@codedology/code-forge 0.15.2 → 0.15.4

package/src/cli/block.mjs

@@ -4,11 +4,12 @@
  *
  *   block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file>
  *              [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <forecast>] [--kind code|docs|contract|light]
- *              [--tests <paths…>]
+ *              [--tests <paths…>] [--after <ids…>] [--after-outcome <ids…>]
  *   block attempt <id> --run <r>
  *   block rebase <id> --run <r> [--head <ref>]
  *   block claim <id> <path> --run <r>
- *   block close <id> --run <r> [--worker-pid <pid>] [--remove-worktree]
+ *   block close <id> --run <r> [--worker-pid <pid>] [--remove-worktree] [--auto-claim]
+ *   block land <id> --run <r> --report <file> --transcript <file> [--max <dur>] [--merge] [--no-merge-gate] [--json]
  *   block stop <id> --run <r> --reason <text>
  *   block waive <id> <finding-id> --run <r> --file <path> --reason <text> [--yes]   (orchestrator --yes: evidence and a fresh judge)
  *   block reopen <id> --run <r> --file <path> --reason <text> [--yes]   (B124c: evidence and a fresh judge for the agent path)
@@ -20,8 +21,9 @@
  * close (`closed`): status, reason, close_event (the close result's own event word, as the text
  * prints it in parentheses, else null), and `worktree {removed, path, branch}` with
  * `--remove-worktree`). On
- * failure the exit code and stderr are unchanged and stdout stays empty, except a close the gate
- * refused (`closeBlock` said no), which also prints `{"block", "ok": false, "reason"}`. A usage
+ * failure the exit code and stderr are unchanged and stdout stays empty, except an open refused
+ * for `after-not-done`, `bad-after`, `outcome-not-ready` or `bad-after-outcome`, which prints `{"block", "event": "refused", "code", "message"}`,
+ * or a close the gate refused (`closeBlock` said no), which also prints `{"block", "ok": false, "reason"}`. A usage
  * error, a thrown refusal, a cancelled `--no-require-reviews`, `block waive` or `block reopen` (or
  * one with no terminal, B80) and a failed `--remove-worktree`
  * print nothing on stdout. Without `--json` every output is byte-identical to before.
@@ -194,14 +196,20 @@
  * through `closeBlock`'s `extraChecks`.
  */
 
-import { existsSync, statSync } from 'node:fs';
-import { readFile, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { mkdtemp, readFile, realpath, rm } from 'node:fs/promises';
 import path from 'node:path';
 import { parse as parseYAML } from 'yaml';
+import { runGatesVerb } from './gates.mjs';
+import { parseTapPassed } from '../gates/acceptance.mjs';
+import { parseMax, requeueStoppedFiles, runReviewFile } from './review-file.mjs';
 import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { fallbackLane } from '../decide/fallback-rules.mjs';
 import { laneFacts } from '../decide/lane-facts.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
+import { checkOutcome } from '../outcome/outcome.mjs';
+import { loadPipeline } from '../pipeline/pipeline.mjs';
 import { amendAcceptanceBlock, attemptBlock, claimPath, closeBlock, humanPassBlock, openBlock, prepareAcceptanceAmendment, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { configInForce, externalReviewer, requireCoderTests } from '../state/config-snapshot.mjs';
@@ -209,17 +217,17 @@ import { readFileDiff } from '../review/packet.mjs';
 import { StateError } from '../state/paths.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
 import { loadKey, verifyRow } from '../state/signer.mjs';
-import { PROOF_FINDING, blockFileSet, changedFiles, checkBlockReviews, openFindings, ownsAt, recordedSeverity, resultFilesFor, reviewedFiles, reviewGateCheck, routineCloseProblem, unownedChanges, waiveFinding } from '../review/gate-check.mjs';
+import { PROOF_FINDING, blockFileSet, changedFiles, checkBlockReviews, lockfileProblem, openFindings, ownsAt, recordedSeverity, resultFilesFor, reviewedFiles, reviewGateCheck, routineCloseProblem, unownedChanges, waiveFinding } from '../review/gate-check.mjs';
 import { agentWaivers, agentWaiversAcked, prepareAckWaivers, prepareUnwaive, waiveAsAgent } from '../review/agent-waiver.mjs';
 import { checkExpiry, grantFor, grantState } from '../autopilot/grant.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { blockTree, prepareWorktree, removeWorktree, worktreeSettings } from '../proof/worktree.mjs';
 import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
-import { validateConfig } from '../config/validate.mjs';
+import { reviewExcludeRule, validateConfig } from '../config/validate.mjs';
 import { migrateConfig } from '../config/migrate.mjs';
 import { exec } from '../util/exec.mjs';
 import { contentHash, gitChildEnv, readRegularFileNoFollow } from '../worker/ticket.mjs';
-import { clearDone, resetAcceptanceWatch, resolveTicket } from '../worker/queue.mjs';
+import { clearDone, enqueue, resetAcceptanceWatch, resolveTicket } from '../worker/queue.mjs';
 import { loadState } from '../worker/review-state.mjs';
 import { agentReopens, openBlockEntry, reopenFile } from '../review/reopen.mjs';
 import { checkFileForm, checkFindingId } from '../review/verb-forms.mjs';
@@ -236,7 +244,7 @@ import { acceptedTranscriptHits, prepareAcceptHit, writeAcceptedHit } from '../r
  * main tree), its state is read (never moved) from the code-forge home or the run's old temp root,
  * the checks, the done marker's removal and then the signed row are `reopenFile`'s.
  * @param {{runId: string, id: string, file: string, reason: string, record: Record<string, any>, writeRow: (row: Record<string, any>) => Promise<unknown>, agent?: boolean, judge?: import('../review/agent-waiver.mjs').WaiverJudge}} opts
- * @returns {Promise<{row: Record<string, any>, cleared: boolean}>}
+ * @returns {Promise<{row: Record<string, any>, cleared: boolean, ticket?: string}>}
  */
 async function reopenBlockFile({ runId, id, file, reason, record, writeRow, agent = false, judge }) {
   if (agent) {
@@ -268,7 +276,7 @@ async function reopenBlockFile({ runId, id, file, reason, record, writeRow, agen
   const key = await loadKey(runId);
   const rows = await readAllRows(record.project);
   const tree = contentRoot === mainTop ? {} : { tree: contentRoot };
-  const { row, cleared } = await reopenFile({
+  const { row, cleared, ticket } = await reopenFile({
     runId,
     id,
     file,
@@ -286,14 +294,242 @@ async function reopenBlockFile({ runId, id, file, reason, record, writeRow, agen
       readFile: (f) => readRegularFileNoFollow(contentRoot, f),
       // C11 (synchronous): the cached result of the current content's ticket would repeat the stop
       clearDone: (f) => clearDone({ repoRoot: mainTop, run: runId, block: id, file: f, ...tree }).removed,
+      enqueue: (f, reopened) => enqueue({ repoRoot: mainTop, run: runId, block: id, file: f, ...tree, after: reopened.ts }).ticket,
     },
   });
-  return { row, cleared };
+  return { row, cleared, ticket };
+}
+
+/** Quote a displayed command for a POSIX shell; execution always uses argv.
+ * @param {string[]} argv @returns {string}
+ */
+function landCommand(argv) {
+  return argv.map((arg) => /^[\w./:@=-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", "'\\''")}'`).join(' ');
+}
+
+/** Claim only changes the normal scope check cannot account for, then join real review tickets.
+ * @param {{record: Record<string, any>, runId: string, id: string, writeRow: import('../state/run.mjs').WriteRow, print: (line: string) => void, join?: boolean}} opts
+ */
+async function autoClaimChanges({ record, runId, id, writeRow, print, join = true }) {
+  const entry = record.blocks[id];
+  const wt = await blockTree(record.workspace, entry);
+  const mainTop = await repoTop(record.workspace);
+  const top = wt?.top ?? mainTop;
+  const prefix = path.relative(mainTop, await realpath(record.workspace)).split(path.sep).join('/');
+  const owns = ownsAt(prefix);
+  const ownState = new Set([path.posix.join(prefix, `.code-forge/runs/${runId}.json`), path.posix.join(prefix, `.code-forge/runs/${runId}/${id}.log`)]);
+  const changed = (await changedFiles({ repoRoot: top, base: wt?.base_sha ?? entry.base_sha })).filter((f) => !ownState.has(f));
+  const scope = await unownedChanges({ top, changed, id, blocks: record.blocks, rows: (await readAllRows(record.project)).filter((r) => r.run === runId), key: await loadKey(runId),
+    isMine: (file) => owns(entry.owned_files, file, entry.owned_kinds), owns, ownTree: wt !== null });
+  const files = [...new Set([...(scope?.unowned ?? []), ...(scope?.siblings.map((s) => s.file) ?? [])])].sort();
+  if (files.length === 0) return;
+  const invoke = async (/** @type {string[]} */ args) => {
+    let output = '', error = '';
+    const code = await runReviewFile(args, { cwd: top, stdout: { write: (s) => { output += s; } }, stderr: { write: (s) => { error += s; } } });
+    let data;
+    try { data = JSON.parse(output); } catch { /* Excluded files print a text line. */ }
+    if (code !== 0) throw new StateError('auto-claim-review', error || output || 'auto-claim review failed');
+    return { data, output };
+  };
+  for (const file of files) {
+    await claimPath({ runId, id, file, writeRow, auto: true });
+    Object.assign(entry, (await readRun(runId)).blocks[id]);
+    print(`block ${id} auto-claimed ${file}\n`);
+    await invoke([file, '--block', id, '--run', runId]);
+  }
+  if (!join) return; // Land joins all claimed and originally owned paths under one deadline.
+  const joined = await invoke(['--wait-block', id, '--run', runId]);
+  if (joined.data?.done !== true) throw new StateError('auto-claim-review', `auto-claim reviews did not finish: ${joined.output.trim()}`);
+  for (const file of joined.data.files) {
+    if (file.status === 'excluded' || file.outcome === 'approved') continue;
+    const detail = file.ticket ? (await invoke(['--wait', file.ticket])).output : file.outcome ?? file.status;
+    throw new StateError('auto-claim-review', `auto-claim review refused ${file.file}: ${detail}`);
+  }
+}
+
+/** Join, gates and close share their existing CLI handlers, without spawning the CLI.
+ * @param {{id: string, runId: string, record: Record<string, any>, report: string, transcript: string, maxMs: number, merge: boolean, noMergeGate: boolean, json: boolean}} options
+ * @param {NonNullable<Parameters<typeof runBlock>[1]>} deps
+ * @returns {Promise<number>}
+ */
+async function landBlock({ id, runId, record, report, transcript, maxMs, merge, noMergeGate, json }, deps) {
+  const stdout = deps.stdout ?? process.stdout;
+  const stderr = deps.stderr ?? process.stderr;
+  const emit = (/** @type {Record<string, any>} */ value) => writeSafe(stdout, `${JSON.stringify(value)}\n`);
+  let step = 'join';
+  let next = landCommand(['code-forge', 'review-file', '--wait-block', id, '--run', runId]);
+  const stop = (/** @type {string} */ reason) => {
+    if (step === 'join' && reason === 'wait_timeout') {
+      next = landCommand(['code-forge', 'block', 'land', id, '--run', runId, '--report', report, '--transcript', transcript,
+        '--max', `${Math.max(1800, Math.ceil(maxMs / 500))}s`, ...(merge ? ['--merge'] : []), ...(noMergeGate ? ['--no-merge-gate'] : []), ...(json ? ['--json'] : [])]);
+    }
+    writeSafe(stderr, `block ${id} land stopped at ${step}: ${reason.trim()}\nnext: ${next}\n`);
+    if (json) emit({ block: id, event: 'refused', step, reason: reason.trim(), next });
+    return 1;
+  };
+  /** @param {(streams: {stdout: {write: (s: string) => void}, stderr: {write: (s: string) => void}}) => Promise<number>} run */
+  const capture = async (run) => {
+    let output = '';
+    let error = '';
+    const code = await run({ stdout: { write: (s) => { output += s; } }, stderr: { write: (s) => { error += s; } } });
+    /** @type {Record<string, any> | null} */
+    let data = null;
+    try { data = JSON.parse(output); } catch { /* A thrown refusal may only write stderr. */ }
+    return { code, output, error, data };
+  };
+  try {
+    const entry = record.blocks?.[id];
+    if (!entry) return stop(`unknown block in run ${runId}`);
+    if (entry.status !== 'open') return stop(`block is ${entry.status}, not open`);
+    const tree = await blockTree(record.workspace, entry);
+    if (!tree) return stop('block has no recorded worktree and branch');
+    const deadline = Date.now() + maxMs;
+    await autoClaimChanges({ record, runId, id, writeRow: (row) => appendRow(row, { slug: record.project }), print: (line) => writeSafe(json ? stderr : stdout, line), join: false });
+    let joined;
+    // Findings are usually final; cap retries so land does not wait the full --max on them.
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      const remaining = Math.max(0, deadline - Date.now());
+      if (remaining === 0) return stop('wait_timeout');
+      const duration = remaining > 9_999_999 ? `${Math.floor(remaining / 1000)}s` : `${remaining}ms`;
+      joined = await capture((streams) => runReviewFile(['--wait-block', id, '--run', runId, '--max', duration], { ...streams, cwd: tree.workspace }));
+      for (const line of joined.error.split('\n')) if (line.startsWith('auto-requeue ')) writeSafe(stderr, `${line}\n`);
+      if (joined.code !== 0 || !joined.data?.done || !joined.data.files.some((file) => file.status === 'findings')) break;
+    }
+    if (joined.code !== 0 || !joined.data?.done) {
+      if (joined.data?.status === 'wait_timeout' || joined.data?.reason === 'wait_timeout' || Date.now() >= deadline) return stop('wait_timeout');
+      return stop(joined.error || joined.data?.message || joined.data?.reason || joined.data?.status || 'reviews did not finish');
+    }
+    const problems = joined.data.files.filter((/** @type {Record<string, any>} */ file) => file.status !== 'excluded' && file.outcome !== 'approved');
+    if (problems.length > 0) {
+      const details = [];
+      for (const file of problems) {
+        details.push(`${file.file}: ${file.outcome ?? file.status}`);
+        if (file.ticket) {
+          const result = await capture((streams) => runReviewFile(['--wait', file.ticket], { ...streams, cwd: tree.workspace }));
+          details.push(result.output.trim() || result.error.trim());
+        }
+      }
+      next = landCommand(['code-forge', 'review-file', '--wait', problems[0].ticket]);
+      return stop(details.join('\n'));
+    }
+
+    step = 'gates';
+    next = landCommand(['code-forge', 'gates', 'run', '--run', runId, '--block', id, '--changed']);
+    const gates = await capture((streams) => runGatesVerb(['run', '--run', runId, '--block', id, '--changed', '--cwd', tree.workspace], streams));
+    if (gates.code !== 0 || gates.data?.allOk !== true) return stop(gates.error + (gates.output || 'gates did not pass'));
+    if (gates.error) writeSafe(stderr, gates.error);
+
+    step = 'close';
+    const closeArgs = ['close', id, '--run', runId, '--report', report, '--transcript', transcript];
+    next = landCommand(['code-forge', 'block', ...closeArgs]);
+    const closed = await capture((streams) => runBlock([...closeArgs, '--json'], { ...deps, ...streams }));
+    if (closed.code !== 0 || closed.data?.status !== 'closed') {
+      if (typeof closed.data?.next_command === 'string') next = closed.data.next_command;
+      return stop(closed.error || closed.data?.reason || closed.data?.status || 'close refused');
+    }
+    if (closed.error) writeSafe(stderr, closed.error);
+
+    step = 'merge';
+    const main = await repoTop(record.workspace);
+    if (typeof entry.base_branch !== 'string' || !entry.base_branch) return stop('block has no recorded base branch');
+    const mergeArgs = ['git', '-C', main, 'merge', '--no-ff', '--no-edit', '--', tree.branch];
+    const command = landCommand(mergeArgs);
+    next = command;
+    if (!merge) {
+      writeSafe(json ? stderr : stdout, 'hint: the merge gate runs only with --merge\n');
+      if (json) emit({ block: id, event: 'closed', merge: command });
+      else writeSafe(stdout, `block ${id} closed; merge: ${command}\n`);
+      return 0;
+    }
+    const gitOptions = { cwd: main, env: gitChildEnv(), timeoutMs: 120000 };
+    const branch = await exec(['git', 'symbolic-ref', '-q', 'HEAD'], gitOptions);
+    if (branch.result !== 'ok' || branch.stdout.trim() !== `refs/heads/${entry.base_branch}`) {
+      next = `${landCommand(['git', '-C', main, 'checkout', entry.base_branch])} && ${command}`;
+      return stop(`main checkout must be on recorded base branch ${entry.base_branch}`);
+    }
+    const status = await exec(['git', 'status', '--porcelain', '--untracked-files=all'], gitOptions);
+    if (status.result !== 'ok') return stop(status.stderr || 'cannot check main checkout');
+    if (status.stdout) {
+      next = landCommand(['git', '-C', main, 'status', '--short']);
+      return stop('main checkout is dirty; commit or stash its changes before merging');
+    }
+    // Close measures uncommitted content too; never call that content landed if git cannot merge it.
+    const blockStatus = await exec(['git', 'status', '--porcelain', '--untracked-files=all'], { ...gitOptions, cwd: tree.top });
+    if (blockStatus.result !== 'ok' || blockStatus.stdout) {
+      next = landCommand(['git', '-C', tree.top, 'status', '--short']);
+      return stop('block worktree is dirty or unreadable; commit and review its changes before merging');
+    }
+    if (noMergeGate || configInForce(record)?.gates?.merge_gate === false) {
+      writeSafe(stderr, 'warning: merge gate skipped; merged full suite was not checked\n');
+    } else {
+      step = 'merge-gate';
+      next = landCommand(['code-forge', 'gates', 'run', '--cwd', tree.workspace]);
+      const mainHead = await exec(['git', 'rev-parse', '--verify', 'HEAD'], gitOptions);
+      const blockHead = await exec(['git', 'rev-parse', '--verify', `refs/heads/${tree.branch}`], gitOptions);
+      if (mainHead.result !== 'ok' || blockHead.result !== 'ok') return stop('cannot resolve merge parents');
+      const started = Date.now();
+      // A sibling of this run's block worktree, never the process temp directory.
+      const temporary = await mkdtemp(path.join(path.dirname(tree.path), '.merge-gate-'));
+      let added = false;
+      let failure = '';
+      try {
+        // mkdtemp gives an empty directory; git worktree add accepts an existing empty path.
+        const created = await exec(['git', 'worktree', 'add', '--detach', temporary, mainHead.stdout.trim()], gitOptions);
+        added = created.result === 'ok';
+        if (!added) throw new Error(created.stderr || 'cannot create merge-gate worktree');
+        const merged = await exec(['git', 'merge', '--no-ff', '--no-edit', '--', blockHead.stdout.trim()], { ...gitOptions, cwd: temporary });
+        if (merged.result !== 'ok') {
+          const conflicts = await exec(['git', 'diff', '--name-only', '--diff-filter=U'], { ...gitOptions, cwd: temporary });
+          failure = conflicts.stdout.trim() ? `merge conflict:\n${conflicts.stdout.trim()}` : merged.stderr || merged.stdout || 'trial merge failed';
+        } else {
+          const workspace = path.join(temporary, path.relative(main, record.workspace));
+          // No block scope: the shared gate runner drops scope tokens and runs the full suite.
+          const suite = await capture((streams) => runGatesVerb(['run', '--cwd', workspace], streams));
+          if (suite.code !== 0 || suite.data?.allOk !== true) {
+            const results = suite.data?.results ?? [];
+            const output = results.filter((r) => !r.ok).map((r) => `${r.stdout}\n${r.stderr}`).join('\n');
+            const failed = [...parseTapPassed(output).failed].slice(0, 10);
+            failure = failed.length ? `full suite failed:\n${failed.join('\n')}`
+              : `full suite failed:\n${(suite.error || output || suite.output).trim().split('\n').slice(-20).join('\n')}`;
+          } else if (!suite.data.results.some((r) => r.gate === 'test' && !r.skipped)) {
+            failure = 'full suite unavailable: configure gates.test before merging';
+          }
+        }
+      } finally {
+        const removed = await exec(['git', 'worktree', 'remove', '--force', temporary], gitOptions);
+        if (added && removed.result !== 'ok') throw new Error(`cannot remove merge-gate worktree ${temporary}: ${removed.stderr}`);
+        await rm(temporary, { recursive: true, force: true });
+      }
+      if (failure) return stop(failure);
+      // Refuse a moving target: only merge the same parents whose combined suite passed.
+      const currentMain = await exec(['git', 'rev-parse', '--verify', 'HEAD'], gitOptions);
+      const currentBlock = await exec(['git', 'rev-parse', '--verify', `refs/heads/${tree.branch}`], gitOptions);
+      const currentBranch = await exec(['git', 'symbolic-ref', '-q', 'HEAD'], gitOptions);
+      const currentStatus = await exec(['git', 'status', '--porcelain', '--untracked-files=all'], gitOptions);
+      if (currentMain.result !== 'ok' || currentBlock.result !== 'ok' || currentBranch.result !== 'ok' || currentStatus.result !== 'ok'
+        || currentMain.stdout !== mainHead.stdout || currentBlock.stdout !== blockHead.stdout || currentBranch.stdout !== branch.stdout || currentStatus.stdout) {
+        return stop('merge parents or main checkout changed during the full suite; check the checkout and rerun the merge gate');
+      }
+      writeSafe(json ? stderr : stdout, `merge gate: full suite passed (${((Date.now() - started) / 1000).toFixed(1)}s)\n`);
+    }
+    step = 'merge';
+    next = command;
+    const merged = await exec(mergeArgs, gitOptions);
+    if (merged.result !== 'ok') {
+      next = landCommand(['git', '-C', main, 'status']);
+      return stop(merged.stderr || merged.stdout || 'git merge failed; resolve the merge before continuing');
+    }
+    if (json) emit({ block: id, event: 'landed', merge: command });
+    else writeSafe(stdout, `block ${id} landed\n`);
+    return 0;
+  } catch (thrown) {
+    return stop(thrown?.message ?? String(thrown));
+  }
 }
 
 const USAGE =
-  'usage: code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract|light] [--tests <paths…>]\n' +
-  '       code-forge block attempt|rebase <id> --run <r> · block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews] [--remove-worktree] · block claim <id> <path> --run <r> · block stop <id> --run <r> --reason <text>\n' +
+  'usage: code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract|light] [--tests <paths…>] [--after <ids…>] [--after-outcome <ids…>]\n' +
+  '       code-forge block attempt|rebase <id> --run <r> · block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews] [--remove-worktree] [--auto-claim] · block claim <id> <path> --run <r> · block stop <id> --run <r> --reason <text>\n' +
   '       code-forge block waive <id> <finding-id> --run <r> --file <path> --reason <text> [--yes]\n' +
   '       code-forge block reopen <id> --run <r> --file <path> --reason <text> [--yes]\n' +
   '       code-forge block accept-hit <id> --run <r> [--rule <rule-id>] --line <n> --transcript <path> --reason <text>\n' +
@@ -301,9 +537,42 @@ const USAGE =
   '       code-forge block ack-waivers <id> --run <r>\n' +
   '       code-forge block human-pass <id> --run <r> --note <text> [--proof <dir-or-file>]\n' +
   '       code-forge block amend-acceptance <id> --run <r> --acceptance <file> --reason <text>\n' +
+  '       code-forge block land <id> --run <r> --report <file> --transcript <file> [--max <dur>] [--merge] [--no-merge-gate]\n' +
   '       every block verb takes --json: one JSON line on stdout ({"block","event",…}) instead of the text\n';
 
-const SUBCOMMANDS = ['open', 'attempt', 'rebase', 'claim', 'close', 'stop', 'waive', 'reopen', 'accept-hit', 'unwaive', 'ack-waivers', 'human-pass', 'amend-acceptance'];
+/** @type {Record<string, string>} */
+const VERB_USAGE = {
+  open: '<id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract|light] [--tests <paths…>] [--after <ids…>] [--after-outcome <ids…>]',
+  attempt: '<id> --run <r>',
+  rebase: '<id> --run <r> [--head <ref>] [--accept-changed <file>… --reason <text>]',
+  claim: '<id> <path> --run <r>',
+  close: '<id> --run <r> [--worker-pid <pid>] [--transcript <file>] [--report <file>] [--no-require-reviews] [--remove-worktree] [--auto-claim] [--decide]',
+  land: '<id> --run <r> --report <file> --transcript <file> [--max <dur>] [--merge] [--no-merge-gate]',
+  stop: '<id> --run <r> --reason <text>',
+  waive: '<id> <finding-id> --run <r> --file <path> --reason <text> [--yes]',
+  reopen: '<id> --run <r> --file <path> --reason <text> [--yes]',
+  'accept-hit': '<id> --run <r> [--rule <rule-id>] --line <n> --transcript <path> --reason <text>',
+  unwaive: '<id> <finding-id> --run <r> --file <path> --reason <text>',
+  'ack-waivers': '<id> --run <r>',
+  'human-pass': '<id> --run <r> --note <text> [--proof <dir-or-file>]',
+  'amend-acceptance': '<id> --run <r> --acceptance <file> --reason <text>',
+};
+const SUBCOMMANDS = Object.keys(VERB_USAGE);
+
+/** @param {string} sub @returns {string} */
+function verbUsage(sub) {
+  return `usage: code-forge block ${sub} ${VERB_USAGE[sub]} [--json] [--help|-h]\n` +
+    '  --help, -h  Print this usage and exit without changing state.\n' +
+    '  --json      Print one JSON line on success instead of text.\n' +
+    (sub === 'open' || sub === 'amend-acceptance'
+      ? '  --acceptance <file>  JSON/YAML list [{clause, tests}]; tests is a nonempty list of test ids.\n' +
+        '                       Human checks use {clause, kind: human_check} without tests.\n' : '') +
+    (sub === 'open' ? '  --brief <file>       A file inside the repository, not inline text.\n' : '') +
+    (sub === 'land' ? '  Join block reviews, run changed gates in its worktree, then close.\n' +
+      '  --max <dur>  Total review wait (default 30m); accepts 90s, 30m or 1500ms.\n' +
+      '  --merge     Check the merged full suite, then merge with --no-ff in the clean main checkout.\n' +
+      '  --no-merge-gate  Skip the merged full suite with a warning.\n' : '');
+}
 
 /** Refuse likely shell quoting slips before any row is written.
  * @param {string} workspace @param {string[]} entries @param {string} label
@@ -329,7 +598,33 @@ function checkWhitespacePaths(workspace, entries, label) {
     }
   }
 }
-const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', 'lines', 'head', 'worker-pid', 'reason', 'file', 'transcript', 'kind', 'report', 'rule', 'line', 'note', 'proof'];
+const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', 'lines', 'head', 'worker-pid', 'reason', 'file', 'transcript', 'kind', 'report', 'rule', 'line', 'note', 'proof', 'max'];
+
+/** Check specialist outcomes against the run's project, before state open can write anything.
+ * @param {string} root @param {string} id @param {string[]} ids
+ * @returns {{step: string, sha256: string}[]}
+ */
+function acceptedOutcomes(root, id, ids) {
+  const loaded = loadPipeline(root);
+  const bad = (/** @type {string} */ problem) => new StateError('bad-after-outcome', `block ${id}: --after-outcome: ${problem}`);
+  if (!loaded.exists) throw bad(`no code-forge.pipeline.yml in ${root}`);
+  if (!loaded.ok) throw bad(loaded.problems[0]);
+  const steps = [...new Set(ids)].map((stepId) => {
+    const step = loaded.pipeline.steps.find((candidate) => candidate.id === stepId);
+    if (!step) throw bad(`unknown step ${stepId}`);
+    return step;
+  });
+  return steps.map((step) => {
+    const file = path.resolve(root, step.outcome);
+    const result = existsSync(file) ? checkOutcome(file, { root }) : { ok: false, problems: ['missing outcome'] };
+    if (!result.ok) throw new StateError('outcome-not-ready', `block ${id}: --after-outcome step ${step.id}: ${result.problems[0]}`);
+    try {
+      return { step: step.id, sha256: createHash('sha256').update(readFileSync(file)).digest('hex') };
+    } catch (err) {
+      throw new StateError('outcome-not-ready', `block ${id}: --after-outcome step ${step.id}: cannot read outcome (${err.code ?? 'error'})`);
+    }
+  });
+}
 
 /**
  * @param {string[]} args
@@ -359,8 +654,13 @@ export async function runBlock(args, deps = {}) {
     err(USAGE);
     return 2;
   }
+  if (rest.includes('--help') || rest.includes('-h')) {
+    out(verbUsage(sub));
+    return 0;
+  }
+  let jsonOpenId;
   try {
-    const { flags, positionals } = parseFlags(rest, { values: FLAG_VALUES, multi: ['owned', 'tests'], booleans: ['no-require-reviews', 'remove-worktree', 'json', ...(sub === 'close' ? ['decide'] : []), ...(['waive', 'reopen'].includes(sub) ? ['yes'] : [])] });
+    const { flags, positionals } = parseFlags(rest, { values: FLAG_VALUES, multi: ['owned', 'tests', ...(sub === 'rebase' ? ['accept-changed'] : []), ...(sub === 'open' ? ['after', 'after-outcome'] : [])], booleans: ['no-require-reviews', 'remove-worktree', 'json', ...(sub === 'land' ? ['merge', 'no-merge-gate'] : []), ...(sub === 'close' ? ['decide', 'auto-claim'] : []), ...(['waive', 'reopen'].includes(sub) ? ['yes'] : [])] });
     // B64a: --json prints ONE JSON line on success instead of the text lines (`emit`, one object
     // per verb, built where the text is); without it every output is exactly as before (`say` is `out`)
     const json = flags.json === true;
@@ -375,8 +675,22 @@ export async function runBlock(args, deps = {}) {
       if (t.startsWith('-')) throw new StateError('usage', `--tests: a path may not start with "-": ${JSON.stringify(t)}`);
     }
     const [id, extra] = positionals;
+    if (sub === 'open' && json) jsonOpenId = id;
     const runId = typeof flags.run === 'string' ? flags.run : undefined;
     if (!id || !runId) throw new StateError('usage', 'a block id and --run are required');
+    if (sub === 'land' && (positionals.length !== 1 || typeof flags.report !== 'string' || typeof flags.transcript !== 'string' || Object.keys(flags).some((key) => !['run', 'report', 'transcript', 'max', 'merge', 'no-merge-gate', 'json'].includes(key)))) {
+      throw new StateError('usage', 'block land takes one block id, --run, --report, --transcript and optional --max/--merge/--no-merge-gate/--json');
+    }
+    let landMaxMs = 30 * 60_000;
+    if (sub === 'land' && flags.max !== undefined) {
+      // Reuse review-file's parser, with minutes as a convenience for long lands.
+      try {
+        landMaxMs = typeof flags.max === 'string' && /^\d{1,7}m$/.test(flags.max)
+          ? parseMax(`${Number(flags.max.slice(0, -1)) * 60}s`) : parseMax(flags.max);
+      } catch {
+        throw new StateError('usage', '--max must look like 90s, 30m or 1500ms');
+      }
+    }
     if (sub === 'amend-acceptance' && (positionals.length !== 1 || typeof flags.acceptance !== 'string' || typeof flags.reason !== 'string' || !flags.reason.trim() || /\p{Cc}/u.test(flags.reason))) {
       throw new StateError('usage', 'amend-acceptance needs one block id, --acceptance and a nonblank --reason without control characters');
     }
@@ -405,6 +719,7 @@ export async function runBlock(args, deps = {}) {
       return 0;
     }
     const record = await readRun(runId);
+    if (sub === 'land') return await landBlock({ id, runId, record, report: /** @type {string} */ (flags.report), transcript: /** @type {string} */ (flags.transcript), maxMs: landMaxMs, merge: flags.merge === true, noMergeGate: flags['no-merge-gate'] === true, json }, deps);
     if (sub === 'amend-acceptance') {
       /** @type {ReturnType<typeof prepareAcceptanceAmendment> | null} */
       let prepared = null;
@@ -481,10 +796,11 @@ export async function runBlock(args, deps = {}) {
     const writeRow =(/** @type {Record<string, any>} */ row) => appendRow(row, { slug: record.project });
     const reopened = async (/** @type {boolean} */ agent) => {
       const file = /** @type {string} */ (flags.file);
-      const { row, cleared } = await reopenBlockFile({ runId, id, file, reason: /** @type {string} */ (flags.reason), record, writeRow, agent, judge: deps.waiverJudge });
+      const { row, cleared, ticket } = await reopenBlockFile({ runId, id, file, reason: /** @type {string} */ (flags.reason), record, writeRow, agent, judge: deps.waiverJudge });
       const fromText = row.stop_reason == null ? row.from : `${row.from} ${row.stop_reason}`;
       say(`block ${id} reopened ${file} (from ${fromText}; by: ${row.by})\n`);
-      if (json) emit({ block: id, event: 'reopened', file, from: row.from, stop_reason: row.stop_reason, at_seq: row.at_seq, from_hash: row.from_hash, to_hash: row.to_hash, ticket_cleared: cleared, by: row.by });
+      if (ticket) say(`ticket ${ticket}\nnext: code-forge review-file --wait ${ticket}\n`);
+      if (json) emit({ block: id, event: 'reopened', file, from: row.from, stop_reason: row.stop_reason, at_seq: row.at_seq, from_hash: row.from_hash, to_hash: row.to_hash, ticket_cleared: cleared, by: row.by, ticket });
       return 0;
     };
     // Agent refusals precede even the lazy expiry checks: no rows on refusal.
@@ -542,13 +858,18 @@ export async function runBlock(args, deps = {}) {
     // B48: every block command runs the lazy autopilot checks (grant expiry, expired approvals);
     // a failed check is a warning, never a reason to stop the block command
     const requireHumanClose = sub === 'close' && configInForce(record)?.close?.require_human === true;
-    try {
-      if (!deciding && !requireHumanClose) {
-        err(approvalCheckText(await expiryChecks(runId, (deps.now ?? (() => new Date()))(), { writeRow })));
+    const expire = async () => {
+      try {
+        if (!deciding && !requireHumanClose) {
+          err(approvalCheckText(await expiryChecks(runId, (deps.now ?? (() => new Date()))(), { writeRow })));
+        }
+      } catch (thrown) {
+        err(`autopilot: WARN the expiry check failed (${thrown?.message ?? String(thrown)})\n`);
       }
-    } catch (thrown) {
-      err(`autopilot: WARN the expiry check failed (${thrown?.message ?? String(thrown)})\n`);
-    }
+    };
+    // B148: a refused dependency must not leave even an expiry row behind.
+    const deferExpiry = sub === 'open' && (Array.isArray(flags.after) || Array.isArray(flags['after-outcome']));
+    if (!deferExpiry) await expire();
 
     if (sub === 'open') {
       // an explicit --level wins; B59: else in a brief-mode run the rules lane; B47: else the level
@@ -581,7 +902,21 @@ export async function runBlock(args, deps = {}) {
       }
       // B62a: the run's isolation, from its config snapshot (fixed for the run)
       const isolated = worktreeSettings(record);
-      const { block, pointer, worktreeReused } = await openBlock({
+      // Preserve --after's self-before-unfinished order before examining specialist outcomes.
+      // State open still checks these dependencies under the run lock.
+      let afterOutcome;
+      if (Array.isArray(flags['after-outcome'])) {
+        if (Array.isArray(flags.after)) {
+          if (flags.after.includes(id)) throw new StateError('bad-after', `block ${id} cannot name itself in --after`);
+          const blocking = [...new Set(flags.after)].filter((dependency) => record.blocks[dependency]?.status !== 'closed');
+          if (blocking.length > 0) {
+            const statuses = blocking.map((dependency) => `${dependency} (${record.blocks[dependency]?.status ?? 'not in run'})`);
+            throw new StateError('after-not-done', `block ${id}: --after dependencies not closed: ${statuses.join(', ')}`);
+          }
+        }
+        afterOutcome = acceptedOutcomes(record.workspace, id, flags['after-outcome']);
+      }
+      const { block, pointer, worktreeReused, keptClaims } = await openBlock({
         runId,
         id,
         level,
@@ -594,15 +929,19 @@ export async function runBlock(args, deps = {}) {
         ...(rules ? { decision: { question: 'lane', answer: rules.lane, source: 'rules', facts: rules.facts } } : {}),
         ...(typeof flags.kind === 'string' ? { kind: flags.kind } : {}),
         ...(Array.isArray(flags.tests) ? { tests: flags.tests } : {}),
+        ...(Array.isArray(flags.after) ? { after: flags.after } : {}),
+        ...(afterOutcome ? { after_outcome: afterOutcome } : {}),
         cfg: await openConfig(record.workspace),
         writeRow,
         ...(isolated ? { worktree: (/** @type {{baseSha: string, previous: any}} */ ctx) => prepareWorktree({ cwd: record.workspace, settings: isolated, runId, id, ...ctx }) } : {}),
       });
+      if (deferExpiry) await expire();
       const raised = block.level !== level ? ` (${block.kind} floor, asked ${level})` : '';
       const chosen = typeof flags.level === 'string' ? '' : rules ? ' (rules lane)' : ' (autopilot level)';
       const testCount = Array.isArray(block.test_files) ? block.test_files.length : 0;
       const tests = testCount > 0 ? ` · ${testCount} test file${testCount === 1 ? '' : 's'}` : '';
       say(`block ${id} open · ${block.level}${raised}${chosen} · ${block.kind} · attempt ${block.attempt} · base ${block.base_sha.slice(0, 12)}${tests}\n`);
+      if (keptClaims > 0) say(`kept claims: ${keptClaims}\n`);
       if (block.worktree) say(`worktree ${block.worktree.path} · branch ${block.worktree.branch}${worktreeReused ? ' · reused' : ''}\n`);
       say(`${pointer ?? 'brief: none given (--brief <file>)'}\n`);
       if (json) {
@@ -614,6 +953,7 @@ export async function runBlock(args, deps = {}) {
           source: typeof flags.level === 'string' ? 'flag' : rules ? 'rules' : 'autopilot',
           kind: block.kind,
           attempt: block.attempt,
+          ...(keptClaims > 0 ? { kept_claims: keptClaims } : {}),
           base_sha: block.base_sha,
           tests: testCount,
           worktree: block.worktree ? { path: block.worktree.path, branch: block.worktree.branch, reused: Boolean(worktreeReused) } : null,
@@ -623,13 +963,24 @@ export async function runBlock(args, deps = {}) {
       return 0;
     }
     if (sub === 'attempt') {
-      const n = await attemptBlock({ runId, id, writeRow });
+      const { attempt: n, keptClaims } = await attemptBlock({ runId, id, writeRow });
       say(`block ${id} attempt ${n}\n`);
-      if (json) emit({ block: id, event: 'attempt', attempt: n });
+      if (keptClaims > 0) say(`kept claims: ${keptClaims}\n`);
+      if (json) emit({ block: id, event: 'attempt', attempt: n, ...(keptClaims > 0 ? { kept_claims: keptClaims } : {}) });
       return 0;
     }
     if (sub === 'rebase') {
-      const moved = await rebaseBlock({ runId, id, head: typeof flags.head === 'string' ? flags.head : undefined, writeRow });
+      const acceptChanged = Array.isArray(flags['accept-changed']) ? [...new Set(flags['accept-changed'])] : [];
+      if (acceptChanged.length) {
+        if (positionals.length !== 1 || typeof flags.reason !== 'string' || !flags.reason.trim() || /\p{Cc}/u.test(flags.reason)) throw new StateError('usage', '--accept-changed needs one block id and a nonblank --reason without control characters');
+        for (const file of acceptChanged) checkFileForm(file, { normalized: true });
+        const asked = await confirmHumanVerb('rebase', runId, id, { file: acceptChanged.join(', ') }, record, deps, async () => {
+          if ((await checkExpiry(runId, (deps.now ?? (() => new Date()))())).state === 'active') throw new StateError('autopilot-active', 'block rebase --accept-changed is refused while an autopilot grant is active');
+        });
+        if (asked === 'no-tty') { err(`${humanVerbNoTTY('rebase')}\n`); return 2; }
+        if (asked === 'cancelled') { err(`block ${id} rebase: cancelled — nothing was recorded\n`); return 1; }
+      }
+      const moved = await rebaseBlock({ runId, id, head: typeof flags.head === 'string' ? flags.head : undefined, writeRow, acceptChanged, reason: typeof flags.reason === 'string' ? flags.reason : undefined });
       say(`block ${id} rebased ${moved.old_base.slice(0, 12)} → ${moved.new_base.slice(0, 12)}\n`);
       if (json) emit({ block: id, event: 'rebased', old_base: moved.old_base, new_base: moved.new_base });
       return 0;
@@ -679,7 +1030,7 @@ export async function runBlock(args, deps = {}) {
         throw thrown;
       });
       // ONE base for the whole close: a worktree block is measured against the commit its tree was
-      // made from (kept equal to base_sha, including after a closed worktree rebase)
+      // made from (kept equal to base_sha, including after a worktree rebase)
       const base = wt !== null ? wt.base_sha : entry.base_sha;
       const reviewsWaived = flags['no-require-reviews'] === true;
       let routineGrant = null;
@@ -705,8 +1056,28 @@ export async function runBlock(args, deps = {}) {
       }
       // B58: the owner's other way out — `review.external.required` in the run's config snapshot
       // (set before `run start`, immutable): no TTY, allowed under autopilot, the human flag wins
+      if (flags['auto-claim'] === true) await autoClaimChanges({ record, runId, id, writeRow, print: json ? err : say });
       const external = reviewsWaived ? null : externalReviewer(record);
-      const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      const reviewConfig = configInForce(record);
+      let rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      // Restart changed stopped findings before entering closeBlock's run lock: the worker
+      // needs that lock to publish its fresh review. Refresh rows after the join finishes.
+      if (!reviewsWaived && external === null && !deciding && routineGrant === null) {
+        const mainTop = await repoTop(record.workspace);
+        const restarted = await requeueStoppedFiles({ repoRoot: mainTop, run: runId, block: id,
+          tree: wt?.top ?? mainTop, files: reviewedFiles(rows, id), print: err });
+        if (restarted.size > 0) {
+          let output = '';
+          const code = await runReviewFile(['--wait-block', id, '--run', runId], {
+            cwd: wt?.workspace ?? record.workspace, stdout: { write: (text) => { output += text; } }, stderr: { write: err },
+          });
+          if (code !== 0 || JSON.parse(output).done !== true) {
+            err(`block ${id} open: automatic requeue did not finish\n`);
+            return code || 1;
+          }
+          rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+        }
+      }
       // B52: ONE path base and ONE listing, memoised as a promise and shared by every check. The
       // base is the repository top level: the worker signs every review row with a repo-root-
       // relative `file` and keeps its queue and signed result files under `<top>/.code-forge/`
@@ -770,6 +1141,16 @@ export async function runBlock(args, deps = {}) {
         // B20: the high paths come first — a base the workspace does not know refuses the close here
         const highPaths = await highPathsAt(record.workspace, base);
         const { top, mainTop, where, inTree, wsPrefix, owns, changed, fileSet, reviewed } = await tree();
+        const excluded = fileSet.flatMap((f) => {
+          const rule = reviewExcludeRule(reviewConfig, f.file);
+          return rule === null ? [] : [{ ...f, rule }];
+        });
+        for (const f of excluded) {
+          const problem = lockfileProblem(top, f.file, reviewConfig);
+          if (problem !== null) throw new StateError('lockfile', `lockfile ${f.file}: ${problem}`);
+        }
+        const otherRows = closeRows.filter((r) => r.event !== 'gate.review_excluded');
+        closeRows.splice(0, closeRows.length, ...otherRows, ...excluded.map((f) => ({ event: 'gate.review_excluded', block: id, ...f })));
         const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f, entry.owned_kinds);
         const key = await loadKey(runId);
         // B52: an empty diff with review rows is never silent — name the likely cause
@@ -801,7 +1182,7 @@ export async function runBlock(args, deps = {}) {
           unowned: scope?.unowned ?? [],
           // B52: an old ledger's review.result rows are judged by their signed result files
           resultFiles: await resultFilesFor({ repoRoot: mainTop, runId, block: id, rows }),
-          files: reviewsWaived || external !== null ? [] : fileSet,
+          files: reviewsWaived || external !== null ? [] : fileSet.filter((f) => reviewExcludeRule(reviewConfig, f.file) === null),
           // B52: nothing changed and nothing reviewed is never a pass (the owner's way out is
           // --no-require-reviews); B58: `review.external` does not lift it
           noChanges: !reviewsWaived && fileSet.length === 0,
@@ -852,7 +1233,7 @@ export async function runBlock(args, deps = {}) {
               }
             };
             return await (deps.reviewedLines ?? reviewedLines)({
-              files: fileSet,
+              files: fileSet.filter((f) => reviewExcludeRule(reviewConfig, f.file) === null),
               waivedAll,
               ticketOf,
               onNoTicket: (file) => lineWarnings.push(`WARN no ticket for ${file}\n`),
@@ -879,7 +1260,7 @@ export async function runBlock(args, deps = {}) {
         const { fileSet } = await tree();
         const lines = await toolLines();
         const given = new Set(lines.map((l) => l.file));
-        const missing = missingReviewTickets(text, fileSet.map((f) => f.file)).filter((f) => !given.has(f));
+        const missing = missingReviewTickets(text, fileSet.filter((f) => reviewExcludeRule(reviewConfig, f.file) === null).map((f) => f.file)).filter((f) => !given.has(f));
         if (missing.length > 0) return { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
         for (const file of reportMismatches(text, lines)) lineWarnings.push(`WARN report ticket mismatch ${file}\n`);
         return { ok: true };
@@ -900,7 +1281,9 @@ export async function runBlock(args, deps = {}) {
       });
       if (configInForce(record)?.gates?.test != null) {
         const testGate = async () => {
-          const green = rows.filter((row) => row.block === id && row.event === 'gate.done' && row.all_ok === true);
+          // A rebase changes the tested tree even when owned commit timestamps are preserved.
+          const lastRebase = rows.reduce((last, row, index) => row.block === id && row.event === 'block.rebase' ? index : last, -1);
+          const green = rows.filter((row, index) => index > lastRebase && row.block === id && row.event === 'gate.done' && row.all_ok === true);
           // Only commits after the block base that touch its owned paths belong to this block.
           // Older rows without timestamps remain usable, but a failed history lookup cannot prove freshness.
           const commit = green.length === 0 ? null : await exec(['git', 'log', '-1', '--format=%ct', `${base}..HEAD`, '--', ...entry.owned_files], {
@@ -1024,6 +1407,7 @@ export async function runBlock(args, deps = {}) {
           await warnMovedBase(record.workspace, entry, id, runId, err);
           for (const w of lineWarnings) err(w);
           for (const l of reviewedJson) say(`reviewed ${l.file} ticket ${l.ticket}\n`);
+          for (const f of closeRows.filter((r) => r.event === 'gate.review_excluded')) say(`not reviewed (review.exclude ${f.rule}): ${f.file}\n`);
           for (const f of waivedAll) {
             const parts = f.findings.length > 0 ? [`${f.findings.join(', ')}; by ${f.by}`] : [];
             if (f.answered?.length) parts.push(`answered ${f.answered.join(', ')}`);
@@ -1072,6 +1456,9 @@ export async function runBlock(args, deps = {}) {
       }
     }
   } catch (thrown) {
+    if (jsonOpenId && thrown instanceof StateError && ['after-not-done', 'bad-after', 'outcome-not-ready', 'bad-after-outcome'].includes(thrown.code)) {
+      out(`${JSON.stringify({ block: jsonOpenId, event: 'refused', code: thrown.code, message: thrown.message })}\n`);
+    }
     err(`block ${sub ?? ''}: ${thrown?.message ?? String(thrown)}\n`);
     return thrown instanceof StateError && thrown.code === 'usage' ? 2 : 1;
   }
@@ -1168,7 +1555,7 @@ export const NO_REVIEWS_NO_TTY = '--no-require-reviews needs the human at a term
 
 /**
  * B80: the refusal when `block waive` or `block reopen` has no terminal to ask the human at.
- * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance' | 'close'} verb @returns {string}
+ * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance' | 'close' | 'rebase'} verb @returns {string}
  */
 export const humanVerbNoTTY = (verb) => verb === 'waive'
   ? 'block waive needs the human at a terminal to confirm; nothing was recorded (--yes works only for a recorded warning or nit finding, with evidence)'
@@ -1229,14 +1616,16 @@ async function confirmNoReviews(runId, id, deps) {
  * `by: autopilot`); human-pass instead refuses an active grant. The
  * pre-checks (`reopenPrecheck`, `waivePrecheck`) run first, at a terminal, so the human is never
  * asked about a waive or reopen the verb would refuse that way.
- * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance'} verb @param {string} runId @param {string} id
+ * @param {'waive' | 'reopen' | 'accept-hit' | 'unwaive' | 'ack-waivers' | 'human-pass' | 'amend-acceptance' | 'rebase'} verb @param {string} runId @param {string} id
  * @param {{finding?: string, file: string, rule?: string, line?: number, hits?: {rule: string, line: number}[], oldCount?: number, newCount?: number}} what @param {Record<string, any>} record @param {ConfirmDeps} deps
  * @param {() => Promise<unknown> | unknown} [before]
  * @returns {Promise<'no-tty' | 'confirmed' | 'cancelled'>}
  */
 function confirmHumanVerb(verb, runId, id, what, record, deps, before) {
   const message = () =>
-    verb === 'amend-acceptance'
+    verb === 'rebase'
+      ? `Accept rebased changes in ${what.file} of block ${id} (run ${runId})? Only the owner may say yes.`
+      : verb === 'amend-acceptance'
       ? `Amend acceptance of block ${id} (run ${runId}) from ${what.oldCount} clauses to ${what.newCount} clauses? Only the owner may say yes.`
       : verb === 'human-pass'
       ? `Confirm all device checks of block ${id} (run ${runId}) passed? Only the owner may say yes.`