@codedology/code-forge 0.8.0 → 0.9.0

package/src/review/reopen.mjs

@@ -0,0 +1,258 @@
+/**
+ * B72 (issues #12, #15): `block reopen <id> --file <path> --run <r> --reason <text>` — the human
+ * restarts the review of a file the fix loop STOPPED (any reason: `review_cap`,
+ * `l3_patch_exhausted`, `split_required`, …) or whose state is LOST (B68). Only a stopped file
+ * needs content that differs from what its stop reviewed; a lost file restarts on its current
+ * content.
+ *
+ * Human-only like `block waive`: the verb is on `CODER_ONLY_FORBIDDEN` (`src/util/forbidden.mjs`)
+ * and its row is signed with the run key, `by: human` (`block waive` has no other in-verb guard,
+ * so neither has this). The verb (`reopenFile`) refuses, writing no row, with a stable code:
+ *  - `usage` (exit 2) — no `--file`, no `--reason`, or a path that is not a normalised
+ *    repo-root-relative path;
+ *  - `unknown_block` — the run does not know the block (the code `block waive` uses);
+ *  - `reopen-block-not-open` — the block is not open (stopped or closed);
+ *  - `reopen-not-owned` — the block does not own the file;
+ *  - `reopen-tampered` — the file's state does not verify (an integrity failure stays a security
+ *    event; the owner's exit is `block close --no-require-reviews`);
+ *  - `reopen-not-stopped` — no state, or a state that is open or complete;
+ *  - `reopen-same-content` — a stopped file whose current content is the content its stop
+ *    reviewed (no free re-roll: the human waives the findings instead), or a stop whose content
+ *    is unknown;
+ *  - `reopen-already-recorded` — a verified human row already names the file's latest anchor seq
+ *    for other content (run `review-file`, or the content changed since that reopen);
+ *  - `reopen-write-failed` — the signed row was not written.
+ * Accepted, it first drops the done marker of the current content's ticket (C11, `io.clearDone`),
+ * then writes ONE signed `review.reopened {block, file, from: stopped|lost, stop_reason, at_seq,
+ * from_hash, to_hash, reason, by: human}` row (`at_seq` = the file's latest anchor seq). There is
+ * at most one verified human row per `at_seq`: a retry on the same content finds it and writes
+ * none.
+ *
+ * The content a stop reviewed (`stopContentHash`) is the stopped state's `stop_content_hash`,
+ * which the worker sets on every stop (`src/worker/engine.mjs`) and which is signed through the
+ * anchor. A state from before B72 has none: then the latest verified `review.cap` row of THIS
+ * stop counts — written after the file's latest verified `review.reopened` row, with the state's
+ * round and stop reason — else the content is unknown and the reopen is refused.
+ *
+ * The worker (`fixLoopRound`) asks `reopenRowFor`: a verified human row of this run for the block
+ * and file whose `at_seq` is the file's latest anchor seq starts a new state (round 1, a FULL
+ * review, `reviewed_content` null, the level from the run record, `l3_rung_used` kept). The new
+ * state saves at `at_seq + 1`, so a row works once. For `stopped` the content must still differ
+ * from the stop's content; else the stop repeats.
+ *
+ * This file imports nothing from `src/worker/`: the fix-loop state is read through `io`.
+ */
+import path from 'node:path';
+import { StateError } from '../state/paths.mjs';
+import { verifyRow } from '../state/signer.mjs';
+
+export const REOPENED_EVENT = 'review.reopened';
+
+/** A code a refusal may name: an errno (`EACCES`), a StateError code (`ledger-locked`), a name. */
+const CAUSE_CODE = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
+
+/**
+ * B79: the code a failed write names — the error's `code`, else its `name`, when it has the form
+ * {@link CAUSE_CODE}, else `unknown` (a thrown `undefined` or `null` too). Called only for a
+ * write that threw; one that wrote nothing is named `no-write` by its caller. Never the message:
+ * it may hold a path or a value.
+ * @param {unknown} err @returns {string}
+ */
+function causeCode(err) {
+  if (err === null || err === undefined) return 'unknown';
+  const e = /** @type {{code?: unknown, name?: unknown}} */ (err);
+  if (typeof e.code === 'string' && CAUSE_CODE.test(e.code)) return e.code;
+  if (typeof e.name === 'string' && CAUSE_CODE.test(e.name)) return e.name;
+  return 'unknown';
+}
+
+/**
+ * Whether a row's MAC verifies with the run key (a throw is a no).
+ * @param {Record<string, any>} row @param {Buffer} key
+ */
+function verified(row, key) {
+  try {
+    return verifyRow(row, key).ok === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The content hash the stop of a stopped state reviewed, or null when it is unknown: the state's
+ * `stop_content_hash`; for a state from before B72, the latest verified `review.cap` row of this
+ * run for the block and file that belongs to this stop (after the file's latest verified
+ * `review.reopened` row, with the state's round and stop reason).
+ * @param {Record<string, any> | null} state
+ * @param {ReadonlyArray<Record<string, any>>} rows
+ * @param {{runId: string, block: string, file: string, key: Buffer}} at
+ * @returns {string | null}
+ */
+export function stopContentHash(state, rows, { runId, block, file, key }) {
+  if (state?.status !== 'stopped') return null;
+  if (typeof state.stop_content_hash === 'string' && state.stop_content_hash.length > 0) return state.stop_content_hash;
+  const mine = (/** @type {Record<string, any>} */ r) => r?.run === runId && r.block === block && r.file === file && verified(r, key);
+  for (let i = rows.length - 1; i >= 0; i -= 1) {
+    const r = rows[i];
+    if (r?.event === REOPENED_EVENT && mine(r)) return null;
+    if (r?.event !== 'review.cap' || !mine(r)) continue;
+    if (typeof r.content_hash !== 'string' || r.round !== state.round || r.reason !== state.next?.reason) return null;
+    return r.content_hash;
+  }
+  return null;
+}
+
+/**
+ * The block checks every reopen runs first, before any config, key or ledger read: the run must
+ * know the block (`unknown_block`, the code `block waive` uses) and the block must be open.
+ * @param {Record<string, any>} record @param {string} runId @param {string} id
+ * @returns {Record<string, any>} the block's entry.
+ * @throws {StateError} `unknown_block` or `reopen-block-not-open`.
+ */
+export function openBlockEntry(record, runId, id) {
+  const entry = record.blocks?.[id];
+  if (!entry) throw new StateError('unknown_block', `block ${id} is not in run ${runId}`);
+  if (entry.status !== 'open') throw new StateError('reopen-block-not-open', `reopen-block-not-open: block ${id} is not open in run ${runId}; nothing was recorded`);
+  return entry;
+}
+
+/**
+ * The latest verified human `review.reopened` row of this run for the block and file whose
+ * `at_seq` is `seq`, or null.
+ * @param {ReadonlyArray<Record<string, any>>} rows
+ * @param {{runId: string, block: string, file: string, key: Buffer, seq: number}} at
+ * @returns {Record<string, any> | null}
+ */
+function latestRowAt(rows, { runId, block, file, key, seq }) {
+  for (let i = rows.length - 1; i >= 0; i -= 1) {
+    const r = rows[i];
+    if (r?.event !== REOPENED_EVENT || r.run !== runId || r.block !== block || r.file !== file) continue;
+    if (r.by !== 'human' || r.at_seq !== seq || !verified(r, key)) continue;
+    return r;
+  }
+  return null;
+}
+
+/**
+ * Worker side: the `review.reopened` row that restarts this file now, or null. Only a row whose MAC
+ * verifies with the run key, of this run, block and file, `by: human`, and whose `at_seq` is the
+ * file's latest anchor seq counts (the latest such row). A `lost` state needs `from: lost`; a
+ * stopped state needs `from: stopped` AND current content that is neither the row's `from_hash`
+ * nor the content the stop reviewed (`stopContentHash`; unknown ⇒ no restart).
+ * @param {ReadonlyArray<Record<string, any>>} rows
+ * @param {{runId: string, block: string, file: string, key: Buffer, status: string, state: Record<string, any> | null, seq: number, contentHash: string}} at
+ * @returns {Record<string, any> | null}
+ */
+export function reopenRowFor(rows, { runId, block, file, key, status, state, seq, contentHash }) {
+  const row = latestRowAt(rows, { runId, block, file, key, seq });
+  if (row === null) return null;
+  if (status === 'lost') return row.from === 'lost' ? row : null;
+  if ((status === 'ok' || status === 'restored') && state?.status === 'stopped' && row.from === 'stopped') {
+    const stopHash = stopContentHash(state, rows, { runId, block, file, key });
+    if (stopHash === null || contentHash === stopHash || contentHash === row.from_hash) return null;
+    return row;
+  }
+  return null;
+}
+
+/**
+ * The verb (`block reopen`): check, drop the done marker (`io.clearDone`), then write the signed
+ * row — or return the verified human row an earlier try wrote for the same `at_seq` and `to_hash`
+ * (at most one row per `at_seq`: one for other content is refused `reopen-already-recorded`).
+ * @param {{
+ *   runId: string, id: string, file: unknown, reason: unknown,
+ *   record: Record<string, any>, rows: ReadonlyArray<Record<string, any>>, key: Buffer,
+ *   writeRow: (row: Record<string, any>) => Promise<unknown>,
+ *   writeSigned: (runId: string, writeRow: (row: Record<string, any>) => Promise<unknown>, row: Record<string, any>) => Promise<unknown>,
+ *   io: {
+ *     owns: (owned: ReadonlyArray<string>, file: string, kinds?: Readonly<Record<string, string>>) => boolean,
+ *     loadState: (where: Record<string, any>) => {status: string, state: Record<string, any> | null, seq: number},
+ *     contentHash: (file: string) => string,
+ *     clearDone: (file: string) => boolean,
+ *   },
+ * }} opts
+ * @returns {Promise<{row: Record<string, any>, cleared: boolean, existing: boolean}>}
+ * @throws {StateError} `usage` or a refusal code (see the module doc).
+ */
+export async function reopenFile({ runId, id, file, reason, record, rows, key, writeRow, writeSigned, io }) {
+  if (typeof file !== 'string' || file.length === 0) throw new StateError('usage', 'block reopen needs --file <path>');
+  if (typeof reason !== 'string' || reason.trim().length === 0) throw new StateError('usage', 'block reopen needs --reason');
+  if (path.isAbsolute(file) || file.split('/').includes('..') || file.startsWith('./') || path.posix.normalize(file) !== file) {
+    throw new StateError('usage', '--file must be repo-root-relative');
+  }
+  const entry = openBlockEntry(record, runId, id);
+  const owned = Array.isArray(entry.owned_files) ? entry.owned_files : [];
+  if (!io.owns(owned, file, entry.owned_kinds)) throw new StateError('reopen-not-owned', `reopen-not-owned: block ${id} does not own ${file}; nothing was recorded`);
+
+  const runRows = rows.filter((r) => r?.run === runId);
+  const loaded = io.loadState({ runId, block: id, file, key, rows: runRows });
+  if (loaded.status === 'tampered') {
+    throw new StateError('reopen-tampered', `reopen-tampered: the review state of ${file} does not verify (a security event, not a stop); the owner's way out is block close --no-require-reviews; nothing was recorded`);
+  }
+  const current = io.contentHash(file);
+  /** @type {'stopped' | 'lost'} */
+  let from;
+  /** @type {string | null} */
+  let stopReason = null;
+  /** @type {string | null} */
+  let fromHash = null;
+  if (loaded.status === 'lost') {
+    from = 'lost';
+  } else if ((loaded.status === 'ok' || loaded.status === 'restored') && loaded.state?.status === 'stopped') {
+    from = 'stopped';
+    stopReason = typeof loaded.state.next?.reason === 'string' ? loaded.state.next.reason : 'stopped';
+    fromHash = stopContentHash(loaded.state, runRows, { runId, block: id, file, key });
+    if (fromHash === null) {
+      throw new StateError('reopen-same-content', `reopen-same-content: the content the stop of ${file} reviewed is unknown, so a change cannot be shown; waive its findings instead (block waive); nothing was recorded`);
+    }
+    if (fromHash === current) {
+      throw new StateError('reopen-same-content', `reopen-same-content: ${file} still has the content its stop (${stopReason}) reviewed; change the file first, or waive its findings (block waive); nothing was recorded`);
+    }
+  } else {
+    const what = loaded.status === 'none' || loaded.state === null ? 'has no review state' : `is ${loaded.state.status}`;
+    throw new StateError('reopen-not-stopped', `reopen-not-stopped: ${file} ${what}; only a stopped or lost file is reopened; nothing was recorded`);
+  }
+  if (!Number.isInteger(loaded.seq) || loaded.seq < 0) {
+    throw new StateError('reopen-tampered', `reopen-tampered: the review state of ${file} has no valid anchor seq; nothing was recorded`);
+  }
+  // one verified human row per at_seq: the same content reuses it, other content is refused
+  const earlier = latestRowAt(runRows, { runId, block: id, file, key, seq: loaded.seq });
+  if (earlier !== null && earlier.to_hash !== current) {
+    throw new StateError('reopen-already-recorded', `reopen-already-recorded: ${file} was already reopened at state seq ${loaded.seq} for other content; run review-file, or the content changed since the reopen; nothing was recorded`);
+  }
+  // C11: the cached result of the current content's ticket would repeat the stop — dropped FIRST,
+  // so a failed row write leaves at worst a re-run that returns the same stop, never a row with a
+  // stale marker
+  const cleared = io.clearDone(file);
+  if (earlier !== null) return { row: earlier, cleared, existing: true };
+  const row = { event: REOPENED_EVENT, block: id, file, from, stop_reason: stopReason, at_seq: loaded.seq, from_hash: fromHash, to_hash: current, reason: reason.trim(), by: 'human' };
+  /** @type {Record<string, any> | null} */
+  let written = null;
+  let signedOut = null;
+  /** @type {unknown} */
+  let failure = null;
+  // a thrown `undefined` (or null) is still a throw: `threw`, not the value, says the write threw
+  let threw = false;
+  try {
+    signedOut = await writeSigned(runId, async (signed) => {
+      const result = await writeRow(signed);
+      // the ledger's appendRow resolves with the row it wrote; nothing (or false) is no write
+      if (result === null || result === undefined || result === false) return result;
+      written = signed;
+      return result;
+    }, row);
+  } catch (err) {
+    written = null;
+    failure = err;
+    threw = true;
+  }
+  if (written === null || signedOut === null || signedOut === undefined || signedOut === false) {
+    // B79: the cause is kept (`cause`) and named by its code only — never a path, key or config value
+    const refused = new StateError('reopen-write-failed', `reopen-write-failed: the signed review.reopened row for ${file} was not written (${threw ? causeCode(failure) : 'no-write'}); run block reopen again`);
+    // StateError takes (code, message) only (src/state/paths.mjs is not this block's): `cause` is
+    // set here, non-enumerable like a native one, so a serializer never emits the cause's path
+    if (threw) Object.defineProperty(refused, 'cause', { value: failure, enumerable: false, configurable: true, writable: true });
+    throw refused;
+  }
+  return { row: written, cleared, existing: false };
+}

package/src/review/stop-exits.mjs

@@ -0,0 +1,15 @@
+/**
+ * B73 (issue #12): the ways out of a file the fix loop stopped (`review_cap`,
+ * `l3_patch_exhausted`, `split_required`), in this order — `block reopen` after a fix,
+ * `block waive` for each open finding, `review-file --answers` for a fix made in another owned
+ * file, or re-decompose the block. `review-file`'s `stopped` answer carries them as `exits`; the
+ * gate appends {@link stopExitsLine} to its `review_cap` and `unreviewed` detail for a stopped
+ * file. A `tampered` review state is not a stop (it is refused; the owner's way out is
+ * `block close --no-require-reviews`) and never gets them.
+ */
+
+/** @type {ReadonlyArray<string>} */
+export const STOP_EXITS = Object.freeze(['block reopen', 'block waive', 'review-file --answers', 're-decompose']);
+
+/** The one short line the gate appends to a stopped file's detail. */
+export const stopExitsLine = `exits: ${STOP_EXITS.join(', ')}`;

package/src/util/forbidden.mjs

@@ -276,6 +276,7 @@ export const FORBIDDEN = Object.freeze(
  * They are NOT part of `FORBIDDEN` (whose rendered count other blocks pin); `mergeForbidden()`
  * always appends them, so every list built for a coder carries them.
  *  - `code-forge block waive` — waiving a review finding is human-only;
+ *  - `code-forge block reopen` (B72) — restarting a stopped or lost file's review is human-only;
  *  - `code-forge autopilot` (any subcommand, B45) — the owner's grant to a delegate;
  *  - `--no-require-reviews` — the human's way out of `block close`'s per-file review check;
  *  - `--remove-worktree` (B62a) — `block close` removing the block's worktree, the orchestrator's
@@ -293,6 +294,15 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
       ],
       description: 'Waive a review finding (forge block waive) — human-only, run by the orchestrator after the human said so (§4.9)',
     },
+    {
+      id: 'code-forge-block-reopen-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [
+        ['code-forge', 'block', 'reopen'],
+        ['forge', 'block', 'reopen'],
+      ],
+      description: 'Reopen the review of a stopped or lost file (forge block reopen) — human-only, run by the orchestrator after the human said so (B72)',
+    },
     {
       id: 'code-forge-autopilot-from-coder',
       kind: 'anyPrefix',

package/src/util/tmp.mjs

@@ -130,18 +130,30 @@ export function tmpBase(root) {
 }
 
 /**
- * Create (if needed) the run root `<base>/<runId>/`, record this process as its owner, and
- * return its real absolute path.
+ * The run root's path `<base>/<runId>`, without creating anything (B69: doctor looks for old
+ * review-state files there). The same run id check as {@link runRoot}.
  * @param {string} runId
  * @param {{root?: string}} [opts]
  * @returns {string}
+ * @throws {TypeError} a bad run id, or a `root` that is not absolute.
  */
-export function runRoot(runId, opts = {}) {
+export function runRootPath(runId, opts = {}) {
   if (typeof runId !== 'string' || !RUN_ID.test(runId)) {
     throw new TypeError('tmp: runId must be one path segment of letters, digits, ".", "_" or "-"');
   }
+  return path.join(tmpBase(opts.root), runId);
+}
+
+/**
+ * Create (if needed) the run root `<base>/<runId>/`, record this process as its owner, and
+ * return its real absolute path.
+ * @param {string} runId
+ * @param {{root?: string}} [opts]
+ * @returns {string}
+ */
+export function runRoot(runId, opts = {}) {
+  const dir = runRootPath(runId, opts);
   const base = tmpBase(opts.root);
-  const dir = path.join(base, runId);
   // A parallel sweep that claimed a dead root of this name renames it away (see the claim rule)
   // between our mkdir and our write: the directory is then "missing" or the write fails with
   // ENOENT, and the retry creates a fresh directory in its place. A tombstone itself can never be

package/src/worker/engine.mjs

@@ -17,6 +17,13 @@
  *  - `stopped` (`review_cap`, `l3_patch_exhausted`, `split_required`) ⇒ no session: the result
  *    repeats the stop — only the human moves on (§4.11 rule 5). A `split_required` result (round 1
  *    or a recheck stop) carries `tokens_in` and `budget` (B54).
+ * A state that does not load is refused with no session: `review-state-tampered` (a wrong file or
+ * anchor) or `review-state-lost` (the file is gone and its anchor has no `state_body`). A file
+ * that is gone but whose anchor carries the signed body is `restored` (B68): saved as a new seq,
+ * one signed `review.state_restored {block, file, seq, from_seq}` row, then the round runs as if
+ * it had loaded. B69: the state file lives under the code-forge home (`runs/<run>/review-state/`),
+ * not the temp root; a valid file still at the old temp path is moved there on its first load
+ * (status `ok`, no restored row).
  * The round's outcome: `approved: true` ONLY when the loop is `complete` AND its signed
  * `review.approved` row (keyed `run, block, file, content_hash` = the ticket's hash) was written;
  * else `findings` = the open fix list, `next` = what the orchestrator does (`fix` at `level`,
@@ -65,6 +72,20 @@
  * ticket is done); `review-file` on the same content is a fresh attempt every time (`retry: true`).
  * The tree is passed as `contentRoot`: `repoRoot` stays the main tree, and the fix-loop state
  * stays under the run root.
+ * B72: a verified `review.reopened {by: human}` row of this run for the file whose `at_seq` is the
+ * file's latest anchor seq (`reopenRowFor`, `review/reopen.mjs`) restarts a `stopped` file whose
+ * content changed since the stop, or a `lost` one: a new state (round 1, a FULL review with no
+ * `reviewed_content`, the level from the run record), saved at `at_seq + 1`, so the row works
+ * once; no `review.state_restored` row then. The block's L3 rung stays spent (it is read from the
+ * anchors). A row that does not verify, of another run, not `by: human`, at another seq, or a
+ * stopped file on the stop's own content changes nothing: the stop (or the lost refusal) repeats.
+ * Every stop records the ticket's content hash as the state's `stop_content_hash` (signed with
+ * the state), the content `block reopen` and this check compare against.
+ * B71: a ticket with `kind: 'answers'` (`review-file --answers`) runs no fix-loop round: after the
+ * same run-record, tree and mismatch checks it goes to `reviewAnswers` (`review/answers.mjs`) —
+ * one fresh L2 session that judges whether the answering file resolves the named open findings of
+ * the source, with signed `review.answered` rows for the resolved ones; the source's fix-loop
+ * state is neither read for a round nor saved.
  */
 
 import { realpathSync, rmSync } from 'node:fs';
@@ -75,9 +96,11 @@ import { planAndRecord, tierOf } from '../review/budget.mjs';
 import { budgetFor } from '../review/packet.mjs';
 import { ContextError, reviewDigest } from '../context/pack.mjs';
 import { reviewFile, rulesRisk } from '../review/engine.mjs';
+import { reviewAnswers } from '../review/answers.mjs';
 import { peerDiffReader } from '../review/moved.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
 import { extraRoundsFor, newFileState, reopenForExtraRound, runRound } from '../review/fixloop.mjs';
+import { reopenRowFor } from '../review/reopen.mjs';
 import { readRun } from '../state/run.mjs';
 import { StateError } from '../state/paths.mjs';
 import { blockTree, worktreeRecord } from '../proof/worktree.mjs';
@@ -85,8 +108,9 @@ import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
 import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
 import { keyedLock } from '../util/locks.mjs';
-import { blockAnchors, blockRungUsed, loadState, saveState } from './review-state.mjs';
-import { assertTicketId, WorkerError } from './ticket.mjs';
+import { blockAnchors, blockRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
+import { assertAnswers } from './queue.mjs';
+import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } from './ticket.mjs';
 
 /**
  * @typedef {object} ReviewContext
@@ -94,7 +118,8 @@ import { assertTicketId, WorkerError } from './ticket.mjs';
  * @property {string} [contentRoot] - B62b: the tree the ticket's content is read in (the block's
  *   worktree); `repoRoot` when absent.
  * @property {string} runId
- * @property {string} runRootDir - the run's temp root (packets and session dirs live under it).
+ * @property {string} runRootDir - the run's temp root (packets and session dirs live under it; the
+ *   review state no longer does — B69 — it is only read there once, to move an old file).
  * @property {Record<string, any>} cfg - the project config.
  * @property {string | null} jevKey - resolved once by the worker through B2's chain; never print.
  * @property {(opts: Record<string, any>) => Promise<Record<string, any>>} spawn - one isolated
@@ -116,6 +141,7 @@ import { assertTicketId, WorkerError } from './ticket.mjs';
  * @property {string} engine - `adaptive` or `consensus`.
  * @property {Array<Record<string, any>>} sessions - one summary per session run.
  * @property {string} [reason] - why it is not `reviewed` (stub-guard reason, `needs_file-refused`, …).
+ * @property {string} [message] - a refusal's human-readable explanation (`review-state-lost`).
  * @property {Array<Record<string, any>>} [findings] - the open fix list (`reviewed` / `stopped`).
  * @property {number} [round] - the fix-loop round this ticket ran (patch_check rounds not counted).
  * @property {string} [kind] - `full`, `recheck` or `patch_check`.
@@ -338,6 +364,14 @@ export async function reviewTicket(ticket, ctx) {
   }
   /** @type {ReviewContext} */
   const tctx = { ...ctx, contentRoot };
+  if (ticket.kind === 'answers') {
+    // B71: an answers ticket is no review round: one answers session, the fix-loop state untouched
+    try {
+      return await reviewAnswers(ticket, tctx, { entry, workDir, io: { readFile: readRegularFileNoFollow, loadState, assertAnswers } });
+    } finally {
+      rmSync(workDir, { recursive: true, force: true });
+    }
+  }
   const factsExcerpt = factsFor(entry, ctx.cfg);
   const peerDiffs = blockPeerDiffs(contentRoot, { base: entry.base, owned: entry.owned, ownedKinds: entry.ownedKinds, file: ticket.file });
   try {
@@ -413,6 +447,9 @@ export function blockPeerDiffs(repoRoot, { base, owned, ownedKinds, file }) {
  */
 export const blockLockKey = (runId, block) => `block:${runId}\0${block}`;
 
+/** B68: the `review-state-lost` refusal's message (the file is gone and the ledger has no body). */
+export const LOST_MESSAGE = 'the review state file is gone and the ledger cannot rebuild it (its anchor carries no state_body); the file is not reviewed again from round 1 — the owner can run `code-forge block reopen`';
+
 /**
  * Whether the block's one L3 rung is taken: a verified anchor says so (`blockRungUsed`), OR another
  * file of the block has a saved state whose round decided `next: patch` — that round took the rung,
@@ -429,11 +466,12 @@ export function rungTaken(where) {
   for (const file of siblings) {
     let other;
     try {
-      other = loadState({ ...where, file });
+      other = loadState({ ...where, file, migrate: false }); // B69: a sibling's old file is read, never moved here
     } catch {
       return { status: 'ok', used: true };
     }
-    if (other.status !== 'ok' || other.state?.next?.action === 'patch') return { status: 'ok', used: true };
+    // a sibling that would be restored (B68) counts by its rebuilt state; lost or tampered fails closed
+    if ((other.status !== 'ok' && other.status !== 'restored') || other.state?.next?.action === 'patch') return { status: 'ok', used: true };
   }
   return rung;
 }
@@ -488,11 +526,34 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       await recordBlockBudget(ticket, ctx, { base, owned, ownedKinds });
     }
     const where = { runRootDir: ctx.runRootDir, runId: ctx.runId, block: ticket.block, file: ticket.file, key, rows };
-    const loaded = loadState(where);
+    const loaded = loadState({ ...where, contentRoot: ctx.contentRoot ?? ctx.repoRoot });
     const rung = rungTaken(where);
     if (loaded.status === 'tampered' || rung.status === 'tampered') return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-tampered', approved: false, engine: 'adaptive', sessions: [] }) };
+    // B72: the human's `block reopen` row for this file's latest anchor seq restarts a stopped
+    // (on changed content) or lost file: a new state, saved at that seq + 1 — the row works once
+    // (`rows`: this run's rows read above under the block lock; `key`: the run key from opts)
+    const reopenAt = {
+      runId: ctx.runId,
+      block: ticket.block,
+      file: ticket.file,
+      key,
+      status: loaded.status,
+      state: loaded.state,
+      seq: loaded.seq,
+      contentHash: ticket.content_hash,
+    };
+    const reopened = reopenRowFor(rows, reopenAt) !== null;
+    if (loaded.status === 'lost' && !reopened) return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-lost', message: LOST_MESSAGE, approved: false, engine: 'adaptive', sessions: [] }) };
+    let seq = loaded.seq;
+    if (loaded.status === 'restored' && loaded.state !== null && !reopened) {
+      // B68: the lost file is rebuilt from the anchor's signed body; saved as a new seq, then recorded
+      const writeRow = /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow);
+      await saveState({ ...where, state: loaded.state, seq, writeRow, contentRoot: ctx.contentRoot ?? ctx.repoRoot });
+      seq += 1;
+      await writeRow({ event: RESTORED_EVENT, block: ticket.block, file: ticket.file, seq, from_seq: loaded.seq });
+    }
     const rungUsed = rung.used;
-    let state = loaded.state;
+    let state = reopened ? null : loaded.state;
     if (state === null || state.status === 'complete') state = newFileState({ file: ticket.file, level, l3RungUsed: rungUsed });
     state.l3_rung_used = state.l3_rung_used || rungUsed;
     // B47: an autopilot extra round raises the file's cap; a file stopped at the old cap reopens
@@ -511,7 +572,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       state.l3_rung_used = true; // the orchestrator ran the block's one L3 patch before this ticket
     }
     const fixed = state;
-    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq: loaded.seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs });
+    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs });
     // a round that could take the rung keeps the block lock until its state is saved
     if (mayTakeRung(fixed, kind, ctx.cfg, rungUsed)) return { outcome: await round() };
     return { round };
@@ -606,7 +667,12 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
       state.pending_kind = kind;
     }
   }
-  await saveState({ ...where, state, seq, writeRow: /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow) });
+  // B72: a stop (any reason) records the content it reviewed — the ticket's — in the signed state,
+  // so `block reopen` and the worker know which content this stop saw (`stopContentHash`)
+  const stamped = /** @type {Record<string, any>} */ (state);
+  if (state.status === 'stopped') stamped.stop_content_hash = ticket.content_hash;
+  else delete stamped.stop_content_hash;
+  await saveState({ ...where, state, seq, writeRow: /** @type {(row: Record<string, any>) => Promise<unknown>} */ (ctx.writeRow), contentRoot: ctx.contentRoot ?? ctx.repoRoot });
 
   const eng = /** @type {Record<string, any> | null} */ (engineOutcome);
   const head = { ...loopFields(state, kind), engine: eng?.engine ?? 'adaptive', sessions: eng?.sessions ?? rechecks };

package/src/worker/loop.mjs

@@ -318,6 +318,7 @@ export async function createWorker(opts, deps = {}) {
         approved: outcome.approved === true,
         engine: outcome.engine,
         ...(typeof outcome.reason === 'string' ? { reason: outcome.reason } : {}),
+        ...(typeof outcome.message === 'string' ? { message: outcome.message } : {}),
         ...(Array.isArray(outcome.findings) ? { findings: outcome.findings } : {}),
         ...packetSize(outcome),
         ...loopResult(outcome),
@@ -389,7 +390,8 @@ export async function createWorker(opts, deps = {}) {
       return { ...base, status: 'refused', reason, approved: false };
     }
     if (current === DELETED_HASH && ticket.content_hash !== DELETED_HASH) return { ...base, status: 'stale', reason: 'missing-file', approved: false };
-    if (current !== ticket.content_hash) return { ...base, status: 'stale', approved: false };
+    // B71: an answers ticket names why (its source moved); a review ticket keeps no reason
+    if (current !== ticket.content_hash) return { ...base, status: 'stale', ...(ticket.kind === 'answers' ? { reason: 'source-changed' } : {}), approved: false };
     let ticketCfg;
     try {
       ticketCfg = await configFor(id);