@codedology/code-forge 0.15.0 → 0.15.2

package/CHANGELOG.md

@@ -6,6 +6,23 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.15.2] — 2026-10-30
+
+### Fixed
+
+- OpenAI strict schemas make only optional keys nullable, so `forge facts` no longer refuses an answer with null on a required field; a facts row with a null command or excerpt is downgraded to UNVERIFIABLE on its own (issue #27, B165)
+
+## [0.15.1] — 2026-10-19
+
+### Changed
+
+- The test leak check ignores a lock held by a live process outside the suite (same pid start time), so gates can run while a review worker runs (B142)
+- The coder brief keeps only the final test log after a sandbox EPERM rerun, and fix rounds list the typecheck command next to the block tests (B140)
+- The first-use and brief-mode walkthrough tests no longer fail when a live code-forge run of the developer writes into ~/.code-forge during the suite (B145)
+- Process tests have wider time bounds, so the suite no longer fails from slowness on a busy machine (B144)
+- The Codex transcript check ignores rule text inside a node/python/ruby/perl script body that spawns nothing, also inside `zsh -lc` wrappers (B141)
+- New human verb `block amend-acceptance` corrects a wrong acceptance clause of an open block; reviews signed before the change no longer count at close (B143b)
+
 ## [0.15.0] — 2026-10-19
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 A CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.
 
-Latest: 0.15.0 - see [CHANGELOG.md](CHANGELOG.md)
+Latest: 0.15.2 - see [CHANGELOG.md](CHANGELOG.md)
 
 ## The problem
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 149,
+  "block_count": 156,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -2754,6 +2754,135 @@
         "B106"
       ],
       "note": "Issue #16 item 7 (rest of Group E). Fix round 1: results without a worker field keep the old pin check (82 old tests). Fix round 2: a recycled live pid must match its own pin (critical); an added worker is stopped when its probe fails."
+    },
+    "B142": {
+      "title": "Test leak check ignores a verified live foreign lock (owner pid alive, same start time, not the suite or its descendant)",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/helpers/isolate.mjs",
+        "test/helpers-isolate.test.mjs"
+      ],
+      "depends_on": [],
+      "note": "F-19. Gates passed on the second run (first run: one reaper timing flake at load ~490)."
+    },
+    "B140": {
+      "title": "Coder brief keeps only the final test log after a sandbox EPERM rerun; fix rounds list the typecheck command",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "skill/references/code.md",
+        "skill/templates/coder-brief.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [],
+      "note": "F-20 + F-23. Gates passed on the third run with --timeout-ms 1800000 after B142 landed. Closed on the old base, then rebased (F-27)."
+    },
+    "B145": {
+      "title": "In-test no-leak checks (first-use, brief-mode walkthrough) use the suite leak filter: baseline runs and verified live foreign locks are not leaks",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/helpers/isolate.mjs",
+        "test/helpers-isolate.test.mjs",
+        "test/first-use.test.mjs",
+        "test/integration/brief-mode-walkthrough.test.mjs"
+      ],
+      "depends_on": [
+        "B142"
+      ],
+      "note": "F-28, found in the B141 gates during this run. Gates passed on the first run."
+    },
+    "B144": {
+      "title": "Process-spawning tests get per-test bounds of at least 30 s and wider observation deadlines, keeping the timing proofs that matter (SIGKILL at settle)",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/util/exec.test.mjs",
+        "test/util/reaper.test.mjs",
+        "test/util/tmp.test.mjs",
+        "test/state/block-end.test.mjs",
+        "test/worker/helpers.mjs",
+        "test/worker/worker.test.mjs",
+        "test/worker/pool.test.mjs",
+        "test/worker/heartbeat.test.mjs",
+        "test/worker/orphan.test.mjs",
+        "test/worker/multi.test.mjs",
+        "test/cli/review.test.mjs"
+      ],
+      "depends_on": [],
+      "note": "F-24. One fix round (2 review warnings). Gates passed on the first run. F-29 (queue enqueue < 1 s) left out: it is a product speed rule."
+    },
+    "B141": {
+      "title": "The Codex transcript check ignores rule text inside a node/python/ruby/perl script body that spawns nothing, also inside zsh -lc wrappers; parent-shell substitutions in double-quoted wrapper segments still count",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/util/forbidden.mjs",
+        "test/util/transcript-codex.test.mjs",
+        "skill/references/security.md"
+      ],
+      "depends_on": [],
+      "note": "F-21. Three fix rounds (zsh -lc wrappers, shell quoting, double-quoted substitutions). The real B137b transcript gives no hit. Gates passed on the third run (runs 1-2: load and live-run flakes, fixed by B144/B145)."
+    },
+    "B143": {
+      "title": "A human verb to correct a block's acceptance clauses (block amend-acceptance)",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/cli/block.mjs",
+        "src/state/block.mjs",
+        "src/review/gate-check.mjs",
+        "src/util/forbidden.mjs",
+        "src/cli/review-file.mjs",
+        "src/worker/engine.mjs",
+        "src/worker/queue.mjs",
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/SKILL.md",
+        "test/cli/block-amend-acceptance.test.mjs",
+        "test/engines/codex-home.test.mjs",
+        "test/engines/builders/forbidden-rendering.test.mjs",
+        "test/engines/builders/argv-snapshots.test.mjs"
+      ],
+      "depends_on": [
+        "B141"
+      ],
+      "note": "F-17. Stopped for scope only: two pinned counts in test/util/forbidden.test.mjs were not in the owned list. Its changes landed through B143b."
+    },
+    "B143b": {
+      "title": "A human verb to correct a block's acceptance clauses: block amend-acceptance (terminal confirm, signed row, stale approvals no longer count, new review tickets see the new clauses; coder-forbidden)",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/cli/block.mjs",
+        "src/state/block.mjs",
+        "src/review/gate-check.mjs",
+        "src/util/forbidden.mjs",
+        "src/cli/review-file.mjs",
+        "src/worker/engine.mjs",
+        "src/worker/queue.mjs",
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/SKILL.md",
+        "test/cli/block-amend-acceptance.test.mjs",
+        "test/engines/codex-home.test.mjs",
+        "test/engines/builders/forbidden-rendering.test.mjs",
+        "test/engines/builders/argv-snapshots.test.mjs",
+        "test/util/forbidden.test.mjs"
+      ],
+      "depends_on": [
+        "B143",
+        "B141"
+      ],
+      "note": "F-17. Took the B143 commit, updated the pinned coder-only counts. Reviews clean on the first join; gates passed on the first run."
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/SKILL.md

@@ -22,6 +22,8 @@ State lives in the plan file's header — `facts → planned → hardened → co
 
 ## §2 Roles by level (never by model name)
 
+`block amend-acceptance <id> --run <r> --acceptance <file> --reason <text>` is human-only: it corrects an open block's clauses after terminal confirmation, requires a nonblank reason, has no `--yes`, and refuses an active autopilot grant. Earlier reviews become stale and a fresh review uses the new clauses. Coders never run it (`references/code.md` §5).
+
 `block human-pass <id> --run <r> --note <text> [--proof <dir-or-file>]` is human-only: the owner checks the listed device checks and confirms in their own terminal, with no `--yes` and no active autopilot grant. The note is required; proof is optional, must name an existing path when given, and is recorded as `proof: null` when omitted. A successful code close with `kind: human_check` acceptance clauses leaves `awaiting_human_check`, which status and report list; it has no fresh done file until the human passes or stops it. Never run this verb for the human, and do not end the run or treat the block as ready to land while it is awaiting a check (`references/code.md` §5).
 
 | role | level | session | who runs it |

package/skill/references/code.md

@@ -68,10 +68,12 @@ Waived or external reviews (`--no-require-reviews`, `review.external`) do not li
 
 Each `review-file` ticket is served by the worker `forge run start` launched: tools first (the project's gates on that file — red ⇒ `tools_red`, no model review), then S1 `risk`, then the planned depth (`review.md` §2). You watch the run, not the coder's output: `forge status` (B64a) is the progress check — read-only (no ledger row, never the run lock), every run of this repository that is not ended, newest first, with a blank line between runs, at most 10 lines per run: `run <id> · <status> · <plan|brief> · spent $<x>[ of $<budget>]` (money with 2 decimals; `$<x>+?` when some session has no known price, `$?` when the ledger cannot be read), then per open or in-attempt block `<id> <open|attempt-<n>> <level> · <model or -> · gate <pass|fail|none>[ (<gate>)] · findings <n>` (the gate field is `gate pass`, `gate fail (<gate>)` with the failing gate's name, `gate fail` when no gate was named, or `gate none` when no gate ran; findings = the count of open review findings the close gate would refuse today), `… +<k> more blocks` as the last block line when they do not fit, and `closed <a> · stopped <b>` only when either is non-zero — printed LAST, but it keeps its place in the cap ahead of block lines (block lines are dropped first). No such run: `no active run`, exit 0. `--run <id>` shows one run (ended too); an unknown run exits 1, a usage error exits 2. `--json` prints one line, `{"runs":[…]}`, with every open block (no cap, so `more` is always 0), `unknown_usd_sessions`, and per block `gate: {result, name}` (`name` null for `pass`, for `none` and for an unnamed fail). Use it instead of reading logs or polling the coder's transcript: it never prints transcript or diff text. `forge ledger tail --slug <slug>` shows the rows themselves (`review.plan`, `review.round`, `review.done`). Idle is a wake, never proof; the sentinel is the only completion signal (`adapters/*.md`).
 
-**One fix round per block (B94).** After the coder's first COMPLETE, wait until every `review-file` ticket of the block is answered and the block's tests ran; then send ONE fix message with every failing test (name and first error line) and every open finding (by file and id). Never one finding or one file at a time. A finding that arrives after that message waits for the next round. In that round the coder fixes, runs the block's tests, follows the selected file loop on every changed file, and prints its `TESTS` line. In fix rounds, follow the selected loop: `wait` uses `forge review-file` and `--wait`, `overlap` enqueues each green file, and `watch` commits each green file. Both `overlap` and `watch` run `forge review-file --wait-block <id> --run <r>` before the sentinel. The per-file cap still counts per file: one block round is one round for each file it touched (`review.md` §5).
+**One fix round per block (B94).** After the coder's first COMPLETE, wait until every `review-file` ticket of the block is answered and the block's tests ran; then send ONE fix message with every failing test (name and first error line) and every open finding (by file and id). The message lists the block test command next to the project build/typecheck command from the context pack's `build` field (for example, `npm run typecheck`). Never one finding or one file at a time. A finding that arrives after that message waits for the next round. In that round the coder fixes, runs both commands, follows the selected file loop on every changed file, and prints its `TESTS` line. In fix rounds, follow the selected loop: `wait` uses `forge review-file` and `--wait`, `overlap` enqueues each green file, and `watch` commits each green file. Both `overlap` and `watch` run `forge review-file --wait-block <id> --run <r>` before the sentinel. The per-file cap still counts per file: one block round is one round for each file it touched (`review.md` §5).
 
 ## §5 The block gate is a re-measurement — `forge block close <id> --run <r>`
 
+To correct an open block's snapshotted clauses, the human uses `code-forge block amend-acceptance <id> --run <r> --acceptance <file> --reason <text>` with a nonblank reason and the same acceptance format as `block open`. Both terminals and confirmation are required, with no `--yes` and no active autopilot grant. Invalid or unchanged lists write nothing; a successful amendment updates the human checks and signs one `block.acceptance_amended` row with both clause-list hashes. Earlier reviews no longer count at close; review requests, block waits and watch ticks queue a fresh review with the new clauses. Coders must never run this human verb.
+
 The human can use `block close <id> --run <r> --decide --reason <text>` to see all waivable findings, unacknowledged agent waivers and acceptable transcript hits in one numbered list, then confirm once. Yes writes the same signed human rows as the individual verbs, with the shared reason for findings and hits, then runs normal close. No writes nothing. Unreviewed or stopped content needing a new review, failed gates, unowned changes and missing proof print `cannot decide here:` and write nothing. Both terminal streams are required; no `--yes`; an active autopilot grant refuses decision close. Coders must leave this step to the human.
 
 `close.require_human: true` in the run snapshot also makes plain close require terminal confirmation. It cannot change through `run reload`. An active `close:routine` grant permits unattended close only with signed approvals for every changed file, a signed green gate row, no waiver rows of any kind and no transcript or accepted hits; otherwise `close-not-routine: <reason>` refuses it. A routine close also signs `autopilot.close {block, grant}`. With the key absent or false, ordinary close retains its existing behavior.

package/skill/references/security.md

@@ -10,6 +10,8 @@
 
 Rendered into every coder spawn as the CLI's own deny rules (path rules widen a directory to `<dir>/**`; a read-write path denies read, edit and write); carried verbatim in the brief; refused by the package's own process spawner; and at block close the transcript (captured stdout, the harness log, or the Solo output) is grepped for the forbidden verbs **and paths**. A hit fails the gate as `rule_break`. Only the human can accept a false hit with `block accept-hit`, after terminal confirmation. That verb is also coder-forbidden. It writes one signed `rule_break.accepted` row for the run, block, rule and SHA-256 of the exact transcript line text. Close verifies the signature and matches by line content, so moving the line does not invalidate it. Unsigned, tampered or other-run or other-block rows never count. A ledger `rule_break` row still refuses. Where a CLI cannot load a rules file, `doctor` says so and the transcript grep remains the detector.
 
+In Codex `exec --json` transcripts, node, Python, Ruby and Perl heredoc or quoted inline script bodies without a process-spawn word are not scanned for command or contains rules. Backticks and `$(` count when the shell expands the body (an unquoted heredoc delimiter or double-quoted inline script), or for Ruby/Perl; `%x` counts for Ruby/Perl, and `qx` for Perl. Quoted or backslash-escaped heredoc delimiters and single-quoted inline scripts prevent shell expansion. A single sh/bash/zsh/dash/ksh wrapper with `-c`, `-lc`, `-ic` or `-l -c` and one quoted script is decoded before this check; its prefix remains scanned. Path rules still apply inside those bodies. Nested or malformed wrappers, shell and unknown-command heredocs, unterminated heredocs and the shell text outside interpreter bodies are scanned whole; the plain-text transcript grep is unchanged.
+
 ## §3 Signed ledger rows — the threat model, stated honestly
 
 `block unwaive` and `block ack-waivers` are human-only and coder-forbidden with both `forge` and `code-forge` prefixes. Both require a yes at a terminal and have no `--yes`. No terminal exits 2 with no row. A no, cancel or pre-check refusal writes nothing. Only verified human undo and acknowledgement rows count at close.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.15.0"
+PINNED_VERSION="0.15.2"
 set -eu
 
 self="$0"

package/skill/templates/coder-brief.md

@@ -33,6 +33,8 @@ Proof is behaviour, not text: never read a source file in a test to assert on it
 
 ## Final report — the close prints the ticket ids
 
+If the sandbox refuses process probes with EPERM errors, rerun the block tests outside the sandbox. Keep and report only the final run. Name the final log file in the report. A saved log of a refused sandbox run is not proof either way.
+
 Run the block's test command (`test_command`) and print its result on a line of its own, exactly:
 
 `TESTS <command> exit=<n>`
@@ -54,7 +56,7 @@ Or `===BLOCK <id> FAILED: <reason>===`.
 
 ## Fix-round brief (round ≥ 2, or a respawn after a climb)
 
-The open findings by id, the fix history, the files they sit in. Fix only those hunks, then follow the selected file loop on **every file the round changed** (`wait`: run `forge review-file <path> --block <id> --run <r>` and `--wait`; `overlap`: enqueue each green file and continue; `watch`: commit each green file; both `overlap` and `watch`: run `forge review-file --wait-block <id> --run <r>` before the sentinel) — a fix the reviewer never saw is not a fix. A fix made in another owned file is sent with `--answers <ids> --of <source>` (The file loop). The round's final report follows the same rule as the first: it needs no ticket lines. Re-run the block's test command after the fixes and print a fresh `TESTS <command> exit=<n>` line just before the round's sentinel: a TESTS line from an earlier report does not count. In a fix round, you may use `code-forge gates run --run <r> --block <id> --changed` as the block's test command; the TESTS line names the command actually run (substitute the run and block ids). Any green `code-forge gates run --run <r> --block <id>` records the owned file hashes on `gate.done`, including runs without `--changed`; when `--slug` is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next `--changed` falls back with `no_baseline`; unreadable inputs also leave no record. `{test_files}` expands to changed tests and stem-paired tests of changed sources; `{changed_files}` expands to changed lint/format paths. Deleted files still count for pairing and the threshold, but both tokens receive only files that exist now. Both tokens must be whole argv items and cannot be the command or the only item; config validation refuses a gate whose command or only item is `{changed_files}`. Without `--changed`, `{changed_files}` is dropped. Gates without tokens run as before. Rows carry `scope: changed`, including fallback rows with a `reason`: `no_baseline` uses today's scope, `unpaired` uses today's test scope when a changed source has no test pair, `threshold` runs the full suite above `gates.full_suite_threshold_files` changed files, and `no_changes` uses today's scope when nothing is left to run. The orchestrator runs the full `code-forge gates run` before `block close` (D2).
+The open findings by id, the fix history, the files they sit in. The message lists the block test command next to the project build/typecheck command from the context pack's `build` field (for example, `npm run typecheck`). Fix only those hunks, then follow the selected file loop on **every file the round changed** (`wait`: run `forge review-file <path> --block <id> --run <r>` and `--wait`; `overlap`: enqueue each green file and continue; `watch`: commit each green file; both `overlap` and `watch`: run `forge review-file --wait-block <id> --run <r>` before the sentinel) — a fix the reviewer never saw is not a fix. A fix made in another owned file is sent with `--answers <ids> --of <source>` (The file loop). The round's final report follows the same rule as the first: it needs no ticket lines. Run both commands after the fixes and before the round's sentinel. Print a fresh `TESTS <command> exit=<n>` line just before the round's sentinel: a TESTS line from an earlier report does not count. In a fix round, you may use `code-forge gates run --run <r> --block <id> --changed` as the block's test command; the TESTS line names the command actually run (substitute the run and block ids). Any green `code-forge gates run --run <r> --block <id>` records the owned file hashes on `gate.done`, including runs without `--changed`; when `--slug` is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next `--changed` falls back with `no_baseline`; unreadable inputs also leave no record. `{test_files}` expands to changed tests and stem-paired tests of changed sources; `{changed_files}` expands to changed lint/format paths. Deleted files still count for pairing and the threshold, but both tokens receive only files that exist now. Both tokens must be whole argv items and cannot be the command or the only item; config validation refuses a gate whose command or only item is `{changed_files}`. Without `--changed`, `{changed_files}` is dropped. Gates without tokens run as before. Rows carry `scope: changed`, including fallback rows with a `reason`: `no_baseline` uses today's scope, `unpaired` uses today's test scope when a changed source has no test pair, `threshold` runs the full suite above `gates.full_suite_threshold_files` changed files, and `no_changes` uses today's scope when nothing is left to run. The orchestrator runs the full `code-forge gates run` before `block close` (D2).
 
 ## Context pack
 

package/src/cli/block.mjs

@@ -202,7 +202,7 @@ import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { fallbackLane } from '../decide/fallback-rules.mjs';
 import { laneFacts } from '../decide/lane-facts.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
-import { attemptBlock, claimPath, closeBlock, humanPassBlock, openBlock, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
+import { amendAcceptanceBlock, attemptBlock, claimPath, closeBlock, humanPassBlock, openBlock, prepareAcceptanceAmendment, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { configInForce, externalReviewer, requireCoderTests } from '../state/config-snapshot.mjs';
 import { readFileDiff } from '../review/packet.mjs';
@@ -219,7 +219,7 @@ import { validateConfig } from '../config/validate.mjs';
 import { migrateConfig } from '../config/migrate.mjs';
 import { exec } from '../util/exec.mjs';
 import { contentHash, gitChildEnv, readRegularFileNoFollow } from '../worker/ticket.mjs';
-import { clearDone, resolveTicket } from '../worker/queue.mjs';
+import { clearDone, resetAcceptanceWatch, resolveTicket } from '../worker/queue.mjs';
 import { loadState } from '../worker/review-state.mjs';
 import { agentReopens, openBlockEntry, reopenFile } from '../review/reopen.mjs';
 import { checkFileForm, checkFindingId } from '../review/verb-forms.mjs';
@@ -300,9 +300,10 @@ const USAGE =
   '       code-forge block unwaive <id> <finding-id> --run <r> --file <path> --reason <text>\n' +
   '       code-forge block ack-waivers <id> --run <r>\n' +
   '       code-forge block human-pass <id> --run <r> --note <text> [--proof <dir-or-file>]\n' +
+  '       code-forge block amend-acceptance <id> --run <r> --acceptance <file> --reason <text>\n' +
   '       every block verb takes --json: one JSON line on stdout ({"block","event",…}) instead of the text\n';
 
-const SUBCOMMANDS = ['open', 'attempt', 'rebase', 'claim', 'close', 'stop', 'waive', 'reopen', 'accept-hit', 'unwaive', 'ack-waivers', 'human-pass'];
+const SUBCOMMANDS = ['open', 'attempt', 'rebase', 'claim', 'close', 'stop', 'waive', 'reopen', 'accept-hit', 'unwaive', 'ack-waivers', 'human-pass', 'amend-acceptance'];
 
 /** Refuse likely shell quoting slips before any row is written.
  * @param {string} workspace @param {string[]} entries @param {string} label
@@ -376,6 +377,9 @@ export async function runBlock(args, deps = {}) {
     const [id, extra] = positionals;
     const runId = typeof flags.run === 'string' ? flags.run : undefined;
     if (!id || !runId) throw new StateError('usage', 'a block id and --run are required');
+    if (sub === 'amend-acceptance' && (positionals.length !== 1 || typeof flags.acceptance !== 'string' || typeof flags.reason !== 'string' || !flags.reason.trim() || /\p{Cc}/u.test(flags.reason))) {
+      throw new StateError('usage', 'amend-acceptance needs one block id, --acceptance and a nonblank --reason without control characters');
+    }
     if (sub === 'open' && (typeof flags.acceptance !== 'string' || !Array.isArray(flags.owned) || (flags.level !== undefined && typeof flags.level !== 'string'))) {
       throw new StateError('usage', 'block open needs --level, --owned and --acceptance');
     }
@@ -401,6 +405,30 @@ export async function runBlock(args, deps = {}) {
       return 0;
     }
     const record = await readRun(runId);
+    if (sub === 'amend-acceptance') {
+      /** @type {ReturnType<typeof prepareAcceptanceAmendment> | null} */
+      let prepared = null;
+      const what = { file: '', oldCount: 0, newCount: 0 };
+      const noGrant = (/** @type {Record<string, any>} */ current) => {
+        if (current.autopilot && grantState(current.autopilot, (deps.now ?? (() => new Date()))()) === 'active') throw new StateError('autopilot-active', 'amend-acceptance is refused while an autopilot grant is active');
+      };
+      const asked = await confirmHumanVerb(sub, runId, id, what, record, deps, async () => {
+        noGrant(record);
+        const clauses = parseYAML(await readFile(/** @type {string} */ (flags.acceptance), 'utf8'), { prettyErrors: false });
+        prepared = prepareAcceptanceAmendment(record, id, clauses);
+        what.oldCount = prepared.oldCount;
+        what.newCount = prepared.acceptance.length;
+      });
+      if (asked === 'no-tty') { err(`${humanVerbNoTTY(sub)}\n`); return 2; }
+      if (asked === 'cancelled') { err(`block ${id} ${sub}: cancelled — nothing was recorded\n`); return 1; }
+      if (prepared === null) throw new Error('acceptance was not prepared');
+      const accepted = /** @type {ReturnType<typeof prepareAcceptanceAmendment>} */ (prepared);
+      const row = await amendAcceptanceBlock({ runId, id, acceptance: accepted.acceptance, old_sha256: accepted.old_sha256, reason: /** @type {string} */ (flags.reason), writeRow: (signed) => appendRow(signed, { slug: record.project }), before: noGrant });
+      resetAcceptanceWatch(await repoTop(record.workspace), id);
+      say(`block ${id} acceptance amended (${row.clauses} clauses; by: human)\n`);
+      if (json) emit(row);
+      return 0;
+    }
     const deciding = sub === 'close' && flags.decide === true;
     if (deciding) {
       if (positionals.length !== 1 || typeof flags.reason !== 'string' || !flags.reason.trim() || /[\x00-\x1f\x7f]/.test(flags.reason)) throw new StateError('usage', '--decide needs one block id and a nonblank --reason without control characters');
@@ -1140,7 +1168,7 @@ export const NO_REVIEWS_NO_TTY = '--no-require-reviews needs the human at a term
 
 /**
  * B80: the refusal when `block waive` or `block reopen` has no terminal to ask the human at.
- * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'close'} verb @returns {string}
+ * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance' | 'close'} verb @returns {string}
  */
 export const humanVerbNoTTY = (verb) => verb === 'waive'
   ? 'block waive needs the human at a terminal to confirm; nothing was recorded (--yes works only for a recorded warning or nit finding, with evidence)'
@@ -1160,7 +1188,7 @@ export const humanVerbNoTTY = (verb) => verb === 'waive'
  * terminal check and the question (a refusal it throws means the human is never asked).
  * `deps.stdinIsTTY` / `deps.stdoutIsTTY` inject each side, `deps.isTTY` both at once, `deps.ui`
  * the prompt (default `@clack/prompts`). A "no" or a cancel (Ctrl-C) is `cancelled`.
- * @param {ConfirmDeps} deps @param {string} message
+ * @param {ConfirmDeps} deps @param {string | (() => string)} message
  * @param {() => Promise<unknown> | unknown} [before]
  * @returns {Promise<'no-tty' | 'confirmed' | 'cancelled'>}
  */
@@ -1170,7 +1198,7 @@ async function confirmAtTerminal(deps, message, before) {
   if (!(stdinTTY && stdoutTTY)) return 'no-tty';
   if (before) await before();
   const ui = deps.ui ?? /** @type {any} */ (await import('@clack/prompts'));
-  const go = await ui.confirm({ message, initialValue: false });
+  const go = await ui.confirm({ message: typeof message === 'function' ? message() : message, initialValue: false });
   return ui.isCancel(go) || go !== true ? 'cancelled' : 'confirmed';
 }
 
@@ -1201,14 +1229,16 @@ async function confirmNoReviews(runId, id, deps) {
  * `by: autopilot`); human-pass instead refuses an active grant. The
  * pre-checks (`reopenPrecheck`, `waivePrecheck`) run first, at a terminal, so the human is never
  * asked about a waive or reopen the verb would refuse that way.
- * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass'} verb @param {string} runId @param {string} id
- * @param {{finding?: string, file: string, rule?: string, line?: number, hits?: {rule: string, line: number}[]}} what @param {Record<string, any>} record @param {ConfirmDeps} deps
- * @param {() => void} [before]
+ * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance'} verb @param {string} runId @param {string} id
+ * @param {{finding?: string, file: string, rule?: string, line?: number, hits?: {rule: string, line: number}[], oldCount?: number, newCount?: number}} what @param {Record<string, any>} record @param {ConfirmDeps} deps
+ * @param {() => Promise<unknown> | unknown} [before]
  * @returns {Promise<'no-tty' | 'confirmed' | 'cancelled'>}
  */
 function confirmHumanVerb(verb, runId, id, what, record, deps, before) {
-  const message =
-    verb === 'human-pass'
+  const message = () =>
+    verb === 'amend-acceptance'
+      ? `Amend acceptance of block ${id} (run ${runId}) from ${what.oldCount} clauses to ${what.newCount} clauses? Only the owner may say yes.`
+      : verb === 'human-pass'
       ? `Confirm all device checks of block ${id} (run ${runId}) passed? Only the owner may say yes.`
       : verb === 'waive'
       ? `Waive finding ${what.finding} in ${what.file} of block ${id} (run ${runId})? Only the owner may say yes.`
@@ -1226,7 +1256,7 @@ function confirmHumanVerb(verb, runId, id, what, record, deps, before) {
     }
     if (verb === 'reopen') await reopenPrecheck(record, runId, id, what.file);
     else if (verb === 'waive') await waivePrecheck(record, runId, id, /** @type {string} */ (what.finding), what.file);
-    before?.();
+    await before?.();
   });
 }
 

package/src/config/schema-compile.mjs

@@ -4,7 +4,7 @@
  *
  * OpenAI's structured-output "strict" mode has three rules a hand-written schema violates by
  * default: (1) every property under an object must be listed in `required` (optional fields are
- * instead modeled as **nullable** required fields), (2) every object must set
+ * instead modeled as **nullable** required fields; source-required keys stay as they are), (2) every object must set
  * `additionalProperties: false`, (3) nothing may be missing from `required`. Claude and Grok take
  * the source schema unchanged (they support ordinary JSON Schema `required`/optional).
  *
@@ -149,8 +149,9 @@ function childSchemas(node) {
 }
 
 /**
- * Recursively rewrites every object node: a `properties` map makes every property `required` and
- * nullable and closes the node (unless it already has an open-ended `additionalProperties`); a
+ * Recursively rewrites every object node: a `properties` map makes every property `required`;
+ * optional keys become nullable; required keys stay as they are. It closes the node (unless it
+ * already has an open-ended `additionalProperties`); a
  * bare `{type: 'object'}` is closed to an empty strict object. `visited` guards against revisiting
  * the same shared node twice — not against a genuine schema cycle, which this project's schema
  * does not have.
@@ -165,12 +166,13 @@ function compileForOpenAI(node, visited) {
 
   if (node.properties && typeof node.properties === 'object') {
     const keys = Object.keys(node.properties);
+    const wasRequired = new Set(Array.isArray(node.required) ? node.required : []);
     node.required = keys;
     if (node.additionalProperties === undefined) {
       node.additionalProperties = false;
     }
     for (const key of keys) {
-      makeNullable(node.properties[key]);
+      if (!wasRequired.has(key)) makeNullable(node.properties[key]);
     }
   } else if (isObjectTyped(node) && node.additionalProperties === undefined && node.patternProperties === undefined) {
     node.properties = {};

package/src/review/gate-check.mjs

@@ -139,7 +139,7 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
   /** @type {Map<string, string>} */
   const current = new Map();
   for (const f of [...proofFiles, ...files]) current.set(f.file, f.content_hash);
-  const { mine, latestOf, signedOf, matches, waiverOf, waiverFor, waivedAllOf, recordedRefusalSeverity, supersededCap } = reviewRules({ block, runId, rows, key, resultFiles, current });
+  const { mine, acceptanceAmended, latestOf, signedOf, matches, waiverOf, waiverFor, waivedAllOf, recordedRefusalSeverity, supersededCap } = reviewRules({ block, runId, rows, key, resultFiles, current });
   /** @type {Refusal[]} */
   const refusals = [];
   const approvedFor = (/** @type {string} */ file, /** @type {string} */ hash) => mine.filter((r) => r.event === 'review.approved' && r.file === file && r.content_hash === hash);
@@ -169,7 +169,7 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
       else {
         // B73: a stopped file (a cap row of the block) names its ways out
         const exits = mine.some((r) => r.event === 'review.cap' && r.file === file) ? `; ${stopExitsLine}` : '';
-        refusals.push({ code: 'unreviewed', file, detail: `no review.approved row for ${file} at its current content${exits}` });
+        refusals.push({ code: 'unreviewed', file, detail: `no review.approved row for ${file} at its current content${acceptanceAmended ? ' (acceptance amended)' : ''}${exits}` });
       }
     } else if (!signedApproval) refusals.push({ code: 'unsigned', file, detail: `the review.approved row for ${file} has no valid MAC` });
     if (signedApproval) {
@@ -279,7 +279,14 @@ function reviewRules({ block, runId, rows, key, resultFiles = {}, current, verif
   // B71: `verify` replaces the MAC check only for `review-file`'s unverified pre-check ({@link
   // namedOnHash}), which has no key and can only refuse; it then reads no autopilot waiver
   const ok = verify ?? ((/** @type {Record<string, any>} */ r) => verified(r, key));
-  const mine = rows.filter((r) => r?.block === block && (runId === undefined || r.run === undefined || r.run === runId));
+  let amendedAt = -1;
+  rows.forEach((r, i) => {
+    if (r?.event === 'block.acceptance_amended' && r.block === block && r.run === runId && ok(r)) amendedAt = i;
+  });
+  const acceptanceAmended = amendedAt >= 0;
+  // Acceptance is a review input. Every older review verdict belongs to the previous input.
+  const mine = rows.filter((r, i) => r?.block === block && (runId === undefined || r.run === undefined || r.run === runId)
+    && !(i < amendedAt && typeof r.event === 'string' && r.event.startsWith('review.')));
   /** A verified human or agreed agent reopen followed by a real review clears older cap ids.
    * @param {Record<string, any>} cap @returns {boolean}
    */
@@ -517,7 +524,7 @@ function reviewRules({ block, runId, rows, key, resultFiles = {}, current, verif
     return new Map([...named].filter(([id, severity]) => id !== PROOF_FINDING && answerableSeverity(severity) && waiverOf(file, id, severity, ticket).by === null));
   };
 
-  return { mine, latestOf, signedOf, matches, waiverOf, waiverFor, waivedAllOf, openAt, answerRows, recordedRefusalSeverity, supersededCap };
+  return { mine, acceptanceAmended, latestOf, signedOf, matches, waiverOf, waiverFor, waivedAllOf, openAt, answerRows, recordedRefusalSeverity, supersededCap };
 }
 
 /**

package/src/session/facts.mjs

@@ -777,7 +777,8 @@ function ruleBroken(row, claim, ctx) {
 }
 
 /**
- * Validate the delegate's answer (step 3). Only a schema-invalid answer is refused. A row answers
+ * Validate the delegate's answer (step 3). Null commands/excerpts are normalized on a copy and
+ * their matched claims downgraded; every other schema-invalid answer is refused. A row answers
  * claim `F<n>` when its fact_id is `F<n>` and its kind is the claim's kind (the id is the anchor,
  * the claim text may be reworded); failing that, when its echoed claim ({@link echoedClaim})
  * equals the claim token and its fact_id is `F<n>` or its kind is the claim's kind. Claims the
@@ -794,11 +795,23 @@ function ruleBroken(row, claim, ctx) {
  * @throws {FactsError} `refused` when the answer does not match the schema.
  */
 export function validateFacts(answer, claims, opts = {}) {
-  if (!validateFile(answer)) {
+  const normalized = structuredClone(answer);
+  /** @type {Map<object, string[]>} */
+  const nullFields = new Map();
+  if (normalized && typeof normalized === 'object' && 'facts' in normalized && Array.isArray(normalized.facts)) {
+    for (const row of normalized.facts) {
+      if (!row || typeof row !== 'object' || Array.isArray(row)) continue;
+      const fields = ['command', 'output_excerpt'].filter((field) => row[field] === null);
+      if (fields.length === 0) continue;
+      for (const field of fields) row[field] = '';
+      nullFields.set(row, fields);
+    }
+  }
+  if (!validateFile(normalized)) {
     const where = (validateFile.errors ?? []).map((e) => `${e.instancePath || '/'} ${e.message}`).slice(0, 5);
     throw new FactsError('refused', `facts answer does not match facts.schema.json: ${where.join('; ')}`);
   }
-  const rows = /** @type {{facts: Fact[]}} */ (answer).facts;
+  const rows = /** @type {{facts: Fact[]}} */ (normalized).facts;
   /** @type {Fact[]} */
   const facts = [];
   /** @type {Downgrade[]} */
@@ -828,7 +841,8 @@ export function validateFacts(answer, claims, opts = {}) {
       return;
     }
     const base = { fact_id: id, claim: redact(claim.token), kind: claim.kind, command: redact(row.command), output_excerpt: claim.kind === 'env' ? '' : redact(row.output_excerpt) };
-    const broken = ruleBroken(row, claim, opts);
+    const fields = nullFields.get(row);
+    const broken = fields ? `delegate returned null ${fields.join(', ')}` : ruleBroken(row, claim, opts);
     if (broken) {
       const reason = redact(broken);
       downgraded.push({ fact_id: id, reason });

package/src/state/block.mjs

@@ -24,7 +24,7 @@ import { isAncestorArgv, revParseArgv } from '../util/git.mjs';
 import { StateError } from './paths.mjs';
 import { assertOwned, blocksOverlap, isExactEntry, ownsFile, scopeGate } from './registry.mjs';
 import { checkWorkerPin, readRun, saveRun, withRunLock, writeSigned } from './run.mjs';
-import { verifyRow, loadKey } from './signer.mjs';
+import { canonicalJSON, verifyRow, loadKey } from './signer.mjs';
 import * as reviewQueue from '../worker/queue.mjs';
 import { repoRootOf } from '../worker/ticket.mjs';
 
@@ -33,7 +33,7 @@ import { repoRootOf } from '../worker/ticket.mjs';
 export const BRIEF_POINTER_MAX_BYTES = 200;
 
 /** Ledger events the block gate requires to carry a valid MAC (§4.6 row 10). */
-export const GATE_EVENTS = Object.freeze(['dispatch', 'block.attempt', 'block.rebase', 'block.claim', 'review.approved', 'proof']);
+export const GATE_EVENTS = Object.freeze(['dispatch', 'block.attempt', 'block.rebase', 'block.claim', 'block.acceptance_amended', 'review.approved', 'proof']);
 
 const BLOCK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/;
 const LEVEL = /^L[0-3]$/;
@@ -233,6 +233,38 @@ function assertAcceptance(clauses) {
   return clauses;
 }
 
+/** Validate before the human question, and again under the run lock.
+ * @param {Record<string, any>} record @param {string} id @param {unknown} clauses
+ */
+export function prepareAcceptanceAmendment(record, id, clauses) {
+  const block = record.blocks?.[id];
+  if (!block) throw new StateError('unknown_block', `block ${id} is not in run ${record.run_id}`);
+  if (block.status !== 'open') throw new StateError('not-open', `not-open: block ${id} is not open`);
+  const acceptance = assertAcceptance(clauses);
+  const old_sha256 = sha256(canonicalJSON(block.acceptance));
+  const new_sha256 = sha256(canonicalJSON(acceptance));
+  if (old_sha256 === new_sha256) throw new StateError('acceptance-unchanged', 'acceptance-unchanged: the clause list is unchanged; nothing was recorded');
+  return { acceptance, old_sha256, new_sha256, oldCount: block.acceptance.length };
+}
+
+/** @param {{runId: string, id: string, acceptance: unknown, reason: string, old_sha256: string, writeRow: WriteRow, before: (record: Record<string, any>) => void}} opts */
+export async function amendAcceptanceBlock({ runId, id, acceptance, reason, old_sha256, writeRow, before }) {
+  return mutateRun(runId, null, writeRow, (record) => {
+    before(record);
+    const prepared = prepareAcceptanceAmendment(record, id, acceptance);
+    if (prepared.old_sha256 !== old_sha256) throw new StateError('acceptance-moved', `acceptance changed while confirming block ${id}; confirm again`);
+    const block = record.blocks[id];
+    block.acceptance = prepared.acceptance;
+    const checks = prepared.acceptance.filter((c) => c.kind === 'human_check').map((c) => c.clause);
+    if (checks.length) block.human_checks = checks;
+    else delete block.human_checks;
+    // Unique even when a later amendment restores an earlier list of clauses.
+    block.acceptance_revision = randomUUID();
+    const row = { event: 'block.acceptance_amended', block: id, old_sha256, new_sha256: prepared.new_sha256, clauses: prepared.acceptance.length, reason, by: 'human' };
+    return { result: row, rows: [row] };
+  });
+}
+
 /**
  * Under the run lock: load the run, check it is active and (when `id` is given) that the block
  * is open, run `mutate`, write its signed `rows` through the ledger writer, THEN save the record —

package/src/util/forbidden.mjs

@@ -360,6 +360,12 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
       groups: [{ anyOf: ['--add-worker'] }],
       description: 'Add a review worker to a run — the orchestrator only (B107)',
     },
+    {
+      id: 'code-forge-block-amend-acceptance-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [['code-forge', 'block', 'amend-acceptance'], ['forge', 'block', 'amend-acceptance']],
+      description: 'Correct a block acceptance list — human-only, confirmed in the human terminal (B143)',
+    },
   ].map(freezeEntry),
 );
 
@@ -819,6 +825,194 @@ export function renderForCodex(list = FORBIDDEN) {
 
 // ── Transcripts ──────────────────────────────────────────────────────────────
 
+/**
+ * Mask inert, non-shell interpreter bodies for command/contains rules only. Walk shell
+ * words and queued heredocs once; unknown commands, malformed quotes and unfinished
+ * heredocs stay fail closed. Decode at most one shell -c wrapper; deeper wrappers
+ * stay whole. This deliberately does not evaluate shell expansions.
+ * @param {string} command
+ * @param {boolean} [unwrapShell]
+ * @returns {string}
+ */
+function transcriptCommandText(command, unwrapShell = true) {
+  if (unwrapShell) {
+    const wrapper = /^\s*(?:[^\s'"\\;|&()<>`$]+\/)?(?:sh|bash|zsh|dash|ksh)(?:[ \t]+-[li]+)*[ \t]+-[li]*c[ \t]+(['"])/.exec(command);
+    if (wrapper) {
+      let quote = wrapper[1];
+      const parts = [];
+      let i = wrapper[0].length;
+      while (i < command.length) {
+        const char = command[i++];
+        if (char === quote) {
+          // A shell word can splice opposite-quoted text into its enclosing
+          // quotes, as in "script"'literal'"rest". Require the enclosing
+          // quote again at the end; uncertain suffixes still scan whole.
+          if (command[i] === (quote === '"' ? "'" : '"')) {
+            quote = command[i++];
+            continue;
+          }
+          if (quote !== wrapper[1] || command.slice(i).trim() !== '') return command;
+          const prefix = command.slice(0, wrapper[0].length - 1);
+          return prefix + transcriptCommandText(parts.join(''), false);
+        }
+        // Within double quotes, other backslashes are literal; single quotes
+        // preserve every character. A backslash-newline pair disappears.
+        if (quote === '"' && char === '\\' && /["\\$`\n]/.test(command[i] ?? '')) {
+          const escaped = command[i++];
+          if (escaped !== '\n') parts.push(escaped);
+        } else {
+          // Keep the source segment's quote context until after this check:
+          // the parent shell expands these even inside an inner quoted heredoc.
+          // Single-quoted splices and the escaped characters above are literal.
+          // Unquoted splices already fail closed at the closing-quote check.
+          if (quote === '"' && (char === '`' || (char === '$' && command[i] === '('))) return command;
+          parts.push(char);
+        }
+      }
+      return command;
+    }
+  }
+  const spawnWord = /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|fork|system|popen|subprocess|child_process|Popen)\b/;
+  const interpreter = /^(node|python|python3|ruby|perl)(?:\d+(?:\.\d+)*)?$/;
+  /** @param {string} body */
+  const hasShellSubstitution = (body) => {
+    for (let i = 0; i < body.length; i += 1) {
+      // Skip escaped characters in pairs so even backslash runs still expand.
+      if (body[i] === '\\') { i += 1; continue; }
+      if (body[i] === '`' || (body[i] === '$' && body[i + 1] === '(')) return true;
+    }
+    return false;
+  };
+  /** @param {string} body @param {string} language @param {boolean} shellExpands */
+  const hasSpawn = (body, language, shellExpands) => spawnWord.test(body)
+    || (shellExpands && hasShellSubstitution(body))
+    || ((language === 'ruby' || language === 'perl') && /`|\$\(|%x/.test(body))
+    || (language === 'perl' && /\bqx\b/.test(body));
+  const evalFlags = new Set(['-e', '-c', '--eval', '-p', '--print']);
+  /** @type {{start: number, end: number}[]} */
+  const inert = [];
+  /** @type {{delimiter: string, tabs: boolean, language: string, shellExpands: boolean}[]} */
+  let heredocs = [];
+  let state = 'command';
+  let language = '';
+  let evalNext = false;
+  let envValue = false;
+  let redirect = '';
+  let i = 0;
+  while (i < command.length) {
+    const char = command[i];
+    if (char === '\n') {
+      i += 1;
+      for (const doc of heredocs) {
+        const start = i;
+        let closed = false;
+        while (i < command.length) {
+          const newline = command.indexOf('\n', i);
+          const end = newline < 0 ? command.length : newline;
+          const line = command.slice(i, end);
+          if ((doc.tabs ? line.replace(/^\t+/, '') : line) === doc.delimiter) {
+            if (doc.language && !hasSpawn(command.slice(start, i), doc.language, doc.shellExpands)) inert.push({ start, end: i });
+            i = newline < 0 ? end : end + 1;
+            closed = true;
+            break;
+          }
+          i = newline < 0 ? end : end + 1;
+        }
+        if (!closed) return command;
+      }
+      heredocs = [];
+      state = 'command';
+      evalNext = false;
+      redirect = '';
+      continue;
+    }
+    if (/\s/.test(char)) { i += 1; continue; }
+    if (char === '#') {
+      const newline = command.indexOf('\n', i);
+      i = newline < 0 ? command.length : newline;
+      continue;
+    }
+    if (';|&()'.includes(char)) {
+      state = 'command';
+      evalNext = false;
+      i += 1;
+      continue;
+    }
+    if (char === '<' || char === '>') {
+      redirect = char;
+      i += 1;
+      if (command[i] === char) { redirect += char; i += 1; }
+      if (redirect === '<<' && command[i] === '-') { redirect += '-'; i += 1; }
+      // Here-strings and other uncertain shell syntax are never exempted.
+      if (command[i] === '<') return command;
+      continue;
+    }
+    const start = i;
+    const parts = [];
+    let quotes = 0;
+    let quote = '';
+    let escaped = false;
+    let unquoted = false;
+    while (i < command.length && !/[\s;|&()<>]/.test(command[i])) {
+      const next = command[i++];
+      if (next === "'" || next === '"') {
+        quotes += 1;
+        quote = next;
+        let closed = false;
+        while (i < command.length) {
+          const inside = command[i++];
+          if (inside === next) { closed = true; break; }
+          if (inside === '\\' && next === '"' && i < command.length) parts.push(command[i++]);
+          else parts.push(inside);
+        }
+        if (!closed) return command;
+      } else {
+        unquoted = true;
+        if (next === '\\') escaped = true;
+        parts.push(next === '\\' && i < command.length ? command[i++] : next);
+      }
+    }
+    const word = parts.join('');
+    if (redirect) {
+      if (redirect.startsWith('<<')) heredocs.push({
+        delimiter: word, tabs: redirect === '<<-', language: state === 'interpreter' ? language : '',
+        shellExpands: quotes === 0 && !escaped,
+      });
+      redirect = '';
+      continue;
+    }
+    if (state === 'env') {
+      if (envValue) { envValue = false; continue; }
+      if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(word) || ['-i', '--ignore-environment'].includes(word)) continue;
+      if (['-u', '--unset', '-C', '--chdir'].includes(word)) { envValue = true; continue; }
+      if (word === '--') { state = 'command'; continue; }
+      if (word.startsWith('-')) { state = 'other'; continue; }
+      state = 'command';
+    }
+    if (state === 'command') {
+      if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(word)) continue;
+      const name = word.slice(word.lastIndexOf('/') + 1);
+      language = interpreter.exec(name)?.[1] ?? '';
+      state = name === 'env' ? 'env' : language ? 'interpreter' : 'other';
+    } else if (state === 'interpreter') {
+      if (evalNext) {
+        if (quotes === 1 && !unquoted && !hasSpawn(command.slice(start, i), language, quote === '"')) inert.push({ start, end: i });
+        evalNext = false;
+      } else if (evalFlags.has(word)) evalNext = true;
+      else if (!word.startsWith('-') || word === '--') state = 'other';
+    }
+  }
+  if (heredocs.length > 0) return command;
+  const chunks = [];
+  let end = 0;
+  for (const span of inert) {
+    chunks.push(command.slice(end, span.start), ' ');
+    end = span.end;
+  }
+  chunks.push(command.slice(end));
+  return chunks.join('');
+}
+
 /**
  * Scan captured coder output (subprocess stdout, Solo `search_output` text, a harness log) for
  * any entry of `list`, line by line: each line is split into shell-ish tokens (whitespace,
@@ -829,7 +1023,18 @@ export function renderForCodex(list = FORBIDDEN) {
  * Codex `exec --json` logs (every non-empty line an object with a string `type`, first event
  * `thread.started`) scan command_execution commands and file_change paths as writes. Other
  * items scan whole, except agent_message and reasoning; a command_execution's aggregated_output
- * is never scanned; non-item events are skipped. Any other log uses the plain-text grep above, unchanged.
+ * is never scanned; non-item events are skipped. For string commands, node/python/ruby/perl
+ * heredocs and quoted -e/-c/--eval/-p/--print bodies without a process-spawn word are omitted
+ * from command and contains rules only; path rules still scan the whole command. Backticks and
+ * $( count when unescaped and the shell expands the body (unquoted heredoc delimiter or double-quoted inline
+ * script), or for Ruby/Perl; %x counts for Ruby/Perl, and qx for Perl. Quoted or backslash-escaped
+ * heredoc delimiters and single-quoted inline scripts prevent shell expansion. One sh/bash/zsh/
+ * dash/ksh -c wrapper (including -lc/-ic and -l -c) with a single quoted script (including
+ * opposite-quoted splices) is decoded first; its prefix remains scanned. Unescaped parent-shell
+ * substitutions in double-quoted wrapper segments keep the entire command scanned; single-quoted
+ * splices are literal at that layer. Unquoted splices, nested wrappers,
+ * malformed wrappers, shell/unknown heredocs and
+ * unterminated bodies scan whole. Any other log uses the plain-text grep above, unchanged.
  *
  * Linear in the line length: `contains` and `path` entries are evaluated ONCE per line over its
  * tokens (a `write` path entry hits when a write command starts before a token naming the path);
@@ -864,13 +1069,17 @@ export function scanTranscript(text, list = FORBIDDEN) {
   const hits = [];
   lines
     .forEach((lineText, index) => {
+      let commandText;
       if (events !== null) {
         const event = events[index];
         if (!event?.type.startsWith('item.') || !event.item) return;
         const item = event.item;
         if (item.type === 'agent_message' || item.type === 'reasoning') return;
         // a command that is not a string is scanned with the rest of its item (fail closed), its output left out
-        if (item.type === 'command_execution') lineText = typeof item.command === 'string' ? item.command : JSON.stringify({ ...item, aggregated_output: undefined });
+        if (item.type === 'command_execution') {
+          lineText = typeof item.command === 'string' ? item.command : JSON.stringify({ ...item, aggregated_output: undefined });
+          if (typeof item.command === 'string') commandText = transcriptCommandText(lineText);
+        }
         else if (item.type === 'file_change') {
           lineText = (Array.isArray(item.changes) ? item.changes : [])
             .filter((change) => typeof change?.path === 'string')
@@ -878,20 +1087,21 @@ export function scanTranscript(text, list = FORBIDDEN) {
         } else lineText = JSON.stringify(item);
       }
       const tokens = lineText.split(/(>>?)|[\s'"`;|&(),{}[\]]+/).filter((t) => typeof t === 'string' && t.length > 0);
+      const commandTokens = commandText === undefined ? tokens : commandText.split(/(>>?)|[\s'"`;|&(),{}[\]]+/).filter((t) => typeof t === 'string' && t.length > 0);
       const ids = new Set();
       let firstWrite = -1;
       for (let i = 0; i < tokens.length && firstWrite < 0; i += 1) {
         if (writeStarts.has(commandName(tokens[i])) && isWriteCommand(tokens.slice(i, i + TRANSCRIPT_WINDOW))) firstWrite = i;
       }
       for (const entry of list) {
-        if (entry.kind === 'contains' && matchesEntry([], tokens, entry)) ids.add(entry.id);
+        if (entry.kind === 'contains' && matchesEntry([], commandTokens, entry)) ids.add(entry.id);
         if (entry.kind !== 'path') continue;
         const named = tokens.findIndex((t, i) => (entry.access === 'readwrite' || (firstWrite >= 0 && i > firstWrite)) && namesPath(t, entry));
         if (named >= 0) ids.add(entry.id);
       }
-      for (let i = 0; i < tokens.length; i += 1) {
-        if (!firstWords.has(commandName(tokens[i])) && !tokens[i].includes('code-forge')) continue;
-        const window = tokens.slice(i, i + TRANSCRIPT_WINDOW);
+      for (let i = 0; i < commandTokens.length; i += 1) {
+        if (!firstWords.has(commandName(commandTokens[i])) && !commandTokens[i].includes('code-forge')) continue;
+        const window = commandTokens.slice(i, i + TRANSCRIPT_WINDOW);
         for (const entry of commandEntries) {
           if (!ids.has(entry.id) && isForbidden(window, [entry])) ids.add(entry.id);
         }

package/src/worker/engine.mjs

@@ -171,7 +171,7 @@ import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } fro
  * `tree` (B62b) is the recorded `worktree` `{path, branch, base_sha}`, null when the block has
  * none; `base` is then the tree's `base_sha`. A recorded worktree that `worktreeRecord` refuses
  * (path, branch, hex base_sha) throws `worktree-malformed`.
- * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, testFiles: string[], acceptance?: unknown, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
+ * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, testFiles: string[], acceptance?: unknown, acceptance_revision?: string, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
  */
 export async function blockEntryFor(runId, block) {
   let record;
@@ -199,7 +199,7 @@ export async function blockEntryFor(runId, block) {
       throw new Error('worktree-malformed');
     }
   }
-  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, testFiles, acceptance: entry.acceptance, kind: entry.kind === 'light' ? 'light' : blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
+  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, testFiles, acceptance: entry.acceptance, acceptance_revision: entry.acceptance_revision, kind: entry.kind === 'light' ? 'light' : blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
 }
 
 /** @typedef {{path: string, branch: string, base_sha: string}} WorktreeEntry */
@@ -354,6 +354,9 @@ export async function reviewTicket(ticket, ctx) {
     return { status: 'unavailable', reason: err instanceof Error ? err.message : 'run-record-unreadable', approved: false, engine: 'adaptive', sessions: [] };
   }
   if (entry.kind === null) entry = { ...entry, kind: blockKind({ owned: [ticket.file] }) };
+  if (!ticket.kind && ticket.acceptance_revision !== entry.acceptance_revision) {
+    return { status: 'stale', reason: 'acceptance-amended', approved: false, engine: 'adaptive', sessions: [] };
+  }
   // B62b: every content read of this ticket happens in the block's tree (the main tree without
   // one), taken from the SAME entry as the base and the facts. The worker passes the tree it
   // hashed the ticket in as `ctx.contentRoot`; a record that changed since names another tree.
@@ -621,7 +624,16 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       seq: loaded.seq,
       contentHash: ticket.content_hash,
     };
-    const reopened = reopenRowFor(rows, reopenAt) !== null;
+    let amendedAt = -1;
+    let anchoredAt = -1;
+    rows.forEach((row, i) => {
+      if (row.block !== ticket.block || !verifyRow(row, key).ok) return;
+      if (row.event === 'block.acceptance_amended') amendedAt = i;
+      if (row.event === 'review.state' && row.file === ticket.file) anchoredAt = i;
+    });
+    // A changed review input starts a full round, including previously stopped files. Keep
+    // the anchor sequence and the block's spent L3 rung; tampered state still refuses above.
+    const reopened = amendedAt > anchoredAt || reopenRowFor(rows, reopenAt) !== null;
     if (loaded.status === 'lost' && !reopened) return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-lost', message: LOST_MESSAGE, approved: false, engine: 'adaptive', sessions: [] }) };
     let seq = loaded.seq;
     if (loaded.status === 'restored' && loaded.state !== null && !reopened) {

package/src/worker/queue.mjs

@@ -31,6 +31,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { runRecordPath } from '../state/paths.mjs';
 import { loadKey, signRow, verifyRow } from '../state/signer.mjs';
 import { isAlive, readStartTime, UNKNOWN_START_TIME } from '../util/reaper.mjs';
 import { assertRowPath, assertTicketId, contentHash, ticketId, WorkerError } from './ticket.mjs';
@@ -75,7 +76,7 @@ function readJSON(file) {
 }
 
 /**
- * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string, tree?: string, kind?: 'answers', by_file?: string, by_hash?: string, answers?: string[]}} Ticket
+ * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string, tree?: string, acceptance_revision?: string, kind?: 'answers', by_file?: string, by_hash?: string, answers?: string[]}} Ticket
  *   `tree` (B62b): the block's worktree the content was hashed in. It is part of the ticket id,
  *   and the worker only checks it against the tree it takes from the run record (a ticket whose
  *   tree is not that one is `unavailable`, `worktree-mismatch`); it never reads content there.
@@ -93,7 +94,30 @@ export function resolveTicket({ repoRoot, run, block, file, tree = null }) {
   const rel = assertRowPath(file);
   const root = tree === null ? null : realTree(tree);
   const content_hash = contentHash(root ?? repoRoot, rel);
-  return { rel, root, content_hash, ticket: ticketId({ run, block, file: rel, content_hash, tree: root }) };
+  const revision = acceptanceRevision(repoRoot, run, block);
+  return { rel, root, content_hash, ticket: reviewTicketId({ run, block, file: rel, content_hash, tree: root, acceptance_revision: revision }) };
+}
+
+/** The mirror lets sandboxed callers resolve the same ticket without the private record.
+ * @param {string} repoRoot @param {string} run @param {string} block @returns {string | undefined}
+ */
+function acceptanceRevision(repoRoot, run, block) {
+  const record = readJSON(runRecordPath(run)) ?? readJSON(path.join(repoRoot, '.code-forge', 'runs', `${run}.json`));
+  const revision = record?.blocks?.[block]?.acceptance_revision;
+  return typeof revision === 'string' ? revision : undefined;
+}
+
+/** @param {{run: string, block: string, file: string, content_hash: string, tree?: string | null, acceptance_revision?: string}} parts */
+function reviewTicketId(parts) {
+  const id = ticketId(parts);
+  return parts.acceptance_revision === undefined ? id : createHash('sha256').update(`${id}\0${parts.acceptance_revision}`).digest('hex').slice(0, 24);
+}
+
+/** Reset only the commit-watch cursor; review evidence and results remain intact.
+ * @param {string} repoRoot @param {string} block
+ */
+export function resetAcceptanceWatch(repoRoot, block) {
+  rmSync(path.join(queueDir(repoRoot), 'watch', `${block}.json`), { force: true });
 }
 
 /**
@@ -118,9 +142,10 @@ export function enqueue({ repoRoot, run, block, file, tree = null, now = new Dat
 export function enqueueHash({ repoRoot, run, block, file, content_hash, tree = null, now = new Date() }) {
   const rel = assertRowPath(file);
   const root = tree === null ? null : realTree(tree);
-  const ticket = ticketId({ run, block, file: rel, content_hash, tree: root });
+  const acceptance_revision = acceptanceRevision(repoRoot, run, block);
+  const ticket = reviewTicketId({ run, block, file: rel, content_hash, tree: root, acceptance_revision });
   const target = path.join(queueDir(repoRoot), `${ticket}.json`);
-  const named = root === null ? {} : { tree: root };
+  const named = { ...(root === null ? {} : { tree: root }), ...(acceptance_revision === undefined ? {} : { acceptance_revision }) };
   if (!existsSync(target)) {
     /** @type {Ticket} */
     const body = { ticket, run, block, file: rel, content_hash, enqueued_at: now.toISOString(), ...named };
@@ -444,7 +469,8 @@ export function blockTickets({ repoRoot, run, block, tree = null }) {
     throw new WorkerError('queue-unreadable', 'the review queue cannot be read');
   }
   const tickets = names.filter((n) => /^[0-9a-f]{24}\.json$/.test(n)).map((n) => readTicket(repoRoot, n.slice(0, 24)));
-  return tickets.filter((t) => !t.kind && t.run === run && t.block === block && (t.tree ?? null) === tree)
+  const revision = acceptanceRevision(repoRoot, run, block);
+  return tickets.filter((t) => !t.kind && t.run === run && t.block === block && (t.tree ?? null) === tree && t.acceptance_revision === revision)
     .sort((a, b) => a.enqueued_at.localeCompare(b.enqueued_at) || a.ticket.localeCompare(b.ticket));
 }
 
@@ -505,7 +531,8 @@ export function readTicket(repoRoot, id) {
     if (typeof t.by_hash !== 'string' || ids.join(',') !== t.answers.join(',') || answersTicketId(t) !== id) throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
     return /** @type {Ticket} */ (t);
   }
-  if (ticketId(t) !== id) throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
+  if (t.acceptance_revision !== undefined && typeof t.acceptance_revision !== 'string') throw new WorkerError('bad-ticket', `ticket ${id} has an invalid acceptance revision`);
+  if (reviewTicketId(t) !== id) throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
   return /** @type {Ticket} */ (t);
 }