@codedology/code-forge 0.7.3 → 0.7.5

package/CHANGELOG.md

@@ -6,6 +6,30 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.5] — 2026-10-08
+
+### Fixed
+
+- An owned entry with no glob character now owns every path below it everywhere, not only at `block close`: `block open`
+  and the plan check refuse a directory that overlaps a file or directory of another block (parent or child, either way
+  round; `src/feature` vs `src/featureX` stay disjoint), and `block claim`, `block rebase`, the scope gate, proof and
+  the worker's file set and budget count the files inside an owned directory (B57, issue #2). An entry that is a regular
+  file at `block open` or `block claim` owns only itself (recorded as `owned_kinds`); one not there yet stays
+  directory-like; a brace entry stays a glob. A refused `block claim` names the entry it overlaps
+  (`<path> overlaps <entry> owned by open block <id>`), and `proof export` never copies or removes an owned directory
+  itself, only the files in it.
+
+## [0.7.4] — 2026-10-08
+
+### Added
+
+- Review: code moved between two changed files of the same block is named in a ## moved code packet section
+  (deterministic line matching against the block's other changed owned files, same base: >= 3 significant lines or >=
+  120 significant characters; at most 12 ranges; a Markdown section packet lists only the moves in that section) in
+  round 1, rechecks, patch checks and the judge packet, so the source file's reviewer no longer reports the removal as a
+  deleted feature; every hunk and the reviewed_hunks check are unchanged, and the section counts toward the packet
+  budget (issue #2).
+
 ## [0.7.3] — 2026-10-08
 
 ### Added

package/README.md

@@ -12,6 +12,21 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 Next release:
 
+- **An owned directory owns the files inside it, everywhere.** A block that owns `src/feature`
+  now owns `src/feature/a.swift` for `block open`, `block claim`, `block rebase`, the scope gate,
+  proof and the review worker, not only for `block close`. `block open` refuses a second block
+  that owns a file or folder inside it (or a folder around it), so two coders can no longer edit
+  the same files at once. A path that is already a file when the block opens owns only itself.
+
+In 0.7.4:
+
+- **Code moved between files is no longer read as deleted.** When a block moves code from one
+  file to another, each file's review packet now says where the lines went (or came from), so the
+  reviewer of the old file stops reporting the removal as a lost feature, also on rechecks. Every
+  hunk is still reviewed.
+
+In 0.7.3:
+
 - **A model that keeps failing the answer format gets a stand-in.** When a reviewer's answer
   fails the schema twice on the same packet and you set `review.second_levels` for that level, the
   worker retries that packet once with the second model, and the ledger records it. Each failed

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 58,
+  "block_count": 60,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -794,6 +794,35 @@
         "B54"
       ],
       "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-06; also amends src/review/{engine,fixloop,validate-review}.mjs, src/worker/engine.mjs, src/session/spawn.mjs (stderr tail moved to util), src/autopilot/binnacle.mjs, test fakes, docs/how-it-works.md, skill/references/review.md"
+    },
+    "B56": {
+      "title": "Moved-code hint (issue #2): code moved between changed files of the same block is detected by deterministic line matching (>= 3 significant lines or >= 120 significant characters; peers in the base diffed against it, deleted peers included) and named in a ## moved code packet section on both files, in round 1, rechecks, patch checks, the judge packet and per Markdown section; extra text only (every hunk and reviewed_hunks unchanged); counted in the packet budget with one measure; unsafe peer names never read or printed; peer diffs read once per ticket with a 2 MiB per-peer cap",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/moved.mjs",
+        "test/review/moved.test.mjs",
+        "test/review/moved-wiring.test.mjs",
+        "test/worker/moved-peers-guard.test.mjs"
+      ],
+      "depends_on": [
+        "B55"
+      ],
+      "note": "root-added 2026-10-08; GitHub issue #2 note of 2026-10-06 (stale critical from a cross-file move); also amends src/review/{packet,engine,fixloop,sections}.mjs, src/worker/engine.mjs, docs/how-it-works.md, skill/references/review.md"
+    },
+    "B57": {
+      "title": "One ownership rule (issue #2): an owned entry with no glob character owns its path and every path below it (src/feature owns src/feature/a.swift, never src/featureX/a.swift) unless block open or block claim saw a regular file there (owned_kinds: then it owns only itself); globs, brace entries included, own what they match; findOverlap reports file/dir and dir/dir parent-child overlaps either way and a directory-like entry against a glob matching it or any path below it; the rule lives in src/state/registry.mjs and every caller uses it (block open, claim, rebase, scope gate, close gate, proof, worker file set and budget, plan check)",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/state/owned-kinds.mjs"
+      ],
+      "depends_on": [
+        "B56"
+      ],
+      "note": "root-added 2026-10-08; found while fixing GitHub issue #2 (B52); also amends src/state/{registry,block}.mjs, src/review/gate-check.mjs, src/cli/{block,proof,plan}.mjs, src/proof/{export,tiers}.mjs, src/worker/engine.mjs, src/session/plan-check.mjs, tests, docs/how-it-works.md, skill/references/code.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/references/code.md

@@ -10,7 +10,7 @@ The coder then forecasts **cases** (tests) and **lines**. Compute the floor your
 
 ## §3 Dispatch — what the brief contains
 
-`forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> --brief <file> [--attempt <n>] [--base <sha>] [--kind code|docs|contract] --lines <n>` records the base sha, the owned files (overlap with another active block ⇒ refused), the block kind (declared, else detected — `decisions.md` §5), the level (a docs/contract block below `levels.coder_floor_docs`, default L1, is raised to it and the CLI prints the floor), the clauses with their test ids and the forecast, writes the ledger `dispatch` row and prints the pointer `BRIEF <path> lines=<n> sha=<sha8> <<<EOM>>>` (≤ 200 B). Call it before every spawn, in every engine. A docs block that owns a glob (`docs/**`) must declare `--kind docs`: a glob is judged by its literal ending, so undeclared it counts as `code`. The brief file carries, in this order:
+`forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> --brief <file> [--attempt <n>] [--base <sha>] [--kind code|docs|contract] --lines <n>` records the base sha, the owned files (overlap with another active block ⇒ refused; an owned entry with no glob character — `*`, `?`, `{` — owns that path and every path below it, so `src/feature` owns `src/feature/a.swift` but not `src/featureX/a.swift`, and `src/feature` overlaps `src/feature/x.swift` or `src` in another block — unless the entry is a regular file in the workspace at `block open` (or `block claim`): then it owns only itself, recorded as `owned_kinds`, and every later check reads that answer; a glob owns what it matches, and a brace entry `src/{a,b}` is a glob, so `src/a` owns nothing below it; no trailing `/`), the block kind (declared, else detected — `decisions.md` §5), the level (a docs/contract block below `levels.coder_floor_docs`, default L1, is raised to it and the CLI prints the floor), the clauses with their test ids and the forecast, writes the ledger `dispatch` row and prints the pointer `BRIEF <path> lines=<n> sha=<sha8> <<<EOM>>>` (≤ 200 B). Call it before every spawn, in every engine. A docs block that owns a glob (`docs/**`) must declare `--kind docs`: a glob is judged by its literal ending, so undeclared it counts as `code`. The brief file carries, in this order:
 
 1. `id`, `title`, the level, `owned_files` ("edit ONLY these"), the acceptance clauses with test ids, `test_command`.
 2. The reply contract: `ACK <sha8> lines=<n>` before any tool call; the facts diff; the forecast.

package/skill/references/review.md

@@ -15,7 +15,7 @@ The topology is decided in one place (`planSessions`). Consensus (§6) runs only
 
 ## §3 Isolation and the packet
 
-Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp dir under the run's temp root and the packet **on stdin** — a no-tools session never opens a path and the packet never enters argv. Packet order is fixed so provider prompt caching applies: lens, project rules digest (≤ 60 lines), facts-sheet excerpt for the symbols in the diff, context, diff. Context: a file at or under `review.context.whole_file_max_lines` travels whole; above it each hunk carries ± `review.context.hunk_context_lines` lines; over `review.budgets.full_in` the context shrinks to ± `review.context.min_context_lines`, then the digest is trimmed, never the diff; a diff alone over budget ⇒ `split_required`, with `tokens_in` and `budget` in the result, its ledger `review.result` row and the `review-file --wait` answer (`stop: split_required`) — except a Markdown file (`.md`, `.markdown`), which is reviewed **section by section**: the diff is cut at its headings (`#`..`######`, not inside fenced code), consecutive sections share a packet while it fits, every section packet runs the file's whole plan with its own stub guard, the file is approved only when every section is, and findings are merged with ids `S<section>.<id>`; a recheck over budget is split the same way, each open finding listed in its own section's packet. A section that alone is over budget keeps the file `split_required` (with that `section`), and so does a deleted Markdown file or one with no heading (fail-safe: one section); nothing is ever truncated. The closed-book rule is in every lens: judge only what is in the packet; a file you cannot see goes in `needs_file`, and the worker attaches it (read-only, trimmed) for **one** more round.
+Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp dir under the run's temp root and the packet **on stdin** — a no-tools session never opens a path and the packet never enters argv. Packet order is fixed so provider prompt caching applies: lens, project rules digest (≤ 60 lines), facts-sheet excerpt for the symbols in the diff, context, diff. Context: a file at or under `review.context.whole_file_max_lines` travels whole; above it each hunk carries ± `review.context.hunk_context_lines` lines; over `review.budgets.full_in` the context shrinks to ± `review.context.min_context_lines`, then the digest is trimmed, never the diff; a diff alone over budget ⇒ `split_required`, with `tokens_in` and `budget` in the result, its ledger `review.result` row and the `review-file --wait` answer (`stop: split_required`) — except a Markdown file (`.md`, `.markdown`), which is reviewed **section by section**: the diff is cut at its headings (`#`..`######`, not inside fenced code), consecutive sections share a packet while it fits, every section packet runs the file's whole plan with its own stub guard, the file is approved only when every section is, and findings are merged with ids `S<section>.<id>`; a recheck over budget is split the same way, each open finding listed in its own section's packet. A section that alone is over budget keeps the file `split_required` (with that `section`), and so does a deleted Markdown file or one with no heading (fail-safe: one section); nothing is ever truncated. Moved code (B56): code moved between two changed files of the same block is named in a `## moved code` section before the diff (`- base lines a-b removed here were added in <file> lines c-d in this block.` / `- lines c-d were moved here from <file> (its base lines a-b) in this block.`), in round 1, rechecks, patch checks and the judge's packet. Detection is deterministic line matching against the block's other changed owned files diffed against the same base: lines trimmed with whitespace collapsed, lines with fewer than 4 letters or digits ignored, a moved stretch needs ≥ 3 such lines or ≥ 120 such characters; at most 12 ranges are listed; a Markdown section packet lists only the moves under its own headings (none ⇒ no section); the peers are listed and read once per review (one `git ls-tree <base>`, one `git diff <base>` over the peers that exist in the base — a peer deleted in the block, staged or not, is all removed lines — one `git check-ignore` and one `git diff --no-index` per new peer; `a/`/`b/` prefixes forced, `core.quotePath=false`; a peer name with a control, bidi or separator character, a quote or a backslash is skipped; a peer whose diff is over 2 MiB is skipped, never buffered past that); a removed block cut right above a heading belongs to the section holding its removed hunk; a move inside one file is not detected. It is extra text counted in the packet budget: every hunk stays, `reviewed_hunks` is unchanged, and a removal listed there is not a defect by itself — only stale references or imports are. The closed-book rule is in every lens: judge only what is in the packet; a file you cannot see goes in `needs_file`, and the worker attaches it (read-only, trimmed) for **one** more round.
 
 ## §4 The stub guard — what counts as a review (R11)
 

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.7.3"
+PINNED_VERSION="0.7.5"
 set -eu
 
 self="$0"

package/src/cli/block.mjs

@@ -218,7 +218,7 @@ export async function runBlock(args, deps = {}) {
           const real = async (/** @type {string} */ p) => realpath(p).catch(() => path.resolve(p));
           const wsPrefix = path.relative(await real(top), await real(record.workspace)).split(path.sep).join('/');
           const owns = ownsAt(wsPrefix);
-          const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+          const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f, entry.owned_kinds);
           const changed = await changedFiles({ repoRoot: top, base: entry.base_sha });
           // the file set is the diff since base ∪ every owned file with review rows of this block —
           // work the diff cannot see (committed before `block open`, done in another worktree) is
@@ -238,7 +238,7 @@ export async function runBlock(args, deps = {}) {
         // B20: the high paths come first — a base the workspace does not know refuses the close here
         const highPaths = await highPathsAt(record.workspace, entry.base_sha);
         const { top, wsPrefix, owns, changed, fileSet, reviewed } = await tree();
-        const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+        const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f, entry.owned_kinds);
         const key = await loadKey(runId);
         // B52: an empty diff with review rows is never silent — name the likely cause
         if (reviewed.length > 0 && !changed.some(isMine)) {

package/src/cli/plan.mjs

@@ -71,7 +71,7 @@ export async function runPlanVerb(args, deps = {}) {
     // package.json fails only the plans that depend on it
     let result;
     try {
-      result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions, projectBins: () => readProjectBins(root) });
+      result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions, root, projectBins: () => readProjectBins(root) });
     } catch (err) {
       if (!(err instanceof FactsError)) throw err;
       writeSafe(stderr, `plan: ${err.message}\n`);

package/src/cli/proof.mjs

@@ -36,7 +36,7 @@ import { acquireProofLock, lockHolder, releaseProofLock } from '../proof/lock.mj
 import { MECHANISMS, readJournal, restoreJournal, runRedGreen } from '../proof/red-green.mjs';
 import { tierFor } from '../proof/tiers.mjs';
 import { blockFileSet, repoRelativePath } from '../review/gate-check.mjs';
-import { findOverlap } from '../state/registry.mjs';
+import { ownsFile } from '../state/registry.mjs';
 
 const USAGE =
   'usage: code-forge proof tier --file <path> --risk <0-3> [--security] [--cwd <dir>]\n' +
@@ -126,6 +126,7 @@ async function exportAndRecord({ runId, record, blockId, block, config, writeRow
     blockId,
     baseSha: block.base_sha,
     owned: block.owned_files,
+    ownedKinds: block.owned_kinds,
     linkDirs: config?.proof?.export?.link_dirs ?? DEFAULT_LINK_DIRS,
     copyUntracked: config?.proof?.export?.copy_untracked ?? DEFAULT_COPY_UNTRACKED,
   });
@@ -243,7 +244,7 @@ export async function runProof(args, deps = {}) {
         repoRoot: record.workspace,
         base: block.base_sha,
         owned: block.owned_files,
-        matchOwned: (f) => findOverlap(block.owned_files, [f]) !== null,
+        matchOwned: (f) => ownsFile(block.owned_files, f, block.owned_kinds),
       });
       const sources = mechanism === 'assertion-deletion' ? [] : changed.map((c) => c.file).filter((f) => f !== file && !TEST_PATH.test(f));
       if (mechanism === 'revert' && sources.length === 0) {

package/src/proof/export.mjs

@@ -28,7 +28,7 @@ import { copyFile, lstat, mkdir, mkdtemp, readlink, realpath, rm, stat, symlink
 import path from 'node:path';
 import { runGates } from '../gates/run.mjs';
 import { StateError } from '../state/paths.mjs';
-import { ownsFile } from '../state/registry.mjs';
+import { isExactEntry, ownsFile } from '../state/registry.mjs';
 import { writeSigned } from '../state/run.mjs';
 import { exec } from '../util/exec.mjs';
 import { revParse } from '../util/git.mjs';
@@ -148,8 +148,16 @@ async function exportIgnoredBlobs(entries, base, cwd) {
 
 /**
  * Build (or rebuild) the export of one block.
+ *
+ * Owned paths follow the registry's one rule (B57): `ownedKinds` is the block's `owned_kinds` from
+ * the run record — every caller passes it; left out it is `{}`, so every exact entry is
+ * directory-like (fail closed: it owns the paths below it). A path's kind may differ between base
+ * and the tree: a base FILE where the tree has a directory leaves the export before the files below
+ * it are copied, and a base DIRECTORY where the tree has a file leaves with every base blob in it;
+ * each base blob that leaves is listed in `removed`. A directory is never removed whole because
+ * it is owned or missing: only the blobs below it, one by one.
  * @param {{
- *   cwd: string, blockId: string, baseSha: string, owned: ReadonlyArray<string>,
+ *   cwd: string, blockId: string, baseSha: string, owned: ReadonlyArray<string>, ownedKinds?: Readonly<Record<string, string>>,
  *   linkDirs?: ReadonlyArray<string>, copyUntracked?: ReadonlyArray<string>, exportRoot?: string,
  * }} opts
  * @returns {Promise<{dir: string, base: string, restored: string[], untracked: string[], owned: string[], removed: string[], linked: string[]}>}
@@ -206,21 +214,54 @@ export async function buildExport(opts) {
 
     // (d) owned files at current content; owned base files deleted in the tree leave the export.
     const listed = (await git(['ls-files', '-z', '--cached', '--others', '--exclude-standard'], cwd)).split('\0').filter(Boolean);
-    const exact = owned.filter((o) => !/[*?{]/.test(o));
-    const candidates = [...new Set([...listed, ...exact, ...baseBlobs])].filter((f) => ownsFile(owned, f)).sort();
+    const exact = owned.filter((o) => isExactEntry(o));
+    const ownedKinds = opts.ownedKinds ?? {};
+    const candidates = [...new Set([...listed, ...exact, ...baseBlobs])].filter((f) => ownsFile(owned, f, ownedKinds)).sort();
+    const candidateSet = new Set(candidates);
     const ownedCopied = [];
-    const removed = [];
+    /** @type {Set<string>} */
+    const removedSet = new Set();
+    /** A base blob that is not in the tree at its path any more leaves the export: listed. */
+    const markRemoved = (/** @type {string} */ rel) => {
+      if (baseBlobs.has(rel)) removedSet.add(rel);
+    };
+    /** B57: an export entry above `rel` that is not a directory (a base file the tree turned into a directory) leaves. */
+    const clearParents = async (/** @type {string} */ rel) => {
+      const segments = rel.split('/');
+      for (let n = 1; n < segments.length; n += 1) {
+        const parent = segments.slice(0, n).join('/');
+        const at = await lstatOrNull(path.join(dir, parent));
+        if (at === null) return;
+        if (!at.isDirectory()) {
+          await rm(path.join(dir, parent), { force: true });
+          markRemoved(parent);
+          return;
+        }
+      }
+    };
     for (const rel of candidates) {
       assertRelPath(rel, 'owned files');
       const src = path.join(cwd, rel);
       const dest = path.join(dir, rel);
       const st = await lstatOrNull(src);
-      await rm(dest, { recursive: true, force: true });
-      if (st === null) {
-        if (baseBlobs.has(rel)) removed.push(rel);
+      const at = await lstatOrNull(dest);
+      // B57: nothing to copy — a path missing from the tree, or a directory (an exact owned entry may
+      // name one; its files are candidates of their own). A stale non-directory export entry there
+      // leaves; an export directory is never removed whole — its owned blobs leave one by one.
+      if (st === null || st.isDirectory()) {
+        if (at !== null && !at.isDirectory()) await rm(dest, { force: true });
+        markRemoved(rel);
         continue;
       }
+      if (at?.isDirectory()) {
+        // a base directory the tree turned into a file: every base blob in it is gone from the tree
+        for (const blob of baseBlobs) if (blob.startsWith(`${rel}/`) && !candidateSet.has(blob)) markRemoved(blob);
+        await rm(dest, { recursive: true, force: true });
+      } else if (at !== null) {
+        await rm(dest, { force: true });
+      }
       if (!st.isFile() && !st.isSymbolicLink()) continue;
+      await clearParents(rel);
       await mkdir(path.dirname(dest), { recursive: true });
       if (st.isSymbolicLink()) await symlink(await readlink(src), dest);
       else await copyFile(src, dest);
@@ -240,7 +281,7 @@ export async function buildExport(opts) {
       linked.push(rel);
     }
 
-    return { dir, base, restored: [...restored].sort(), untracked: untracked.sort(), owned: ownedCopied, removed, linked: linked.sort() };
+    return { dir, base, restored: [...restored].sort(), untracked: untracked.sort(), owned: ownedCopied, removed: [...removedSet].sort(), linked: linked.sort() };
   } finally {
     await rm(scratch, { recursive: true, force: true });
   }

package/src/proof/tiers.mjs

@@ -23,7 +23,8 @@ export const HIGH_RISK = 2;
 /**
  * @param {{file: string, risk: number, securitySensitive?: boolean, highPaths?: ReadonlyArray<string>}} input
  *   `risk` is the S1 `risk` answer (0–3); `highPaths` is `proof.tiers.high.paths` (exact paths or
- *   globs in the registry's syntax: `*`, `?`, `**`, `{a,b}`).
+ *   globs in the registry's syntax: `*`, `?`, `**`, `{a,b}`; an exact path also covers the paths
+ *   below it, B57).
  * @returns {{tier: Tier, reason: TierReason}} the FIRST reason that applies, in the order
  *   security, risk, path — every one of them yields `high`, so the order only picks the label.
  * @throws {TypeError} on a non-string file, a risk outside 0–3, or a non-array `highPaths`.

package/src/review/engine.mjs

@@ -33,7 +33,13 @@
  *     reviewed (the file is then `unavailable`). The file is approved only when EVERY section is;
  *     the findings of all sections are merged with ids `S<section>.<id>`, every session summary
  *     names its `section`, and `sections` lists them. A section that alone is still over the
- *     budget keeps the file `split_required` (plus `section`: its heading) — never truncated.
+ *     budget keeps the file `split_required` (plus `section`: its heading) — never truncated;
+ *  8. code moved between this file and another changed file of the block (`input.peers`, both
+ *     diffed against the block base) is named in a `## moved code` section of every packet —
+ *     reviewers and judge; a Markdown section packet lists only the moves in that section
+ *     (`moved.mjs`, B56). The peers' diffs are read once per review (`input.peerDiffs`, or a
+ *     reader built from `input.peers`). It is extra text: every hunk still goes to the reviewer,
+ *     and it counts toward the budget in the same measure.
  * Approval (until B12b's triage lands) = the final answer (the judge's in dual/consensus mode, else
  * the single reviewer's) passed the guard, says `passed: true`, and carries no `critical` or
  * `warning` finding.
@@ -47,6 +53,7 @@ import { blockKind, isDocsKind } from '../decide/escalation.mjs';
 import { fallbackRisk } from '../decide/fallback-rules.mjs';
 import { tierFor } from '../proof/tiers.mjs';
 import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, diffOnlyTokens, readFileDiff } from './packet.mjs';
+import { movedText, movesFor, peerDiffReader } from './moved.mjs';
 import { isMarkdownFile, packSections, sectionFindings, sectionGroups } from './sections.mjs';
 import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
@@ -160,6 +167,10 @@ export function rulesRisk({ file, plusCount, cfg }) {
  * @property {string} [kind] - the block kind (`code`, `docs`, `contract`; B34); absent ⇒ `blockKind` of the reviewed file.
  * @property {string} [rulesDigest] @property {string} [factsExcerpt]
  * @property {string} workDir - where packet files are written (under the run's temp root).
+ * @property {ReadonlyArray<string>} [peers] - B56: the block's OTHER changed files (repo-relative);
+ *   code moved between this file and one of them is named in every packet (`## moved code`).
+ * @property {() => Promise<import('./moved.mjs').PeerDiff[]>} [peerDiffs] - B56: a memoised reader
+ *   of those files' diffs (`peerDiffReader`), shared by the caller across the round; wins over `peers`.
  */
 
 /**
@@ -212,6 +223,17 @@ export async function reviewFile(input, deps) {
   if (plan.refused) return { status: 'refused', reason: plan.refused, approved: false, ...head, sessions: [] };
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
+  // B56: the file's moves, read once; every packet and every measure of a part uses `movedOf`
+  /** @type {import('./moved.mjs').Moves | null} */
+  let moves = null;
+  try {
+    const peerDiffs = input.peerDiffs ?? peerDiffReader({ repoRoot, base: input.base, file: diff.file, peers: input.peers });
+    moves = await movesFor({ diff, peerDiffs });
+  } catch {
+    moves = null; // no hint; the review goes on
+  }
+  /** @param {ReadonlyArray<number> | null} keys - a Markdown section's group keys; null ⇒ the whole file. */
+  const movedOf = (keys) => movedText(moves, diff.content, keys);
   const min = minTokensOut(cfg);
   // B55: never in consensus mode — its providers (two reviewers, the judge) are the check itself
   const schemaFallback = plan.mode !== 'consensus';
@@ -237,16 +259,17 @@ export async function reviewFile(input, deps) {
 
   const reviewers = plan.sessions.filter((s) => s.role === 'reviewer');
   const judgeSpec = plan.sessions.find((s) => s.role === 'judge');
-  /** @param {import('./packet.mjs').FileDiff} part */
-  const packetsFor = (part) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg }));
+  /** @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<number> | null} [keys] */
+  const packetsFor = (part, keys = null) => reviewers.map((spec) => assemblePacket({ diff: part, lens: spec.lens, rulesDigest: input.rulesDigest, factsExcerpt: input.factsExcerpt, cfg, moved: movedOf(keys) }));
 
   /**
    * The plan on one packet set (the whole file, or one Markdown section): reviewers, then the judge.
    * @param {import('./packet.mjs').FileDiff} part @param {Array<Record<string, any>>} packets
    * @param {Record<string, any>} [rowExtra] - added to the `review.plan` row (`section`).
+   * @param {ReadonlyArray<number> | null} [keys] - the section's group keys (its moved-code hint).
    * @returns {Promise<{status: 'reviewed' | 'unavailable', reason?: string, approved: boolean, summary?: string, findings?: Array<Record<string, any>>, sessions: Array<Record<string, any>>}>}
    */
-  const reviewPart = async (part, packets, rowExtra = {}) => {
+  const reviewPart = async (part, packets, rowExtra = {}, keys = null) => {
     await note(deps, { event: 'review.plan', depth_unconstrained: plan.depth, depth_chosen: plan.depth, degrade_step: 0, risk, context_mode: packets[0]?.contextMode ?? null, forecast_tokens: packets.reduce((n, p) => n + p.tokensIn, 0), ...rowExtra });
     const done = await Promise.all(reviewers.map((spec, i) => run(spec, /** @type {any} */ (packets[i]))));
     const sessions = done.map(publicSummary);
@@ -258,7 +281,7 @@ export async function reviewFile(input, deps) {
     let final = done[0];
     if (judgeSpec) {
       const bySlot = Object.fromEntries(done.map((s) => [s.slot, s.review]));
-      const packet = assembleJudgePacket({ diff: part, reports: { A: bySlot.A, B: bySlot.B }, cfg });
+      const packet = assembleJudgePacket({ diff: part, reports: { A: bySlot.A, B: bySlot.B }, cfg, moved: movedOf(keys) });
       final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg, schemaFallback });
       sessions.push(publicSummary(final));
       if (final.status !== 'ok') {
@@ -281,18 +304,25 @@ export async function reviewFile(input, deps) {
   if (!isMarkdownFile(diff.file)) return { status: 'split_required', approved: false, ...head, tokens_in: split.tokensIn, budget: split.budget, sessions: [] };
 
   // B54: a Markdown file over the budget is reviewed section by section
-  /** @param {import('./packet.mjs').FileDiff} part @returns {number} the diff-only packet tokens, largest over the lenses. */
-  const measure = (part) => Math.max(...reviewers.map((spec) => diffOnlyTokens({ diff: part, lens: spec.lens })));
+  /**
+   * @param {import('./packet.mjs').FileDiff} part @param {ReadonlyArray<{key: number}> | null} [groups] - null ⇒ the whole file.
+   * @returns {number} the diff-only packet tokens, largest over the lenses.
+   */
+  const measure = (part, groups = null) => {
+    const moved = movedOf(groups === null ? null : groups.map((g) => g.key));
+    return Math.max(...reviewers.map((spec) => diffOnlyTokens({ diff: part, lens: spec.lens, moved })));
+  };
   const packed = packSections({ diff, budget: split.budget, measure });
   /**
    * A `split_required` outcome, its size always numeric (measured here when the packet lacks it).
    * @param {import('./packet.mjs').FileDiff} part @param {{tokensIn?: unknown, budget?: unknown}} over @param {string | null} section
+   * @param {ReadonlyArray<{key: number}> | null} [groups] - the part's heading groups (its moved-code hint); null ⇒ the whole file.
    */
-  const splitOutcome = (part, over, section) => ({
+  const splitOutcome = (part, over, section, groups = null) => ({
     status: 'split_required',
     approved: false,
     ...head,
-    tokens_in: Number.isFinite(over.tokensIn) ? over.tokensIn : measure(part),
+    tokens_in: Number.isFinite(over.tokensIn) ? over.tokensIn : measure(part, groups),
     budget: Number.isFinite(over.budget) ? over.budget : split.budget,
     ...(section ? { section } : {}),
     sessions: [],
@@ -300,7 +330,7 @@ export async function reviewFile(input, deps) {
   if (packed.status !== 'ok') {
     // a named section is measured on its own diff, never the whole file's
     const group = packed.section ? sectionGroups(diff)?.find((g) => g.heading === packed.section) : undefined;
-    return splitOutcome(group ? group.diff : diff, packed, packed.section);
+    return splitOutcome(group ? group.diff : diff, packed, packed.section, group ? [group] : null);
   }
   // never approve with no section: no packet ⇒ no session ⇒ split_required at the whole size
   if (packed.sections.length === 0) return splitOutcome(diff, split, null);
@@ -308,10 +338,10 @@ export async function reviewFile(input, deps) {
   // one measure, so with the real packer none is ever not `ok`: this is a DEFENSIVE guard (a test
   // reaches it through a mocked packer) — one that is not `ok` stops the file as split_required,
   // sized on that section's own diff
-  const sectionPackets = packed.sections.map((section) => packetsFor(section.diff));
+  const sectionPackets = packed.sections.map((section) => packetsFor(section.diff, section.keys));
   for (const [i, set] of sectionPackets.entries()) {
     const over = /** @type {{tokensIn?: unknown, budget?: unknown} | undefined} */ (set.find((p) => p.status !== 'ok'));
-    if (over) return splitOutcome(packed.sections[i].diff, over, packed.sections[i].headings[0] ?? '(before first heading)');
+    if (over) return splitOutcome(packed.sections[i].diff, over, packed.sections[i].headings[0] ?? '(before first heading)', packed.sections[i].keys.map((key) => ({ key })));
   }
   const sections = packed.sections.map((s) => ({ index: s.index, headings: s.headings, hunks: s.diff.hunks.length }));
   /** @type {Array<Record<string, any>>} */
@@ -321,7 +351,7 @@ export async function reviewFile(input, deps) {
   const summaries = [];
   let approved = true;
   for (const [i, section] of packed.sections.entries()) {
-    const part = await reviewPart(section.diff, sectionPackets[i], { section: section.index, sections: packed.sections.length });
+    const part = await reviewPart(section.diff, sectionPackets[i], { section: section.index, sections: packed.sections.length }, section.keys);
     sessions.push(...part.sessions.map((s) => ({ ...s, section: section.index })));
     if (part.status !== 'reviewed') return { status: part.status, reason: part.reason, approved: false, ...head, sections, sessions };
     approved = approved && part.approved;