@codedology/code-forge 0.6.2 → 0.7.0

package/CHANGELOG.md

@@ -6,6 +6,32 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.0] — 2026-10-07
+
+### Fixed
+
+- block close checked no file at all when the block's owned_files were directories, or when the coder's work was
+  committed before block open or done in another worktree, and then closed with findings open. The gate's file set is
+  now the owned diff plus every owned file with review rows for the block, an owned entry with no glob owns the paths
+  below it, an empty diff with review rows prints a WARN naming the likely cause, and a block with no such file refuses
+  no_changes.
+- block close no longer passes a file whose approval a later review of the same content overrode: it refuses
+  not_approved <file> <finding> per open finding until the file is fixed and approved again or the finding is waived (a
+  critical only by the human's block waive; the severity the review recorded decides). The ledger review.result row now
+  carries approved and every open finding with its worst severity (a finding without a valid id as X<n>); an
+  "approved" result that lists a critical is recorded as not approved. An old ledger's review.result row is judged by
+  the ticket's signed result file, and refuses when that file is missing or fails its MAC. Triage never turns a
+  critical finding into a nit, a late-finding ruling clears only a warning or nit ruled nit, and review_cap stands
+  unless an approval of the current content comes after it.
+
+### Security
+
+- block close refuses unowned_change <file> for a file outside the block's owned files that changed after block open
+  (block open now records the tree) and that no other block of the run accounts for; it used to drop such a file from
+  the gate silently. Only .code-forge/ is exempt, and a file an open sibling block owns gets a WARN line naming it.
+  --no-require-reviews now needs the owner to confirm at a terminal: it has no --yes, exits 2 without
+  a terminal and is refused while an autopilot grant is active.
+
 ## [0.6.2] — 2026-10-07
 
 ### Changed

package/README.md

@@ -10,6 +10,14 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 ## What's new in 0.6
 
+Next release:
+
+- **The close gate now checks every file.** `block close` could close a block with critical
+  findings still open: files inside an owned folder were skipped, and so was work committed
+  before `block open` or done in another worktree. Now every reviewed file is checked, a newer
+  failed review beats an older approval, a critical needs your waiver, a change outside the
+  block's files is refused, and `--no-require-reviews` asks you at a terminal.
+
 In 0.6.1:
 
 - **Never relax a rule alone.** A new skill rule (R17): the orchestrator and the delegate never

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 54,
+  "block_count": 55,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -732,6 +732,22 @@
         "B49b"
       ],
       "note": "root-added 2026-10-06; also amends skill/SKILL.md, skill/references/{autopilot,decisions,ledger}.md, README.md, docs/*"
+    },
+    "B52": {
+      "title": "Block close gate hardening (issue #2 field note: a block closed with open criticals): the file set is the diff since base plus every file with a review row of the block, matched against owned paths including directories; an approval is stale after a later non-approved review of the same content; not_approved per open finding (a critical needs a human waiver); old-ledger rows judged by the signed result file; no_changes for an empty set; unowned_change for files changed after open outside owned paths (tree_at_open stamps); triage never demotes a critical; --no-require-reviews needs the owner at a terminal",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/gate-check.mjs",
+        "src/cli/block.mjs",
+        "test/review/close-gate.test.mjs",
+        "test/review/close-gate-field.test.mjs"
+      ],
+      "depends_on": [
+        "B50"
+      ],
+      "note": "root-added 2026-10-07; GitHub issue #2 field note 2026-10-07; also amends src/state/block.mjs, src/review/triage.mjs, src/worker/loop.mjs, skill/SKILL.md, skill/references/{code,review,decisions}.md, skill/references/adapters/{claude-code,solo}.md, docs/how-it-works.md, docs/tutorial-first-test.md, docs/concepts.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/SKILL.md

@@ -41,7 +41,7 @@ State lives in the plan file's header — `facts → planned → hardened → co
 4. Per block, in dispatch order, never more than `caps.coders` alive: `forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> --brief <file> --lines <n> [--kind code|docs|contract]` prints the pointer `BRIEF <path> lines=<n> sha=<sha8> <<<EOM>>>`. Send the pointer per the engine's adapter — `solo` → `references/adapters/solo.md`, `harness` → `references/adapters/claude-code.md`, `subprocess` → `references/adapters/subprocess.md` — and wait for `ACK <sha8> lines=<n>`.
 5. The coder's first message is its **facts diff**, then its forecast (cases and lines, `templates/block-record.md`), then code, file by file: after each file `forge review-file <path> --block <id> --run <r>`, then `forge review-file --wait <ticket>` before the next file. Rounds ≥ 2 re-check only the fix hunks (`references/review.md`).
 6. `===BLOCK <id> COMPLETE===` or `===BLOCK <id> FAILED: <reason>===` ends the coder's turn. Its report is a claim sheet: re-measure it (`references/code.md` §5).
-7. `forge block close <id> --run <r> --report <coder report>` is the gate: a report without a `reviewed <path> ticket <id>` line per changed file is FAILED; a signed `review.approved` row per changed file, gates green, every clause covered, forecast vs actual, no `rule_break`. Red ⇒ `references/decisions.md` (S1 `next`, escalation). Green ⇒ one commit for the block in the project's house style; `forge block rebase <id> --run <r>` first when HEAD moved.
+7. `forge block close <id> --run <r> --report <coder report>` is the gate: a report without a `reviewed <path> ticket <id>` line per changed file is FAILED; a signed `review.approved` row per changed file that no later review of the same content overrode (`not_approved`), no `unowned_change`, no `no_changes` (the files are the owned diff plus every owned file reviewed for the block), gates green, every clause covered, forecast vs actual, no `rule_break`. Red ⇒ `references/decisions.md` (S1 `next`, escalation). Green ⇒ one commit for the block in the project's house style; `forge block rebase <id> --run <r>` first when HEAD moved.
 8. `forge run end --run <r>` when every block is `done`; `forge report --slug <slug>` prints cost per block, escalations, review rounds and the spend per run (`budget.usd`, `references/ledger.md` §3.1).
 
 ## §4 Hard rules (the headings of `references/rules-core.md`)

package/skill/references/adapters/claude-code.md

@@ -12,7 +12,7 @@ The harness's `Agent` tool runs the coder as a subagent; everything else — the
 
 The tool return is the completion signal; the report must begin with `ACK <sha8>` and end with `===BLOCK <id> COMPLETE===` (+ test summary + `git diff --stat`) or `===BLOCK <id> FAILED: <reason>===`. A report without the sentinel is a failed block, never a partial success.
 
-**Between completion and close come the review rounds.** The subagent ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket inside its turn, so most rounds happen before the sentinel; when the tool returns, first drain every `pending` ticket with `forge review-file --wait <ticket>` yourself — a pending ticket is a review in flight, not an open finding, and waiting on it costs no round. Then only an open `fix_now` finding, or a file the coder never submitted, starts a fix round (each one counts toward the file's cap): dispatch a new `Agent` call at the level the ladder says (`review.md` §5 — the coder is gone with its tool return, so the fix brief carries the open findings and the fix history) and it runs `review-file` again on the fixed file. Rounds are bounded: four rounds per file, then the L3 rung once, then `stopped: review_cap` for the human. Only when every changed file has a signed `review.approved` row do you run the re-measurement of `code.md` §5 and `forge block close <id> --run <r> --report <file>` (the subagent's final report, saved to a file) — the transcript grep reads `.code-forge/runs/<run>/<block>.log`; pass `--transcript <file>` when the harness saved the subagent's transcript elsewhere. Closing with a file still unreviewed is a human decision: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, both audited as their own rows.
+**Between completion and close come the review rounds.** The subagent ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket inside its turn, so most rounds happen before the sentinel; when the tool returns, first drain every `pending` ticket with `forge review-file --wait <ticket>` yourself — a pending ticket is a review in flight, not an open finding, and waiting on it costs no round. Then only an open `fix_now` finding, or a file the coder never submitted, starts a fix round (each one counts toward the file's cap): dispatch a new `Agent` call at the level the ladder says (`review.md` §5 — the coder is gone with its tool return, so the fix brief carries the open findings and the fix history) and it runs `review-file` again on the fixed file. Rounds are bounded: four rounds per file, then the L3 rung once, then `stopped: review_cap` for the human. Only when every changed file has a signed `review.approved` row do you run the re-measurement of `code.md` §5 and `forge block close <id> --run <r> --report <file>` (the subagent's final report, saved to a file) — the transcript grep reads `.code-forge/runs/<run>/<block>.log`; pass `--transcript <file>` when the harness saved the subagent's transcript elsewhere. Closing with a file still unreviewed is a human decision: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, which the human runs at their own terminal (it asks for a yes, has no `--yes`, and is refused under an active autopilot grant), both audited as their own rows.
 
 ## §2.1 Plan approval
 

package/skill/references/adapters/solo.md

@@ -22,7 +22,7 @@ Solo adds spawn, watch, timers, scratchpads, locks and `kv` on top of the CLI; i
 5. **Wake channels, event-driven, never fixed polls:** record your own pid once (`whoami` → `kv_set("forge:orchestrator_pid")`); coders that can call Solo carry the push contract (post-sentinel `kv_set("block:<id>", …)` + `timer_set(1s, body, delivery_process_id=<your pid>)`); for every group arm `timer_fire_when_idle_any([coders], max_wait≈20–25 min, delivery_process_id=<your pid>)` right after the launch gate (idle-any ignores already-idle processes, so arm while they are provably running); keep one long dead-man fallback per 30–40 min with an L0 triage first. On wake: sentinel ⇒ gate; no sentinel and active again ⇒ re-arm; no sentinel and idle ⇒ parked, intervene now.
 6. Completion = `search_output(pattern="===BLOCK <id> COMPLETE===")`, last occurrence (the `kv` key is the truncation backup). Completion is not closure.
 7. **Review rounds, with the coder still alive.** The coder ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket; read the ledger (`forge ledger tail --slug <slug>`) for what is still open — a `fix_now` finding, a `pending` ticket, a file never submitted. Each open finding is a fix round sent to the **warm coder** by `send_input` (the findings by id, `<<<EOM>>>`), which fixes and re-runs `review-file` on that file; round ≥ 2 re-checks only the fix hunks (`review.md` §5). **One ladder** (`decisions.md` §5): a stall or exhausted rounds *below L2* climbs one level — close this coder and respawn a fresh one at the higher level with the open findings and the fix history in its brief; **the respawn keeps the per-file round count**, the cap does not reset. L2 is the highest running level: a trigger at L2, or the four-round cap on a file, goes to the **L3 rung once** — a fresh L3 patch session, never this coder and never a coder at L3 — and if findings stay open after the `patch_check` round the file is `stopped: review_cap` for the human. No other path exists.
-8. **Close** only when every changed file has a signed `review.approved` row: the re-measurement of `code.md` §5, then `forge block close <id> --run <r> --report <file>` (the coder's final report) — the transcript grep reads the Solo output. Closing with a file still unreviewed is a human decision, audited: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`.
+8. **Close** only when every changed file has a signed `review.approved` row: the re-measurement of `code.md` §5, then `forge block close <id> --run <r> --report <file>` (the coder's final report) — the transcript grep reads the Solo output. Closing with a file still unreviewed is a human decision, audited: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, which the human runs at their own terminal (it asks for a yes, has no `--yes`, and is refused under an active autopilot grant).
 9. **Reap after the close**: `close_process` the coder and confirm `lock_status` shows no lease before the next group. Locks: a coder that can call Solo holds `lock_acquire` on its file area while editing; coders that cannot never overlap another block.
 
 ## §4 Latency overlaps (standing)

package/skill/references/code.md

@@ -30,8 +30,8 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 
 | claim | re-measured by |
 |---|---|
-| only owned paths touched | file set = tracked changes ∪ untracked, minus other active blocks' owned sets ⊆ `owned_files`; anything else is an orphan that stops every gate until `forge block claim <id> <path> --run <r>` or the human deletes it |
-| every file reviewed | the report names a `review-file` ticket id per changed file (`--report`, which the orchestrator always passes) and a **signed** `review.approved` row for the current content hash of every changed or new file, or an architect-ruled disposition to a named successor block |
+| only owned paths touched | file set = tracked changes since the base ∪ untracked (not ignored), listed from the repository top level, outside the repository top-level `.code-forge/` (keep transcripts and reports there; a subdirectory workspace's own `.code-forge/` is source tree except this run's record mirror and the block's default transcript: a `--transcript` or `--report` path in the source tree is a change like any other); each file must be in `owned_files`, unchanged since `block open` recorded the tree (`tree_at_open`; a path unreadable at open or at close never counts as unchanged), owned by another block of the run that is still **open**, or a closed block's file still exactly at the content its gate approved — else `unowned_change <file>` until `forge block claim <id> <path> --run <r>` or the human puts it back (not lifted by `--no-require-reviews`). The gate cannot tell which coder wrote a file an open sibling owns: it passes it to that sibling's gate and prints `WARN block <id>: <file> changed and is owned by open block <other>` for each one — read those lines |
+| every file reviewed | file set = owned files changed since the base ∪ owned files with any review row of the block (`review.result`/`round`/`approved`/`triage`/`cap`/`late_finding`), an owned entry with no glob covering the paths below it; every path is repo-root-relative (what the worker signs), and an owned entry also matches relative to a workspace in a subdirectory; an empty set refuses `no_changes` (only the owner's `--no-require-reviews`, confirmed at a terminal, lifts it), and an empty diff with review rows WARNs (work committed before `block open`, or in another worktree — open blocks on a base without the work, in the workspace the coder edits). The report names a `review-file` ticket id per changed file (`--report`, which the orchestrator always passes) and a **signed** `review.approved` row for the current content hash of every changed or new file that no later review of the same content overrode (a `review.result` with `approved: false`, a `review.round` with findings open, a `review.cap`): else `not_approved <file> <finding>` per open finding, cleared only by a fix and a fresh approval or a waiver — a critical only by the human's `block waive` — or an architect-ruled disposition to a named successor block |
 | tests green | every gate command run once in the export, each exit status read |
 | clauses covered | every clause names ≥ 1 test id; each test exists and passed in this run; S1 `scope` on the hunks outside the named tests says `false` |
 | test count | the filtered run's delta equals the new tests' own count |
@@ -39,9 +39,9 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 | no rule break | the transcript grep for forbidden verbs and paths (`--transcript <file>`, else the run record's log); a missing transcript ⇒ a signed `gate.transcript_missing` row and a WARN, never silence |
 | high tier proven | every changed high-tier file (`proof.md` §1) has a signed, proven red→green row with `red_kind: assertion` for this block whose `covers` names it (light tier: optional), else `unproven <file>`; only the human's `block waive <id> proof --file <path>` clears it |
 | rows genuine | the MAC of every gate-relevant row verifies; the live worker matches the pinned pid |
-| nothing left open | no unruled `late_findings`; no file at `review_cap` without a signed `review.waived` row |
+| nothing left open | no unruled `late_findings` (a ruling clears only a warning or nit ruled `nit`; a critical late finding needs the human's waiver); no file at `review_cap` without a signed `review.waived` row |
 
-`--no-require-reviews` is the human's way out, written as its own audit row; the orchestrator runs it only after the human said so in chat. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
+`--no-require-reviews` is the human's way out, written as its own audit row. The human runs it themselves at a terminal: it asks for a yes, has no `--yes`, exits 2 unless stdin and stdout are both terminals, lifts `no_changes` and is refused while an autopilot grant is active — so never run it for them; tell them the command when they say so in chat. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
 
 ## §6 Budget — the stop is the feature (R6)
 

package/skill/references/decisions.md

@@ -50,6 +50,6 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 
 ## §7 What reaches the human
 
-`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
+`next = stop`, `review.over_budget`, an orphan file or `unowned_change`, a `not_approved` critical finding, `--no-require-reviews`, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
 
 **Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/review.md

@@ -11,7 +11,7 @@ The topology is decided in one place (`planSessions`). Consensus (§6) runs only
 1. Tools on the file first: lint, types, the file's own tests. Red ⇒ `tools_red` back to the coder, no model review, ledger `gate.red`.
 2. S1 `risk` (path floors first; `confidence < check` ⇒ S2 picks the depth).
 3. Planned depth: `risk < 1` ⇒ one L2 `quick` · `1 ≤ risk < 2`, or `risk ≤ review.single_reviewer_max_risk` ⇒ one L2 `full`, no judge · otherwise two blind L2 sessions (lens A correctness, lens B contracts and security) plus an L3 judge that reads the two reports — and the diff only when `review.judge_sees_diff` is true.
-4. Triage: findings from a single L2 session go to S1 `defect` (`thresholds.findings.fix` fix now · mid-band batched to one L3 ruling per file · below `thresholds.findings.nit` a nit). Findings that come from a judge are final.
+4. Triage: findings from a single L2 session go to S1 `defect` (`thresholds.findings.fix` fix now · mid-band batched to one L3 ruling per file · below `thresholds.findings.nit` a nit). A `critical` finding is always fix now — neither S1 nor the L3 ruling makes it a nit. Findings that come from a judge are final.
 
 ## §3 Isolation and the packet
 
@@ -31,7 +31,7 @@ Per file, per block:
 3a. **Heavy rounds climb at once** (`review_warnings`, `decisions.md` §5 rule 3a): below L2, a round — round 1 included — that leaves ≥ `escalation.warning_threshold` (2) warnings or any `critical` open, `escalation.after_rounds_with_warnings` (1) times at the current level, climbs one level for the next fix. One round with a stronger model is faster and cheaper than three with a cheap one. The per-file cap (step 5) stays the outer limit.
 4. **Ladder**: the running ceiling is `min(L2, escalation.stop_at)` — L3 is never a *running* level. A trigger — rule 1 (`retries`), rule 2 (`escalation.review_rounds_per_level` exhausted with an open `fix_now`), rule 2b (`review_stall`) or step 3a (`review_warnings`) — below the ceiling climbs one level, coded by a fresh session with the open findings and the fix history in its brief (an L1 block's rounds 3–4 run at L2). At the ceiling — an L2 block, or an L1 block that has climbed to L2 — it takes the **L3 rung**: a patch ≤ 80 lines, owned files only, reviewed as a `patch_check` round outside the cap. Under `escalation.l3_mode: code` (opt-in) the rung is instead one L3 coding turn. Either way the rung fires **once per block** and the same post-patch order follows it. After it, in order: `patch_check` clean ⇒ complete; open set not smaller than before the patch ⇒ `stopped: l3_patch_exhausted` (`review_stall`); round ≥ `review.max_rounds_per_file` ⇒ `stopped: review_cap`; otherwise the fixes continue at L2 with `rounds_at_level` reset and the patch in the brief. Any later trigger in that block stops with its named reason (`l3_patch_exhausted`, `review_cap`) and never patches again.
 5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list. **Autopilot:** under a grant, a warning or nit finding may be waived by the delegate (`forge autopilot waive … --decision <id>`, written `by: autopilot`) and a file at the cap may get one extra round (`forge autopilot round`); a critical or proof waiver is never delegated (`autopilot.md`).
-6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap.
+6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap. The gate counts a ruling only when it is `nit` on a warning or nit finding; a critical late finding stays open until the human waives it.
 7. Ledger: one `review.round` row per round with `open_before`, `closed`, `new_in_hunks`, `late`, `open_after`; `forge report` prints rounds per file and rounds that stalled.
 
 Rechecks are never degraded by the budget: a round-2+ packet is already the minimum.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.6.2"
+PINNED_VERSION="0.7.0"
 set -eu
 
 self="$0"

package/src/cli/block.mjs

@@ -13,9 +13,26 @@
  *
  * `block close [--transcript <file>] [--report <file>] [--no-require-reviews]` also runs B12b's review rows
  * (`review/gate-check.mjs`): a signed `review.approved` row for the current content hash of every
- * changed owned file (deletions included) — `--no-require-reviews` is the human's way out, is
- * forbidden to coders (`mergeForbidden`), and leaves a signed `gate.reviews_waived {by: human}`
- * row before the close (never a silent skip); late findings ruled; `review_cap` findings waived; no
+ * changed owned file (deletions included) that no later review of the same content made stale
+ * (B52: `not_approved <file> <finding>` per open finding of that later review, unless waived — a
+ * critical only by the human's `block waive`) — `--no-require-reviews` is the human's way out, is
+ * forbidden to coders (`mergeForbidden`), needs the human to confirm at a terminal (B52: stdin
+ * or stdout not a TTY ⇒ exit 2, an active autopilot grant ⇒ refused, there is no `--yes`; a block
+ * that is not open is refused first, exactly as without the flag), lifts `no_changes`, and leaves a signed
+ * `gate.reviews_waived {by: human}` row before the close (never a silent skip; a declined prompt
+ * prints `block <id> close: cancelled …`). B52: a changed or new file no block of the run
+ * accounts for is `unowned_change <file>` (`unownedChanges`, listed from the repository top
+ * level; not lifted by `--no-require-reviews`; only the repository top-level `.code-forge/` is
+ * exempt — plus, for a workspace in a subdirectory, this run's record mirror and this block's
+ * default transcript there — never a `--transcript` or `--report` path in the source tree; a
+ * closed block's file still exactly at the content its gate approved is accounted for); a file another OPEN block of the run owns
+ * is left to that block's gate with one `WARN` line per file (the close cannot tell which coder
+ * wrote it); an old ledger's `review.result` rows are judged by their signed result files
+ * (`resultFilesFor`). B52 (field run): the file set is the diff since base ∪ every owned file
+ * with review rows of the block (`reviewedFiles`; an owned entry with no glob owns the paths below
+ * it, `ownsAt`), so work committed before `block open` or done in another worktree is still
+ * checked (with a WARN naming the likely cause when the diff shows none of it); an empty set is
+ * `no_changes`; late findings ruled; `review_cap` findings waived; no
  * `rule_break`, plus the transcript grep. The transcript is `--transcript`, else the block's
  * `transcript` in the run record, else `.code-forge/runs/<run>/<block>.log`; none ⇒ a signed
  * `gate.transcript_missing` row and a WARN line (never a silent pass, never a refusal). An id the
@@ -48,13 +65,13 @@ import path from 'node:path';
 import { parse as parseYAML } from 'yaml';
 import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
-import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, stopBlock } from '../state/block.mjs';
+import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { findOverlap } from '../state/registry.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
 import { loadKey, verifyRow } from '../state/signer.mjs';
-import { blockFileSet, reviewGateCheck, waiveFinding } from '../review/gate-check.mjs';
+import { blockFileSet, changedFiles, ownsAt, resultFilesFor, reviewedFiles, reviewGateCheck, unownedChanges, waiveFinding } from '../review/gate-check.mjs';
+import { checkExpiry } from '../autopilot/grant.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
 import { validateConfig } from '../config/validate.mjs';
@@ -73,8 +90,13 @@ const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', '
 
 /**
  * @param {string[]} args
- * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date}} [deps] -
- *   `now` (B48): the clock of the autopilot expiry checks.
+ * @param {{
+ *   stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date,
+ *   isTTY?: boolean, stdinIsTTY?: boolean, stdoutIsTTY?: boolean,
+ *   ui?: {confirm: (o: {message: string, initialValue?: boolean}) => Promise<unknown>, isCancel: (v: unknown) => boolean},
+ * }} [deps] - `now` (B48): the clock of the autopilot expiry checks. `stdinIsTTY` / `stdoutIsTTY`
+ *   (default `process.stdin.isTTY` / `process.stdout.isTTY`; `isTTY` sets both) and `ui` (default
+ *   `@clack/prompts`): B52's confirmation of `--no-require-reviews`, which needs both to be TTYs.
  * @returns {Promise<number>}
  */
 export async function runBlock(args, deps = {}) {
@@ -167,13 +189,44 @@ export async function runBlock(args, deps = {}) {
     if (sub === 'close') {
       const entry = record.blocks?.[id];
       if (!entry) throw new StateError('unknown_block', `block ${id} is not in run ${runId}`);
-      const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      // B52: a block that is not open is refused here, with or without --no-require-reviews, by
+      // the same check and message as `closeBlock` — and the owner is never asked about it
+      if (entry.status !== 'open') throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
       const reviewsWaived = flags['no-require-reviews'] === true;
-      // the block's file set is listed once and shared by the review and report checks; a failure
-      // there is the usual `git-failed` refusal
-      /** @type {ReturnType<typeof blockFileSet> | undefined} */
-      let fileSetOnce;
-      const blockFiles = () => (fileSetOnce ??= blockFileSet({ repoRoot: record.workspace, base: entry.base_sha, owned: entry.owned_files, matchOwned: (f) => findOverlap(entry.owned_files, [f]) !== null }));
+      // B52: the human's way out is confirmed by the human, at a terminal, before anything is written
+      if (reviewsWaived) {
+        const asked = await confirmNoReviews(runId, id, deps);
+        if (asked === 'cancelled') {
+          err(`block ${id} close: cancelled — the review checks stay on\n`);
+          return 1;
+        }
+      }
+      const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      // B52: ONE path base and ONE listing, memoised as a promise and shared by every check. The
+      // base is the repository top level: the worker signs every review row with a repo-root-
+      // relative `file` and keeps its queue and signed result files under `<top>/.code-forge/`
+      // (`repoRootOf`), and `tree_at_open` is stamped there too. An owned entry matches a path
+      // as given or, for a workspace in a subdirectory, relative to the workspace (`ownsAt`).
+      // A failure here is the usual `git-failed` refusal.
+      /** @type {Promise<{top: string, wsPrefix: string, owns: (owned: ReadonlyArray<string>, file: string) => boolean, changed: string[], fileSet: Array<{file: string, content_hash: string}>, reviewed: string[]}> | undefined} */
+      let treeOnce;
+      const tree = () =>
+        (treeOnce ??= (async () => {
+          const top = await repoTop(record.workspace);
+          // both sides as realpaths: git prints the top resolved (/private/var on macOS) while the
+          // run record may keep a symlinked spelling (/var)
+          const real = async (/** @type {string} */ p) => realpath(p).catch(() => path.resolve(p));
+          const wsPrefix = path.relative(await real(top), await real(record.workspace)).split(path.sep).join('/');
+          const owns = ownsAt(wsPrefix);
+          const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+          const changed = await changedFiles({ repoRoot: top, base: entry.base_sha });
+          // the file set is the diff since base ∪ every owned file with review rows of this block —
+          // work the diff cannot see (committed before `block open`, done in another worktree) is
+          // still checked, at its content in the workspace
+          const reviewed = reviewedFiles(rows, id).filter(isMine);
+          const fileSet = await blockFileSet({ repoRoot: top, base: entry.base_sha, owned: entry.owned_files, matchOwned: isMine, changed: [...new Set([...changed, ...reviewed])].sort() });
+          return { top, wsPrefix, owns, changed, fileSet, reviewed };
+        })());
       const reviews = reviewGateCheck(async () => {
         const transcript = await findTranscript(record, id, typeof flags.transcript === 'string' ? flags.transcript : null);
         if (transcript === null) {
@@ -184,14 +237,37 @@ export async function runBlock(args, deps = {}) {
         if (reviewsWaived) await writeSigned(runId, writeRow, { event: 'gate.reviews_waived', block: id, by: 'human' });
         // B20: the high paths come first — a base the workspace does not know refuses the close here
         const highPaths = await highPathsAt(record.workspace, entry.base_sha);
-        const fileSet = await blockFiles();
+        const { top, wsPrefix, owns, changed, fileSet, reviewed } = await tree();
+        const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+        const key = await loadKey(runId);
+        // B52: an empty diff with review rows is never silent — name the likely cause
+        if (reviewed.length > 0 && !changed.some(isMine)) {
+          err(`WARN block ${id}: no owned file differs from the block base in the workspace, but ${reviewed.length} owned file(s) have review rows — the work was likely committed before block open or done in another worktree; they are checked at their content in the workspace\n`);
+        }
+        // B52: only code-forge's own state is exempt — `<top>/.code-forge/`, where the worker keeps
+        // its queue and signed results — never a `--transcript` or `--report` path in the source
+        // tree. For a workspace in a subdirectory, `<workspace>/.code-forge/` is source tree like any
+        // other path, except the two files code-forge itself keeps there at fixed names: this run's
+        // record mirror and this block's default transcript (`.code-forge/runs/<run>.json`,
+        // `.code-forge/runs/<run>/<id>.log`)
+        const wsRel = (/** @type {string} */ p) => path.posix.join(wsPrefix, p);
+        const ownState = new Set([wsRel(`.code-forge/runs/${runId}.json`), wsRel(`.code-forge/runs/${runId}/${id}.log`)]);
+        const scope = await unownedChanges({ top, changed: changed.filter((f) => !ownState.has(f)), id, blocks: record.blocks, rows, key, isMine, owns, stateDir: '.code-forge' });
+        if (scope === null) err(`WARN block ${id}: opened before code-forge recorded the tree at block open; unowned changes were not checked\n`);
+        for (const { file, block: other } of scope?.siblings ?? []) err(`WARN block ${id}: ${file} changed and is owned by open block ${other}; not checked here (its own gate reviews it)\n`);
         return {
           block: id,
           runId,
           rows,
-          key: await loadKey(runId),
+          key,
           transcript,
+          // B52: a change no block of the run owns is refused — `--no-require-reviews` does not lift it
+          unowned: scope?.unowned ?? [],
+          // B52: an old ledger's review.result rows are judged by their signed result files
+          resultFiles: await resultFilesFor({ repoRoot: top, runId, block: id, rows }),
           files: reviewsWaived ? [] : fileSet,
+          // B52: nothing changed and nothing reviewed is never a pass (the owner's way out is --no-require-reviews)
+          noChanges: !reviewsWaived && fileSet.length === 0,
           // B20: high-tier files need a proven red→green row; `--no-require-reviews` does not lift it
           proofFiles: fileSet,
           highPaths,
@@ -206,8 +282,8 @@ export async function runBlock(args, deps = {}) {
         } catch {
           return { ok: false, reason: 'coder report FAILED: --report cannot be read' };
         }
-        const files = await blockFiles();
-        const missing = missingReviewTickets(text, files.map((f) => f.file));
+        const { fileSet } = await tree();
+        const missing = missingReviewTickets(text, fileSet.map((f) => f.file));
         return missing.length === 0 ? { ok: true } : { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
       };
       const result = await closeBlock({ runId, id, rows, writeRow, livePid: intFlag(flags['worker-pid'], 'worker-pid'), probe, extraChecks: [reviews, report] });
@@ -222,6 +298,35 @@ export async function runBlock(args, deps = {}) {
   return 2;
 }
 
+/** B52: the refusal when `--no-require-reviews` has no terminal to ask the human at. */
+export const NO_REVIEWS_NO_TTY = '--no-require-reviews needs the human at a terminal to confirm; the block stays open (there is no --yes)';
+
+/**
+ * B52: `--no-require-reviews` lifts every per-file review check, so it is the human's alone — the
+ * same rule as `autopilot approve`: a flag can be passed by any process (the orchestrator, a
+ * script, the delegate's tooling), so the human confirms at a terminal and there is NO `--yes`.
+ * No terminal — stdin AND stdout must both be TTYs (a piped stdout means nobody may see the
+ * question) — ⇒ `usage` (exit 2); an active autopilot grant on the run ⇒ `autopilot-active`
+ * (exit 1; the owner stops the grant first) — nothing is written either way. `deps.stdinIsTTY` /
+ * `deps.stdoutIsTTY` inject each side; `deps.isTTY` injects both at once.
+ * @param {string} runId @param {string} id
+ * @param {{isTTY?: boolean, stdinIsTTY?: boolean, stdoutIsTTY?: boolean, ui?: {confirm: (o: {message: string, initialValue?: boolean}) => Promise<unknown>, isCancel: (v: unknown) => boolean}, now?: () => Date}} deps
+ * @returns {Promise<'confirmed' | 'cancelled'>}
+ * @throws {StateError} `usage`, `autopilot-active`
+ */
+async function confirmNoReviews(runId, id, deps) {
+  const stdinTTY = deps.stdinIsTTY ?? deps.isTTY ?? process.stdin.isTTY === true;
+  const stdoutTTY = deps.stdoutIsTTY ?? deps.isTTY ?? process.stdout.isTTY === true;
+  if (!(stdinTTY && stdoutTTY)) throw new StateError('usage', NO_REVIEWS_NO_TTY);
+  const grant = await checkExpiry(runId, (deps.now ?? (() => new Date()))());
+  if (grant.state === 'active') {
+    throw new StateError('autopilot-active', `--no-require-reviews is refused while an autopilot grant is active on run ${runId} (stop it first: code-forge autopilot stop --run ${runId})`);
+  }
+  const ui = deps.ui ?? /** @type {any} */ (await import('@clack/prompts'));
+  const go = await ui.confirm({ message: `Close block ${id} of run ${runId} WITHOUT the per-file review checks? Only the owner may say yes.`, initialValue: false });
+  return ui.isCancel(go) || go !== true ? 'cancelled' : 'confirmed';
+}
+
 /**
  * B47: the level `autopilot level` chose for the block — the latest `autopilot.level` row of this
  * run for it whose MAC verifies — or null when there is none.

package/src/review/gate-check.mjs

@@ -1,16 +1,43 @@
 /**
  * The block gate's review rows (plan §4.6 rows 2, 9 and 11; §4.9 `block waive`; §4.11; block B12b).
  *
- * `checkBlockReviews` refuses the block when:
+ * `checkBlockReviews` refuses the block when (the file set is the close's: the diff since base ∪
+ * every owned file with review rows of the block, {@link reviewedFiles}, owned through
+ * {@link ownsPath}):
+ *  - `no_changes`: (B52) that set is empty — the block changed no owned file and has no reviews;
+ *    a close that checked nothing is never a pass (`--no-require-reviews` is the owner's way out);
+ *  - `unowned_change`: (B52) a changed or new file outside the block's `owned_files` that no other
+ *    block of the run accounts for ({@link unownedChanges}: it is as it was when the block opened,
+ *    another block of the run that is still OPEN owns it — the gate cannot tell which coder wrote
+ *    it, so the close WARNs naming each such file — or a closed one owns it and its gate approved
+ *    exactly the current content);
  *  - `unreviewed`: a changed or new file has NO `review.approved` row for its CURRENT content hash;
  *  - `unsigned`:   the file's approvals for that hash exist but none carries a valid MAC;
+ *  - `not_approved`: (B52) the file's signed approval for its current hash is STALE — a later row of
+ *    the block (ledger order) for the same file and hash refuses it ({@link denialOf}: a
+ *    `review.result` with `approved: false` whatever its status, except the outcomes that never
+ *    reviewed the content, {@link neverReviewed}; a `review.round` with `open_after` not 0; a
+ *    `review.cap`; a refusal row with no `content_hash` counts for every hash of its file). One
+ *    refusal per open finding the latest such row names, each cleared only by a valid waiver for
+ *    the severity that row RECORDS (anything but warning/nit — a critical — only by a signed
+ *    `by: human` waiver); a row that names no finding is one `not_approved <file>` that only a
+ *    fresh approval clears. An old ledger's `review.result` row has no `approved` field and is
+ *    trusted neither way: the ticket's signed result file decides ({@link resultFilesFor}); a
+ *    file that is missing or fails its MAC refuses `not_approved <file>`. Refusal rows count
+ *    whether or not they are signed (fail closed); approvals only when signed. The check is per
+ *    content hash: an approval of the current bytes is not made stale by a review of other bytes
+ *    (a file edited and then put back);
  *  - `rule_break`: a `rule_break` row names the block, or the coder transcript hits the forbidden
  *    list (`scanTranscript`; a read of `~/.code-forge/runs/` — the signer key — is the named case);
  *  - `late_unruled`: a `review.late_finding` has neither a signed `review.late_ruling` (the
- *    block-close sweep's L3 ruling) nor a signed `review.waived` row;
+ *    block-close sweep's L3 ruling) nor a signed `review.waived` row. B52: a ruling clears it only
+ *    when it rules `nit` AND the late finding is recorded `warning` or `nit` — a `fix_now` ruling
+ *    clears nothing, and a critical (or unrecorded severity) late finding needs a waiver;
  *  - `review_cap`: a file stopped at `review_cap` has an open finding with no signed
- *    `review.waived {by: human}` row — unless the file has a signed approval at its current hash
- *    (the human fixed it by hand and it was reviewed);
+ *    `review.waived {by: human}` row — unless a signed approval of the file's current hash comes
+ *    AFTER the cap row (ledger order) and no later refusal row made it stale (the human fixed it
+ *    by hand and it was reviewed); a finding already refused as `not_approved` for that file is
+ *    not repeated;
  *  - `unproven`:   a changed owned file of tier `high` (B20, Ricardo 2026-09-25) has no covering
  *    red→green proof (`checkBlockProof`, below). Light-tier files need no proof row.
  * Rulings and waivers only count when their MAC verifies AND name the finding's file exactly
@@ -20,7 +47,7 @@
  * B47 (autopilot): a `review.waived {by: autopilot}` row (written by `autopilot waive`) clears a
  * finding ONLY when {@link autopilotWaiverProblem} finds nothing wrong with it: its MAC verifies;
  * the finding is not `proof`; the finding's severity recorded in the block's signed review rows
- * (`review.triage`, `review.late_finding`; {@link recordedSeverity}) is `warning` or `nit` and
+ * (`review.triage`, `review.late_finding`, B52: `review.result.open`; {@link recordedSeverity}) is `warning` or `nit` and
  * equals the waiver's `severity`; a signed `autopilot.grant` row of this run with the waiver's
  * `grant_id` exists, its window (`ts` ≤ waiver `ts` < `until`) holds the waiver, and its scopes
  * include `waive:<severity>`; no `autopilot.stop` / `autopilot.expire` row for that grant is
@@ -41,12 +68,15 @@ import { mergeForbidden, scanTranscript } from '../util/forbidden.mjs';
 import { exec } from '../util/exec.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
 import { StateError } from '../state/paths.mjs';
+import { findOverlap } from '../state/registry.mjs';
+import { sameStamp, treeStamp } from '../state/block.mjs';
 import { verifyRow } from '../state/signer.mjs';
 import { tierFor } from '../proof/tiers.mjs';
 import { DELETED_HASH, contentHash, gitChildEnv } from '../worker/ticket.mjs';
+import { verifyResult } from '../worker/queue.mjs';
 
 /**
- * @typedef {{code: 'unreviewed' | 'unsigned' | 'rule_break' | 'late_unruled' | 'review_cap' | 'unproven' | 'autopilot_waiver_invalid', file?: string, finding?: string, detail?: string}} Refusal
+ * @typedef {{code: 'no_changes' | 'unowned_change' | 'not_approved' | 'unreviewed' | 'unsigned' | 'rule_break' | 'late_unruled' | 'review_cap' | 'unproven' | 'autopilot_waiver_invalid', file?: string, finding?: string, detail?: string}} Refusal
  */
 
 /** @param {Record<string, any>} row @param {Buffer} key */
@@ -57,15 +87,19 @@ const verified = (row, key) => verifyRow(row, key).ok;
  *   block: string, runId: string, files: Array<{file: string, content_hash: string}>,
  *   rows: Array<Record<string, any>>, key: Buffer, transcript?: string | null,
  *   extraTokens?: string[], proofFiles: Array<{file: string, content_hash: string}>,
- *   highPaths: ReadonlyArray<string>,
- * }} opts `proofFiles` is the set the proof check reads — `--no-require-reviews` empties `files`
+ *   highPaths: ReadonlyArray<string>, unowned?: ReadonlyArray<string>, resultFiles?: Record<string, ResultFile>, noChanges?: boolean,
+ * }} opts `noChanges` (B52): the block changed no owned file and no owned file has review rows —
+ *   refused `no_changes`. `resultFiles` (B52): the signed result files of old-ledger `review.result` rows
+ *   ({@link resultFilesFor}; a row whose file is absent here refuses). `unowned` (B52): the
+ *   changed files no block accounts for ({@link unownedChanges}),
+ *   refused even when `files` is empty. `proofFiles` is the set the proof check reads — `--no-require-reviews` empties `files`
  *   but never the proof check; `highPaths` is `proof.tiers.high.paths`. Both are REQUIRED: a
  *   caller that leaves one out gets a TypeError, never a silent default that skips the proof.
  *   `runId` is required too: the proof check matches its rows on this run only (fix round 4).
  * @returns {{ok: boolean, refusals: Refusal[]}}
  * @throws {TypeError} `runId`, `proofFiles` or `highPaths` undefined
  */
-export function checkBlockReviews({ block, runId, files, rows, key, transcript = null, extraTokens = [], proofFiles, highPaths }) {
+export function checkBlockReviews({ block, runId, files, rows, key, transcript = null, extraTokens = [], proofFiles, highPaths, unowned = [], resultFiles = {}, noChanges = false }) {
   if (runId === undefined) throw new TypeError('checkBlockReviews: runId is required (the proof check matches rows on this run only)');
   if (proofFiles === undefined) throw new TypeError('checkBlockReviews: proofFiles is required (the changed owned files the proof check reads)');
   if (highPaths === undefined) throw new TypeError('checkBlockReviews: highPaths is required (proof.tiers.high.paths)');
@@ -74,11 +108,58 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
   const refusals = [];
   const approvedFor = (/** @type {string} */ file, /** @type {string} */ hash) => mine.filter((r) => r.event === 'review.approved' && r.file === file && r.content_hash === hash);
   const hashOf = new Map(files.map((f) => [f.file, f.content_hash]));
+  /**
+   * B52: the index of the last signed approval and the latest refusal AFTER it for (file, hash);
+   * `denial` is null when that approval stands (or there is none — `unreviewed` / `unsigned` say
+   * so). A refusal row with no `content_hash` counts for every hash of its file (fail closed).
+   * `latest` is the latest refusal for (file, hash) whether or not an approval exists.
+   * @param {string} file @param {string} hash
+   * @returns {{lastApproval: number, denial: Denial | null, latest: Denial | null}}
+   */
+  const latestOf = (file, hash) => {
+    let lastApproval = -1;
+    /** @type {Denial | null} */
+    let denial = null;
+    let lastDenial = -1;
+    mine.forEach((r, i) => {
+      if (r.file !== file) return;
+      if (r.event === 'review.approved') {
+        if (r.content_hash === hash && verified(r, key)) lastApproval = i;
+        return;
+      }
+      if (r.content_hash !== hash && r.content_hash !== undefined) return;
+      const d = denialOf(r, resultFiles);
+      if (d !== null) {
+        denial = d;
+        lastDenial = i;
+      }
+    });
+    return { lastApproval, denial: lastApproval >= 0 && lastDenial > lastApproval ? denial : null, latest: denial };
+  };
+  const staleBy = (/** @type {string} */ file, /** @type {string} */ hash) => latestOf(file, hash).denial;
+
+  for (const file of unowned) refusals.push({ code: 'unowned_change', file, detail: `${file} changed but no block of the run owns it — block claim it, or put it back` });
+
+  if (noChanges) refusals.push({ code: 'no_changes', detail: `block ${block} changed no owned file and has no reviews` });
 
+  /** @type {Array<{file: string, denial: Denial}>} */
+  const stale = [];
   for (const { file, content_hash } of files) {
     const approvals = approvedFor(file, content_hash);
+    const signedApproval = approvals.some((r) => verified(r, key));
     if (approvals.length === 0) refusals.push({ code: 'unreviewed', file, detail: `no review.approved row for ${file} at its current content` });
-    else if (!approvals.some((r) => verified(r, key))) refusals.push({ code: 'unsigned', file, detail: `the review.approved row for ${file} has no valid MAC` });
+    else if (!signedApproval) refusals.push({ code: 'unsigned', file, detail: `the review.approved row for ${file} has no valid MAC` });
+    if (signedApproval) {
+      const denial = staleBy(file, content_hash);
+      if (denial !== null) stale.push({ file, denial });
+    } else {
+      // B52: never approved — its latest review's open findings are named too (the file stays
+      // refused by `unreviewed` / `unsigned` whatever is waived: only an approval clears that)
+      // (a file stopped at the cap is named by the `review_cap` check below instead)
+      const latest = latestOf(file, content_hash).latest;
+      const capped = mine.some((r) => r.event === 'review.cap' && r.file === file);
+      if (latest !== null && latest.open.length > 0 && !capped) stale.push({ file, denial: latest });
+    }
   }
 
   for (const r of mine.filter((row) => row.event === 'rule_break')) refusals.push({ code: 'rule_break', detail: `rule_break row: ${String(r.id ?? r.rule ?? 'unnamed')}` });
@@ -109,8 +190,33 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
   const orInvalid = (refusal, finding, invalid) =>
     invalid === null ? refusal : { code: 'autopilot_waiver_invalid', file: refusal.file, finding, detail: `the autopilot waiver of ${finding} in ${refusal.file} does not count: ${invalid}` };
 
+  /** B52: a ruling clears a late finding only when it rules `nit` on one recorded warning or nit. @param {Record<string, any>} late */
+  const ruledNit = (late) => (late.severity === 'warning' || late.severity === 'nit') && rulings.some((r) => matches(r, late.file, late.finding) && r.ruling === 'nit');
+
+  /** @type {Set<string>} `file\0finding` pairs already refused as not_approved */
+  const notApproved = new Set();
+  for (const { file, denial } of stale) {
+    if (denial.open.length === 0) {
+      refusals.push({ code: 'not_approved', file, detail: `a later review of ${file}'s current content did not approve it (${denial.event}) and names no finding; review it again` });
+      continue;
+    }
+    for (const { id: finding, severity } of denial.open) {
+      notApproved.add(`${file}\0${finding}`);
+      const refusal = /** @type {Refusal} */ ({ code: 'not_approved', file, finding, detail: `the latest review of ${file}'s current content left ${finding} open and it is not waived` });
+      // the severity the refusal row records wins: anything but warning/nit is the human's alone
+      if (severity !== null && !DELEGABLE_SEVERITIES.includes(severity)) {
+        if (waivers.some((r) => matches(r, file, finding))) continue;
+        const delegated = autopilotWaivers.some((r) => matches(r, file, finding));
+        refusals.push(delegated ? { code: 'autopilot_waiver_invalid', file, finding, detail: `the autopilot waiver of ${finding} in ${file} does not count: the latest review records it ${severity}; only the human waives it` } : refusal);
+        continue;
+      }
+      const w = waiverFor(file, finding);
+      if (!w.waived) refusals.push(orInvalid(refusal, finding, w.invalid));
+    }
+  }
+
   for (const late of mine.filter((r) => r.event === 'review.late_finding')) {
-    if (rulings.some((r) => matches(r, late.file, late.finding))) continue;
+    if (ruledNit(late)) continue;
     const w = waiverFor(late.file, late.finding);
     if (w.waived) continue;
     refusals.push(orInvalid({ code: 'late_unruled', file: late.file, finding: late.finding, detail: `late finding ${late.finding} in ${late.file} has no ruling` }, late.finding, w.invalid));
@@ -118,8 +224,13 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
 
   for (const cap of mine.filter((r) => r.event === 'review.cap')) {
     const hash = hashOf.get(cap.file);
-    if (hash !== undefined && approvedFor(cap.file, hash).some((r) => verified(r, key))) continue;
+    // honoured unless a signed approval of the current content comes AFTER the cap and is not stale
+    if (hash !== undefined) {
+      const latest = latestOf(cap.file, hash);
+      if (latest.lastApproval > mine.indexOf(cap) && latest.denial === null) continue;
+    }
     for (const finding of Array.isArray(cap.open) ? cap.open : []) {
+      if (notApproved.has(`${cap.file}\0${finding}`)) continue;
       const w = waiverFor(cap.file, finding);
       if (!w.waived) refusals.push(orInvalid({ code: 'review_cap', file: cap.file, finding, detail: `${cap.file} stopped at review_cap; finding ${finding} is open and not waived` }, finding, w.invalid));
     }
@@ -131,6 +242,122 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
   return { ok: refusals.length === 0, refusals };
 }
 
+/**
+ * B52: the `review.result` outcomes that never reviewed the content, and so are no verdict on it,
+ * whatever they carry: `stale` (the file moved before the review), `unavailable` (no session
+ * answered, or the worker failed) and `refused` with reason `other-run` (the ticket was another
+ * run's). Every other status — `reviewed`, `stopped`, `refused` for any other reason,
+ * `no_change`, `split_required`, … — is a verdict, and anything but `approved: true` refuses.
+ * @param {Record<string, any>} r @returns {boolean}
+ */
+export const neverReviewed = (r) => r.status === 'stale' || r.status === 'unavailable' || (r.status === 'refused' && r.reason === 'other-run');
+
+/**
+ * @typedef {{event: string, open: Array<{id: string, severity: string | null}>}} Denial
+ *   a refusal row: the findings it leaves open (empty = it names none: only a fresh approval
+ *   clears it) with the severity it records (null = it records none; the triage rows decide).
+ * @typedef {{status: unknown, approved: unknown, findings: unknown} | null} ResultFile
+ *   a ticket's signed result file as the gate read it — null when it is missing or its MAC fails.
+ */
+
+/**
+ * B52: what a row says about a review of its (file, content_hash), or null when it is no refusal:
+ *  - `review.result` (the worker's): no verdict when {@link neverReviewed} — those outcomes never
+ *    reviewed the content, so they neither approve nor refuse it. `approved: true` with no
+ *    critical in its `open` is no refusal (the approval itself is the `review.approved` row);
+ *    `approved: true` whose `open` names a critical, and `approved: false`, refuse with every
+ *    finding of `open`. A row WITHOUT `approved` (an old ledger) cannot be trusted either way: the
+ *    ticket's signed result file (`resultFiles[ticket]`, read and MAC-checked by
+ *    {@link resultFilesFor}) decides by the same rule. In particular a file that says `approved:
+ *    true` and lists no critical is no refusal: that is the fix loop's normal approval — the
+ *    remaining warnings and nits were accepted by the reviewer and triage (a critical never is,
+ *    `triage.mjs`). A file that is missing, fails its MAC or names another status refuses with no
+ *    finding (fail closed);
+ *  - `review.round` (the fix loop's): `open_after` not 0, with no finding named;
+ *  - `review.cap`: the file stopped; its `open` ids (severity from the triage rows).
+ * @param {Record<string, any>} r @param {Record<string, ResultFile>} [resultFiles]
+ * @returns {Denial | null}
+ */
+export function denialOf(r, resultFiles = {}) {
+  if (r?.event === 'review.result') {
+    if (neverReviewed(r)) return null;
+    /** @param {unknown} approved @param {Array<{id: string, severity: string}>} open @returns {Denial | null} */
+    const judge = (approved, open) => (approved === true && !open.some((f) => f.severity === 'critical') ? null : { event: r.event, open });
+    if (r.approved === true || r.approved === false) return judge(r.approved, normalizeOpen(r.open));
+    const file = typeof r.ticket === 'string' && Object.hasOwn(resultFiles, r.ticket) ? resultFiles[r.ticket] : null;
+    if (!file || file.status !== r.status) return { event: r.event, open: [] };
+    return judge(file.approved, openFindings(file.findings));
+  }
+  if (r?.event === 'review.round') return r.open_after === 0 ? null : { event: r.event, open: [] };
+  if (r?.event === 'review.cap') {
+    const ids = Array.isArray(r.open) ? r.open.filter((/** @type {unknown} */ id) => typeof id === 'string' && id.length > 0) : [];
+    return { event: r.event, open: [...new Set(/** @type {string[]} */ (ids))].map((id) => ({ id, severity: null })) };
+  }
+  return null;
+}
+
+/**
+ * B52: a ledger row's `open` list as `{id, severity}` — an entry without a string id is kept
+ * under a synthetic id by position (`X<n>`) and an unknown severity as `unknown`, so nothing
+ * vanishes; repeated ids keep the worst severity.
+ * @param {unknown} open @returns {Array<{id: string, severity: string}>}
+ */
+function normalizeOpen(open) {
+  return Array.isArray(open) ? openFindings(open) : [];
+}
+
+/** The finding id form `block waive` accepts. */
+const FINDING_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/;
+/** B52: severity order for {@link openFindings}; an unknown severity ranks above critical (fail closed). */
+const OPEN_RANK = Object.freeze({ nit: 0, warning: 1, critical: 2, unknown: 3 });
+
+/**
+ * B52: the open findings of a review as `{id, severity}`, for the ledger's `review.result` row
+ * (the worker) and the gate (`not_approved <file> <id>`). Nothing vanishes: a finding with a
+ * missing or malformed id (not the form `block waive` takes) is kept as `X<n>`, n its 1-based
+ * position in the list; a severity outside critical/warning/nit is `unknown` (only the human
+ * waives it). An id given more than once keeps its WORST severity (unknown > critical > warning >
+ * nit), at its first position.
+ * @param {unknown} findings @returns {Array<{id: string, severity: string}>}
+ */
+export function openFindings(findings) {
+  if (!Array.isArray(findings)) return [];
+  /** @type {Map<string, string>} */
+  const out = new Map();
+  /** @type {Record<string, number>} */
+  const rank = OPEN_RANK;
+  findings.forEach((f, i) => {
+    const id = typeof f?.id === 'string' && FINDING_ID.test(f.id) ? f.id : `X${i + 1}`;
+    const severity = typeof f?.severity === 'string' && Object.hasOwn(rank, f.severity) && f.severity !== 'unknown' ? f.severity : 'unknown';
+    const had = out.get(id);
+    if (had === undefined || rank[severity] > rank[had]) out.set(id, severity);
+  });
+  return [...out].map(([id, severity]) => ({ id, severity }));
+}
+
+/**
+ * B52: the signed result files {@link denialOf} needs — one per `review.result` row of the block
+ * that has no `approved` field (an old ledger) and is a verdict — keyed by ticket. A file that is
+ * missing, unparsable, names another run or ticket, or fails its MAC is null.
+ * @param {{repoRoot: string, runId: string, block: string, rows: Array<Record<string, any>>}} opts
+ *   `repoRoot`: the repository root the worker writes `.code-forge/reviews/` under.
+ * @returns {Promise<Record<string, ResultFile>>}
+ */
+export async function resultFilesFor({ repoRoot, runId, block, rows }) {
+  /** @type {Record<string, ResultFile>} */
+  const out = {};
+  for (const r of rows) {
+    if (r?.event !== 'review.result' || r.block !== block || Object.hasOwn(r, 'approved') || neverReviewed(r) || typeof r.ticket !== 'string' || Object.hasOwn(out, r.ticket)) continue;
+    try {
+      const checked = await verifyResult(repoRoot, runId, r.ticket);
+      out[r.ticket] = checked.ok && checked.result ? { status: checked.result.status, approved: checked.result.approved, findings: checked.result.findings } : null;
+    } catch {
+      out[r.ticket] = null; // a malformed ticket id, an unreadable file: fail closed
+    }
+  }
+  return out;
+}
+
 /** The finding severities autopilot may waive (B47); anything else is never delegated. */
 export const DELEGABLE_SEVERITIES = Object.freeze(['warning', 'nit']);
 
@@ -139,7 +366,8 @@ const SEVERITY_RANK = Object.freeze({ nit: 0, warning: 1, critical: 2, blocker:
 
 /**
  * The severity the block's signed review rows record for one finding of one file (B47): every
- * `review.triage` and `review.late_finding` row with that `block`, `file` and `finding`; the worst
+ * `review.triage` and `review.late_finding` row with that `block`, `file` and `finding`, and (B52)
+ * every `review.result` row whose `open` list names it (with the severity recorded there); the worst
  * one wins. Fails closed: no row ⇒ `not-recorded`; any such row whose MAC does not verify ⇒
  * `unverified`; a severity outside critical/blocker/warning/nit ⇒ `unknown` — each with
  * `severity: null`.
@@ -148,15 +376,24 @@ const SEVERITY_RANK = Object.freeze({ nit: 0, warning: 1, critical: 2, blocker:
  * @returns {{severity: string, why: null} | {severity: null, why: 'not-recorded' | 'unverified' | 'unknown'}}
  */
 export function recordedSeverity(rows, { block, file, finding, key }) {
-  const named = rows.filter((r) => (r?.event === 'review.triage' || r?.event === 'review.late_finding') && r.block === block && r.file === file && r.finding === finding);
+  /** @type {Array<{row: Record<string, any>, severity: unknown}>} */
+  const named = [];
+  for (const r of rows) {
+    if (r?.block !== block || r.file !== file) continue;
+    if ((r.event === 'review.triage' || r.event === 'review.late_finding') && r.finding === finding) named.push({ row: r, severity: r.severity });
+    // B52: the worker's review.result rows record the open findings' severities too
+    else if (r.event === 'review.result' && Array.isArray(r.open)) {
+      for (const o of r.open) if (o?.id === finding) named.push({ row: r, severity: o.severity });
+    }
+  }
   if (named.length === 0) return { severity: null, why: 'not-recorded' };
-  if (named.some((r) => !verified(r, key))) return { severity: null, why: 'unverified' };
+  if (named.some((n) => !verified(n.row, key))) return { severity: null, why: 'unverified' };
   /** @type {Record<string, number>} */
   const rank = SEVERITY_RANK;
   let worst = '';
-  for (const r of named) {
-    if (typeof r.severity !== 'string' || !Object.hasOwn(rank, r.severity)) return { severity: null, why: 'unknown' };
-    if (worst === '' || rank[r.severity] > rank[worst]) worst = r.severity;
+  for (const { severity } of named) {
+    if (typeof severity !== 'string' || !Object.hasOwn(rank, severity)) return { severity: null, why: 'unknown' };
+    if (worst === '' || rank[severity] > rank[worst]) worst = severity;
   }
   return { severity: worst, why: null };
 }
@@ -330,10 +567,24 @@ export function repoRelativePath(raw) {
  * The block's file set (§4.1): changed tracked files since `base` (deletions included, hashed
  * `DELETED_HASH`) ∪ untracked files, filtered to `owned` (exact paths; a glob owned entry matches through `matchOwned`), each with its content hash.
  * Every path goes through `repoRelativePath`.
- * @param {{repoRoot: string, base: string, owned: string[], matchOwned?: (file: string) => boolean}} opts
+ * @param {{repoRoot: string, base: string, owned: string[], matchOwned?: (file: string) => boolean, changed?: string[]}} opts
+ *   `changed`: the tree's changed files when the caller already listed them ({@link changedFiles}).
  * @returns {Promise<Array<{file: string, content_hash: string}>>}
  */
-export async function blockFileSet({ repoRoot, base, owned, matchOwned }) {
+export async function blockFileSet({ repoRoot, base, owned, matchOwned, changed }) {
+  const all = changed ?? (await changedFiles({ repoRoot, base }));
+  const isOwned = matchOwned ?? ((/** @type {string} */ f) => owned.includes(f));
+  return all.filter((f) => isOwned(f)).map((file) => ({ file, content_hash: currentHash(repoRoot, file) }));
+}
+
+/**
+ * Every changed tracked file since `base` (deletions included) ∪ every untracked, not ignored
+ * file, through `repoRelativePath`, sorted — the set {@link blockFileSet} filters to the block.
+ * @param {{repoRoot: string, base: string}} opts
+ * @returns {Promise<string[]>}
+ * @throws {StateError} `bad-ref`, `git-failed`
+ */
+export async function changedFiles({ repoRoot, base }) {
   if (typeof base !== 'string' || !/^[0-9a-f]{7,64}$/.test(base)) throw new StateError('bad-ref', 'the block base must be a commit id');
   const env = gitChildEnv();
   const changed = await exec(['git', 'diff', '--name-only', '-z', '--no-renames', base, '--'], { cwd: repoRoot, env, timeoutMs: 30000 });
@@ -342,11 +593,130 @@ export async function blockFileSet({ repoRoot, base, owned, matchOwned }) {
   const all = new Set(
     [...changed.stdout.split('\0'), ...untracked.stdout.split('\0')].filter((f) => f.length > 0).map((f) => repoRelativePath(f)),
   );
-  const isOwned = matchOwned ?? ((/** @type {string} */ f) => owned.includes(f));
-  return [...all]
-    .filter((f) => isOwned(f))
-    .sort()
-    .map((file) => ({ file, content_hash: isOnDisk(repoRoot, file) ? contentHash(repoRoot, file) : DELETED_HASH }));
+  return [...all].sort();
+}
+
+/**
+ * B52: whether `owned` (a block's `owned_files`) covers `file` at the gate: the `findOverlap`
+ * match `block open` uses (exact paths and globs), and — what the field run needed — an entry with
+ * no glob character also covers every path below it as a directory (`src/feature` owns
+ * `src/feature/Fan.swift`). A wider match only ever puts more files under the gate's checks.
+ * @param {ReadonlyArray<string>} owned @param {string} file @returns {boolean}
+ */
+export function ownsPath(owned, file) {
+  if (findOverlap(owned, [file]) !== null) return true;
+  return owned.some((o) => typeof o === 'string' && o.length > 0 && !/[*?[\]{}]/.test(o) && file.startsWith(`${o.replace(/\/+$/, '')}/`));
+}
+
+/**
+ * B52: {@link ownsPath} for the close's one path base, the repository top level: `file` is
+ * repo-root-relative (as git lists it and the worker signs it); an owned entry matches it as
+ * given, or — for a workspace in a subdirectory (`wsPrefix`, the workspace relative to the top;
+ * `''` when they are the same) — relative to the workspace. A file outside the workspace is
+ * matched as given only.
+ * @param {string} wsPrefix @returns {(owned: ReadonlyArray<string>, file: string) => boolean}
+ */
+export function ownsAt(wsPrefix) {
+  const prefix = wsPrefix.replace(/\/+$/, '');
+  return (owned, file) => ownsPath(owned, file) || (prefix !== '' && prefix !== '.' && file.startsWith(`${prefix}/`) && ownsPath(owned, file.slice(prefix.length + 1)));
+}
+
+/** B52: the review rows that name a file the block's worker reviewed. */
+const REVIEW_EVENTS = new Set(['review.result', 'review.round', 'review.approved', 'review.triage', 'review.cap', 'review.late_finding']);
+
+/**
+ * B52: every file with ANY review row (`review.result`, `review.round`, `review.approved`,
+ * `review.triage`, `review.cap`, `review.late_finding`) for `block` among the run's `rows`,
+ * through `repoRelativePath` (a path it
+ * refuses is left out), sorted. The close adds them to the diff's file set, so work the diff
+ * cannot see — committed before `block open`, done in another worktree — is still checked.
+ * @param {Array<Record<string, any>>} rows @param {string} block @returns {string[]}
+ */
+export function reviewedFiles(rows, block) {
+  /** @type {Set<string>} */
+  const out = new Set();
+  for (const r of rows) {
+    if (r?.block !== block || !REVIEW_EVENTS.has(r.event) || typeof r.file !== 'string') continue;
+    try {
+      out.add(repoRelativePath(r.file));
+    } catch {
+      // not a repo path: nothing on disk to check it against
+    }
+  }
+  return [...out].sort();
+}
+
+/** @param {string} repoRoot @param {string} file @returns {string} the content hash, `DELETED_HASH` when gone. */
+const currentHash = (repoRoot, file) => (isOnDisk(repoRoot, file) ? contentHash(repoRoot, file) : DELETED_HASH);
+
+/**
+ * B52: the changed files of the tree (`changed`, from {@link changedFiles} run at the repository
+ * top level `top`, so top-relative) that NO block of the run accounts for — each one is an
+ * `unowned_change` refusal at `block close`. A file is accounted for when:
+ *  - this block owns it (`isMine`, the close's own `owned_files` match);
+ *  - it is exactly as it was when this block opened: its `tree_at_open` stamp (`treeStamp`) is
+ *    the same now (`sameStamp`; an `unreadable` stamp at open or now never is) — a change made
+ *    before the coder started (plan files, `init`'s config, a skill link) is not the coder's; any
+ *    later edit to it is;
+ *  - another block of the run that is still OPEN owns it (parallel coders share the tree and its
+ *    own gate reviews it). The gate cannot tell which coder wrote it, so such files are returned
+ *    in `siblings` and the close WARNs naming each one;
+ *  - a CLOSED block of the run owns it AND a signed `review.approved` row of that block names the
+ *    file at its current content hash (that block's work, exactly as its gate approved it — a
+ *    later edit makes it unowned again);
+ *  - it is code-forge's own state: under `.code-forge/` at the top level or under `stateDir` (the
+ *    workspace's `.code-forge/`, top-relative). Nothing else is exempt — not the close's own
+ *    `--transcript` or `--report` when they sit in the source tree.
+ * A stopped block accounts for nothing. Paths match through {@link ownsPath} (globs as at `block
+ * open`). A stamp that throws counts as not accounted (refused). A block opened before B52 has no
+ * `tree_at_open`: null — nothing can tell the coder's changes from earlier ones, so the caller
+ * warns that the check did not run (never a silent pass).
+ * @param {{
+ *   top: string, changed: ReadonlyArray<string>, id: string, blocks: Record<string, any>,
+ *   rows: Array<Record<string, any>>, key: Buffer, isMine: (file: string) => boolean, owns?: (owned: ReadonlyArray<string>, file: string) => boolean, stateDir?: string,
+ * }} opts `blocks`: the run record's `blocks`; `rows`: the run's ledger rows; `owns` (default {@link ownsPath}): how another block's `owned_files` match a path.
+ * @returns {Promise<{unowned: string[], siblings: Array<{file: string, block: string}>} | null>}
+ */
+export async function unownedChanges({ top, changed, id, blocks, rows, key, isMine, owns = ownsPath, stateDir = '.code-forge' }) {
+  const atOpen = blocks?.[id]?.tree_at_open;
+  if (!atOpen || typeof atOpen !== 'object' || Array.isArray(atOpen)) return null;
+  const others = Object.entries(blocks ?? {}).filter(([other, b]) => other !== id && b && Array.isArray(b.owned_files));
+  /** @param {string} file @returns {boolean} */
+  const approvedClosed = (file) => {
+    let hash;
+    try {
+      hash = currentHash(top, file);
+    } catch {
+      return false; // a symlink or an unreadable path was never approved
+    }
+    return others.some(
+      ([other, b]) =>
+        b.status === 'closed' &&
+        owns(b.owned_files, file) &&
+        rows.some((r) => r?.event === 'review.approved' && r.block === other && r.file === file && r.content_hash === hash && verified(r, key)),
+    );
+  };
+  /** @param {string} file @returns {Promise<boolean>} */
+  const unchangedSinceOpen = async (file) => {
+    if (!Object.hasOwn(atOpen, file)) return false;
+    try {
+      return sameStamp(atOpen[file], await treeStamp(top, file));
+    } catch {
+      return false;
+    }
+  };
+  const state = (/** @type {string} */ f) => [...new Set(['.code-forge', stateDir])].some((dir) => f === dir || f.startsWith(`${dir}/`));
+  /** @type {string[]} */
+  const unowned = [];
+  /** @type {Array<{file: string, block: string}>} */
+  const siblings = [];
+  for (const file of changed) {
+    if (state(file) || isMine(file) || (await unchangedSinceOpen(file))) continue;
+    const sibling = others.find(([, b]) => b.status === 'open' && owns(b.owned_files, file));
+    if (sibling) siblings.push({ file, block: sibling[0] });
+    else if (!approvedClosed(file)) unowned.push(file);
+  }
+  return { unowned, siblings };
 }
 
 /**

package/src/review/triage.mjs

@@ -11,7 +11,11 @@
  *    to ONE L3 ruling per file (`deps.rule`). Jev unavailable or `defect` disabled ⇒ §3.5 fallback:
  *    `defect` has no rule (`alwaysResidue`), so every finding is residue for the L3 ruling;
  *  - fail closed: a mid-band finding with no ruling available (no `deps.rule`, or it failed or
- *    left the id out) is `fix_now` unless its severity is `nit`.
+ *    left the id out) is `fix_now` unless its severity is `nit`;
+ *  - B52: a `critical` finding is ALWAYS `fix_now` — neither S1's band nor the L3 ruling makes it
+ *    a nit (both are still asked and logged in the row's `p` / `band`). Only a fix (the recheck)
+ *    or the human's `block waive` ends a critical; otherwise the loop would write
+ *    `review.approved` with the reviewer's critical still standing.
  * One `review.triage` row per finding: `{file, finding, severity, source, p, band, verdict}`.
  */
 
@@ -110,6 +114,8 @@ export async function triageFindings({ file, findings, fromJudge, diffText = '',
   /** @type {Array<{finding: Finding, p: number | null}>} */
   const mid = [];
   const put = (/** @type {Finding} */ f, /** @type {'fix_now' | 'nit'} */ verdict) => (verdict === 'fix_now' ? fixNow : nits).push(f);
+  /** B52: a critical is never demoted. @param {Finding} f @param {'fix_now' | 'nit'} verdict @returns {'fix_now' | 'nit'} */
+  const keepCritical = (f, verdict) => (f.severity === 'critical' ? 'fix_now' : verdict);
 
   for (const finding of findings) {
     const p = await askNoul('defect', { file_diff_hunk: diffText, finding }, { jev, cfg });
@@ -129,8 +135,9 @@ export async function triageFindings({ file, findings, fromJudge, diffText = '',
       mid.push({ finding, p });
       continue;
     }
-    put(finding, band);
-    await note(writeRow, { event: 'review.triage', file, finding: finding.id, severity: finding.severity, source: 'jev', p, band, verdict: band });
+    const verdict = keepCritical(finding, band);
+    put(finding, verdict);
+    await note(writeRow, { event: 'review.triage', file, finding: finding.id, severity: finding.severity, source: 'jev', p, band, verdict });
   }
 
   let rulings = 0;
@@ -147,7 +154,7 @@ export async function triageFindings({ file, findings, fromJudge, diffText = '',
     }
     for (const { finding, p } of mid) {
       const given = ruled?.[finding.id];
-      const verdict = given === 'fix_now' || given === 'nit' ? given : severityVerdict(finding);
+      const verdict = keepCritical(finding, given === 'fix_now' || given === 'nit' ? given : severityVerdict(finding));
       put(finding, verdict);
       await note(writeRow, {
         event: 'review.triage',

package/src/state/block.mjs

@@ -12,7 +12,9 @@
  */
 
 import { createHash } from 'node:crypto';
+import { createReadStream, existsSync, lstatSync, readlinkSync, realpathSync } from 'node:fs';
 import os from 'node:os';
+import path from 'node:path';
 import { BLOCK_KINDS, blockKind, dispatchLevel } from '../decide/escalation.mjs';
 import { exec } from '../util/exec.mjs';
 import { isAncestorArgv, revParseArgv } from '../util/git.mjs';
@@ -48,6 +50,133 @@ async function git(argv, cwd, okExitCodes) {
   return res;
 }
 
+/** B52: the stamp of a path whose state could not be read; never equal to anything (see {@link sameStamp}). */
+export const UNREADABLE = 'unreadable';
+
+/**
+ * B52: a stamp of one path's current state, never following a symlink and never throwing:
+ *  - `deleted` — nothing at the path;
+ *  - `file:<x|->:<sha256 of the bytes>` — a regular file, with its executable bit (hash streamed);
+ *  - `link:<sha256 of the target text>` — a symlink, by where it points;
+ *  - `repo:<HEAD commit>:<sha256 of its changes>` — a directory holding a git repository (a
+ *    checked-out submodule, a nested repo): its checked-out commit, and the status, the binary
+ *    diff against HEAD and every untracked file's content (`repoStamp`) — so a repo already dirty
+ *    at open and edited again later stamps differently;
+ *  - `gitlink:<commit>` — a directory with no `.git` that the index records as a gitlink (an
+ *    uninitialised submodule);
+ *  - {@link UNREADABLE} — anything else (a plain directory, a FIFO, a read or git failure).
+ * Two stamps are the same only when the path did not change between them, and an `unreadable`
+ * stamp never matches — a read failure must never make a file look unchanged.
+ * @param {string} top - the repository top level (`repoTop`). @param {string} file - top-relative.
+ * @returns {Promise<string>}
+ */
+export async function treeStamp(top, file) {
+  const full = path.join(top, file);
+  let stat;
+  try {
+    stat = lstatSync(full);
+  } catch (err) {
+    return /** @type {NodeJS.ErrnoException} */ (err).code === 'ENOENT' ? 'deleted' : UNREADABLE;
+  }
+  try {
+    if (stat.isSymbolicLink()) return `link:${sha256(readlinkSync(full))}`;
+    if (stat.isFile()) return `file:${(stat.mode & 0o111) !== 0 ? 'x' : '-'}:${await fileSha256(full)}`;
+    if (stat.isDirectory() && existsSync(path.join(full, '.git'))) return await repoStamp(full);
+    if (stat.isDirectory()) return await gitlinkStamp(top, file);
+  } catch {
+    return UNREADABLE;
+  }
+  return UNREADABLE;
+}
+
+/** @param {Buffer | string} data @returns {string} */
+const sha256 = (data) => createHash('sha256').update(data).digest('hex');
+
+/**
+ * B52: a file's sha256, streamed (a large file is never read whole into memory).
+ * @param {string} full @returns {Promise<string>}
+ */
+async function fileSha256(full) {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(full)) hash.update(/** @type {Buffer} */ (chunk));
+  return hash.digest('hex');
+}
+
+/**
+ * B52: a nested repository's stamp — its HEAD, and a sha256 over its own changes: `git status
+ * --porcelain=v1 -z`, `git diff HEAD --binary` (the content of every tracked change) and each
+ * untracked file's path and sha256. Any git failure is {@link UNREADABLE}.
+ * @param {string} dir @returns {Promise<string>}
+ */
+async function repoStamp(dir) {
+  const run = (/** @type {string[]} */ argv) => exec(argv, { cwd: dir, env: gitEnv(), timeoutMs: 30000 });
+  const head = await run(['git', 'rev-parse', '--verify', 'HEAD']);
+  const status = await run(['git', 'status', '--porcelain=v1', '-z', '--untracked-files=all']);
+  const diff = await run(['git', 'diff', 'HEAD', '--binary']);
+  const untracked = await run(['git', 'ls-files', '-z', '--others', '--exclude-standard']);
+  if (head.result !== 'ok' || status.result !== 'ok' || diff.result !== 'ok' || untracked.result !== 'ok') return UNREADABLE;
+  const hash = createHash('sha256').update(status.stdout).update('\0diff\0').update(diff.stdout);
+  for (const rel of untracked.stdout.split('\0').filter((f) => f.length > 0).sort()) {
+    const inner = path.join(dir, rel);
+    const st = lstatSync(inner);
+    hash.update(`\0${rel}\0`).update(st.isFile() ? await fileSha256(inner) : st.isSymbolicLink() ? `link:${sha256(readlinkSync(inner))}` : 'other');
+  }
+  return `repo:${head.stdout.trim()}:${hash.digest('hex')}`;
+}
+
+/**
+ * B52: a directory with no `.git` of its own that the index records as a gitlink (an uninitialised
+ * submodule): `gitlink:<commit>` from `git ls-files -s`; anything else is {@link UNREADABLE}.
+ * @param {string} top @param {string} file @returns {Promise<string>}
+ */
+async function gitlinkStamp(top, file) {
+  const res = await exec(['git', 'ls-files', '-s', '-z', '--', file], { cwd: top, env: gitEnv(), timeoutMs: 30000 });
+  if (res.result !== 'ok') return UNREADABLE;
+  const entry = res.stdout.split('\0').find((e) => e.endsWith(`\t${file}`));
+  const m = entry ? /^160000 ([0-9a-f]{40,64}) \d+\t/.exec(entry) : null;
+  return m ? `gitlink:${m[1]}` : UNREADABLE;
+}
+
+/**
+ * B52: whether two stamps say the path did not change: equal, and neither {@link UNREADABLE}.
+ * @param {unknown} a @param {unknown} b @returns {boolean}
+ */
+export const sameStamp = (a, b) => typeof a === 'string' && a === b && a !== UNREADABLE;
+
+/**
+ * B52: the repository's top level (`git rev-parse --show-toplevel`, realpath'd) — the root both
+ * git listings run from and every stamp is taken against, so a workspace in a subdirectory of
+ * the repository lines up with the repo-root-relative paths git prints.
+ * @param {string} cwd @returns {Promise<string>}
+ * @throws {StateError} `git-failed`
+ */
+export async function repoTop(cwd) {
+  const res = await git(['git', 'rev-parse', '--show-toplevel'], cwd);
+  return realpathSync(res.stdout.trim());
+}
+
+/**
+ * B52: the tree's changes when a block opens — every file changed since `base` (deletions
+ * included) and every untracked, not ignored file, listed from the repository top level, each
+ * with its {@link treeStamp}. Recorded in the block's entry (`tree_at_open`, top-relative paths):
+ * at `block close`, a file outside the block's `owned_files` whose stamp is still the same
+ * ({@link sameStamp}) is not the coder's change (plan files, `init`'s config, a skill link…); one
+ * that changed since, or could not be read either time, is `unowned_change` (`review/gate-check.mjs`).
+ * @param {string} cwd @param {string} base - a full commit sha.
+ * @returns {Promise<Record<string, string>>}
+ * @throws {StateError} `git-failed`
+ */
+export async function treeAtOpen(cwd, base) {
+  const top = await repoTop(cwd);
+  const changed = await git(['git', 'diff', '--name-only', '-z', '--no-renames', base, '--'], top);
+  const untracked = await git(['git', 'ls-files', '-z', '--others', '--exclude-standard'], top);
+  const files = [...new Set([...changed.stdout.split('\0'), ...untracked.stdout.split('\0')].filter((f) => f.length > 0))].sort();
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const file of files) out[file] = await treeStamp(top, file);
+  return out;
+}
+
 /** @param {string} ref @param {string} cwd @returns {Promise<string>} the full commit sha */
 async function resolveCommit(ref, cwd) {
   if (typeof ref !== 'string' || ref.length === 0 || ref.startsWith('-')) {
@@ -130,7 +259,8 @@ function activeBlocks(record) {
  * block kind (B34: the declared `kind`, else `blockKind` of the owned files). A docs/contract
  * block asked for below `levels.coder_floor_docs` (default L1) is opened AT the floor: the entry
  * and the dispatch row carry the floor level, and the row adds `requested_level` and
- * `trigger: 'docs_floor'`.
+ * `trigger: 'docs_floor'`. B52: the entry also records `tree_at_open` ({@link treeAtOpen}), the
+ * tree's changes at open, which `block close` reads to tell the coder's changes from earlier ones.
  * @param {{
  *   runId: string, id: string, level: string, owned: string[], acceptance: unknown,
  *   attempt?: number, base?: string, lines?: number, brief?: {path: string, content: Buffer | string},
@@ -151,6 +281,12 @@ export async function openBlock(opts) {
   const dispatched = dispatchLevel({ lane: level, kind, cfg: opts.cfg });
   const pointer = opts.brief ? briefPointer(opts.brief.path, opts.brief.content) : null;
 
+  // B52: the tree is stamped BEFORE the run lock (hashing can be slow; other block commands must
+  // not wait on it); under the lock the base is resolved again and must be the one stamped against
+  const { workspace } = await readRun(runId);
+  const stampedBase = await resolveCommit(opts.base ?? 'HEAD', workspace);
+  const treeOpen = await treeAtOpen(workspace, stampedBase);
+
   const block = await mutateRun(runId, null, writeRow, async (record) => {
     if (record.blocks[id]?.status === 'open') throw new StateError('already-open', `block ${id} is already open`);
     for (const [otherId, other] of Object.entries(activeBlocks(record))) {
@@ -158,7 +294,8 @@ export async function openBlock(opts) {
       if (pair) throw new StateError('overlap', `block ${id} owns ${pair[0]}, which overlaps ${pair[1]} owned by open block ${otherId}`);
     }
     const baseSha = await resolveCommit(opts.base ?? 'HEAD', record.workspace);
-    const entry = { block: id, base_sha: baseSha, owned_files: [...owned], level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open' };
+    if (baseSha !== stampedBase || record.workspace !== workspace) throw new StateError('base-moved', `the base moved while block ${id} was being opened; run block open again`);
+    const entry = { block: id, base_sha: baseSha, owned_files: [...owned], level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open', tree_at_open: treeOpen };
     record.blocks[id] = entry;
     const floor = dispatched.trigger === 'docs_floor' ? { requested_level: level, trigger: 'docs_floor' } : {};
     return {

package/src/worker/loop.mjs

@@ -49,6 +49,7 @@ import { logWarning } from '../util/error-log.mjs';
 import { keyedLock } from '../util/locks.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
+import { openFindings } from '../review/gate-check.mjs';
 import { reviewTicket } from './engine.mjs';
 import { announceWorker, beatWorker, HEARTBEAT_MS, liveWorker, pendingTickets, readTicket, retractWorker, writeResult } from './queue.mjs';
 import { contentHash, DELETED_HASH, repoRootOf, WorkerError } from './ticket.mjs';
@@ -158,6 +159,21 @@ export function loopResult(outcome) {
   return out;
 }
 
+/**
+ * B52: the verdict a result is recorded with (its signed file and its ledger row), always with
+ * `approved` and `open`: `approved: true, open: []` only when the outcome said so AND it lists no
+ * critical finding. Otherwise `approved: false` and `open` = ALL its findings (`openFindings`:
+ * criticals, warnings and nits; a missing or malformed id as `X<n>` by position; the worst
+ * severity per id; `[]` when it names none, which the gate refuses until a fresh approval) — so
+ * an "approved" result that names a critical is downgraded with every one of its findings open.
+ * @param {Record<string, any>} result @returns {Record<string, any>}
+ */
+export function recordedVerdict(result) {
+  const listed = openFindings(result.findings);
+  if (result.approved === true && !listed.some((f) => f.severity === 'critical')) return { ...result, approved: true, open: [] };
+  return { ...result, approved: false, open: listed };
+}
+
 /**
  * @typedef {object} WorkerOpts
  * @property {string} runId
@@ -351,9 +367,10 @@ export async function createWorker(opts, deps = {}) {
   /**
    * Sign and write the result + done marker, then the signed ledger row. A ledger failure does not
    * undo the result: the done marker is what the queue reads.
-   * @param {string} id @param {Record<string, any>} result
+   * @param {string} id @param {Record<string, any>} outcome - recorded through {@link recordedVerdict}.
    */
-  async function complete(id, result) {
+  async function complete(id, outcome) {
+    const result = recordedVerdict(outcome);
     const signed = writeResult({ repoRoot, runId, ticket: id, result, key });
     try {
       await ledger({
@@ -363,6 +380,11 @@ export async function createWorker(opts, deps = {}) {
         file: result.file ?? null,
         content_hash: result.content_hash ?? null,
         status: result.status,
+        // B52: the gate reads the verdict from the ledger, never from the result file
+        approved: result.approved,
+        open: result.open,
+        // the gate tells `refused: other-run` (never reviewed) from other refusals by it
+        ...(typeof result.reason === 'string' ? { reason: result.reason } : {}),
         ...(typeof result.trigger === 'string' ? { trigger: result.trigger } : {}),
         ...(typeof result.stopped === 'string' ? { stopped: result.stopped } : {}),
       });