<string, any>) => Promise<unknown>} [writeBlockRow] - light fanout rows;
+ *   the worker pins run and block, while the batch supplies each file and content hash.
  * @property {Buffer} [key] - the run's HMAC key: signs the fix-loop state. Absent ⇒ engine only.
  * @property {() => Promise<Array<Record<string, any>>>} [readRows] - the run's ledger rows (the
  *   `review.state` anchors the state is checked against); required with `key`.
@@ -169,7 +171,7 @@ import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } fro
  * `tree` (B62b) is the recorded `worktree` `{path, branch, base_sha}`, null when the block has
  * none; `base` is then the tree's `base_sha`. A recorded worktree that `worktreeRecord` refuses
  * (path, branch, hex base_sha) throws `worktree-malformed`.
- * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, testFiles: string[], acceptance?: unknown, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
+ * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, testFiles: string[], acceptance?: unknown, acceptance_revision?: string, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
  */
 export async function blockEntryFor(runId, block) {
   let record;
@@ -197,7 +199,7 @@ export async function blockEntryFor(runId, block) {
       throw new Error('worktree-malformed');
     }
   }
-  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, testFiles, acceptance: entry.acceptance, kind: blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
+  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, testFiles, acceptance: entry.acceptance, acceptance_revision: entry.acceptance_revision, kind: entry.kind === 'light' ? 'light' : blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
 }
 
 /** @typedef {{path: string, branch: string, base_sha: string}} WorktreeEntry */
@@ -352,6 +354,9 @@ export async function reviewTicket(ticket, ctx) {
     return { status: 'unavailable', reason: err instanceof Error ? err.message : 'run-record-unreadable', approved: false, engine: 'adaptive', sessions: [] };
   }
   if (entry.kind === null) entry = { ...entry, kind: blockKind({ owned: [ticket.file] }) };
+  if (!ticket.kind && ticket.acceptance_revision !== entry.acceptance_revision) {
+    return { status: 'stale', reason: 'acceptance-amended', approved: false, engine: 'adaptive', sessions: [] };
+  }
   // B62b: every content read of this ticket happens in the block's tree (the main tree without
   // one), taken from the SAME entry as the base and the facts. The worker passes the tree it
   // hashed the ticket in as `ctx.contentRoot`; a record that changed since names another tree.
@@ -411,6 +416,10 @@ export async function reviewTicket(ticket, ctx) {
       return { status: 'unavailable', reason: 'context-unreadable', approved: false, engine: 'adaptive', sessions: [] };
     }
     const digest = rulesDigest === '' ? {} : { rulesDigest };
+    if (entry.kind === 'light' && ctx.key) {
+      const batch = await lightRound(ticket, tctx, { entry, workDir, factsExcerpt, rulesDigest });
+      if (batch) return batch;
+    }
     if (!ctx.key) {
       return await reviewFile(
         { repoRoot: contentRoot, file: ticket.file, base: entry.base, cfg: ctx.cfg, kind: entry.kind, workDir, factsExcerpt, ...digest, peerDiffs, ...(await fileContext()) },
@@ -423,6 +432,56 @@ export async function reviewTicket(ticket, ctx) {
   }
 }
 
+/** Serialize a light block across tickets/workers; durable signed rows enforce the two-batch cap.
+ * A batch completes every file's queue ticket, including files queued after this ticket started.
+ * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
+ * @param {{entry: Awaited<ReturnType<typeof blockEntryFor>>, workDir: string, factsExcerpt: string, rulesDigest: string}} input
+ * @returns {Promise<ReviewOutcome | null>} null enters the ordinary per-file loop.
+ */
+async function lightRound(ticket, ctx, { entry, workDir, factsExcerpt, rulesDigest }) {
+  if (!ctx.key || !ctx.readRows || !ctx.writeBlockRow) return { status: 'unavailable', reason: 'no-ledger', approved: false, engine: 'adaptive', sessions: [] };
+  const key = ctx.key, readRows = ctx.readRows, writeRow = ctx.writeBlockRow;
+  const worker = { pid: process.pid, started_at: await processStartTime(process.pid) };
+  return withLock(`light:${ctx.runId}\0${ticket.block}`, async () => {
+    const root = ctx.contentRoot ?? ctx.repoRoot;
+    const files = (await computeFileSet({ cwd: root, base: entry.base ?? 'HEAD' })).all.filter((file) => ownsFile(entry.owned, file, entry.ownedKinds)).sort();
+    const hashes = files.map((file) => ({ file, content_hash: contentHash(root, file) }));
+    if (!hashes.some((f) => f.file === ticket.file && f.content_hash === ticket.content_hash)) return { status: 'stale', approved: false, engine: 'adaptive', sessions: [] };
+    const signature = JSON.stringify([entry.base, hashes]);
+    const rows = (await readRows()).filter((r) => r.run === ctx.runId && r.block === ticket.block && verifyRow(r, key).ok);
+    const cached = rows.filter((r) => r.event === 'review.light_result' && r.signature === signature).at(-1)?.outcomes?.[ticket.file];
+    if (cached && (cached.status === 'reviewed' || isDone(ctx.repoRoot, ticket.ticket))) return cached;
+    const count = rows.filter((r) => r.event === 'review.light_batch').length;
+    if (count >= 2) return null;
+    const round = count + 1;
+    // Reserve before the session: a crash cannot reset the cap on a worker restart.
+    await writeRow({ event: 'review.light_batch', round, signature });
+    const batch = await reviewLightBatch({ repoRoot: root, files, base: entry.base, cfg: ctx.cfg, workDir, factsExcerpt, rulesDigest }, { spawn: ctx.spawn, writeRow });
+    const moved = hashes.some((f) => contentHash(root, f.file) !== f.content_hash);
+    const findings = batch.findings ?? [];
+    const blocking = findings.some((f) => f.severity === 'critical' || f.severity === 'warning');
+    /** @type {Record<string, ReviewOutcome>} */
+    const outcomes = {};
+    for (const { file, content_hash } of hashes) {
+      const own = findings.filter((f) => f.file === file);
+      const approved = !moved && batch.status === 'reviewed' && (batch.approved || blocking) && own.every((f) => f.severity === 'nit');
+      const outcome = { ...batch, ...(moved ? { status: 'stale' } : {}), approved, findings: own, round, kind: 'full', level: entry.level,
+        next: { action: approved ? 'complete' : 'fix', level: entry.level } };
+      outcomes[file] = outcome;
+      if (batch.status === 'reviewed' && !moved) {
+        await writeRow({ event: 'review.round', file, content_hash, round, kind: 'full', level: entry.level, open_after: own.filter((f) => f.severity !== 'nit').length });
+        if (approved) await writeRow({ event: 'review.approved', file, content_hash });
+      }
+      const queued = enqueueHash({ repoRoot: ctx.repoRoot, run: ctx.runId, block: ticket.block, file, content_hash, ...(ticket.tree ? { tree: ticket.tree } : {}) });
+      const open = approved ? [] : own;
+      await writeRow({ event: 'review.result', ticket: queued.ticket, file, content_hash, status: outcome.status, approved, open, worker });
+      writeResult({ repoRoot: ctx.repoRoot, runId: ctx.runId, ticket: queued.ticket, result: { ...outcome, block: ticket.block, file, content_hash, open, worker }, key });
+    }
+    await writeRow({ event: 'review.light_result', signature, outcomes });
+    return outcomes[ticket.file];
+  });
+}
+
 /**
  * B56: the block's OTHER changed files — the §4.1 file set since the block base (tracked changes ∪
  * untracked), filtered to the block's owned files (`ownsFile`, as the budget row does), minus the
@@ -565,7 +624,16 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       seq: loaded.seq,
       contentHash: ticket.content_hash,
     };
-    const reopened = reopenRowFor(rows, reopenAt) !== null;
+    let amendedAt = -1;
+    let anchoredAt = -1;
+    rows.forEach((row, i) => {
+      if (row.block !== ticket.block || !verifyRow(row, key).ok) return;
+      if (row.event === 'block.acceptance_amended') amendedAt = i;
+      if (row.event === 'review.state' && row.file === ticket.file) anchoredAt = i;
+    });
+    // A changed review input starts a full round, including previously stopped files. Keep
+    // the anchor sequence and the block's spent L3 rung; tampered state still refuses above.
+    const reopened = amendedAt > anchoredAt || reopenRowFor(rows, reopenAt) !== null;
     if (loaded.status === 'lost' && !reopened) return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-lost', message: LOST_MESSAGE, approved: false, engine: 'adaptive', sessions: [] }) };
     let seq = loaded.seq;
     if (loaded.status === 'restored' && loaded.state !== null && !reopened) {

package/src/worker/loop.mjs

@@ -42,12 +42,13 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { expiryChecks } from '../autopilot/limits.mjs';
 import { loadProjectConfig } from '../config/load.mjs';
+import { reviewWorkers } from '../config/validate.mjs';
 import { cacheHoursFrom, createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
 import { runRecordPath } from '../state/paths.mjs';
-import { readRun, reattachWorker } from '../state/run.mjs';
+import { processStartTime, readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
 import { logWarning } from '../util/error-log.mjs';
 import { withLock, tryLock } from '../util/file-locks.mjs';
@@ -260,6 +261,7 @@ export function recordedVerdict(result) {
  */
 export async function createWorker(opts, deps = {}) {
   const { runId, repoRoot, cfg, runRootDir, slug, key } = opts;
+  const identity = { pid: process.pid, started_at: await processStartTime(process.pid) };
   const env = deps.env ?? process.env;
   const review = deps.review ?? reviewTicket;
   const spawn = deps.spawn ?? spawnSession;
@@ -382,6 +384,7 @@ export async function createWorker(opts, deps = {}) {
           { env: childEnv, ...(deps.bins ? { bins: deps.bins } : {}), ...(deps.stderr ? { stderr: deps.stderr } : {}) },
         ),
       writeRow: (row) => ledger({ ...row, block: ticket.block, file: ticket.file, content_hash: ticket.content_hash }),
+      writeBlockRow: (row) => ledger({ ...row, block: ticket.block }),
     };
     try {
       const outcome = await review(ticket, ctx);
@@ -484,12 +487,14 @@ export async function createWorker(opts, deps = {}) {
    * @param {string} id @param {Record<string, any>} outcome - recorded through {@link recordedVerdict}.
    */
   async function complete(id, outcome) {
-    const result = recordedVerdict(outcome);
+    /** @type {Record<string, any>} */
+    const result = { ...recordedVerdict(outcome), worker: identity };
     const signed = writeResult({ repoRoot, runId, ticket: id, result, key });
     try {
       await ledger({
         event: 'review.result',
         ticket: id,
+        worker: identity,
         block: result.block ?? null,
         file: result.file ?? null,
         content_hash: result.content_hash ?? null,
@@ -793,9 +798,6 @@ export async function createWorker(opts, deps = {}) {
   return { processTicket, drain, run, once, stop, release, announce, watchTick: tickWatch, jevKeyResolved: jevKey !== null, sessionEnv: childEnv };
 }
 
-/** This block permits one registered worker per queue. */
-const WORKER_LIMIT = 1;
-
 /**
  * Start-up for the `worker` verb: run record, repo root, config, run temp root (owned by this
  * process), run key; refuses when another live worker already serves this queue.
@@ -831,7 +833,10 @@ export async function bootWorker(opts, deps = {}) {
     const legacy = liveWorker(repoRoot);
     if (legacy && !entries.some((entry) => entry.worker?.pid === legacy.pid && entry.worker.start_time === legacy.start_time)) count++;
     await deps.hooks?.afterCount?.(count);
-    if (count >= WORKER_LIMIT) throw new WorkerError('worker-running', 'a live or unreadable worker entry already serves this queue');
+    const limit = reviewWorkers(cfg);
+    if (entries.some((entry) => entry.live && !entry.worker) || (legacy && legacy.run !== opts.runId) || entries.some((entry) => entry.live && entry.worker?.run !== opts.runId) || count >= limit) {
+      throw new WorkerError('worker-running', `review.workers limit ${limit}: a live or unreadable worker entry already serves this queue`);
+    }
     worker.announce();
   });
   return { ...worker, repoRoot, runRootDir };
@@ -844,10 +849,10 @@ export async function bootWorker(opts, deps = {}) {
  * `expectPid` (a `run start` that just launched a worker) pins ONLY that pid: an older or stale
  * announcement naming another live pid is refused (`worker_mismatch`) instead of being pinned
  * over the new worker.
- * @param {{runId: string, repoRoot: string, writeRow?: (row: Record<string, any>) => Promise<unknown>, probe?: import('../state/run.mjs').StartTimeProbe, expectPid?: number}} opts
+ * @param {{runId: string, repoRoot: string, writeRow?: (row: Record<string, any>) => Promise<unknown>, probe?: import('../state/run.mjs').StartTimeProbe, expectPid?: number, add?: boolean}} opts
  */
-export async function repinWorker({ runId, repoRoot, writeRow, probe, expectPid }) {
-  const live = liveWorker(repoRoot);
+export async function repinWorker({ runId, repoRoot, writeRow, probe, expectPid, add = false }) {
+  const live = (expectPid === undefined ? null : liveWorker(repoRoot, { pid: expectPid, registeredOnly: true })) ?? liveWorker(repoRoot);
   if (!live) throw new WorkerError('worker_down', 'no live worker serves this queue');
   if (live.run !== runId) throw new WorkerError('other-run', `the live worker serves run ${live.run}`);
   if (expectPid !== undefined && live.pid !== expectPid) {
@@ -855,7 +860,7 @@ export async function repinWorker({ runId, repoRoot, writeRow, probe, expectPid
   }
   const { project } = await readRun(runId);
   const write = writeRow ?? ((/** @type {Record<string, any>} */ row) => appendRow(row, { slug: project }));
-  return reattachWorker({ runId, workerPid: live.pid, writeRow: write, ...(probe ? { probe } : {}) });
+  return reattachWorker({ runId, workerPid: live.pid, writeRow: write, add, ...(probe ? { probe } : {}) });
 }
 
 /** The CLI entry the worker is launched from. */
@@ -887,5 +892,9 @@ export async function launchWorker({ runId, workspace, env = process.env, timeou
       // already gone
     }
   }
+  const other = liveWorker(repoRoot);
+  if (other && other.run !== runId) {
+    throw new WorkerError('worker_down', `the worker did not start: run ${other.run} still has a live worker (pid ${other.pid}); end it with: code-forge run end --run ${other.run}`);
+  }
   throw new WorkerError('worker_down', 'the worker did not start (run `code-forge worker --run <id>` by hand to see why)');
 }