@codedology/code-forge 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -6,6 +6,15 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.3] — 2026-10-08
+
+### Added
+
+- Review: a packet whose answer fails the schema twice is retried once on `review.second_levels.<level>` when configured
+  (signed `review.schema_fallback` row; never in consensus mode; budget and closed-book rules apply), and every schema
+  miss logs a structural diagnosis of the answer (`review.schema_invalid`: keys, types, schema errors or the parse error
+  offset, never the text); the autopilot binnacle shows each fallback as an incident (issue #2).
+
 ## [0.7.2] — 2026-10-07
 
 ### Changed

package/README.md

@@ -12,6 +12,14 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 Next release:
 
+- **A model that keeps failing the answer format gets a stand-in.** When a reviewer's answer
+  fails the schema twice on the same packet and you set `review.second_levels` for that level, the
+  worker retries that packet once with the second model, and the ledger records it. Each failed
+  answer's shape (its keys, types and schema errors, never its text) is logged, so you can see
+  what went wrong.
+
+In 0.7.2:
+
 - **Long documents get reviewed.** The packet budget (`review.budgets.full_in`) is now 32,000
   tokens, and a Markdown file still too large is reviewed section by section instead of refused;
   a `split_required` result now says its size and the budget.

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 57,
+  "block_count": 58,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -778,6 +778,22 @@
         "B53"
       ],
       "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-02 (25k-token brief never reviewed); also amends src/review/{packet,engine,fixloop}.mjs, src/worker/{engine,loop}.mjs, src/cli/{review,review-file}.mjs, schema/code-forge.schema.json, docs/reference/config.md, docs/how-it-works.md, skill/references/review.md"
+    },
+    "B55": {
+      "title": "Schema-miss fallback (issue #2): a review answer that fails the schema twice on the same packet (same run, file, content, packet text, level and role) is retried once on review.second_levels.<level> (its ladder minus the failed model and, for closed-book roles, minus Codex unless allowed) behind a signed review.schema_fallback row written before the spawn; never in consensus mode; tokens of both sessions summed; every miss logs a structural diagnosis (review.schema_invalid: bytes, kind, keys and types, schema errors, never the text); the autopilot binnacle shows each fallback",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/schema-fallback.mjs",
+        "src/util/diagnostic-tail.mjs",
+        "test/review/schema-fallback.test.mjs",
+        "test/worker/schema-fallback-wiring.test.mjs"
+      ],
+      "depends_on": [
+        "B54"
+      ],
+      "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-06; also amends src/review/{engine,fixloop,validate-review}.mjs, src/worker/engine.mjs, src/session/spawn.mjs (stderr tail moved to util), src/autopilot/binnacle.mjs, test fakes, docs/how-it-works.md, skill/references/review.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/references/review.md

@@ -19,7 +19,7 @@ Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp
 
 ## §4 The stub guard — what counts as a review (R11)
 
-A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens (a clean pass — `passed: true`, no findings, a non-blank summary — needs only 40, whatever the diff size). Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; the worker retries once on the level's fallback, then the file stays unreviewed and the block cannot close. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
+A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens (a clean pass — `passed: true`, no findings, a non-blank summary — needs only 40, whatever the diff size). Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; `review-file` on the same content re-runs the same packet once, then the file stays unreviewed and the block cannot close. Every `schema` miss leaves a signed `review.schema_invalid` row with a structural diagnosis of the answer — its size and kind (`json`, `not-json`, `empty`), its top-level keys and their types, and the schema errors (path, keyword, message), or the parse error and its byte offset — never the answer's text. At a packet's **second** `schema` miss (same run, file, content hash, packet text, level and role — the first try plus that re-run), the worker tries the packet ONCE on `review.second_levels.<level>` when the owner configured one, and writes a signed `review.schema_fallback {lens, role, level, packet_hash, from_provider, from_model, to, to_provider, to_model, attempts, refused?}` row first (no row written ⇒ no try; any earlier row for the packet at that level ⇒ no try). Its first model that is not the failed one — and, for a closed-book role, not Codex unless `review.allow_open_book_codex` — runs (`refused: same-model` or `refused: closed-book` when there is none). The session's tokens are both sessions'. Its answer goes through the same stub guard; a valid one is a normal answer, a failed one leaves the file unavailable. Never in consensus mode; `budget.usd` refuses it like any session. Without a second level only the diagnosis row is new. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
 
 ## §5 The convergence rule — bounded fix rounds (R15)
 

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.7.2"
+PINNED_VERSION="0.7.3"
 set -eu
 
 self="$0"

package/src/autopilot/binnacle.mjs

@@ -39,7 +39,7 @@ export const LOG_FILE = 'autopilot-log.md';
 export const NONE_YET = 'none yet';
 
 /** The ledger events (besides every `autopilot.*`) that belong to the log and the timeline. */
-const EXTRA_EVENTS = Object.freeze(['block.close', 'review.session_timeout', 'worker.down', 'worker.replaced', 'ledger.tamper', 'budget.refused', 'gate.red', 'gate.done']);
+const EXTRA_EVENTS = Object.freeze(['block.close', 'review.session_timeout', 'review.schema_fallback', 'worker.down', 'worker.replaced', 'ledger.tamper', 'budget.refused', 'gate.red', 'gate.done']);
 
 /** @typedef {Record<string, any>} Row */
 /** @typedef {{home?: string | null, cwd?: string | null}} ScrubCtx */
@@ -146,6 +146,8 @@ function describe(row) {
       return { event: 'Block closed', detail: `status ${row.status ?? 'unknown'}${short(first(row.commit, row.sha, row.commit_sha)) ? ` · commit ${short(first(row.commit, row.sha, row.commit_sha))}` : ''}`, link: first(row.pr_url, row.pr) };
     case 'review.session_timeout':
       return { event: 'Review session timed out', detail: `${row.lens ?? row.role ?? 'session'} · attempt ${u(row.attempt)} · ${row.retried === true ? 'retried' : 'gave up'}`, link: null };
+    case 'review.schema_fallback':
+      return { event: 'Review answer off-schema twice', detail: `${row.lens ?? row.role ?? 'session'} · ${u(row.from_model, 'unknown model')} → ${u(row.to_model, 'unknown model')} · ${typeof row.refused === 'string' ? `refused (${u(row.refused)})` : 'retried once'}`, link: null };
     case 'worker.down':
       return { event: 'Worker down', detail: 'the pinned worker is not running', link: null };
     case 'worker.replaced':
@@ -181,6 +183,31 @@ export function buildFullLog({ runId, rows, scrubCtx }) {
 /** @param {Row} row @returns {string} the subject line of an event, e.g. ` · b1 · src/a.mjs`. */
 const where = (row) => `${str(row.block) ? ` · ${u(row.block)}` : ''}${str(row.file) ? ` · ${u(row.file)}` : ''}`;
 
+/**
+ * B55: what the owner does about a refused second-level try, by refusal. `schema-fallback.mjs`
+ * writes `closed-book` (every model left is Codex for a closed-book role) and `same-model`
+ * (nothing but the failed model is configured). No writer puts `budget` in this row today — the
+ * budget gate refuses inside the spawn and writes its own `budget.refused` row — so `budget` is
+ * shown only when a row carries it; any other string gets the generic fix.
+ */
+const SCHEMA_FALLBACK_FIX = Object.freeze({
+  'closed-book': 'Set a second level that can run closed-book (not Codex), or review the file by hand.',
+  'same-model': 'Set review.second_levels to a different model than the one that failed, or review the file by hand.',
+  budget: 'Raise the budget (only you can) or review the file by hand.',
+});
+
+/**
+ * The incident of a `review.schema_fallback` row (B55): retried once, or refused and why.
+ * @param {Row} r @param {string | null} time
+ * @returns {{time: string | null, what: string, effect: string, fix: string}}
+ */
+function schemaFallbackIncident(r, time) {
+  const what = `A ${r.lens ?? r.role ?? 'review'} answer failed the schema twice on the same packet (${u(r.from_model, 'unknown model')})`;
+  if (typeof r.refused !== 'string') return { time, what, effect: `It was retried once on the second level (${u(r.to_model, 'unknown model')}).`, fix: "Check the file's next review result." };
+  const fix = Object.hasOwn(SCHEMA_FALLBACK_FIX, r.refused) ? SCHEMA_FALLBACK_FIX[/** @type {keyof typeof SCHEMA_FALLBACK_FIX} */ (r.refused)] : 'Review the file by hand.';
+  return { time, what, effect: `The second-level try was refused (${u(r.refused)}); the review stays unavailable.`, fix };
+}
+
 /**
  * @param {Row[]} blockRows rows of one block @param {Row | undefined} entry its run-record entry
  * @param {string} id
@@ -285,6 +312,7 @@ export function buildBinnacle({ runId, rows, record, now, scrubCtx = scrubCtxOf(
   for (const { row, time } of mine) {
     const r = row;
     if (r.event === 'review.session_timeout') incidents.push({ time, what: `A ${r.lens ?? r.role ?? 'review'} session timed out (attempt ${u(r.attempt)})`, effect: r.retried === true ? 'It was retried.' : 'No retry left; the review was marked unavailable.', fix: r.retried === true ? 'None needed unless it repeats.' : 'Run the review again.' });
+    else if (r.event === 'review.schema_fallback') incidents.push(schemaFallbackIncident(r, time));
     else if (r.event === 'worker.down' || r.event === 'worker.replaced') incidents.push({ time, what: r.event === 'worker.down' ? 'The pinned worker was down' : 'The pinned worker was replaced', effect: 'Reviews wait until the worker is back.', fix: 'Restart the worker for this run.' });
     else if (r.event === 'ledger.tamper') incidents.push({ time, what: `A ledger check failed for block ${r.block ?? 'unknown'}`, effect: 'The block was stopped.', fix: 'Look at the block before reopening it.' });
     else if (r.event === 'autopilot.issue_failed') incidents.push({ time, what: `The waiver issue for ${u(r.finding, 'unknown finding')} in ${u(r.file, 'unknown file')} could not be opened`, effect: 'The waiver stands without an issue.', fix: 'Open the tracking issue by hand.' });

package/src/review/engine.mjs

@@ -20,6 +20,12 @@
  *  6. a session that ends in `timeout` is spawned ONCE more on the same packet and level
  *     (`session-retry.mjs`, B30); a second timeout is `unavailable: timeout`. The summary's
  *     `attempts` says how many ran;
+ *  6b. a session whose answer fails the schema logs it (`review.schema_invalid`, the raw answer
+ *     redacted); at the packet's second such miss it is tried ONCE on `review.second_levels.<level>`
+ *     when the owner configured one (`schema-fallback.mjs`, B55; never in consensus mode).
+ *     The summary then carries `schema_fallback: {level, provider, model}` (`level`:
+ *     `review.second_levels.<level>`), the second level's own provider/model, and `tokens_in` /
+ *     `tokens_out` summed over both sessions;
  *  7. a diff alone over the packet budget is `split_required` (with `tokens_in` and `budget`) —
  *     except a Markdown file (B54), which is reviewed SECTION BY SECTION (`sections.mjs`): every
  *     section packet runs the whole plan above (its own sessions, judge and stub guard, its own
@@ -44,6 +50,7 @@ import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTo
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups } from './sections.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
+import { afterSchemaMiss, logSecondLevelMiss } from './schema-fallback.mjs';
 import { assertRowPath } from '../worker/ticket.mjs';
 
 /**
@@ -161,7 +168,10 @@ export function rulesRisk({ file, plusCount, cfg }) {
  *   session (`spawnSession` opts minus the worker-pinned ones); a per-call `cfg` selects another
  *   provider's level for the same slot (consensus).
  * @property {(row: Record<string, any>) => Promise<unknown>} [writeRow] - ledger rows
- *   (`review.plan`, `review.unavailable`); a failed write never fails the review.
+ *   (`review.plan`, `review.unavailable`, `review.schema_invalid`, `review.schema_fallback`); a
+ *   failed write never fails the review (a failed `review.schema_fallback` write means no try).
+ * @property {import('./schema-fallback.mjs').SchemaHistory} [schemaHistory] - B55: the packet's
+ *   signed schema-miss history (the worker's); absent ⇒ no second-level try.
  */
 
 /** @param {ReviewDeps} deps @param {Record<string, any>} row */
@@ -203,11 +213,13 @@ export async function reviewFile(input, deps) {
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
   const min = minTokensOut(cfg);
+  // B55: never in consensus mode — its providers (two reviewers, the judge) are the check itself
+  const schemaFallback = plan.mode !== 'consensus';
 
   /** @param {SessionSpec} spec @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet */
   const run = async (spec, packet) => {
     /** @type {Record<string, any>} */
-    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, cfg });
+    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, cfg, schemaFallback });
     const needs = summary.review?.needs_file;
     if (spec.role === 'reviewer' && summary.status === 'ok' && Array.isArray(needs) && needs.length > 0) {
       const paths = safeNeeds(needs);
@@ -218,7 +230,7 @@ export async function reviewFile(input, deps) {
         extra = null;
       }
       if (extra === null) return { ...summary, status: 'unavailable', reason: 'needs_file-refused', review: null };
-      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, cfg })), needs_file_round: true };
+      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, cfg, schemaFallback })), needs_file_round: true };
     }
     return summary;
   };
@@ -247,7 +259,7 @@ export async function reviewFile(input, deps) {
     if (judgeSpec) {
       const bySlot = Object.fromEntries(done.map((s) => [s.slot, s.review]));
       const packet = assembleJudgePacket({ diff: part, reports: { A: bySlot.A, B: bySlot.B }, cfg });
-      final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg });
+      final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg, schemaFallback });
       sessions.push(publicSummary(final));
       if (final.status !== 'ok') {
         await note(deps, { event: 'review.unavailable', reason: final.reason, lens: 'judge', ...rowExtra });
@@ -320,22 +332,29 @@ export async function reviewFile(input, deps) {
 }
 
 /**
- * One session: packet file (0600, removed after), spawn, stub guard.
+ * One session: packet file (0600, removed after), spawn, stub guard — and, on a `schema` miss, the
+ * B55 second-level try (`schema-fallback.mjs`) on the same packet file before it is removed.
  * @param {SessionSpec} spec @param {string} text
  * @param {{hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet
- * @param {{deps: ReviewDeps, workDir: string, min: number, cfg: Record<string, any>}} env
+ * @param {{deps: ReviewDeps, workDir: string, min: number, cfg: Record<string, any>, schemaFallback?: boolean}} env -
+ *   `schemaFallback: false` (consensus mode: its providers ARE the check) never tries.
  */
-async function runOne(spec, text, packet, { deps, workDir, min }) {
+async function runOne(spec, text, packet, { deps, workDir, min, cfg, schemaFallback = true }) {
   const promptPath = path.join(workDir, `${spec.lens}-${randomBytes(6).toString('hex')}.md`);
   const base = { lens: spec.lens, role: spec.role, level: spec.level, slot: spec.slot, context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn };
   writeFileSync(promptPath, text, { mode: 0o600 });
   /** @type {Record<string, any> | null} */
   let res = null;
   let attempts = 0;
-  try {
+  /** @type {import('./validate-review.mjs').Verdict} */
+  let verdict = { ok: false, reason: 'exit', detail: 'no session result' };
+  /** @type {{level: string, provider: string, model: string} | null} */
+  let fellBackTo = null;
+  /** @param {Record<string, any> | undefined} sessionCfg @param {number} done - attempts before this call. */
+  const attempt = (sessionCfg, done) =>
     // a `timeout` is spawned once more on the same packet and level (B30); a spawn that throws
     // (bad config, refused argv) is an `exit` failure, never approval
-    ({ res, attempts } = await spawnWithTimeoutRetry(
+    spawnWithTimeoutRetry(
       deps.spawn,
       {
         level: spec.level,
@@ -343,35 +362,88 @@ async function runOne(spec, text, packet, { deps, workDir, min }) {
         promptPath,
         schema: FINDING_SCHEMA,
         rowExtra: { lens: spec.lens, context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn },
-        ...(spec.cfg ? { cfg: spec.cfg } : {}),
+        ...(sessionCfg ? { cfg: sessionCfg } : {}),
       },
       (row) => note(deps, row),
       (n) => {
-        attempts = n;
+        attempts = done + n;
       },
-    ));
-  } catch {
-    // defensive only: the helper never throws. If it ever did, it is still an `exit` failure,
-    // never approval, with the attempts it had reported so far (at least 1).
-    res = null;
-    attempts = Math.max(attempts, 1);
+    );
+  /** @type {number | null} the session's tokens: the first spawn's, plus a second-level try's */
+  let tokensIn = null;
+  /** @type {number | null} */
+  let tokensOut = null;
+  // the packet file is removed on every path, and only after the second-level try (which reads it)
+  try {
+    try {
+      ({ res, attempts } = await attempt(spec.cfg, 0));
+    } catch {
+      // defensive only: the helper never throws. If it ever did, it is still an `exit` failure,
+      // never approval, with the attempts it had reported so far (at least 1).
+      res = null;
+      attempts = Math.max(attempts, 1);
+    }
+    tokensIn = res?.usage?.tokens_in ?? null;
+    tokensOut = res?.usage?.tokens_out ?? null;
+    verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    if (!verdict.ok && verdict.reason === 'schema') {
+      try {
+        const session = { lens: spec.lens, role: spec.role, level: spec.level };
+        const done = attempts;
+        // no ledger writer ⇒ nothing logged, nothing tried; every row goes through the same writer
+        // (each helper handles its own failed write)
+        const write = deps.writeRow ? (/** @type {Record<string, any>} */ row) => /** @type {NonNullable<ReviewDeps['writeRow']>} */ (deps.writeRow)(row) : undefined;
+        const second = await afterSchemaMiss({
+          res,
+          session,
+          packetText: text,
+          cfg: spec.cfg ?? cfg,
+          allowed: schemaFallback && !spec.cfg,
+          history: deps.schemaHistory,
+          writeRow: write,
+          spawnAt: (c) => attempt(c, done),
+        });
+        if (second) {
+          const secondVerdict = validateReview(second.res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+          res = second.res;
+          attempts = done + second.attempts;
+          fellBackTo = second.to;
+          verdict = secondVerdict;
+          tokensIn = addTokens(tokensIn, second.res?.usage?.tokens_in);
+          tokensOut = addTokens(tokensOut, second.res?.usage?.tokens_out);
+          if (!verdict.ok && verdict.reason === 'schema') await logSecondLevelMiss({ res, session, packetText: text, writeRow: write });
+        }
+      } catch {
+        // defensive only: the helpers never throw. If they ever did, the first session's result
+        // and its `schema` verdict stand (never turned into `exit`, never approval)
+      }
+    }
   } finally {
     rmSync(promptPath, { force: true });
   }
-  const verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
   const meta = {
     ...base,
     provider: res?.provider ?? null,
     model: res?.model ?? null,
     fallback_step: res?.fallback_step ?? 0,
     attempts,
-    tokens_in: res?.usage?.tokens_in ?? null,
-    tokens_out: res?.usage?.tokens_out ?? null,
+    ...(fellBackTo ? { schema_fallback: fellBackTo } : {}),
+    tokens_in: tokensIn,
+    tokens_out: tokensOut,
   };
   if (!verdict.ok) return { ...meta, status: 'unavailable', reason: verdict.reason, review: null };
   return { ...meta, status: 'ok', reason: null, review: verdict.review };
 }
 
+/**
+ * Two token counts added; a missing one (not a number) adds nothing, both missing ⇒ null.
+ * @param {unknown} a @param {unknown} b @returns {number | null}
+ */
+function addTokens(a, b) {
+  if (typeof a !== 'number') return typeof b === 'number' ? b : null;
+  return typeof b === 'number' ? a + b : a;
+}
+
 /** The per-session summary the worker signs: the answer's verdict and findings, never the packet. */
 function publicSummary(/** @type {Record<string, any>} */ s) {
   const { review, ...rest } = s;

package/src/review/fixloop.mjs

@@ -59,6 +59,10 @@
  * findings get ids `S<section>.<id>`; any section session unavailable ⇒ `retry` of the whole
  * round. A section still over the budget alone ⇒ the terminal stop above (`split_required`).
  *
+ * Schema misses (B55): a recheck (or patch_check) session whose answer fails the schema at its
+ * packet's second miss is tried once on `review.second_levels.L2` when configured
+ * (`schema-fallback.mjs`); only when that fails too is the round `unavailable` as below.
+ *
  * A session that fails the stub guard is `unavailable`, and a failed write of a gate-relevant row
  * (`review.late_finding`, `review.round`, `review.cap`) is `ledger_write_failed`: either way the
  * round is not counted, nothing closes, and `next.action: 'retry'` with `pending_kind` set —
@@ -79,6 +83,7 @@ import { isMarkdownFile, packSections, sectionFindings, sectionGroups, sectionOf
 import { cameFromJudge, resolvedBand, triageFindings } from './triage.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
+import { afterSchemaMiss, logSecondLevelMiss } from './schema-fallback.mjs';
 
 /** @typedef {import('./triage.mjs').Finding} Finding */
 /** @typedef {import('./context.mjs').Hunk} Hunk */
@@ -126,6 +131,7 @@ import { spawnWithTimeoutRetry } from './session-retry.mjs';
  * @property {string | null} [base] - the block base (only for `recheck_scope: file`).
  * @property {string} [rulesDigest] @property {string} [factsExcerpt]
  * @property {number} [extraRounds] - B47: rounds past `review.max_rounds_per_file` granted by autopilot (`extraRoundsFor`).
+ * @property {import('./schema-fallback.mjs').SchemaHistory} [schemaHistory] - B55: the packet's signed schema-miss history; absent ⇒ no second-level try.
  */
 
 /** @param {LoopDeps} deps @param {Record<string, any>} row */
@@ -353,7 +359,8 @@ export function insideHunks(f, hunks) {
 }
 
 /**
- * One recheck session through the stub guard.
+ * One recheck session through the stub guard — and, on a `schema` miss, the B55 second-level try
+ * on the same packet (`schema-fallback.mjs`; rechecks and the patch_check alike).
  * @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string}} packet
  * @param {LoopDeps} deps
  */
@@ -361,26 +368,62 @@ async function recheckSession(packet, deps) {
   mkdirSync(deps.workDir, { recursive: true, mode: 0o700 });
   const promptPath = path.join(deps.workDir, `recheck-${randomBytes(6).toString('hex')}.md`);
   writeFileSync(promptPath, packet.text, { mode: 0o600 });
+  const min = minTokensOut(deps.cfg);
+  const session = { lens: 'recheck', role: 'reviewer', level: 'L2' };
+  /** @param {Record<string, any> | undefined} cfg */
+  const attempt = async (cfg) =>
+    deps.spawn
+      ? // a `timeout` is spawned once more on the same packet and level (B30)
+        spawnWithTimeoutRetry(
+          deps.spawn,
+          { level: 'L2', role: 'reviewer', promptPath, schema: FINDING_SCHEMA, rowExtra: { lens: 'recheck', context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn }, ...(cfg ? { cfg } : {}) },
+          (row) => note(deps, row),
+        )
+      : { res: null, attempts: 0 };
   /** @type {Record<string, any> | null} */
   let res = null;
+  /** @type {import('./validate-review.mjs').Verdict} */
+  let verdict = { ok: false, reason: 'exit', detail: 'no session result' };
+  /** @type {number | null} the round's tokens: the first session's, plus a second-level try's */
+  let tokensIn = null;
+  /** @type {number | null} */
+  let tokensOut = null;
+  // the packet file is removed on every path, and only after the second-level try (which reads it)
   try {
-    // a `timeout` is spawned once more on the same packet and level (B30)
-    res = deps.spawn
-      ? (
-          await spawnWithTimeoutRetry(
-            deps.spawn,
-            { level: 'L2', role: 'reviewer', promptPath, schema: FINDING_SCHEMA, rowExtra: { lens: 'recheck', context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn } },
-            (row) => note(deps, row),
-          )
-        ).res
-      : null;
-  } catch {
-    res = null; // the helper never throws; if it ever did, it is still an `exit` failure
+    try {
+      res = (await attempt(undefined)).res;
+    } catch {
+      res = null; // the helper never throws; if it ever did, it is still an `exit` failure
+    }
+    tokensIn = res?.usage?.tokens_in ?? null;
+    tokensOut = res?.usage?.tokens_out ?? null;
+    verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    if (!verdict.ok && verdict.reason === 'schema') {
+      try {
+        // no ledger writer ⇒ nothing logged, nothing tried; every row goes through the same writer
+        // (each helper handles its own failed write)
+        const write = deps.writeRow ? (/** @type {Record<string, any>} */ row) => /** @type {NonNullable<LoopDeps['writeRow']>} */ (deps.writeRow)(row) : undefined;
+        const second = await afterSchemaMiss({ res, session, packetText: packet.text, cfg: deps.cfg ?? {}, allowed: true /* rechecks are never consensus; the budget gate is inside the spawn */, history: deps.schemaHistory, writeRow: write, spawnAt: attempt });
+        if (second) {
+          // compute everything first, then assign together, so a throw never leaves a mixed state
+          const secondVerdict = validateReview(second.res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+          const sumIn = sum(tokensIn, second.res?.usage?.tokens_in);
+          const sumOut = sum(tokensOut, second.res?.usage?.tokens_out);
+          res = second.res;
+          verdict = secondVerdict;
+          tokensIn = sumIn;
+          tokensOut = sumOut;
+          if (!verdict.ok && verdict.reason === 'schema') await logSecondLevelMiss({ res, session, packetText: packet.text, writeRow: write });
+        }
+      } catch {
+        // defensive only: the helpers never throw. If they ever did, the first session's result
+        // and its `schema` verdict stand (never turned into `exit`, never approval)
+      }
+    }
   } finally {
     rmSync(promptPath, { force: true });
   }
-  const verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: minTokensOut(deps.cfg) });
-  return { verdict, tokens_in: res?.usage?.tokens_in ?? null, tokens_out: res?.usage?.tokens_out ?? null };
+  return { verdict, tokens_in: tokensIn, tokens_out: tokensOut };
 }
 
 /**

package/src/review/schema-fallback.mjs

@@ -0,0 +1,351 @@
+/**
+ * The second-level retry after repeated `schema` misses on ONE packet (block B55, issue #2).
+ *
+ * Field data: one L2 reviewer model answered `unavailable: schema` four times in a row on the same
+ * packet (round 1, its retry, a patch_check recheck, a fresh review), while the model configured in
+ * `review.second_levels.L2` reviewed that packet cleanly on its first try.
+ *
+ * What counts as "2 schema failures on the same packet": a stub-guard verdict `schema` from a
+ * session of the level's OWN ladder (never one from a second-level try) on the same packet — the
+ * same run, file, content hash and exact packet text (`packet_hash`, sha256 of the text) — at the
+ * same level and role (one level's misses or mark never count for, or block, another's). Every
+ * such miss leaves one signed `review.schema_invalid` row; the count is those rows (read through
+ * `history`, which only counts rows whose MAC verifies) plus the miss in hand. In practice: the
+ * round's first session is miss 1; the worker's existing retry of that round (`next: retry`, the
+ * next ticket re-runs the SAME packet) is miss 2, and that ticket then tries the second level once.
+ * A session that times out is retried first by `session-retry.mjs` and counts once, with its last
+ * result; a `needs_file` round or a Markdown section is another packet text, so another count, and
+ * so is a recheck whose pending set changed between tries (S1 `resolved` closed another finding,
+ * so the open-findings list differs): a different packet starts its own count, by design.
+ *
+ * The rows written here carry no `run`, `file` or `content_hash`: the worker's `writeRow` stamps
+ * them (`worker/loop.mjs`: `{...row, block, file, content_hash: ticket.content_hash}`, signed with
+ * the run key), and the worker's history reads them back by the same ticket values — so outside
+ * the worker (no history) nothing is ever tried.
+ *
+ * At most ONCE per packet: a signed `review.schema_fallback` row is written BEFORE the second level
+ * is spawned, and any such row for the packet (whatever its outcome) stops every later try; when
+ * that row cannot be written nothing is spawned. The second level is `review.second_levels.<level>`
+ * only — nothing is tried without one; when every model of it is the one that just failed, the
+ * mark says `refused: same-model` and nothing is spawned. The try goes through the same `spawn` as
+ * any session, so the budget gate (`budget.usd`, B33) refuses it like any other (its own
+ * `budget.refused` row; the review is `unavailable: budget`). For a closed-book role every Codex
+ * model of the second level (its own and its ladder) is dropped unless
+ * `review.allow_open_book_codex`; when none is left the mark says `refused: closed-book` and
+ * nothing is spawned — the spawner's own refusal stays as it was. Its answer goes
+ * through the same stub guard; a valid one is a normal answer, a failed one leaves the file
+ * unavailable as before.
+ *
+ * Every schema miss (second-level ones included) is logged as `review.schema_invalid {lens, role,
+ * level, provider, model, fallback_step, packet_hash, second_level, ...diagnosis}` — a STRUCTURAL
+ * diagnosis of the answer, never its text ({@link diagnoseAnswer}): its size and kind, for JSON the
+ * top-level keys with their JSON types and the finding-schema errors (path, keyword, a few
+ * schema-side params, Ajv's message), for non-JSON the kind of parse error and its byte offset.
+ * Text a model copies from the packet into a JSON string can never reach the ledger this way.
+ *
+ * Concurrency: the worker never runs two tickets for one (block, file) at once (its file lock,
+ * `worker/loop.mjs`), and round 1, its retry, every recheck and the patch_check of a file are all
+ * tickets for that file, so one packet's history is read and written by one ticket at a time. The
+ * read-history → write-mark section here also runs under an in-process lock per (packet hash,
+ * level, role), so even the same file in two blocks cannot take a packet's one try twice.
+ *
+ * No ledger writer (`writeRow` absent) ⇒ nothing is logged and nothing is tried. The helpers never
+ * throw: a history that cannot be read disables the try (with one warning line), and a
+ * second-level spawn that throws is a session with no result (`exit`) after its mark row.
+ */
+
+import { createHash } from 'node:crypto';
+import { closedBookRefused, openBookCodexAllowed } from '../config/closed-book.mjs';
+import { resolveLevel } from '../config/known-ids.mjs';
+import { logWarning } from '../util/error-log.mjs';
+import { keyedLock } from '../util/locks.mjs';
+import { schemaErrorsOf } from './validate-review.mjs';
+
+/** Schema misses of the level's own ladder on one packet before the second level is tried. */
+export const SCHEMA_FAILURES_BEFORE_FALLBACK = 2;
+
+/** At most this many schema errors are kept in a diagnosis (`errors_total` has the full count). */
+export const DIAGNOSIS_MAX_ERRORS = 20;
+/** At most this many top-level keys are kept in a diagnosis (the rest counted in `other_keys`). */
+export const DIAGNOSIS_MAX_KEYS = 30;
+/** Ajv's message, and a parse error, are kept up to this length. */
+const MESSAGE_MAX = 120;
+/** A key or path segment is shown only when it is this plain; any other is `*` (it could be content). */
+const PLAIN_KEY = /^[A-Za-z0-9_.-]{1,40}$/;
+/** The Ajv params kept: they come from the schema, never from the answer's data. */
+const KEPT_PARAMS = Object.freeze(['missingProperty', 'additionalProperty', 'type', 'limit', 'comparison', 'format']);
+
+/**
+ * @typedef {(packetHash: string, who: {level: string, role: string}) => Promise<{failures: number, fellBack: boolean}>} SchemaHistory -
+ *   the signed history of ONE packet (`packetHash`) at one level and role in this run for this
+ *   file at this content hash: `failures` = `review.schema_invalid` rows of the level's own ladder
+ *   (`second_level` not true), `fellBack` = a `review.schema_fallback` row exists. Built by the
+ *   worker; absent ⇒ no second-level try.
+ */
+
+/** @param {string} text @returns {string} the packet's identity: sha256 hex of its exact text. */
+export function packetHash(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+/** @param {unknown} v @returns {string} the JSON type of `v`. */
+function jsonType(v) {
+  if (v === null) return 'null';
+  if (Array.isArray(v)) return 'array';
+  if (typeof v === 'number') return Number.isInteger(v) ? 'integer' : 'number';
+  return typeof v;
+}
+
+/** @param {unknown} key @returns {string} the key when plain (or an array index), else `*`. */
+function plainKey(key) {
+  if (typeof key === 'number') return String(key);
+  return typeof key === 'string' && PLAIN_KEY.test(key) ? key : '*';
+}
+
+/** @param {string} pointer @returns {string} the JSON pointer with every non-plain segment as `*`. */
+function plainPath(pointer) {
+  if (pointer === '') return '';
+  const segments = pointer.slice(1).split('/').map((seg) => (/^\d+$/.test(seg) ? seg : plainKey(seg.replace(/~1/g, '/').replace(/~0/g, '~'))));
+  return `/${segments.join('/')}`;
+}
+
+/**
+ * A parse error without any of the text: V8 quotes the input after a `"` and names the bad
+ * character, so the message is cut at its first quote, the token and the line/column dropped.
+ * @param {string} message @returns {string}
+ */
+function plainParseError(message) {
+  const cut = message
+    .split('"')[0]
+    .replace(/Unexpected token '.*?'/, 'Unexpected token')
+    .replace(/\s*\(line \d+ column \d+\)/, '')
+    .replace(/[,\s]+$/, '');
+  return cut.slice(0, MESSAGE_MAX);
+}
+
+/**
+ * The structural diagnosis of a schema miss (B55) — never the answer's text: `answer_bytes`,
+ * `answer_kind` (`json`, `not-json`, `empty`); for JSON `top_type`, `top_keys` (plain keys ⇒ their
+ * JSON type, at most {@link DIAGNOSIS_MAX_KEYS}; any other key only counted in `other_keys`),
+ * `schema_errors` (at most {@link DIAGNOSIS_MAX_ERRORS}, from the stub guard's own validator:
+ * `path` with non-plain segments as `*`, `keyword`, the schema-side `params`, Ajv's `message` ≤ 120
+ * chars) and `errors_total`; for non-JSON `parse_error` (V8's message cut before any quoted input)
+ * and `parse_offset` (bytes; null when V8 gives no position).
+ * @param {Record<string, any> | null} res - the session result (`text`, else `answer`).
+ * @returns {Record<string, any>}
+ */
+export function diagnoseAnswer(res) {
+  const text = typeof res?.text === 'string' && res.text.length > 0 ? res.text : typeof res?.answer === 'string' ? res.answer : '';
+  const answer_bytes = Buffer.byteLength(text);
+  /** @type {unknown} */
+  let value = res?.answer !== undefined && res?.answer !== null && typeof res.answer !== 'string' ? res.answer : undefined;
+  if (value === undefined) {
+    if (text.trim().length === 0) return { answer_bytes, answer_kind: 'empty' };
+    try {
+      value = JSON.parse(text);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const at = /at position (\d+)/.exec(message);
+      const parse_offset = at ? Buffer.byteLength(text.slice(0, Number(at[1]))) : /end of JSON input/.test(message) ? answer_bytes : null;
+      return { answer_bytes, answer_kind: 'not-json', parse_error: plainParseError(message), parse_offset };
+    }
+  }
+  /** @type {Record<string, string>} */
+  const top_keys = {};
+  let other_keys = 0;
+  if (jsonType(value) === 'object') {
+    for (const [k, v] of Object.entries(/** @type {Record<string, unknown>} */ (value))) {
+      if (PLAIN_KEY.test(k) && k !== '__proto__' && Object.keys(top_keys).length < DIAGNOSIS_MAX_KEYS) top_keys[k] = jsonType(v);
+      else other_keys += 1;
+    }
+  }
+  const errors = schemaErrorsOf(value);
+  const schema_errors = errors.slice(0, DIAGNOSIS_MAX_ERRORS).map((e) => {
+    /** @type {Record<string, unknown>} */
+    const given = e.params ?? {};
+    /** @type {Record<string, unknown>} */
+    const params = {};
+    for (const name of KEPT_PARAMS) {
+      const v = given[name];
+      if (v === undefined) continue;
+      if (name === 'missingProperty' || name === 'additionalProperty') params[name] = plainKey(v);
+      else if (typeof v === 'number' || typeof v === 'string') params[name] = v;
+      else if (Array.isArray(v)) params[name] = v.filter((x) => typeof x === 'string');
+    }
+    return { path: plainPath(e.instancePath ?? ''), keyword: e.keyword, params, message: String(e.message ?? '').slice(0, MESSAGE_MAX) };
+  });
+  return { answer_bytes, answer_kind: 'json', top_type: jsonType(value), top_keys, other_keys, schema_errors, errors_total: errors.length };
+}
+
+/**
+ * The config a second-level try runs with: `levels.<level>` replaced by
+ * `review.second_levels.<level>`. Every model of that level — its own, then its fallback ladder —
+ * gets its effective provider (the entry's own, else the level's: its `provider`, else
+ * `review.second_provider`, else the top-level one), and every one equal to the model that just
+ * failed is dropped; for a closed-book `role` every model Codex cannot run closed-book is dropped
+ * too (unless `review.allow_open_book_codex`). The first one left runs, the rest are its ladder.
+ * `ok: false` with `no-second-level` when none is configured for the level, `same-model` when
+ * nothing but the failed model is configured, `closed-book` when only refused models are left.
+ * @param {Record<string, any>} cfg @param {string} level
+ * @param {{provider: string | null, model: string | null}} from - the model that missed.
+ * @param {string} [role] - the session's role (closed-book check); absent ⇒ no such check.
+ * @returns {{ok: true, cfg: Record<string, any>, provider: string, model: string} | {ok: false, reason: 'no-second-level' | 'same-model' | 'closed-book'}}
+ */
+export function secondLevelFor(cfg, level, from, role) {
+  const override = cfg?.review?.second_levels?.[level] ?? null;
+  if (!override || typeof override !== 'object' || typeof override.model !== 'string' || override.model.length === 0) return { ok: false, reason: 'no-second-level' };
+  const levelProvider = override.provider ?? cfg?.review?.second_provider ?? cfg?.provider;
+  if (typeof levelProvider !== 'string' || levelProvider.length === 0) return { ok: false, reason: 'no-second-level' };
+  const { fallback: ladder, effort: _effort, ...own } = override;
+  /** @type {Array<{provider: string, model: string, effort?: string}>} */
+  const models = [override, ...(Array.isArray(ladder) ? ladder : [])]
+    .filter((e) => e && typeof e === 'object' && typeof e.model === 'string' && e.model.length > 0)
+    .map((e) => ({ provider: typeof e.provider === 'string' && e.provider.length > 0 ? e.provider : levelProvider, model: e.model, ...(typeof e.effort === 'string' ? { effort: e.effort } : {}) }))
+    .filter((e) => !(e.provider === from.provider && e.model === from.model));
+  if (models.length === 0) return { ok: false, reason: 'same-model' };
+  const openBook = openBookCodexAllowed(cfg);
+  const runnable = role === undefined ? models : models.filter((e) => !closedBookRefused(e.provider, role, openBook));
+  if (runnable.length === 0) return { ok: false, reason: 'closed-book' };
+  const [first, ...rest] = runnable;
+  const entry = { ...own, provider: first.provider, model: first.model, ...(first.effort ? { effort: first.effort } : {}), fallback: rest };
+  const next = { ...cfg, levels: { ...cfg.levels, [level]: entry } };
+  try {
+    resolveLevel(next, /** @type {any} */ (level));
+  } catch {
+    return { ok: false, reason: 'no-second-level' };
+  }
+  return { ok: true, cfg: next, provider: first.provider, model: first.model };
+}
+
+/**
+ * Log a schema miss and, when it is the packet's second (see the module doc), try the second level
+ * once. Never throws (see the module doc).
+ * @param {object} p
+ * @param {Record<string, any> | null} p.res - the missed session's result.
+ * @param {{lens: string, role: string, level: string}} p.session
+ * @param {string} p.packetText - the exact packet the session read (still on disk for `spawnAt`).
+ * @param {Record<string, any>} p.cfg - the config the missed session ran with.
+ * @param {boolean} p.allowed - false where a second-level try is never made (consensus mode).
+ * @param {SchemaHistory | undefined} p.history
+ * @param {((row: Record<string, any>) => Promise<unknown>) | undefined} p.writeRow - throws on a
+ *   failed write; absent ⇒ nothing is logged or tried.
+ * @param {(cfg: Record<string, any>) => Promise<{res: Record<string, any> | null, attempts: number}>} p.spawnAt
+ *   - the same session on the same packet with another config (timeout retry included).
+ * @returns {Promise<{res: Record<string, any> | null, attempts: number, to: {level: string, provider: string, model: string}} | null>}
+ *   the second level's result, or null when none was spawned.
+ */
+export async function afterSchemaMiss({ res, session, packetText, cfg, allowed, history, writeRow, spawnAt }) {
+  if (!writeRow) return null;
+  const write = writeRow;
+  const hash = packetHash(packetText);
+  const from = { provider: typeof res?.provider === 'string' ? res.provider : null, model: typeof res?.model === 'string' ? res.model : null };
+  /** @type {{cfg: Record<string, any>, to: {level: string, provider: string, model: string}} | null} */
+  let go = null;
+  try {
+    go = await keyedLock(`schema-fallback\0${hash}\0${session.level}\0${session.role}`, async () => {
+      // the history is read BEFORE this miss is logged: failures = signed earlier misses + this one
+      let seen = null;
+      if (allowed && history) {
+        try {
+          seen = await history(hash, { level: session.level, role: session.role });
+        } catch {
+          seen = null; // unreadable history ⇒ no try (fail closed), one warning line
+          await logWarning({ warning: 'review_schema_history', message: 'the schema-miss history could not be read; no second-level try' }).catch(() => null);
+        }
+      }
+      try {
+        await write({ event: 'review.schema_invalid', lens: session.lens, role: session.role, level: session.level, ...from, fallback_step: res?.fallback_step ?? 0, packet_hash: hash, second_level: false, ...diagnoseAnswer(res) });
+      } catch {
+        // the log is best-effort; the count then misses this one (fewer tries, never more)
+      }
+      if (!seen || seen.fellBack || seen.failures + 1 < SCHEMA_FAILURES_BEFORE_FALLBACK) return null;
+      const second = secondLevelFor(cfg, session.level, from, session.role);
+      const to = `review.second_levels.${session.level}`;
+      /** @type {string | null} */
+      let refused = null;
+      if (second.ok === false) {
+        if (second.reason === 'no-second-level') return null;
+        refused = second.reason; // `same-model` or `closed-book`: nothing of the level may run
+      }
+      await write({
+        event: 'review.schema_fallback',
+        lens: session.lens,
+        role: session.role,
+        level: session.level,
+        packet_hash: hash,
+        from_provider: from.provider,
+        from_model: from.model,
+        to,
+        to_provider: second.ok ? second.provider : null,
+        to_model: second.ok ? second.model : null,
+        attempts: seen.failures + 1,
+        ...(refused ? { refused } : {}),
+      }); // the once-per-packet mark: a failed write throws ⇒ no try
+      return !second.ok ? null : { cfg: second.cfg, to: { level: to, provider: second.provider, model: second.model } };
+    });
+  } catch {
+    return null;
+  }
+  if (!go) return null;
+  await logWarning({ warning: 'review_schema_fallback', message: 'a review answer failed the schema twice on one packet; the second level was tried once' }).catch(() => null);
+  try {
+    const out = await spawnAt(go.cfg);
+    return { res: out.res, attempts: out.attempts, to: go.to };
+  } catch {
+    // a throwing spawn is a session with no result: `exit` through the stub guard, never approval
+    return { res: null, attempts: 1, to: go.to };
+  }
+}
+
+/**
+ * Log a schema miss of the second-level try itself (never counted, never tried again).
+ * @param {{res: Record<string, any> | null, session: {lens: string, role: string, level: string}, packetText: string, writeRow: ((row: Record<string, any>) => Promise<unknown>) | undefined}} p
+ */
+export async function logSecondLevelMiss({ res, session, packetText, writeRow }) {
+  if (!writeRow) return;
+  try {
+    await writeRow({
+      event: 'review.schema_invalid',
+      lens: session.lens,
+      role: session.role,
+      level: session.level,
+      provider: typeof res?.provider === 'string' ? res.provider : null,
+      model: typeof res?.model === 'string' ? res.model : null,
+      fallback_step: res?.fallback_step ?? 0,
+      packet_hash: packetHash(packetText),
+      second_level: true,
+      ...diagnoseAnswer(res),
+    });
+  } catch {
+    // best-effort
+  }
+}
+
+/**
+ * The worker's {@link SchemaHistory} over the run's ledger: for the packet, level and role asked
+ * about, rows of `runId` for `file` at `contentHash` with that `packet_hash`, `level` and `role`
+ * whose MAC verifies (`verify`; a row that does not verify, or whose check throws, counts for
+ * nothing). A miss on another packet of the same content, or at another level, never counts.
+ * @param {{readRows: () => Promise<Array<Record<string, any>>>, verify: (row: Record<string, any>) => boolean, runId: string, file: string, contentHash: string}} opts
+ * @returns {SchemaHistory}
+ */
+export function ledgerSchemaHistory({ readRows, verify, runId, file, contentHash }) {
+  return async (hash, who) => {
+    const rows = (await readRows()).filter((r) => r?.run === runId && r.file === file && r.content_hash === contentHash && r.packet_hash === hash && r.level === who.level && r.role === who.role);
+    let failures = 0;
+    let fellBack = false;
+    for (const r of rows) {
+      if (r.event !== 'review.schema_invalid' && r.event !== 'review.schema_fallback') continue;
+      let ok = false;
+      try {
+        ok = verify(r);
+      } catch {
+        ok = false;
+      }
+      if (!ok) continue;
+      if (r.event === 'review.schema_fallback') fellBack = true;
+      else if (r.second_level !== true) failures += 1;
+    }
+    return { failures, fellBack };
+  };
+}

package/src/review/validate-review.mjs

@@ -37,6 +37,17 @@ const validateSchema = (() => {
   return new Ajv2020({ allErrors: true, strict: false }).compile(body);
 })();
 
+/**
+ * The finding-schema errors of `value` from the SAME validator the stub guard uses (B55): Ajv's
+ * raw error objects, every one (`allErrors`). Callers must strip anything that can carry the
+ * answer's content (`review/schema-fallback.mjs`); this returns them as Ajv gives them.
+ * @param {unknown} value @returns {Array<import('ajv').ErrorObject>} empty when it validates.
+ */
+export function schemaErrorsOf(value) {
+  if (validateSchema(value) === true) return [];
+  return [...(validateSchema.errors ?? [])];
+}
+
 /** @param {Record<string, any> | undefined} cfg @returns {number} */
 export function minTokensOut(cfg) {
   const v = cfg?.review?.min_tokens_out;

package/src/session/spawn.mjs

@@ -64,6 +64,7 @@ import { exec } from '../util/exec.mjs';
 import { isForbidden, mergeForbidden } from '../util/forbidden.mjs';
 import { semaphore } from '../util/locks.mjs';
 import { readStartTime, registerPid, UNKNOWN_START_TIME } from '../util/reaper.mjs';
+import { asText, stderrTail } from '../util/diagnostic-tail.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { currentRunRoot, pidsDir, runRoot, tmpBase, untrustedReason } from '../util/tmp.mjs';
 
@@ -152,11 +153,8 @@ export function runRootFor(runId, root) {
   return runRoot(runId, { root });
 }
 
-/** How much of a timed-out session's stderr is kept (B30). */
-export const DIAGNOSTIC_TAIL_BYTES = 4096;
-
-/** A timed-out session's stderr over this size keeps no text at all (bounds the redact cost). */
-export const STDERR_MAX_BYTES = 1024 * 1024;
+// B30's stderr tail moved to `util/diagnostic-tail.mjs` (B55 shares it); re-exported here unchanged
+export { DIAGNOSTIC_TAIL_BYTES, STDERR_MAX_BYTES, TAIL_WITHHELD_LARGE, TAIL_WITHHELD_LONG_LINE, TAIL_WITHHELD_PACKET, stderrTail } from '../util/diagnostic-tail.mjs';
 
 /** How many stdout event types a timed-out session keeps. */
 export const STDOUT_EVENTS_MAX = 20;
@@ -164,87 +162,6 @@ export const STDOUT_EVENTS_MAX = 20;
 /** The longest event type kept. */
 const EVENT_TYPE_MAX = 40;
 
-/**
- * Packet lines shorter than this are too common to tell apart from ordinary output, so they are
- * NOT filtered. Accepted risk (B30): a packet line under 16 characters (a brace, `return x;`) can
- * appear in a stderr tail; such a line carries no meaningful packet content on its own.
- */
-const PACKET_LINE_MIN = 16;
-
-/** The tail note when the packet cannot be read: no stderr text is kept at all (fail closed). */
-export const TAIL_WITHHELD_PACKET = 'withheld: packet unreadable';
-/** The tail note when stderr is over `STDERR_MAX_BYTES`. */
-export const TAIL_WITHHELD_LARGE = 'stderr too large, withheld';
-/** The tail note when the last 4 KB of stderr is one partial line. */
-export const TAIL_WITHHELD_LONG_LINE = 'one long line, withheld';
-
-/** @param {Buffer} buf @param {number} at @returns {number} the first character start at or after `at`. */
-function charStart(buf, at) {
-  let i = at;
-  while (i < buf.length && (buf[i] & 0xc0) === 0x80) i += 1;
-  return i;
-}
-
-/** @param {unknown} text @returns {string} */
-function asText(text) {
-  return Buffer.isBuffer(text) ? text.toString('utf8') : typeof text === 'string' ? text : '';
-}
-
-const PEM_BEGIN = /-----BEGIN [A-Z0-9 ]*-----/;
-const PEM_END = /-----END [A-Z0-9 ]*-----/;
-
-/**
- * The stderr tail of a timed-out session (B30), never packet content:
- *  1. no packet text (unreadable) ⇒ no text: `{tail: null, note: 'withheld: packet unreadable'}`;
- *     stderr over `STDERR_MAX_BYTES` ⇒ `{tail: null, note: 'stderr too large, withheld'}`;
- *  2. on the FULL raw text: every PEM block (`-----BEGIN` … `-----END` lines, an unterminated one
- *     to the end) and every line repeating a packet line (≥ 16 chars) is dropped;
- *  3. the FULL remaining text goes through B0 `redact`;
- *  4. over `maxBytes`, the last `maxBytes` bytes are kept, starting on a character, with the first
- *     (partial) line dropped; when that piece has no line break the tail is withheld.
- * @param {string | Buffer | null | undefined} text @param {string | null} packetText @param {number} [maxBytes]
- * @returns {{tail: string | null, note?: string}}
- */
-export function stderrTail(text, packetText, maxBytes = DIAGNOSTIC_TAIL_BYTES) {
-  if (typeof packetText !== 'string') return { tail: null, note: TAIL_WITHHELD_PACKET };
-  const raw = asText(text);
-  if (raw.length === 0) return { tail: '' };
-  if (Buffer.byteLength(raw) > STDERR_MAX_BYTES) return { tail: null, note: TAIL_WITHHELD_LARGE };
-  const packetLines = [
-    ...new Set(
-      packetText
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l.length >= PACKET_LINE_MIN),
-    ),
-  ];
-  let inPem = false;
-  /** @type {string[]} */
-  const kept = [];
-  for (const line of raw.split('\n')) {
-    const t = line.trim();
-    if (inPem) {
-      if (PEM_END.test(t)) inPem = false;
-      continue;
-    }
-    if (PEM_BEGIN.test(t)) {
-      inPem = !PEM_END.test(t);
-      continue;
-    }
-    if (t.length >= PACKET_LINE_MIN && packetLines.some((p) => t.includes(p))) continue;
-    kept.push(line);
-  }
-  const safe = /** @type {string} */ (redact(kept.join('\n')));
-  const buf = Buffer.from(safe, 'utf8');
-  if (buf.length <= maxBytes) return { tail: safe };
-  const from = charStart(buf, buf.length - maxBytes);
-  const piece = buf.subarray(from).toString('utf8');
-  if (buf[from - 1] === 0x0a) return { tail: piece }; // the cut fell exactly on a line start
-  const nl = piece.indexOf('\n');
-  if (nl === -1) return { tail: '', note: TAIL_WITHHELD_LONG_LINE };
-  return { tail: piece.slice(nl + 1) };
-}
-
 /**
  * What a timed-out session's stdout says without any of its text (B30): the last
  * `STDOUT_EVENTS_MAX` event types (JSON lines with a string `type`, each cut to 40 characters and

package/src/util/diagnostic-tail.mjs

@@ -0,0 +1,95 @@
+/**
+ * The packet-free, redacted tail of a session's diagnostic text (B30): a timed-out session's
+ * stderr (`spawn.mjs`) and, since B55, a review answer that failed the schema
+ * (`review/schema-fallback.mjs`). Lives in `util/` so both layers can use the one filter.
+ */
+
+import { redact } from './redact.mjs';
+
+/** How much of a timed-out session's stderr is kept (B30). */
+export const DIAGNOSTIC_TAIL_BYTES = 4096;
+
+/** A timed-out session's stderr over this size keeps no text at all (bounds the redact cost). */
+export const STDERR_MAX_BYTES = 1024 * 1024;
+
+/**
+ * Packet lines shorter than this are too common to tell apart from ordinary output, so they are
+ * NOT filtered. Accepted risk (B30): a packet line under 16 characters (a brace, `return x;`) can
+ * appear in a stderr tail; such a line carries no meaningful packet content on its own.
+ */
+const PACKET_LINE_MIN = 16;
+
+/** The tail note when the packet cannot be read: no stderr text is kept at all (fail closed). */
+export const TAIL_WITHHELD_PACKET = 'withheld: packet unreadable';
+/** The tail note when stderr is over `STDERR_MAX_BYTES`. */
+export const TAIL_WITHHELD_LARGE = 'stderr too large, withheld';
+/** The tail note when the last 4 KB of stderr is one partial line. */
+export const TAIL_WITHHELD_LONG_LINE = 'one long line, withheld';
+
+/** @param {Buffer} buf @param {number} at @returns {number} the first character start at or after `at`. */
+function charStart(buf, at) {
+  let i = at;
+  while (i < buf.length && (buf[i] & 0xc0) === 0x80) i += 1;
+  return i;
+}
+
+/** @param {unknown} text @returns {string} */
+export function asText(text) {
+  return Buffer.isBuffer(text) ? text.toString('utf8') : typeof text === 'string' ? text : '';
+}
+
+const PEM_BEGIN = /-----BEGIN [A-Z0-9 ]*-----/;
+const PEM_END = /-----END [A-Z0-9 ]*-----/;
+
+/**
+ * The stderr tail of a timed-out session (B30), never packet content:
+ *  1. no packet text (unreadable) ⇒ no text: `{tail: null, note: 'withheld: packet unreadable'}`;
+ *     stderr over `STDERR_MAX_BYTES` ⇒ `{tail: null, note: 'stderr too large, withheld'}`;
+ *  2. on the FULL raw text: every PEM block (`-----BEGIN` … `-----END` lines, an unterminated one
+ *     to the end) and every line repeating a packet line (≥ 16 chars) is dropped;
+ *  3. the FULL remaining text goes through B0 `redact`;
+ *  4. over `maxBytes`, the last `maxBytes` bytes are kept, starting on a character, with the first
+ *     (partial) line dropped; when that piece has no line break the tail is withheld.
+ * @param {string | Buffer | null | undefined} text @param {string | null} packetText @param {number} [maxBytes]
+ * @returns {{tail: string | null, note?: string}}
+ */
+export function stderrTail(text, packetText, maxBytes = DIAGNOSTIC_TAIL_BYTES) {
+  if (typeof packetText !== 'string') return { tail: null, note: TAIL_WITHHELD_PACKET };
+  const raw = asText(text);
+  if (raw.length === 0) return { tail: '' };
+  if (Buffer.byteLength(raw) > STDERR_MAX_BYTES) return { tail: null, note: TAIL_WITHHELD_LARGE };
+  const packetLines = [
+    ...new Set(
+      packetText
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.length >= PACKET_LINE_MIN),
+    ),
+  ];
+  let inPem = false;
+  /** @type {string[]} */
+  const kept = [];
+  for (const line of raw.split('\n')) {
+    const t = line.trim();
+    if (inPem) {
+      if (PEM_END.test(t)) inPem = false;
+      continue;
+    }
+    if (PEM_BEGIN.test(t)) {
+      inPem = !PEM_END.test(t);
+      continue;
+    }
+    if (t.length >= PACKET_LINE_MIN && packetLines.some((p) => t.includes(p))) continue;
+    kept.push(line);
+  }
+  const safe = /** @type {string} */ (redact(kept.join('\n')));
+  const buf = Buffer.from(safe, 'utf8');
+  if (buf.length <= maxBytes) return { tail: safe };
+  const from = charStart(buf, buf.length - maxBytes);
+  const piece = buf.subarray(from).toString('utf8');
+  if (buf[from - 1] === 0x0a) return { tail: piece }; // the cut fell exactly on a line start
+  const nl = piece.indexOf('\n');
+  if (nl === -1) return { tail: '', note: TAIL_WITHHELD_LONG_LINE };
+  return { tail: piece.slice(nl + 1) };
+}
+

package/src/worker/engine.mjs

@@ -30,6 +30,10 @@
  * block's review budget (§4.10, B19): the forecast over the block's changed owned files (tier from
  * the path floors, before S1), one `review.budget` row per block; a failure there never fails the
  * review.
+ * B55: every round gets the packet's signed schema-miss history (`ledgerSchemaHistory`: rows of
+ * this run for this file and content hash whose MAC verifies with the run key), so a packet's
+ * second `schema` miss — this round's first try after the earlier ticket's — is tried once on
+ * `review.second_levels.<level>` when one is configured.
  * The review NEVER approves an empty or failed session: that is `unavailable` (§4.2 stub guard).
  * A throw inside the round is `unavailable` too, with the state saved as `next: retry` (see
  * `fixLoopRound`): the next ticket re-runs that round, never a fresh round 1.
@@ -45,6 +49,8 @@ import { reviewFile, rulesRisk } from '../review/engine.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
 import { extraRoundsFor, newFileState, reopenForExtraRound, runRound } from '../review/fixloop.mjs';
 import { readRun } from '../state/run.mjs';
+import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
+import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
 import { keyedLock } from '../util/locks.mjs';
 import { blockAnchors, blockRungUsed, loadState, saveState } from './review-state.mjs';
@@ -355,6 +361,23 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
   /** @type {string | null} */
   let crashed = null;
   try {
+    // B55: a packet's schema misses are counted from the run's signed rows for this run, file,
+    // content hash AND packet hash (`ledgerSchemaHistory` is asked per packet). Built inside the
+    // guarded block: a throw here is this round's `unavailable` with `next: retry`, like any other;
+    // a ledger read that throws later only disables the second-level try (with one warning line).
+    // Once per packet holds because this ticket holds the (block, file) file lock (`loop.mjs`) for
+    // the whole round — round 1, its retry, a recheck and the patch_check alike — and
+    // `schema-fallback.mjs` adds a per-packet lock around read-history → write-mark.
+    // The rows are matched on the values the worker's writeRow stamps on them (`loop.mjs`:
+    // `{...row, block, file, content_hash: ticket.content_hash}`): `ticket.file` and
+    // `ticket.content_hash` here are the same ticket's, for round 1 and rechecks alike (a recheck
+    // ticket's hash is the fixed content's). `where.key` is the run key: `loop.mjs` puts the run's
+    // `key` in `ctx.key` (`key, // signs the fix-loop state`), `reviewTicket` passes `key: ctx.key`
+    // to `fixLoopRound`, which builds `where = {…, key, rows}`. A row whose check throws is not
+    // counted (`ledgerSchemaHistory` catches per row).
+    const schemaHistory = ctx.readRows
+      ? ledgerSchemaHistory({ readRows: ctx.readRows, verify: (row) => verifyRow(row, where.key).ok, runId: ctx.runId, file: ticket.file, contentHash: ticket.content_hash })
+      : undefined;
     await runRound(
       state,
       {
@@ -366,8 +389,9 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
         factsExcerpt,
         extraRounds,
         ...(jev ? { jev } : {}),
+        ...(schemaHistory ? { schemaHistory } : {}),
         review: async () => {
-          engineOutcome = await reviewFile({ repoRoot: ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, kind: blockKindOf, workDir, factsExcerpt }, { spawn: ctx.spawn, writeRow });
+          engineOutcome = await reviewFile({ repoRoot: ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, kind: blockKindOf, workDir, factsExcerpt }, { spawn: ctx.spawn, writeRow, ...(schemaHistory ? { schemaHistory } : {}) });
           return engineOutcome;
         },
         spawn: async (opts) => {