@codedology/code-forge 0.8.0 → 0.10.0

package/src/state/config-snapshot.mjs

@@ -44,6 +44,11 @@ export const IMMUTABLE_KEYS = Object.freeze({
   // B64b: the block-end hook runs a command on the owner's machine at every block end, so only
   // the owner sets it, before the run starts
   'hooks.on_block_end': 'it runs a command on the owner\'s machine at every block end; fixed by the owner before the run starts',
+  // B87: the runner argv proves the coder's own work, so only the owner sets it, before the run starts
+  'proof.runners': 'the commands that prove a block are fixed by the owner before the run starts',
+  // B93: the coder sandbox profile widens what the coder may write, so only the owner sets it,
+  // before the run starts (a coder can never own `.code-forge.yml`)
+  'coder.sandbox': 'the coder sandbox widens what the coder may write; fixed by the owner before the run starts',
 });
 
 /** @param {unknown} v @returns {boolean} what `JSON.stringify` drops from an object. */
@@ -235,3 +240,37 @@ export function blockEndHook(record) {
   if (!Number.isInteger(timeoutS) || timeoutS < HOOK_TIMEOUT_MIN_S || timeoutS > HOOK_TIMEOUT_MAX_S) return null;
   return { argv: [...argv], timeoutS };
 }
+
+/**
+ * B87: `proof.runners` of the run-start config snapshot (never the live config), as a deep copy
+ * (entries and argv arrays), or null when the key is absent or the record is from before
+ * snapshots. `proof/runners.mjs` checks each entry again before it runs one (fail closed).
+ * @param {Record<string, any>} record
+ * @returns {unknown[] | null}
+ * @throws {StateError} `config-snapshot` when the snapshot in force does not match its hash;
+ *   `runner-invalid` when the stored value is not a list, or is an empty one.
+ */
+export function proofRunners(record) {
+  const runners = configInForce(record)?.proof?.runners;
+  if (runners === undefined || runners === null) return null;
+  if (!Array.isArray(runners)) throw new StateError('runner-invalid', `run ${record.run_id}: proof.runners in the run snapshot is not a list`);
+  // `validate` refuses an empty list (minItems 1); a record that holds one anyway is refused too
+  if (runners.length === 0) throw new StateError('runner-invalid', `run ${record.run_id}: proof.runners in the run snapshot is an empty list`);
+  // a deep copy: a caller that changes an entry or an argv array never changes the snapshot
+  return structuredClone(runners);
+}
+
+/**
+ * B93: `coder.sandbox` of the run-start config snapshot (never the live config). A record from
+ * before snapshots has no run-start value: `{snapshot: false}`. Otherwise `{snapshot: true,
+ * sandbox}`, where `sandbox` is a deep copy of the value, or null when the snapshot has no key.
+ * @param {Record<string, any>} record
+ * @returns {{snapshot: false} | {snapshot: true, sandbox: Record<string, any> | null}}
+ * @throws {StateError} `config-snapshot` when the snapshot in force does not match its hash.
+ */
+export function coderSandbox(record) {
+  const config = configInForce(record);
+  if (config === null) return { snapshot: false };
+  const sandbox = config.coder?.sandbox;
+  return { snapshot: true, sandbox: sandbox === undefined || sandbox === null ? null : structuredClone(sandbox) };
+}

package/src/state/run.mjs

@@ -269,6 +269,10 @@ export async function reloadRun({ runId, config, readPending = () => [], effecti
       if (config.context?.require_coder_tests === true) frozen.push('context.require_coder_tests');
       // B64b: and never had a block-end hook
       if (config.hooks?.on_block_end !== undefined) frozen.push('hooks.on_block_end');
+      // B87: and never had a proof runner
+      if (config.proof?.runners !== undefined) frozen.push('proof.runners');
+      // B93: and never had a coder sandbox profile
+      if (config.coder?.sandbox !== undefined) frozen.push('coder.sandbox');
     }
     if (frozen.length > 0) {
       const why = frozen.map((key) => `${key} cannot change mid-run (${IMMUTABLE_KEYS[/** @type {keyof typeof IMMUTABLE_KEYS} */ (key)]})`);

package/src/util/forbidden.mjs

@@ -276,6 +276,7 @@ export const FORBIDDEN = Object.freeze(
  * They are NOT part of `FORBIDDEN` (whose rendered count other blocks pin); `mergeForbidden()`
  * always appends them, so every list built for a coder carries them.
  *  - `code-forge block waive` — waiving a review finding is human-only;
+ *  - `code-forge block reopen` (B72) — restarting a stopped or lost file's review is human-only;
  *  - `code-forge autopilot` (any subcommand, B45) — the owner's grant to a delegate;
  *  - `--no-require-reviews` — the human's way out of `block close`'s per-file review check;
  *  - `--remove-worktree` (B62a) — `block close` removing the block's worktree, the orchestrator's
@@ -291,7 +292,16 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
         ['code-forge', 'block', 'waive'],
         ['forge', 'block', 'waive'],
       ],
-      description: 'Waive a review finding (forge block waive) — human-only, run by the orchestrator after the human said so (§4.9)',
+      description: 'Waive a review finding (forge block waive) — human-only, typed by the human in their own terminal (§4.9, B80)',
+    },
+    {
+      id: 'code-forge-block-reopen-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [
+        ['code-forge', 'block', 'reopen'],
+        ['forge', 'block', 'reopen'],
+      ],
+      description: 'Reopen the review of a stopped or lost file (forge block reopen) — human-only, typed by the human in their own terminal (B72, B80)',
     },
     {
       id: 'code-forge-autopilot-from-coder',

package/src/util/tmp.mjs

@@ -130,18 +130,30 @@ export function tmpBase(root) {
 }
 
 /**
- * Create (if needed) the run root `<base>/<runId>/`, record this process as its owner, and
- * return its real absolute path.
+ * The run root's path `<base>/<runId>`, without creating anything (B69: doctor looks for old
+ * review-state files there). The same run id check as {@link runRoot}.
  * @param {string} runId
  * @param {{root?: string}} [opts]
  * @returns {string}
+ * @throws {TypeError} a bad run id, or a `root` that is not absolute.
  */
-export function runRoot(runId, opts = {}) {
+export function runRootPath(runId, opts = {}) {
   if (typeof runId !== 'string' || !RUN_ID.test(runId)) {
     throw new TypeError('tmp: runId must be one path segment of letters, digits, ".", "_" or "-"');
   }
+  return path.join(tmpBase(opts.root), runId);
+}
+
+/**
+ * Create (if needed) the run root `<base>/<runId>/`, record this process as its owner, and
+ * return its real absolute path.
+ * @param {string} runId
+ * @param {{root?: string}} [opts]
+ * @returns {string}
+ */
+export function runRoot(runId, opts = {}) {
+  const dir = runRootPath(runId, opts);
   const base = tmpBase(opts.root);
-  const dir = path.join(base, runId);
   // A parallel sweep that claimed a dead root of this name renames it away (see the claim rule)
   // between our mkdir and our write: the directory is then "missing" or the write fails with
   // ENOENT, and the retry creates a fresh directory in its place. A tombstone itself can never be

package/src/worker/engine.mjs

@@ -17,6 +17,13 @@
  *  - `stopped` (`review_cap`, `l3_patch_exhausted`, `split_required`) ⇒ no session: the result
  *    repeats the stop — only the human moves on (§4.11 rule 5). A `split_required` result (round 1
  *    or a recheck stop) carries `tokens_in` and `budget` (B54).
+ * A state that does not load is refused with no session: `review-state-tampered` (a wrong file or
+ * anchor) or `review-state-lost` (the file is gone and its anchor has no `state_body`). A file
+ * that is gone but whose anchor carries the signed body is `restored` (B68): saved as a new seq,
+ * one signed `review.state_restored {block, file, seq, from_seq}` row, then the round runs as if
+ * it had loaded. B69: the state file lives under the code-forge home (`runs/<run>/review-state/`),
+ * not the temp root; a valid file still at the old temp path is moved there on its first load
+ * (status `ok`, no restored row).
  * The round's outcome: `approved: true` ONLY when the loop is `complete` AND its signed
  * `review.approved` row (keyed `run, block, file, content_hash` = the ticket's hash) was written;
  * else `findings` = the open fix list, `next` = what the orchestrator does (`fix` at `level`,
@@ -65,6 +72,20 @@
  * ticket is done); `review-file` on the same content is a fresh attempt every time (`retry: true`).
  * The tree is passed as `contentRoot`: `repoRoot` stays the main tree, and the fix-loop state
  * stays under the run root.
+ * B72: a verified `review.reopened {by: human}` row of this run for the file whose `at_seq` is the
+ * file's latest anchor seq (`reopenRowFor`, `review/reopen.mjs`) restarts a `stopped` file whose
+ * content changed since the stop, or a `lost` one: a new state (round 1, a FULL review with no
+ * `reviewed_content`, the level from the run record), saved at `at_seq + 1`, so the row works
+ * once; no `review.state_restored` row then. The block's L3 rung stays spent (it is read from the
+ * anchors). A row that does not verify, of another run, not `by: human`, at another seq, or a
+ * stopped file on the stop's own content changes nothing: the stop (or the lost refusal) repeats.
+ * Every stop records the ticket's content hash as the state's `stop_content_hash` (signed with
+ * the state), the content `block reopen` and this check compare against.
+ * B71: a ticket with `kind: 'answers'` (`review-file --answers`) runs no fix-loop round: after the
+ * same run-record, tree and mismatch checks it goes to `reviewAnswers` (`review/answers.mjs`) —
+ * one fresh L2 session that judges whether the answering file resolves the named open findings of
+ * the source, with signed `review.answered` rows for the resolved ones; the source's fix-loop
+ * state is neither read for a round nor saved.
  */
 
 import { realpathSync, rmSync } from 'node:fs';
@@ -75,9 +96,11 @@ import { planAndRecord, tierOf } from '../review/budget.mjs';
 import { budgetFor } from '../review/packet.mjs';
 import { ContextError, reviewDigest } from '../context/pack.mjs';
 import { reviewFile, rulesRisk } from '../review/engine.mjs';
+import { reviewAnswers } from '../review/answers.mjs';
 import { peerDiffReader } from '../review/moved.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
 import { extraRoundsFor, newFileState, reopenForExtraRound, runRound } from '../review/fixloop.mjs';
+import { reopenRowFor } from '../review/reopen.mjs';
 import { readRun } from '../state/run.mjs';
 import { StateError } from '../state/paths.mjs';
 import { blockTree, worktreeRecord } from '../proof/worktree.mjs';
@@ -85,8 +108,9 @@ import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
 import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
 import { keyedLock } from '../util/locks.mjs';
-import { blockAnchors, blockRungUsed, loadState, saveState } from './review-state.mjs';
-import { assertTicketId, WorkerError } from './ticket.mjs';
+import { blockAnchors, blockRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
+import { assertAnswers } from './queue.mjs';
+import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } from './ticket.mjs';
 
 /**
  * @typedef {object} ReviewContext
@@ -94,7 +118,8 @@ import { assertTicketId, WorkerError } from './ticket.mjs';
  * @property {string} [contentRoot] - B62b: the tree the ticket's content is read in (the block's
  *   worktree); `repoRoot` when absent.
  * @property {string} runId
- * @property {string} runRootDir - the run's temp root (packets and session dirs live under it).
+ * @property {string} runRootDir - the run's temp root (packets and session dirs live under it; the
+ *   review state no longer does — B69 — it is only read there once, to move an old file).
  * @property {Record<string, any>} cfg - the project config.
  * @property {string | null} jevKey - resolved once by the worker through B2's chain; never print.
  * @property {(opts: Record<string, any>) => Promise<Record<string, any>>} spawn - one isolated
@@ -116,6 +141,7 @@ import { assertTicketId, WorkerError } from './ticket.mjs';
  * @property {string} engine - `adaptive` or `consensus`.
  * @property {Array<Record<string, any>>} sessions - one summary per session run.
  * @property {string} [reason] - why it is not `reviewed` (stub-guard reason, `needs_file-refused`, …).
+ * @property {string} [message] - a refusal's human-readable explanation (`review-state-lost`).
  * @property {Array<Record<string, any>>} [findings] - the open fix list (`reviewed` / `stopped`).
  * @property {number} [round] - the fix-loop round this ticket ran (patch_check rounds not counted).
  * @property {string} [kind] - `full`, `recheck` or `patch_check`.
@@ -338,6 +364,14 @@ export async function reviewTicket(ticket, ctx) {
   }
   /** @type {ReviewContext} */
   const tctx = { ...ctx, contentRoot };
+  if (ticket.kind === 'answers') {
+    // B71: an answers ticket is no review round: one answers session, the fix-loop state untouched
+    try {
+      return await reviewAnswers(ticket, tctx, { entry, workDir, io: { readFile: readRegularFileNoFollow, loadState, assertAnswers } });
+    } finally {
+      rmSync(workDir, { recursive: true, force: true });
+    }
+  }
   const factsExcerpt = factsFor(entry, ctx.cfg);
   const peerDiffs = blockPeerDiffs(contentRoot, { base: entry.base, owned: entry.owned, ownedKinds: entry.ownedKinds, file: ticket.file });
   try {
@@ -413,6 +447,9 @@ export function blockPeerDiffs(repoRoot, { base, owned, ownedKinds, file }) {
  */
 export const blockLockKey = (runId, block) => `block:${runId}\0${block}`;
 
+/** B68: the `review-state-lost` refusal's message (the file is gone and the ledger has no body). */
+export const LOST_MESSAGE = 'the review state file is gone and the ledger cannot rebuild it (its anchor carries no state_body); the file is not reviewed again from round 1 — the owner can run `code-forge block reopen`';
+
 /**
  * Whether the block's one L3 rung is taken: a verified anchor says so (`blockRungUsed`), OR another
  * file of the block has a saved state whose round decided `next: patch` — that round took the rung,
@@ -429,11 +466,12 @@ export function rungTaken(where) {
   for (const file of siblings) {
     let other;
     try {
-      other = loadState({ ...where, file });
+      other = loadState({ ...where, file, migrate: false }); // B69: a sibling's old file is read, never moved here
     } catch {
       return { status: 'ok', used: true };
     }
-    if (other.status !== 'ok' || other.state?.next?.action === 'patch') return { status: 'ok', used: true };
+    // a sibling that would be restored (B68) counts by its rebuilt state; lost or tampered fails closed
+    if ((other.status !== 'ok' && other.status !== 'restored') || other.state?.next?.action === 'patch') return { status: 'ok', used: true };
   }
   return rung;
 }
@@ -488,11 +526,34 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       await recordBlockBudget(ticket, ctx, { base, owned, ownedKinds });
     }
     const where = { runRootDir: ctx.runRootDir, runId: ctx.runId, block: ticket.block, file: ticket.file, key, rows };
-    const loaded = loadState(where);
+    const loaded = loadState({ ...where, contentRoot: ctx.contentRoot ?? ctx.repoRoot });
     const rung = rungTaken(where);
     if (loaded.status === 'tampered' || rung.status === 'tampered') return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-tampered', approved: false, engine: 'adaptive', sessions: [] }) };
+    // B72: the human's `block reopen` row for this file's latest anchor seq restarts a stopped
+    // (on changed content) or lost file: a new state, saved at that seq + 1 — the row works once
+    // (`rows`: this run's rows read above under the block lock; `key`: the run key from opts)
+    const reopenAt = {
+      runId: ctx.runId,
+      block: ticket.block,
+      file: ticket.file,
+      key,
+      status: loaded.status,
+      state: loaded.state,
+      seq: loaded.seq,
+      contentHash: ticket.content_hash,
+    };
+    const reopened = reopenRowFor(rows, reopenAt) !== null;
+    if (loaded.status === 'lost' && !reopened) return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-lost', message: LOST_MESSAGE, approved: false, engine: 'adaptive', sessions: [] }) };
+    let seq = loaded.seq;
+    if (loaded.status === 'restored' && loaded.state !== null && !reopened) {
+      // B68: the lost file is rebuilt from the anchor's signed body; saved as a new seq, then recorded
+      const writeRow = /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow);
+      await saveState({ ...where, state: loaded.state, seq, writeRow, contentRoot: ctx.contentRoot ?? ctx.repoRoot });
+      seq += 1;
+      await writeRow({ event: RESTORED_EVENT, block: ticket.block, file: ticket.file, seq, from_seq: loaded.seq });
+    }
     const rungUsed = rung.used;
-    let state = loaded.state;
+    let state = reopened ? null : loaded.state;
     if (state === null || state.status === 'complete') state = newFileState({ file: ticket.file, level, l3RungUsed: rungUsed });
     state.l3_rung_used = state.l3_rung_used || rungUsed;
     // B47: an autopilot extra round raises the file's cap; a file stopped at the old cap reopens
@@ -511,7 +572,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       state.l3_rung_used = true; // the orchestrator ran the block's one L3 patch before this ticket
     }
     const fixed = state;
-    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq: loaded.seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs });
+    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs });
     // a round that could take the rung keeps the block lock until its state is saved
     if (mayTakeRung(fixed, kind, ctx.cfg, rungUsed)) return { outcome: await round() };
     return { round };
@@ -606,7 +667,12 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
       state.pending_kind = kind;
     }
   }
-  await saveState({ ...where, state, seq, writeRow: /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow) });
+  // B72: a stop (any reason) records the content it reviewed — the ticket's — in the signed state,
+  // so `block reopen` and the worker know which content this stop saw (`stopContentHash`)
+  const stamped = /** @type {Record<string, any>} */ (state);
+  if (state.status === 'stopped') stamped.stop_content_hash = ticket.content_hash;
+  else delete stamped.stop_content_hash;
+  await saveState({ ...where, state, seq, writeRow: /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow), contentRoot: ctx.contentRoot ?? ctx.repoRoot });
 
   const eng = /** @type {Record<string, any> | null} */ (engineOutcome);
   const head = { ...loopFields(state, kind), engine: eng?.engine ?? 'adaptive', sessions: eng?.sessions ?? rechecks };

package/src/worker/loop.mjs

@@ -39,7 +39,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { expiryChecks } from '../autopilot/limits.mjs';
 import { loadProjectConfig } from '../config/load.mjs';
-import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
+import { cacheHoursFrom, createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
@@ -47,12 +47,13 @@ import { readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
 import { logWarning } from '../util/error-log.mjs';
 import { keyedLock } from '../util/locks.mjs';
-import { writeSafe } from '../util/redact.mjs';
+import { redact, writeSafe } from '../util/redact.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
 import { openFindings } from '../review/gate-check.mjs';
+import { countLines, RouteError, routeTicket } from '../review/route.mjs';
 import { canonicalPath, contentRootFor, reviewTicket } from './engine.mjs';
 import { announceWorker, beatWorker, HEARTBEAT_MS, liveWorker, pendingTickets, readTicket, retractWorker, writeResult } from './queue.mjs';
-import { contentHash, DELETED_HASH, repoRootOf, WorkerError } from './ticket.mjs';
+import { DELETED_HASH, hashBytes, readRegularFileNoFollow, repoRootOf, WorkerError } from './ticket.mjs';
 
 /** Name of the key the worker resolves for System 1 (`keys.jev` / `system1.key` reference). */
 export const JEV_KEY_NAME = 'jev';
@@ -136,16 +137,37 @@ export function sessionEnv(env, secrets) {
 /**
  * Resolve the Jev key through B2's chain (env → store → 1Password). A missing key is not an error:
  * System 1 then falls back (`system1.fallback`, B3). The value is registered for redaction by B2.
+ * A refresh from 1Password is cached for the config's `keys.cache_hours` (B84: the run's snapshot;
+ * a snapshot from before the key has none ⇒ 8 h).
  * @param {Record<string, any>} cfg
- * @param {{store: import('../keys/store.mjs').KeyStore, env: NodeJS.ProcessEnv, opRead?: any}} deps
+ * @param {{store: import('../keys/store.mjs').KeyStore, env: NodeJS.ProcessEnv, opRead?: any, now?: number}} deps
  * @returns {Promise<string | null>}
  */
-export async function resolveJevKey(cfg, { store, env, opRead }) {
+export async function resolveJevKey(cfg, { store, env, opRead, now }) {
   const ref = cfg?.system1?.key ?? cfg?.keys?.[JEV_KEY_NAME];
-  const res = await resolveKey(JEV_KEY_NAME, { store, env, ref: typeof ref === 'string' ? ref : undefined, ...(opRead ? { opRead } : {}) });
+  const res = await resolveKey(JEV_KEY_NAME, {
+    store,
+    env,
+    ref: typeof ref === 'string' ? ref : undefined,
+    cacheHours: cacheHoursFrom(cfg).hours,
+    ...(opRead ? { opRead } : {}),
+    ...(now !== undefined ? { now } : {}),
+  });
   return res.value;
 }
 
+/**
+ * B90: an unexpected failure inside a named worker step (today: `routing`). The ticket still ends
+ * `worker-error`; its result's `detail` says `<step>: <original error text>` (redacted).
+ */
+class StepError extends Error {
+  /** @param {string} step @param {unknown} cause */
+  constructor(step, cause) {
+    super(`${step}: ${cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause)}`, { cause });
+    this.step = step;
+  }
+}
+
 /** The fix-loop fields of an engine outcome the result carries (B12c, §4.11). */
 const LOOP_FIELDS = Object.freeze(['round', 'kind', 'level', 'next', 'trigger', 'stopped', 'late']);
 
@@ -282,14 +304,51 @@ export async function createWorker(opts, deps = {}) {
   }
 
   /**
-   * One ticket through the engine hook with `tcfg` (the ticket's config snapshot): the unsigned result.
+   * One ticket through the engine hook with the ticket's config snapshot, routed by size (B90): the unsigned result.
+   * @param {string} id - the ticket id (B90: a retried ticket never writes its route rows twice).
    * @param {import('./queue.mjs').Ticket} ticket @param {Record<string, any>} base
-   * @param {Record<string, any>} tcfg
+   * @param {Record<string, any>} snapshotCfg - the ticket's config snapshot, before B90 routing.
    * @param {string} contentRoot - B62b: the tree the content was hashed in, and is reviewed in.
+   * @param {{lines: number, deleted: boolean}} size - B90: the line count of the hashed bytes.
    * @returns {Promise<Record<string, any>>}
    */
-  async function reviewWith(ticket, base, tcfg, contentRoot) {
-    const timeoutS = Number.isInteger(tcfg?.review?.session_timeout_s) && tcfg.review.session_timeout_s > 0 ? tcfg.review.session_timeout_s : DEFAULT_SESSION_TIMEOUT_S;
+  async function reviewWith(id, ticket, base, snapshotCfg, contentRoot, size) {
+    const baseTimeoutS = Number.isInteger(snapshotCfg?.review?.session_timeout_s) && snapshotCfg.review.session_timeout_s > 0 ? snapshotCfg.review.session_timeout_s : DEFAULT_SESSION_TIMEOUT_S;
+    // B90: `review.routes` picks the model, second level and timeout of every session of this
+    // ticket from its size, once, before the first session. No route ⇒ the snapshot object itself.
+    // A route list that cannot be used is `unavailable` — never a review on a model it did not name.
+    let routed;
+    try {
+      routed = routeTicket(snapshotCfg, { lines: size.lines, deleted: size.deleted, timeoutS: baseTimeoutS });
+    } catch (err) {
+      // only a route list that cannot be used is `route-invalid`; anything else is a real failure
+      // and goes to runOne (`worker-error`), named as a routing-step failure with its own text
+      if (!(err instanceof RouteError)) throw new StepError('routing', err);
+      return { ...base, status: 'unavailable', reason: 'route-invalid', approved: false };
+    }
+    const tcfg = routed.cfg;
+    const timeoutS = routed.timeoutS;
+    // the signed `review.route` row comes before the first session; a row that cannot be written
+    // is `unavailable` (a routed review the ledger cannot explain never runs). One row per routed
+    // level per ticket: a retried ticket (same id) skips the levels whose row the ledger already has.
+    // `runId` is the run this ticket belongs to (reviewOne refuses `ticket.run !== runId` as
+    // other-run), and a restarted worker serves the same run id (startWorker: `opts.runId`), so the
+    // check holds across workers of that run.
+    if (routed.rows.length > 0) {
+      try {
+        const have = new Set(
+          (await readRows())
+            .filter((r) => r?.event === 'review.route' && r.run === runId && r.ticket === id)
+            .map((r) => r.level),
+        );
+        for (const row of routed.rows) {
+          if (have.has(row.level)) continue;
+          await ledger({ ...row, ticket: id, block: ticket.block, file: ticket.file, content_hash: ticket.content_hash });
+        }
+      } catch {
+        return { ...base, status: 'unavailable', reason: 'route-row', approved: false };
+      }
+    }
     /** @type {import('./engine.mjs').ReviewContext} */
     const ctx = {
       repoRoot,
@@ -318,6 +377,7 @@ export async function createWorker(opts, deps = {}) {
         approved: outcome.approved === true,
         engine: outcome.engine,
         ...(typeof outcome.reason === 'string' ? { reason: outcome.reason } : {}),
+        ...(typeof outcome.message === 'string' ? { message: outcome.message } : {}),
         ...(Array.isArray(outcome.findings) ? { findings: outcome.findings } : {}),
         ...packetSize(outcome),
         ...loopResult(outcome),
@@ -381,22 +441,27 @@ export async function createWorker(opts, deps = {}) {
     if (canonicalPath(hashedIn) !== canonicalPath(contentRoot)) return { ...base, status: 'unavailable', reason: 'worktree-mismatch', approved: false };
     /** @type {string} */
     let current;
+    /** @type {Buffer | null} */
+    let bytes;
     try {
-      current = contentHash(contentRoot, ticket.file);
+      // B90: one read — the bytes hashed are the bytes whose lines route the review
+      bytes = readRegularFileNoFollow(contentRoot, ticket.file);
+      current = hashBytes(bytes);
     } catch (err) {
       // the path no longer passes the on-disk check, or the file cannot be read
       const reason = err instanceof WorkerError ? err.code : 'unreadable';
       return { ...base, status: 'refused', reason, approved: false };
     }
     if (current === DELETED_HASH && ticket.content_hash !== DELETED_HASH) return { ...base, status: 'stale', reason: 'missing-file', approved: false };
-    if (current !== ticket.content_hash) return { ...base, status: 'stale', approved: false };
+    // B71: an answers ticket names why (its source moved); a review ticket keeps no reason
+    if (current !== ticket.content_hash) return { ...base, status: 'stale', ...(ticket.kind === 'answers' ? { reason: 'source-changed' } : {}), approved: false };
     let ticketCfg;
     try {
       ticketCfg = await configFor(id);
     } catch {
       return { ...base, status: 'unavailable', reason: 'config-snapshot', approved: false };
     }
-    return reviewWith(ticket, base, ticketCfg, contentRoot);
+    return reviewWith(id, ticket, base, ticketCfg, contentRoot, { lines: countLines(bytes), deleted: bytes === null });
   }
 
   /**
@@ -443,9 +508,11 @@ export async function createWorker(opts, deps = {}) {
   async function runOne(id) {
     try {
       return (await processTicket(id)) !== null ? 1 : 0;
-    } catch {
+    } catch (err) {
+      // B90: a failure a step names (StepError) keeps its step and original text, redacted
+      const detail = err instanceof StepError ? { detail: redact(err.message) } : {};
       try {
-        await complete(id, { event: 'review.result', status: 'unavailable', reason: 'worker-error', approved: false });
+        await complete(id, { event: 'review.result', status: 'unavailable', reason: 'worker-error', ...detail, approved: false });
         return 1;
       } catch {
         poisoned.add(id);