@codedology/code-forge 0.7.2 → 0.7.4

package/CHANGELOG.md

@@ -6,6 +6,26 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.4] — 2026-10-08
+
+### Added
+
+- Review: code moved between two changed files of the same block is named in a ## moved code packet section
+  (deterministic line matching against the block's other changed owned files, same base: >= 3 significant lines or >=
+  120 significant characters; at most 12 ranges; a Markdown section packet lists only the moves in that section) in
+  round 1, rechecks, patch checks and the judge packet, so the source file's reviewer no longer reports the removal as a
+  deleted feature; every hunk and the reviewed_hunks check are unchanged, and the section counts toward the packet
+  budget (issue #2).
+
+## [0.7.3] — 2026-10-08
+
+### Added
+
+- Review: a packet whose answer fails the schema twice is retried once on `review.second_levels.<level>` when configured
+  (signed `review.schema_fallback` row; never in consensus mode; budget and closed-book rules apply), and every schema
+  miss logs a structural diagnosis of the answer (`review.schema_invalid`: keys, types, schema errors or the parse error
+  offset, never the text); the autopilot binnacle shows each fallback as an incident (issue #2).
+
 ## [0.7.2] — 2026-10-07
 
 ### Changed

package/README.md

@@ -12,6 +12,21 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 Next release:
 
+- **Code moved between files is no longer read as deleted.** When a block moves code from one
+  file to another, each file's review packet now says where the lines went (or came from), so the
+  reviewer of the old file stops reporting the removal as a lost feature, also on rechecks. Every
+  hunk is still reviewed.
+
+In 0.7.3:
+
+- **A model that keeps failing the answer format gets a stand-in.** When a reviewer's answer
+  fails the schema twice on the same packet and you set `review.second_levels` for that level, the
+  worker retries that packet once with the second model, and the ledger records it. Each failed
+  answer's shape (its keys, types and schema errors, never its text) is logged, so you can see
+  what went wrong.
+
+In 0.7.2:
+
 - **Long documents get reviewed.** The packet budget (`review.budgets.full_in`) is now 32,000
   tokens, and a Markdown file still too large is reviewed section by section instead of refused;
   a `split_required` result now says its size and the budget.

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 57,
+  "block_count": 59,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -778,6 +778,38 @@
         "B53"
       ],
       "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-02 (25k-token brief never reviewed); also amends src/review/{packet,engine,fixloop}.mjs, src/worker/{engine,loop}.mjs, src/cli/{review,review-file}.mjs, schema/code-forge.schema.json, docs/reference/config.md, docs/how-it-works.md, skill/references/review.md"
+    },
+    "B55": {
+      "title": "Schema-miss fallback (issue #2): a review answer that fails the schema twice on the same packet (same run, file, content, packet text, level and role) is retried once on review.second_levels.<level> (its ladder minus the failed model and, for closed-book roles, minus Codex unless allowed) behind a signed review.schema_fallback row written before the spawn; never in consensus mode; tokens of both sessions summed; every miss logs a structural diagnosis (review.schema_invalid: bytes, kind, keys and types, schema errors, never the text); the autopilot binnacle shows each fallback",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/schema-fallback.mjs",
+        "src/util/diagnostic-tail.mjs",
+        "test/review/schema-fallback.test.mjs",
+        "test/worker/schema-fallback-wiring.test.mjs"
+      ],
+      "depends_on": [
+        "B54"
+      ],
+      "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-06; also amends src/review/{engine,fixloop,validate-review}.mjs, src/worker/engine.mjs, src/session/spawn.mjs (stderr tail moved to util), src/autopilot/binnacle.mjs, test fakes, docs/how-it-works.md, skill/references/review.md"
+    },
+    "B56": {
+      "title": "Moved-code hint (issue #2): code moved between changed files of the same block is detected by deterministic line matching (>= 3 significant lines or >= 120 significant characters; peers in the base diffed against it, deleted peers included) and named in a ## moved code packet section on both files, in round 1, rechecks, patch checks, the judge packet and per Markdown section; extra text only (every hunk and reviewed_hunks unchanged); counted in the packet budget with one measure; unsafe peer names never read or printed; peer diffs read once per ticket with a 2 MiB per-peer cap",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/moved.mjs",
+        "test/review/moved.test.mjs",
+        "test/review/moved-wiring.test.mjs",
+        "test/worker/moved-peers-guard.test.mjs"
+      ],
+      "depends_on": [
+        "B55"
+      ],
+      "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-06 (stale critical from a cross-file move); also amends src/review/{packet,engine,fixloop,sections}.mjs, src/worker/engine.mjs, docs/how-it-works.md, skill/references/review.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/references/review.md

@@ -15,11 +15,11 @@ The topology is decided in one place (`planSessions`). Consensus (§6) runs only
 
 ## §3 Isolation and the packet
 
-Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp dir under the run's temp root and the packet **on stdin** — a no-tools session never opens a path and the packet never enters argv. Packet order is fixed so provider prompt caching applies: lens, project rules digest (≤ 60 lines), facts-sheet excerpt for the symbols in the diff, context, diff. Context: a file at or under `review.context.whole_file_max_lines` travels whole; above it each hunk carries ± `review.context.hunk_context_lines` lines; over `review.budgets.full_in` the context shrinks to ± `review.context.min_context_lines`, then the digest is trimmed, never the diff; a diff alone over budget ⇒ `split_required`, with `tokens_in` and `budget` in the result, its ledger `review.result` row and the `review-file --wait` answer (`stop: split_required`) — except a Markdown file (`.md`, `.markdown`), which is reviewed **section by section**: the diff is cut at its headings (`#`..`######`, not inside fenced code), consecutive sections share a packet while it fits, every section packet runs the file's whole plan with its own stub guard, the file is approved only when every section is, and findings are merged with ids `S<section>.<id>`; a recheck over budget is split the same way, each open finding listed in its own section's packet. A section that alone is over budget keeps the file `split_required` (with that `section`), and so does a deleted Markdown file or one with no heading (fail-safe: one section); nothing is ever truncated. The closed-book rule is in every lens: judge only what is in the packet; a file you cannot see goes in `needs_file`, and the worker attaches it (read-only, trimmed) for **one** more round.
+Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp dir under the run's temp root and the packet **on stdin** — a no-tools session never opens a path and the packet never enters argv. Packet order is fixed so provider prompt caching applies: lens, project rules digest (≤ 60 lines), facts-sheet excerpt for the symbols in the diff, context, diff. Context: a file at or under `review.context.whole_file_max_lines` travels whole; above it each hunk carries ± `review.context.hunk_context_lines` lines; over `review.budgets.full_in` the context shrinks to ± `review.context.min_context_lines`, then the digest is trimmed, never the diff; a diff alone over budget ⇒ `split_required`, with `tokens_in` and `budget` in the result, its ledger `review.result` row and the `review-file --wait` answer (`stop: split_required`) — except a Markdown file (`.md`, `.markdown`), which is reviewed **section by section**: the diff is cut at its headings (`#`..`######`, not inside fenced code), consecutive sections share a packet while it fits, every section packet runs the file's whole plan with its own stub guard, the file is approved only when every section is, and findings are merged with ids `S<section>.<id>`; a recheck over budget is split the same way, each open finding listed in its own section's packet. A section that alone is over budget keeps the file `split_required` (with that `section`), and so does a deleted Markdown file or one with no heading (fail-safe: one section); nothing is ever truncated. Moved code (B56): code moved between two changed files of the same block is named in a `## moved code` section before the diff (`- base lines a-b removed here were added in <file> lines c-d in this block.` / `- lines c-d were moved here from <file> (its base lines a-b) in this block.`), in round 1, rechecks, patch checks and the judge's packet. Detection is deterministic line matching against the block's other changed owned files diffed against the same base: lines trimmed with whitespace collapsed, lines with fewer than 4 letters or digits ignored, a moved stretch needs ≥ 3 such lines or ≥ 120 such characters; at most 12 ranges are listed; a Markdown section packet lists only the moves under its own headings (none ⇒ no section); the peers are listed and read once per review (one `git ls-tree <base>`, one `git diff <base>` over the peers that exist in the base — a peer deleted in the block, staged or not, is all removed lines — one `git check-ignore` and one `git diff --no-index` per new peer; `a/`/`b/` prefixes forced, `core.quotePath=false`; a peer name with a control, bidi or separator character, a quote or a backslash is skipped; a peer whose diff is over 2 MiB is skipped, never buffered past that); a removed block cut right above a heading belongs to the section holding its removed hunk; a move inside one file is not detected. It is extra text counted in the packet budget: every hunk stays, `reviewed_hunks` is unchanged, and a removal listed there is not a defect by itself — only stale references or imports are. The closed-book rule is in every lens: judge only what is in the packet; a file you cannot see goes in `needs_file`, and the worker attaches it (read-only, trimmed) for **one** more round.
 
 ## §4 The stub guard — what counts as a review (R11)
 
-A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens (a clean pass — `passed: true`, no findings, a non-blank summary — needs only 40, whatever the diff size). Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; the worker retries once on the level's fallback, then the file stays unreviewed and the block cannot close. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
+A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens (a clean pass — `passed: true`, no findings, a non-blank summary — needs only 40, whatever the diff size). Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; `review-file` on the same content re-runs the same packet once, then the file stays unreviewed and the block cannot close. Every `schema` miss leaves a signed `review.schema_invalid` row with a structural diagnosis of the answer — its size and kind (`json`, `not-json`, `empty`), its top-level keys and their types, and the schema errors (path, keyword, message), or the parse error and its byte offset — never the answer's text. At a packet's **second** `schema` miss (same run, file, content hash, packet text, level and role — the first try plus that re-run), the worker tries the packet ONCE on `review.second_levels.<level>` when the owner configured one, and writes a signed `review.schema_fallback {lens, role, level, packet_hash, from_provider, from_model, to, to_provider, to_model, attempts, refused?}` row first (no row written ⇒ no try; any earlier row for the packet at that level ⇒ no try). Its first model that is not the failed one — and, for a closed-book role, not Codex unless `review.allow_open_book_codex` — runs (`refused: same-model` or `refused: closed-book` when there is none). The session's tokens are both sessions'. Its answer goes through the same stub guard; a valid one is a normal answer, a failed one leaves the file unavailable. Never in consensus mode; `budget.usd` refuses it like any session. Without a second level only the diagnosis row is new. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
 
 ## §5 The convergence rule — bounded fix rounds (R15)
 

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.7.2"
+PINNED_VERSION="0.7.4"
 set -eu
 
 self="$0"

package/src/autopilot/binnacle.mjs

@@ -39,7 +39,7 @@ export const LOG_FILE = 'autopilot-log.md';
 export const NONE_YET = 'none yet';
 
 /** The ledger events (besides every `autopilot.*`) that belong to the log and the timeline. */
-const EXTRA_EVENTS = Object.freeze(['block.close', 'review.session_timeout', 'worker.down', 'worker.replaced', 'ledger.tamper', 'budget.refused', 'gate.red', 'gate.done']);
+const EXTRA_EVENTS = Object.freeze(['block.close', 'review.session_timeout', 'review.schema_fallback', 'worker.down', 'worker.replaced', 'ledger.tamper', 'budget.refused', 'gate.red', 'gate.done']);
 
 /** @typedef {Record<string, any>} Row */
 /** @typedef {{home?: string | null, cwd?: string | null}} ScrubCtx */
@@ -146,6 +146,8 @@ function describe(row) {
       return { event: 'Block closed', detail: `status ${row.status ?? 'unknown'}${short(first(row.commit, row.sha, row.commit_sha)) ? ` · commit ${short(first(row.commit, row.sha, row.commit_sha))}` : ''}`, link: first(row.pr_url, row.pr) };
     case 'review.session_timeout':
       return { event: 'Review session timed out', detail: `${row.lens ?? row.role ?? 'session'} · attempt ${u(row.attempt)} · ${row.retried === true ? 'retried' : 'gave up'}`, link: null };
+    case 'review.schema_fallback':
+      return { event: 'Review answer off-schema twice', detail: `${row.lens ?? row.role ?? 'session'} · ${u(row.from_model, 'unknown model')} → ${u(row.to_model, 'unknown model')} · ${typeof row.refused === 'string' ? `refused (${u(row.refused)})` : 'retried once'}`, link: null };
     case 'worker.down':
       return { event: 'Worker down', detail: 'the pinned worker is not running', link: null };
     case 'worker.replaced':
@@ -181,6 +183,31 @@ export function buildFullLog({ runId, rows, scrubCtx }) {
 /** @param {Row} row @returns {string} the subject line of an event, e.g. ` · b1 · src/a.mjs`. */
 const where = (row) => `${str(row.block) ? ` · ${u(row.block)}` : ''}${str(row.file) ? ` · ${u(row.file)}` : ''}`;
 
+/**
+ * B55: what the owner does about a refused second-level try, by refusal. `schema-fallback.mjs`
+ * writes `closed-book` (every model left is Codex for a closed-book role) and `same-model`
+ * (nothing but the failed model is configured). No writer puts `budget` in this row today — the
+ * budget gate refuses inside the spawn and writes its own `budget.refused` row — so `budget` is
+ * shown only when a row carries it; any other string gets the generic fix.
+ */
+const SCHEMA_FALLBACK_FIX = Object.freeze({
+  'closed-book': 'Set a second level that can run closed-book (not Codex), or review the file by hand.',
+  'same-model': 'Set review.second_levels to a different model than the one that failed, or review the file by hand.',
+  budget: 'Raise the budget (only you can) or review the file by hand.',
+});
+
+/**
+ * The incident of a `review.schema_fallback` row (B55): retried once, or refused and why.
+ * @param {Row} r @param {string | null} time
+ * @returns {{time: string | null, what: string, effect: string, fix: string}}
+ */
+function schemaFallbackIncident(r, time) {
+  const what = `A ${r.lens ?? r.role ?? 'review'} answer failed the schema twice on the same packet (${u(r.from_model, 'unknown model')})`;
+  if (typeof r.refused !== 'string') return { time, what, effect: `It was retried once on the second level (${u(r.to_model, 'unknown model')}).`, fix: "Check the file's next review result." };
+  const fix = Object.hasOwn(SCHEMA_FALLBACK_FIX, r.refused) ? SCHEMA_FALLBACK_FIX[/** @type {keyof typeof SCHEMA_FALLBACK_FIX} */ (r.refused)] : 'Review the file by hand.';
+  return { time, what, effect: `The second-level try was refused (${u(r.refused)}); the review stays unavailable.`, fix };
+}
+
 /**
  * @param {Row[]} blockRows rows of one block @param {Row | undefined} entry its run-record entry
  * @param {string} id
@@ -285,6 +312,7 @@ export function buildBinnacle({ runId, rows, record, now, scrubCtx = scrubCtxOf(
   for (const { row, time } of mine) {
     const r = row;
     if (r.event === 'review.session_timeout') incidents.push({ time, what: `A ${r.lens ?? r.role ?? 'review'} session timed out (attempt ${u(r.attempt)})`, effect: r.retried === true ? 'It was retried.' : 'No retry left; the review was marked unavailable.', fix: r.retried === true ? 'None needed unless it repeats.' : 'Run the review again.' });
+    else if (r.event === 'review.schema_fallback') incidents.push(schemaFallbackIncident(r, time));
     else if (r.event === 'worker.down' || r.event === 'worker.replaced') incidents.push({ time, what: r.event === 'worker.down' ? 'The pinned worker was down' : 'The pinned worker was replaced', effect: 'Reviews wait until the worker is back.', fix: 'Restart the worker for this run.' });
     else if (r.event === 'ledger.tamper') incidents.push({ time, what: `A ledger check failed for block ${r.block ?? 'unknown'}`, effect: 'The block was stopped.', fix: 'Look at the block before reopening it.' });
     else if (r.event === 'autopilot.issue_failed') incidents.push({ time, what: `The waiver issue for ${u(r.finding, 'unknown finding')} in ${u(r.file, 'unknown file')} could not be opened`, effect: 'The waiver stands without an issue.', fix: 'Open the tracking issue by hand.' });

package/src/review/engine.mjs

@@ -20,6 +20,12 @@
  *  6. a session that ends in `timeout` is spawned ONCE more on the same packet and level
  *     (`session-retry.mjs`, B30); a second timeout is `unavailable: timeout`. The summary's
  *     `attempts` says how many ran;
+ *  6b. a session whose answer fails the schema logs it (`review.schema_invalid`, the raw answer
+ *     redacted); at the packet's second such miss it is tried ONCE on `review.second_levels.<level>`
+ *     when the owner configured one (`schema-fallback.mjs`, B55; never in consensus mode).
+ *     The summary then carries `schema_fallback: {level, provider, model}` (`level`:
+ *     `review.second_levels.<level>`), the second level's own provider/model, and `tokens_in` /
+ *     `tokens_out` summed over both sessions;
  *  7. a diff alone over the packet budget is `split_required` (with `tokens_in` and `budget`) —
  *     except a Markdown file (B54), which is reviewed SECTION BY SECTION (`sections.mjs`): every
  *     section packet runs the whole plan above (its own sessions, judge and stub guard, its own
@@ -27,7 +33,13 @@
  *     reviewed (the file is then `unavailable`). The file is approved only when EVERY section is;
  *     the findings of all sections are merged with ids `S<section>.<id>`, every session summary
  *     names its `section`, and `sections` lists them. A section that alone is still over the
- *     budget keeps the file `split_required` (plus `section`: its heading) — never truncated.
+ *     budget keeps the file `split_required` (plus `section`: its heading) — never truncated;
+ *  8. code moved between this file and another changed file of the block (`input.peers`, both
+ *     diffed against the block base) is named in a `## moved code` section of every packet —
+ *     reviewers and judge; a Markdown section packet lists only the moves in that section
+ *     (`moved.mjs`, B56). The peers' diffs are read once per review (`input.peerDiffs`, or a
+ *     reader built from `input.peers`). It is extra text: every hunk still goes to the reviewer,
+ *     and it counts toward the budget in the same measure.
  * Approval (until B12b's triage lands) = the final answer (the judge's in dual/consensus mode, else
  * the single reviewer's) passed the guard, says `passed: true`, and carries no `critical` or
  * `warning` finding.
@@ -41,9 +53,11 @@ import { blockKind, isDocsKind } from '../decide/escalation.mjs';
 import { fallbackRisk } from '../decide/fallback-rules.mjs';
 import { tierFor } from '../proof/tiers.mjs';
 import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, readFileDiff } from './packet.mjs';
+import { movedText, movesFor, peerDiffReader } from './moved.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups } from './sections.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
+import { afterSchemaMiss, logSecondLevelMiss } from './schema-fallback.mjs';
 import { assertRowPath } from '../worker/ticket.mjs';
 
 /**
@@ -153,6 +167,10 @@ export function rulesRisk({ file, plusCount, cfg }) {
  * @property {string} [kind] - the block kind (`code`, `docs`, `contract`; B34); absent ⇒ `blockKind` of the reviewed file.
  * @property {string} [rulesDigest] @property {string} [factsExcerpt]
  * @property {string} workDir - where packet files are written (under the run's temp root).
+ * @property {ReadonlyArray<string>} [peers] - B56: the block's OTHER changed files (repo-relative);
+ *   code moved between this file and one of them is named in every packet (`## moved code`).
+ * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader
+ *   of those files' diffs (`peerDiffReader`), shared by the caller across the round; wins over `peers`.
  */
 
 /**
@@ -161,7 +179,10 @@ export function rulesRisk({ file, plusCount, cfg }) {
  *   session (`spawnSession` opts minus the worker-pinned ones); a per-call `cfg` selects another
  *   provider's level for the same slot (consensus).
  * @property {(row: Record<string, any>) => Promise<unknown>} [writeRow] - ledger rows
- *   (`review.plan`, `review.unavailable`); a failed write never fails the review.
+ *   (`review.plan`, `review.unavailable`, `review.schema_invalid`, `review.schema_fallback`); a
+ *   failed write never fails the review (a failed `review.schema_fallback` write means no try).
+ * @property {import('./schema-fallback.mjs').SchemaHistory} [schemaHistory] - B55: the packet's
+ *   signed schema-miss history (the worker's); absent ⇒ no second-level try.
  */
 
 /** @param {ReviewDeps} deps @param {Record<string, any>} row */
@@ -202,12 +223,25 @@ export async function reviewFile(input, deps) {
   if (plan.refused) return { status: 'refused', reason: plan.refused, approved: false, ...head, sessions: [] };
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
+  // B56: the file's moves, read once; every packet and every measure of a part uses `movedOf`
+  /** @type {import('./moved.mjs').Moves | null} */
+  let moves = null;
+  try {
+    const peerDiffs = input.peerDiffs ?? peerDiffReader({ repoRoot, base: input.base, file: diff.file, peers: input.peers });
+    moves = await movesFor({ diff, peerDiffs });
+  } catch {
+    moves = null; // no hint; the review goes on
+  }
+  /** @param {ReadonlyArray<number> | null} keys - a Markdown section's group keys; null ⇒ the whole file. */
+  const movedOf = (keys) => movedText(moves, diff.content, keys);
   const min = minTokensOut(cfg);
+  // B55: never in consensus mode — its providers (two reviewers, the judge) are the check itself
+  const schemaFallback = plan.mode !== 'consensus';
 
   /** @param {SessionSpec} spec @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet */
   const run = async (spec, packet) => {
     /** @type {Record<string, any>} */
-    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, cfg });
+    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, cfg, schemaFallback });
     const needs = summary.review?.needs_file;
     if (spec.role === 'reviewer' && summary.status === 'ok' && Array.isArray(needs) && needs.length > 0) {
       const paths = safeNeeds(needs);
@@ -218,23 +252,24 @@ export async function reviewFile(input, deps) {
         extra = null;
       }
       if (extra === null) return { ...summary, status: 'unavailable', reason: 'needs_file-refused', review: null };
-      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, cfg })), needs_file_round: true };
+      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, cfg, schemaFallback })), needs_file_round: true };
     }
     return summary;
   };
 
   const reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
   const judgeSpec = plan.sessions.find((s) => s.role === 'judge');
-  /** @param {import('./packet.mjs').FileDiff} part */
-  const packetsFor = (part) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg }));
+  /** @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<number> | null} [keys] */
+  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys) }));
 
   /**
    * The plan on one packet set (the whole file, or one Markdown section): reviewers, then the judge.
    * @param {import('./packet.mjs').FileDiff} part @param {Array<Record<string, any>>} packets
    * @param {Record<string, any>} [rowExtra] - added to the `review.plan` row (`section`).
+   * @param {ReadonlyArray<number> | null} [keys] - the section's group keys (its moved-code hint).
    * @returns {Promise<{status: 'reviewed' | 'unavailable', reason?: string, approved: boolean, summary?: string, findings?: Array<Record<string, any>>, sessions: Array<Record<string, any>>}>}
    */
-  const reviewPart = async (part, packets, rowExtra = {}) => {
+  const reviewPart = async (part, packets, rowExtra = {}, keys = null) => {
     await note(deps, { event: 'review.plan', depth_unconstrained: plan.depth, depth_chosen: plan.depth, degrade_step: 0, risk, context_mode: packets[0]?.contextMode ?? null, forecast_tokens: packets.reduce((n, p) => n + p.tokensIn, 0), ...rowExtra });
     const done = await Promise.all(reviewers.map((spec, i) => run(spec, /** @type {any} */ (packets[i]))));
     const sessions = done.map(publicSummary);
@@ -246,8 +281,8 @@ export async function reviewFile(input, deps) {
     let final = done[0];
     if (judgeSpec) {
       const bySlot = Object.fromEntries(done.map((s) => [s.slot, s.review]));
-      const packet = assembleJudgePacket({ diff: part, reports: { A: bySlot.A, B: bySlot.B }, cfg });
-      final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg });
+      const packet = assembleJudgePacket({ diff: part, reports: { A: bySlot.A, B: bySlot.B }, cfg, moved: movedOf(keys) });
+      final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg, schemaFallback });
       sessions.push(publicSummary(final));
       if (final.status !== 'ok') {
         await note(deps, { event: 'review.unavailable', reason: final.reason, lens: 'judge', ...rowExtra });
@@ -269,18 +304,25 @@ export async function reviewFile(input, deps) {
   if (!isMarkdownFile(diff.file)) return { status: 'split_required', approved: false, ...head, tokens_in: split.tokensIn, budget: split.budget, sessions: [] };
 
   // B54: a Markdown file over the budget is reviewed section by section
-  /** @param {import('./packet.mjs').FileDiff} part @returns {number} the diff-only packet tokens, largest over the lenses. */
-  const measure = (part) => Math.max(...reviewers.map((spec) => diffOnlyTokens({ diff: part, lens: spec.lens })));
+  /**
+   * @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<{key: number}> | null} [groups] - null ⇒ the whole file.
+   * @returns {number} the diff-only packet tokens, largest over the lenses.
+   */
+  const measure = (part, groups = null) => {
+    const moved = movedOf(groups === null ? null : groups.map((g) => g.key));
+    return Math.max(...reviewers.map((spec) => diffOnlyTokens({ diff: part, lens: spec.lens, moved })));
+  };
   const packed = packSections({ diff, budget: split.budget, measure });
   /**
    * A `split_required` outcome, its size always numeric (measured here when the packet lacks it).
    * @param {import('./packet.mjs').FileDiff} part @param {{tokensIn?: unknown, budget?: unknown}} over @param {string | null} section
+   * @param {ReadonlyArray<{key: number}> | null} [groups] - the part's heading groups (its moved-code hint); null ⇒ the whole file.
    */
-  const splitOutcome = (part, over, section) => ({
+  const splitOutcome = (part, over, section, groups = null) => ({
     status: 'split_required',
     approved: false,
     ...head,
-    tokens_in: Number.isFinite(over.tokensIn) ? over.tokensIn : measure(part),
+    tokens_in: Number.isFinite(over.tokensIn) ? over.tokensIn : measure(part, groups),
     budget: Number.isFinite(over.budget) ? over.budget : split.budget,
     ...(section ? { section } : {}),
     sessions: [],
@@ -288,7 +330,7 @@ export async function reviewFile(input, deps) {
   if (packed.status !== 'ok') {
     // a named section is measured on its own diff, never the whole file's
     const group = packed.section ? sectionGroups(diff)?.find((g) => g.heading === packed.section) : undefined;
-    return splitOutcome(group ? group.diff : diff, packed, packed.section);
+    return splitOutcome(group ? group.diff : diff, packed, packed.section, group ? [group] : null);
   }
   // never approve with no section: no packet ⇒ no session ⇒ split_required at the whole size
   if (packed.sections.length === 0) return splitOutcome(diff, split, null);
@@ -296,10 +338,10 @@ export async function reviewFile(input, deps) {
   // one measure, so with the real packer none is ever not `ok`: this is a DEFENSIVE guard (a test
   // reaches it through a mocked packer) — one that is not `ok` stops the file as split_required,
   // sized on that section's own diff
-  const sectionPackets = packed.sections.map((section) => packetsFor(section.diff));
+  const sectionPackets = packed.sections.map((section) => packetsFor(section.diff, section.keys));
   for (const [i, set] of sectionPackets.entries()) {
     const over = /** @type {{tokensIn?: unknown, budget?: unknown} | undefined} */ (set.find((p) => p.status !== 'ok'));
-    if (over) return splitOutcome(packed.sections[i].diff, over, packed.sections[i].headings[0] ?? '(before first heading)');
+    if (over) return splitOutcome(packed.sections[i].diff, over, packed.sections[i].headings[0] ?? '(before first heading)', packed.sections[i].keys.map((key) => ({ key })));
   }
   const sections = packed.sections.map((s) => ({ index: s.index, headings: s.headings, hunks: s.diff.hunks.length }));
   /** @type {Array<Record<string, any>>} */
@@ -309,7 +351,7 @@ export async function reviewFile(input, deps) {
   const summaries = [];
   let approved = true;
   for (const [i, section] of packed.sections.entries()) {
-    const part = await reviewPart(section.diff, sectionPackets[i], { section: section.index, sections: packed.sections.length });
+    const part = await reviewPart(section.diff, sectionPackets[i], { section: section.index, sections: packed.sections.length }, section.keys);
     sessions.push(...part.sessions.map((s) => ({ ...s, section: section.index })));
     if (part.status !== 'reviewed') return { status: part.status, reason: part.reason, approved: false, ...head, sections, sessions };
     approved = approved && part.approved;
@@ -320,22 +362,29 @@ export async function reviewFile(input, deps) {
 }
 
 /**
- * One session: packet file (0600, removed after), spawn, stub guard.
+ * One session: packet file (0600, removed after), spawn, stub guard — and, on a `schema` miss, the
+ * B55 second-level try (`schema-fallback.mjs`) on the same packet file before it is removed.
  * @param {SessionSpec} spec @param {string} text
  * @param {{hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet
- * @param {{deps: ReviewDeps, workDir: string, min: number, cfg: Record<string, any>}} env
+ * @param {{deps: ReviewDeps, workDir: string, min: number, cfg: Record<string, any>, schemaFallback?: boolean}} env -
+ *   `schemaFallback: false` (consensus mode: its providers ARE the check) never tries.
  */
-async function runOne(spec, text, packet, { deps, workDir, min }) {
+async function runOne(spec, text, packet, { deps, workDir, min, cfg, schemaFallback = true }) {
   const promptPath = path.join(workDir, `${spec.lens}-${randomBytes(6).toString('hex')}.md`);
   const base = { lens: spec.lens, role: spec.role, level: spec.level, slot: spec.slot, context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn };
   writeFileSync(promptPath, text, { mode: 0o600 });
   /** @type {Record<string, any> | null} */
   let res = null;
   let attempts = 0;
-  try {
+  /** @type {import('./validate-review.mjs').Verdict} */
+  let verdict = { ok: false, reason: 'exit', detail: 'no session result' };
+  /** @type {{level: string, provider: string, model: string} | null} */
+  let fellBackTo = null;
+  /** @param {Record<string, any> | undefined} sessionCfg @param {number} done - attempts before this call. */
+  const attempt = (sessionCfg, done) =>
     // a `timeout` is spawned once more on the same packet and level (B30); a spawn that throws
     // (bad config, refused argv) is an `exit` failure, never approval
-    ({ res, attempts } = await spawnWithTimeoutRetry(
+    spawnWithTimeoutRetry(
       deps.spawn,
       {
         level: spec.level,
@@ -343,35 +392,88 @@ async function runOne(spec, text, packet, { deps, workDir, min }) {
         promptPath,
         schema: FINDING_SCHEMA,
         rowExtra: { lens: spec.lens, context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn },
-        ...(spec.cfg ? { cfg: spec.cfg } : {}),
+        ...(sessionCfg ? { cfg: sessionCfg } : {}),
       },
       (row) => note(deps, row),
       (n) => {
-        attempts = n;
+        attempts = done + n;
       },
-    ));
-  } catch {
-    // defensive only: the helper never throws. If it ever did, it is still an `exit` failure,
-    // never approval, with the attempts it had reported so far (at least 1).
-    res = null;
-    attempts = Math.max(attempts, 1);
+    );
+  /** @type {number | null} the session's tokens: the first spawn's, plus a second-level try's */
+  let tokensIn = null;
+  /** @type {number | null} */
+  let tokensOut = null;
+  // the packet file is removed on every path, and only after the second-level try (which reads it)
+  try {
+    try {
+      ({ res, attempts } = await attempt(spec.cfg, 0));
+    } catch {
+      // defensive only: the helper never throws. If it ever did, it is still an `exit` failure,
+      // never approval, with the attempts it had reported so far (at least 1).
+      res = null;
+      attempts = Math.max(attempts, 1);
+    }
+    tokensIn = res?.usage?.tokens_in ?? null;
+    tokensOut = res?.usage?.tokens_out ?? null;
+    verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+    if (!verdict.ok && verdict.reason === 'schema') {
+      try {
+        const session = { lens: spec.lens, role: spec.role, level: spec.level };
+        const done = attempts;
+        // no ledger writer ⇒ nothing logged, nothing tried; every row goes through the same writer
+        // (each helper handles its own failed write)
+        const write = deps.writeRow ? (/** @type {Record<string, any>} */ row) => /** @type {NonNullable<ReviewDeps['writeRow']>} */ (deps.writeRow)(row) : undefined;
+        const second = await afterSchemaMiss({
+          res,
+          session,
+          packetText: text,
+          cfg: spec.cfg ?? cfg,
+          allowed: schemaFallback && !spec.cfg,
+          history: deps.schemaHistory,
+          writeRow: write,
+          spawnAt: (c) => attempt(c, done),
+        });
+        if (second) {
+          const secondVerdict = validateReview(second.res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
+          res = second.res;
+          attempts = done + second.attempts;
+          fellBackTo = second.to;
+          verdict = secondVerdict;
+          tokensIn = addTokens(tokensIn, second.res?.usage?.tokens_in);
+          tokensOut = addTokens(tokensOut, second.res?.usage?.tokens_out);
+          if (!verdict.ok && verdict.reason === 'schema') await logSecondLevelMiss({ res, session, packetText: text, writeRow: write });
+        }
+      } catch {
+        // defensive only: the helpers never throw. If they ever did, the first session's result
+        // and its `schema` verdict stand (never turned into `exit`, never approval)
+      }
+    }
   } finally {
     rmSync(promptPath, { force: true });
   }
-  const verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
   const meta = {
     ...base,
     provider: res?.provider ?? null,
     model: res?.model ?? null,
     fallback_step: res?.fallback_step ?? 0,
     attempts,
-    tokens_in: res?.usage?.tokens_in ?? null,
-    tokens_out: res?.usage?.tokens_out ?? null,
+    ...(fellBackTo ? { schema_fallback: fellBackTo } : {}),
+    tokens_in: tokensIn,
+    tokens_out: tokensOut,
   };
   if (!verdict.ok) return { ...meta, status: 'unavailable', reason: verdict.reason, review: null };
   return { ...meta, status: 'ok', reason: null, review: verdict.review };
 }
 
+/**
+ * Two token counts added; a missing one (not a number) adds nothing, both missing ⇒ null.
+ * @param {unknown} a @param {unknown} b @returns {number | null}
+ */
+function addTokens(a, b) {
+  if (typeof a !== 'number') return typeof b === 'number' ? b : null;
+  return typeof b === 'number' ? a + b : a;
+}
+
 /** The per-session summary the worker signs: the answer's verdict and findings, never the packet. */
 function publicSummary(/** @type {Record<string, any>} */ s) {
   const { review, ...rest } = s;