@feng0531/dsh-code-review 0.87.0 → 0.87.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.87.2 — 导出案例回归修复
+
+- 大文件稀疏、远距离编辑增加有界最短编辑回退，避免二维差异表超限后不必要地扩大为近全文包络；超预算仍明确受限。
+- 文件／窗口主审在局部额度不足时保留同次检索链，等待其他阶段释放容量后有限续跑；不重置读取总账、轮数或截止时间，不重放已接受生成。
+- 正常组主审仍合并调用；仅真实局部读取预算不足且尚未接受组成果时回退可续跑成员主审，保留已消费总账。风险规划开启时，组响应明确要求各成员提供 `risks`（允许空数组），消除可选提示与验收要求矛盾。
+- 迁移对照保留旧公开校验入口与旧委托实现；新增删除导出／单例／不同名入口的有限词法导航，歧义与未证实因果仍为 uncertain。
+- 预览返回有效截止时间，区分缺失、过期及模型／目录变化；后台摘要说明调用下限不是实际成本上限，阶段限制与全局余额分别展示。
+
+## 0.87.1 — 修复阶段续审缓存中断
+
+- 主审、窗口归因和续审导入从同一批准原文重建包络坐标；包络仍不表示精确编辑或回归因果。
+- 阶段生成先校验再进入缓存，单条拒绝或容量不足不污染已保存记录、不再在文件收尾中止整任务；当前发现与独立复核保留。
+- 组成员、组级和宿主限制按组合后的有界数量保存，单次模型响应仍最多50条；续审不继承旧复核回执。
+- 续审导出总容量不足时仅保存适配的完整记录并披露省略数量，不中止当前审查；非法导入、取消及真实落盘错误不被容量退化吞掉。
+
 ## 0.87.0 — 连续取证、迁移契约与阶段续审
 
 - 当前阶段按批准来源重新投递有限相关正文，交互风险可内联；未送入模型不计证据，缓存仍扣字节，独立复核使用新回执。

package/CORE-SOURCE-INVENTORY.md

@@ -2,7 +2,7 @@
 
 供维护者核查实现依据。使用方法见 [README](README.md)，开发优先级见 [能力清单](CORE-ALIGNMENT-TASKS.md)。
 
-当前本轮对照固定为 alibaba/open-code-review 提交 `216dcf513593055a70165f793e96b52589d71b1b`，不随上游分支变化。下方文件索引仍是旧提交 `2d67596c961f80436deb2afa643efa2b1725d34c` 的历史阅读记录；未把旧记录冒充新提交逐文件复审。
+上一轮完整对照固定为 alibaba/open-code-review 提交 `216dcf513593055a70165f793e96b52589d71b1b`。本轮导出案例修复另核实上游 HEAD `8f9c8b771f65bed63a193e873f12cdffb050b748`，只补读 `internal/tool/file_read_diff.go` 的缺失差异导航和 `internal/diff/git.go` 的 tracked/gitignored 范围修复，不宣称完成该版本全量对照。差异算法参考旧固定版本 `internal/suggestdiff/diff.go` 与 `internal/diff/hunk.go`，不照搬无界二维表或忽略大小写／空白的对齐。下方文件索引仍是旧提交 `2d67596c961f80436deb2afa643efa2b1725d34c` 的历史阅读记录；未把旧记录冒充新提交逐文件复审。
 
 ## 对照结论
 

package/DEVELOPMENT.md

@@ -10,7 +10,7 @@
 	npm test
 	node scripts/host-smoke.mjs <DSH-checkout>
 
-宿主检查加载真实 DSH 工具运行时，但使用受控模型响应，不是 GUI 安装或真实模型质量测试。Windows SVN 需要支持 UTF-8 路径；CI 使用临时工具，不修改用户安装。
+宿主检查加载真实 DSH 工具运行时，但使用受控模型响应，不是 GUI 安装或真实模型质量测试。若安装路径位于 Electron `app.asar` 内，普通 Node 不识别归档虚拟路径；PowerShell 可用 `$env:ELECTRON_RUN_AS_NODE="1"; & "<安装目录>/DeepSeek Harness.exe" scripts/host-smoke.mjs "<安装目录>/resources/app.asar/dsh"` 运行归档感知的同一检查，不解包或修改宿主。Windows SVN 需要支持 UTF-8 路径；CI 使用临时工具，不修改用户安装。
 
 ## 会话与模式
 
@@ -42,11 +42,11 @@ JSON合同新增280字节传输提示防止原始换行／反斜线转义错误
 
 连续正文投递的索引仅保存本次批准且实际发送的坐标；当前 stage reader 重新取原文并扣字节，不共享旧 receipt。可选初始正文事务延迟到调用预算准入后，预算否决／取消／输入不适配必须回滚，未送入模型不发布 audit。交互内联风险缺失／非法不抹合法 findings，不补发规划。
 
-迁移元数据是宿主生成的 side-qualified 导航，不是模型授权。跨文件 regression 只用已批准 contract ID、来源／角色／精确编辑和独立已校验 receipt，默认旧同主文件协议仍严格。C++ 仅在字面 include、唯一类声明／类外定义和明确 receiver 下产生保守线索，重载／继承／虚分派／宏不能猜测唯一绑定。
+迁移元数据是宿主生成的 side-qualified 导航，不是模型授权。`old-delegation` 保留旧公开入口、旧实现及新同源入口，非 uncertain 判定要求本代 receipt 完整覆盖三个函数。删除导出入口、单例调用与不同名新入口的 `deleted-export-route` 只交付词法候选导航，强制 uncertain；不证明类型、宏语义、实参等价或共享状态身份，复杂／歧义语法明确记录不可用。跨文件 regression 只用已批准 contract ID、来源／角色／精确编辑和独立已校验 receipt，默认旧同主文件协议仍严格。C++ 仅在字面 include、唯一类声明／类外定义和明确 receiver 下产生保守线索，重载／继承／虚分派／宏不能猜测唯一绑定。
 
 精确完整组的根可选 interactions 通道独立于合法 primary 结果验收。仅本代读取覆盖全部成员编辑、source／snapshot／hash 及跨文件引用验收成功后替代匹配专门生成；非法或缺失不触发隐藏主审重跑，候选仍用独立复核。原生 schema、文本合同和可选开销进入真实 wire 预算，预览 minimumCalls 是有条件下限并披露 fallbackMinimumCalls。
 
-额度让出不抢 live unit；其他阶段 release 后有限 FIFO 继续，共享原调用／输出总账和绝对截止。schema2 只保存身份校验过的 primary generation，不持久化成可复用的新证据 receipt；恢复只省生成，交互／综合及验证重新从安全边界执行。没有进展保留 pending／partial，取消不自动变为完成。
+额度让出不抢 live unit；文件／窗口 primary 在同次执行以内存闭包保留待执行请求、已送结果、检索轮数和单次纠正许可，其他阶段 release 后有限 FIFO 继续，共享原调用／输出总账和绝对截止。正常 group-primary 仍一次合并生成；仅尚未接受组生成且真实局部分配失败、root 可承接请求时，明确回退成员 primary。预留成员 fallback floor 会降低当时组可用额度，成功组立即释放 floor；不重放已接受组，不给新总账。schema2 只保存身份校验过的 primary generation，不持久化成可复用的新证据 receipt；恢复只省生成，交互／综合及验证重新从安全边界执行。没有进展保留 pending／partial，取消不自动变为完成。
 
 受控集成验证入口为 `test/ocr-refactor-integration.test.mjs`、`test/ocr-complete-policy.test.mjs` 及 group/migration/stage 专项测试；其中开关对照 7→5、组通道 5→3 是固定离线响应的模型调用数，不是提供方速度或召回保证。正式发布仍执行下文完整门禁，不把文档更新或本地通过当作已发布。
 

package/README.md

@@ -53,7 +53,7 @@ dsh plugin add https://github.com/f-e-n-g-0531/dsh-code-review.git
 确认刚才展示的预览范围和模型，使用该 previewId 执行只读审查。
 ```
 
-插件使用预览返回的 ID 执行。默认预览有效期约 **5 分钟**；文件、模型或会话目录变化后，需要重新预览和确认。宿主权限不允许时，确认也不能绕过限制。
+插件使用预览返回的 ID 执行。默认预览有效期约 **5 分钟**，返回 `expiresAt` 与 `validForMs`；到期、文件、模型或会话目录变化后，需要重新预览和确认。计划最少调用只是初始下限，不是总调用数或耗时上限，后续取证、复核与综合会增加工作量。宿主权限不允许时，确认也不能绕过限制。
 
 ### 后台执行如何等待
 

package/RELEASE-NOTES.md

@@ -1,27 +1,23 @@
-# v0.87.0 发布说明
+# v0.87.2 发布说明
 
 使用方式见 [README](README.md)，历史变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
 
-## 减少重复建立上下文，保留证据边界
+## 差异交付与预算恢复
 
-变更审查把此前实际交付过的相关片段，经当前阶段 reader 重新读取并有限投递；输入不适配、已知调用否决、取消或失败时，不留下孤立预算或虚假读取。缓存命中仍计算投递字节，复核回执重新签发。精确适配的交互单元可以内联风险问题，缺失或非法可选风险不会抹去合法发现，也不会隐藏补发规划。
+大文件稀疏、远距离编辑增加有界最短编辑回退，避免差异表超限后不必要地扩大为近全文包络；耗尽预算仍明确受限。文件／窗口主审保留同次检索链，等待其他阶段释放局部额度后有限续跑，不重置总账、检索轮数、纠正许可或超时。
 
-报告把结论摘要与发现放在逐文件覆盖和诊断前。确认新增须满足独立复核与旧新对照引用校验；仅 supported、缺比较或未完成复核仍列未决，未完成范围保留。
+正常组主审仍合并调用；仅真实局部分配失败且尚未接受组结果时明确回退成员主审，保留已消费预算、不回放已接受生成。组风险规划明确要求各成员提供 risks（允许空数组）；缺失或畸形仍报告限制，合法发现保留，不隐藏补发规划。
 
-## 迁移链与组交互
+## 迁移对照与安全边界
 
-新增宿主生成的旧入口→新入口→调用方契约导航，分别解析旧新来源并保留跨组联系；不以同名／相似度认定迁移。跨文件回归复核仅接受契约限定的批准来源、精确编辑及本次独立证据，不放开任意跨文件引用。C++ 线索支持字面 include、唯一类声明／类外定义和明确接收者；重载、继承、虚分派、宏与复杂别名仍保守拒绝。
+迁移导航保留旧公开入口、旧委托实现及新入口。删除导出、单例调用和不同名新入口仅提供有限词法候选导航，强制 uncertain，不证明类型、宏语义、共享状态身份或回归因果。不支持或歧义的旧入口明确报告限制。
 
-精确完整组可附带可选交互结果，只有当前代真实读取覆盖所有成员编辑并通过引用验收，才替代完全匹配的专门交互生成。缺失、非法或缺证据时保留合法主审并回退；候选独立复核不省略。预览披露条件性节省与回退成本，不承诺固定调用量。
+全部宿主迁移合同从批准快照独立重建并匹配完整身份，防止删除种类、基线或来源字段降级绕过限制；拒绝不可信访问器、Proxy 和自定义序列化钩子。独立复核仍使用本代新证据回执。
 
-## 有界继续与配置
+预览返回有效截止时间并区分失效原因；后台分别显示阶段限制与全局余量，调用下限不是成本或耗时上限。批准等待中的取消或模型变化不能发送源码。
 
-阶段额度不足可让出，其他阶段释放后有限继续；不抢活动份额、不扩大根预算、不重置原截止或调用账，无进展仍 pending／partial。schema2 续审检查点仅复用身份匹配的已接受 primary 生成；综合、交互和候选复核从新安全边界进入，旧回执不作为新证据。仍需新预览、确认与授权。
+## 验证与交付
 
-六项开关 enableEvidenceContext、inlineInteractionRisks、enableMigrationContracts、enableMigrationRegression、enableGroupInteractions、enableStageContinuation 在生产变更入口默认 true，底层和直接 service 默认 false，可逐项关闭。项目模式不启用后四项，保留原批次与续审协议。
+修复冻结本地完整回归1309项：1305通过、0失败、4跳过；最终独立复核定向65项通过。真实DSH ToolRuntime加载／工具注册、包内容与差异检查通过。这些不是业务项目真实模型重跑，也不保证召回率或实际耗时。
 
-## 验证与发布边界
-
-受控离线夹具覆盖开关实际调用对照、原生／文本预算、无效可选通道回退、新回执、取消回滚及续审配置绑定。它们验证机制，不是用户业务重跑，也不证明真实模型召回、速度或成本。增量多轮早停、多轮／窗口组主审、推理记忆压缩和安全检索模式仍未实现，见 [能力清单](CORE-ALIGNMENT-TASKS.md)。
-
-正式交付仍须完成冻结标签 Ubuntu／Windows × Node.js22／24 四矩阵及 Actions、npm、GitHub Release 原始安装包逐字节与校验清单核验。本说明不是已发布或已安装声明；发布不会自动升级或重启当前 DSH。
+正式发布须通过冻结标签 Ubuntu／Windows × Node.js22／24 四矩阵，并核验 Actions、npm 与 GitHub Release 的同一原始安装包及校验清单。发布不自动安装、升级或重启当前宿主。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.87.0",
+  "version": "0.87.2",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/background-review.mjs

@@ -36,7 +36,10 @@ function terminalSummary(value) {
     }
     const reasons = Array.isArray(d?.readerLimitReasons) ? d.readerLimitReasons : [];
     const bounded = LIMIT_CODES.flatMap(code => { const row = reasons.find(item => item?.code === code); return row ? [code + ' ' + count(row.calls)] : []; });
-    if (bounded.length) lines.push('读取限制原因：' + bounded.join('；'));
+    if (bounded.length) {
+      lines.push('读取限制原因：' + bounded.join('；'));
+      if (d?.readerBudget?.remainingCalls > 0 && d?.readerBudget?.remainingOutputBytes > 0) lines.push('全局读取预算仍有余额；阶段分配或检索轮次限制仍可能使范围未完成，不能据余额认定可以继续或已经通过。');
+    }
     if (d?.readerLimits) lines.push('每阶段最大检索轮次：' + count(d.readerLimits.maxRounds));
     if (d?.artifacts) lines.push('私有工件计数：留存 ' + count(d.artifacts.retained) + '，未留存 ' + count(d.artifacts.omitted) + '（不包含原始正文）');
     if (value.resultPage) lines.push('当前页：文件 ' + (value.resultPage.files?.length ?? 0) + '/' + count(value.resultPage.totalFiles) + '，发现 ' + (value.resultPage.findings?.length ?? 0) + '/' + count(value.resultPage.totalFindings) + '；code_review_status 的 offset/limit 仅切换结果页。');
@@ -44,6 +47,8 @@ function terminalSummary(value) {
   } else if (report?.previewId) {
     lines.push('预览已完成，尚未执行审查；请展示批准范围并取得用户确认后再执行。');
     lines.push('预览文件总量：' + count(report.filePage?.total ?? report.files?.length) + '；计划最少调用：' + count(report.plan?.minimumCalls));
+    lines.push('最少调用仅为初始计划下限，不是总调用数或耗时上限；后续取证、复核及综合会增加工作量。');
+    if (typeof report.expiresAt === 'string' && Number.isFinite(Date.parse(report.expiresAt))) lines.push('预览有效至：' + new Date(report.expiresAt).toISOString() + '；过期后须重新预览并确认。');
   } else {
     lines.push('未提供完整报告摘要；终态不会自动恢复或重新发送源码。请检查已保存检查点和未完成范围。');
   }

package/src/cpp-migration-bindings.mjs

@@ -4,6 +4,33 @@ const cpp = name => /\.(?:c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(name);
 const id = '[A-Za-z_][A-Za-z0-9_]*';
 const signature = params => params.trim().replace(/\s+/g, ' ').replace(/\s*([*&])\s*/g, '$1');
 
+// Evidence coordinates only, never resolved C++ call or reachability identities.
+export function cppExportRouteDefinitions(text) {
+  if (typeof text !== 'string' || Buffer.byteLength(text) > 256 * 1024 || /\/\*|R"|\\\r?\n|[\x60]/.test(text)) return [];
+  const lines = text.split('\n').map(line => line.replace(/\r$/, '').replace(/\/\/.*$/, ''));
+  if (lines.some(line => /^\s*#\s*(?!include\b)/.test(line) || /\b(?:namespace|template|using|typedef)\b/.test(line))) return [];
+  const output = [];
+  for (let i = 0; i < lines.length; i++) {
+    const match = /^\s*(?:(extern\s+"C")\s+(?:[A-Z_]\w*\s+)?)?(void|bool|int)\s+((?:[A-Za-z_]\w*::)?[A-Za-z_]\w*)\s*\(([^(){};]*)\)\s*(\{)?\s*$/.exec(lines[i]);
+    if (!match || !match[1] && !match[3].includes('::')) continue;
+    const params = match[4].split(',').map(p => p.trim());
+    if (!params.every(p => /^(?:const\s+)?[A-Za-z_]\w*\s*[*&]?\s+[A-Za-z_]\w*$/.test(p))) continue;
+    const brace = match[5] ? i : i + 1;
+    if (!match[5] && !/^\s*\{\s*$/.test(lines[brace] ?? '')) continue;
+    let depth = 1, end;
+    for (let j = brace + 1; j < lines.length; j++) {
+      if (/['"\\]/.test(lines[j])) break;
+      for (const c of lines[j]) { if (c === '{') depth++; else if (c === '}') depth--; }
+      if (depth === 0) { end = j + 1; break; }
+      if (depth < 0) break;
+    }
+    if (end) output.push({ symbol: match[3], exported: Boolean(match[1]), params: signature(match[4]),
+      names: params.map(p => /([A-Za-z_]\w*)$/.exec(p)[1]), start: i + 1, bodyStartLine: brace + 2, end, lines: lines.slice(brace + 1, end - 1) });
+    if (output.length > 100) return [];
+  }
+  return output;
+}
+
 function linesOf(text, header) {
   if (typeof text !== 'string' || Buffer.byteLength(text) > 256 * 1024 || /\/\*|R"|\\\r?\n|[\x60]/.test(text)) return undefined;
   const lines = text.split('\n').map(line => line.replace(/\r$/, ''));
@@ -36,6 +63,9 @@ function headers(entry) {
       if (!plain) continue;
       if (/^(?:public|private|protected):$/.test(plain)) { access = plain.slice(0, -1); continue; }
       const method = /^(void|bool|int)\s+([A-Za-z_]\w*)\s*\(([^;{}]*)\)\s*;\s*$/.exec(plain);
+      // Plain fields do not bind calls; they only allow the containing declaration
+      // to remain navigable. Initializers, aliases and function pointers stay unsupported.
+      if (!method && /^(?:bool|int|float|double|[A-Za-z_]\w*\s*[*&]?)\s+[A-Za-z_]\w*\s*;$/.test(plain)) continue;
       if (!method || /[=<>]|\bconst\b/.test(method[3])) { methods = undefined; break; }
       methods.push({ name: method[2], returnType: method[1], params: signature(method[3]), line: j + 1, access });
     }

package/src/group-primary.mjs

@@ -1,11 +1,14 @@
 import { preparePrimaryInput } from './primary-input.mjs';
 import { initialInputBudget } from './input-budget.mjs';
-import { INLINE_RISK_INSTRUCTIONS } from './prompts.mjs';
 import { validateRiskPlan } from './risk-plan.mjs';
 import { GROUP_INTERACTION_INSTRUCTIONS } from './group-interaction.mjs';
 
 export const GROUP_PRIMARY_INSTRUCTIONS = '批准的group-primary输入包含多个完整主文件。逐个审核所有reviews成员的新旧正文，并结合组内其他文件分析；不能仅审核一个文件。返回 {"reviews":[{"fileId":"原成员身份","findings":[],"limitations":[]}],"limitations":[]}，每个成员恰好一项，包括没有发现的成员。各finding仍需原审查指令全部字段、精确原行anchor及该fileId本次变化归因；不能用其他成员的身份或坐标替代。缺证据写limitations，不声明跨文件综合已完成；专门交互阶段仍独立校验。可按批准检索协议先返回requests。';
 
+// Group output has a different envelope from single-file inline review. Keep the
+// required risk field on each member, without inheriting optional/omit guidance.
+const GROUP_PRIMARY_RISK_INSTRUCTIONS = '每个reviews成员必须包含risks字段（数组，可为[]），禁止省略或放到顶层；没有真实风险或精确编辑时返回risks:[]，不要为满足字段要求编造风险。组风险可引用本组所有成员的精确编辑，不增加规划调用。风险仅为待证假设，不是证据、缺陷或扩大范围/读取权限的授权；sourceIds不证明已读。先审核全部成员编辑与反证，再报告findings。中间可按批准检索协议返回requests，但不得与最终结果混用。Risk shape: {id:"r1",fileIds:["reviews[].fileId"],editRefs:[{fileId:"reviews[].fileId",editId:"changes.edits[].id"}],question:"Risk?",trigger:"Condition",impact:"Failure",checks:["Countercheck"],sourceIds:[]}. Exactly these 8 keys, all required. Each member risks: 0..20; serialized {risks} JSON UTF-8<=65536 bytes. id/question/trigger/impact and each check: nonblank string, JS length<=2000; id unique within each member risks. fileIds: 1..4 unique approved group member IDs. editRefs: 1..20 unique objects with ONLY string fileId/editId; fileId in this risk.fileIds and editId owned by that file. checks: 1..8 unique strings. sourceIds: 0..8 unique catalog IDs (no catalog: []), never paths. Copy real IDs, never guess.';
+
 export function prepareGroupPrimary(snapshot, group, { instructions, scope, maxInputBytes, focusPrimaryContext = false, enableRiskPlanning = false, enableGroupInteractions = false, migrationContracts = [] } = {}) {
   if (typeof enableGroupInteractions !== 'boolean') throw new Error('Invalid group interaction option');
   if (!scope || snapshot.projectScope || !Array.isArray(group?.fileIds) || group.fileIds.length < 2 || group.fileIds.length > 4 || new Set(group.fileIds).size !== group.fileIds.length) return null;
@@ -18,7 +21,8 @@ export function prepareGroupPrimary(snapshot, group, { instructions, scope, maxI
   for (const item of reviews) { delete item.context; delete item.rules; delete item.businessRequirement; delete item.requirementNotice; }
   const value = { snapshotId: snapshot.id, sourceMode: 'group-primary', groupId: group.id, reviews, context, rules: snapshot.rules ?? [], ...(snapshot.businessRequirement !== undefined ? { businessRequirement: snapshot.businessRequirement } : {}) };
   let payload = JSON.stringify(value);
-  let combined = instructions + '\n' + GROUP_PRIMARY_INSTRUCTIONS + (enableRiskPlanning ? '\n各成员可附带risks；组风险可引用所有成员精确编辑，仍只是假设，不增加规划调用。' + INLINE_RISK_INSTRUCTIONS.replace('Final JSON requires findings/limitations;', 'Each reviews member requires findings/limitations;') : '');
+  const groupInstructions = enableRiskPlanning ? GROUP_PRIMARY_INSTRUCTIONS.replace('"findings":[],"limitations":[]}', '"findings":[],"limitations":[],"risks":[]}') + '\n' + GROUP_PRIMARY_RISK_INSTRUCTIONS : GROUP_PRIMARY_INSTRUCTIONS;
+  let combined = instructions + '\n' + groupInstructions;
   if (!initialInputBudget({ input: payload, instructions: combined }, scope, maxInputBytes).fits) return null;
   const contracts = migrationContracts.filter(contract => contract.candidateFileIds?.some(id => group.fileIds.includes(id)));
   if (contracts.length) { const proposed = JSON.stringify({ ...JSON.parse(payload), migrationContracts: contracts, migrationNotice: 'Host navigation hypotheses only. Compare the old public gate, new entry and callers under the same trigger. Neither semantics nor causality are established; independent verification is required.' }); if (initialInputBudget({ input: proposed, instructions: combined }, scope, maxInputBytes).fits) payload = proposed; }

package/src/line-diff.mjs

@@ -1,5 +1,46 @@
 import { changeRegion } from './change-region.mjs';
 
+// Myers frontier search avoids quadratic rectangles for sparse, distant edits.
+// Charge both retained trace cells and equality probes to the same hard budget;
+// exhaustion discards the entire script, never promoting a partial alignment.
+function boundedMatches(a, b, offset, n, m, budget) {
+  const trace = [];
+  let used = 0;
+  for (let d = 0; d <= n + m; d++) {
+    if (used + d + 1 > budget) return null;
+    used += d + 1;
+    const row = new Int32Array(d + 1), previous = trace.at(-1);
+    for (let p = 0; p <= d; p++) {
+      const k = 2 * p - d;
+      let x = d === 0 ? 0 : p === 0 ? previous[0] : p === d ? previous[p - 1] + 1
+        : previous[p - 1] < previous[p] ? previous[p] : previous[p - 1] + 1;
+      let y = x - k;
+      while (x < n && y < m) {
+        if (++used > budget) return null;
+        if (a[offset + x] !== b[offset + y]) break;
+        x++; y++;
+      }
+      row[p] = x;
+      if (x >= n && y >= m) {
+        const matches = [];
+        for (let depth = d; depth > 0; depth--) {
+          const prev = trace[depth - 1], index = (x - y + depth) / 2;
+          const down = index === 0 || (index !== depth && prev[index - 1] < prev[index]);
+          const prevX = prev[down ? index : index - 1];
+          const prevY = prevX - (x - y + (down ? 1 : -1));
+          const count = Math.min(x - prevX, y - prevY);
+          if (count > 0) matches.push([x - count, y - count, count]);
+          x = prevX; y = prevY;
+        }
+        if (x > 0) matches.push([0, 0, x]);
+        return matches.reverse();
+      }
+    }
+    trace.push(row);
+  }
+  return null;
+}
+
 export function lineDiff(before, after, { maxCells = 200000, ...options } = {}) {
   if (!Number.isSafeInteger(maxCells) || maxCells < 1 || maxCells > 2000000) throw new RangeError('Invalid cell limit');
   const region = changeRegion(before, after, options);
@@ -7,7 +48,22 @@ export function lineDiff(before, after, { maxCells = 200000, ...options } = {})
   const split = text => text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
   const a = split(before), b = split(after);
   const offset = region.old.start - 1, n = region.old.count, m = region.new.count;
-  if ((n + 1) * (m + 1) > maxCells) return { status: 'limited', reason: 'Diff cell limit exceeded', envelope: region, edits: [] };
+  if ((n + 1) * (m + 1) > maxCells) {
+    const matches = boundedMatches(a, b, offset, n, m, maxCells);
+    if (!matches) return { status: 'limited', reason: 'Diff cell limit exceeded', envelope: region, edits: [] };
+    const edits = [];
+    let i = 0, j = 0;
+    for (const [nextI, nextJ, count] of [...matches, [n, m, 0]]) {
+      if (nextI > i || nextJ > j) edits.push({
+        old: { start: offset + i + 1, count: nextI - i },
+        new: { start: offset + j + 1, count: nextJ - j },
+        removed: a.slice(offset + i, offset + nextI).join(''),
+        added: b.slice(offset + j, offset + nextJ).join(''),
+      });
+      i = nextI + count; j = nextJ + count;
+    }
+    return { status: 'changed', precision: 'exact', edits };
+  }
   const width = m + 1, table = new Uint32Array((n + 1) * width);
   for (let i = n - 1; i >= 0; i--) for (let j = m - 1; j >= 0; j--) {
     table[i * width + j] = a[offset + i] === b[offset + j] ? 1 + table[(i + 1) * width + j + 1] : Math.max(table[(i + 1) * width + j], table[i * width + j + 1]);

package/src/migration-contracts.mjs

@@ -3,7 +3,7 @@ import { createRetrievalScope } from './retrieval-scope.mjs';
 import { inferImportRelations } from './import-relations.mjs';
 import { inferCppRelations } from './cpp-relations.mjs';
 import { buildReviewGroups } from './review-groups.mjs';
-import { cppMigrationBindings } from './cpp-migration-bindings.mjs';
+import { cppMigrationBindings, cppExportRouteDefinitions } from './cpp-migration-bindings.mjs';
 
 const NOTICE = 'Conservative syntax navigation only; not semantic migration, call reachability, authorization, read coverage or causality proof.';
 const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -148,9 +148,93 @@ export function buildMigrationContracts(snapshot, { maxContracts = 32, maxGroupF
       }
     }
   }
+  // An old public route may stop delegating altogether. Retain that old-side
+  // edge and compare only the same approved file/function coordinates on the
+  // new side; a matching name in another file is never a migration binding.
+  for (const bridge of graph.old) {
+    const enclosing = (definitions.get('old:' + bridge.from) ?? []).filter(d => bridge.callLine > d.start && bridge.callLine < d.end);
+    if (enclosing.length !== 1 || bridge.from === bridge.to) continue;
+    const previous = enclosing[0];
+    const oldText = byId.get(bridge.from)?.left?.text;
+    if (!oldText || !oldText.split('\n').slice(previous.start, bridge.callLine - 1).some(line => /^\s*if\s*\(/.test(line))) continue;
+    const next = (definitions.get('new:' + bridge.from) ?? []).filter(d => d.symbol === previous.symbol);
+    const target = (definitions.get('old:' + bridge.to) ?? []).find(d => d.start === bridge.declarationLine);
+    const oldRole = role(bridge.from, 'old', previous), newRole = next.length === 1 ? role(bridge.from, 'new', next[0]) : undefined;
+    const targetSource = source(bridge.to, 'old');
+    if (!oldRole || !newRole || !target || !targetSource) continue;
+    const key = JSON.stringify(['old-delegation', bridge.from, previous.symbol, bridge.to, bridge.symbol]);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (result.contracts.length >= maxContracts) { unresolved.add('Migration contract limit reached; additional chains remain unresolved.'); continue; }
+    const baseline = { ...(byId.has(bridge.to) ? { fileId: bridge.to } : {}), sourceId: targetSource.id, side: targetSource.side,
+      path: byId.has(bridge.to) ? byId.get(bridge.to).oldPath ?? byId.get(bridge.to).path : targetSource.path,
+      sourcePath: targetSource.path, symbol: target.symbol, line: target.start, endLine: target.end, editIds: [] };
+    Object.assign(oldRole, { startLine: previous.start, endLine: previous.end });
+    Object.assign(newRole, { startLine: next[0].start, endLine: next[0].end });
+    baseline.startLine = target.start;
+    const callers = [caller(bridge, 'old')];
+    const navigationBindings = [...(previous.navigation ? [previous.navigation] : []), ...(next[0].navigation ? [next[0].navigation] : []),
+      ...(target.navigation ? [target.navigation] : []), ...(bridge.navigationBindings ?? [])];
+    result.contracts.push({ id: 'mc' + (result.contracts.length + 1), kind: 'old-delegation', snapshotId: snapshot.id,
+      candidateFileIds: [bridge.from], old: [oldRole], new: [newRole], baseline: [baseline], callers, navigationBindings,
+      sourceIds: [...new Set([oldRole.sourceId, newRole.sourceId, baseline.sourceId, ...callers.map(c => c.sourceId)])],
+      status: 'navigation-only', causality: 'unverified',
+      unresolved: ['Same-file entry continuity is syntax-only; delegation removal, guard ordering and shared-state effects require independent evidence.'] });
+  }
+  // Deleted exports cannot be paired by spelling or filename. Retain a bounded
+  // candidate route only when explicit singleton spelling, full parameter signature,
+  // a shared assignment and forwarding syntax independently connect all three roles.
+  const routeDefs = { old: [], new: [] };
+  for (const side of ['old', 'new']) for (const file of snapshot.files.filter(f => f.eligibility === 'reviewable' && /\.(?:cpp|cc|cxx)$/.test(f.path))) {
+    const text = (side === 'old' ? file.left : file.right)?.text;
+    const parsed = cppExportRouteDefinitions(text);
+    routeDefs[side].push(...parsed.map(def => ({ ...def, fileId: file.id })));
+    if (side === 'old') {
+      const starts = new Set(parsed.filter(d => d.exported).map(d => d.start));
+      for (const [index, line] of (text ?? '').split('\n').entries()) if (/extern\s+"C"[^\n]*\(/.test(line) && !starts.has(index + 1))
+        unresolved.add('Old public export syntax unsupported at ' + (file.oldPath ?? file.path) + ':L' + (index + 1) + '; old entry navigation unavailable.');
+    }
+  }
+  if (routeDefs.old.length > 2000 || routeDefs.new.length > 2000) {
+    unresolved.add('Deleted old public export route definition budget exceeded; candidate navigation unavailable.');
+    routeDefs.old = []; routeDefs.new = [];
+  }
+  for (const previous of routeDefs.old.filter(d => d.exported)) {
+    const oldRole = role(previous.fileId, 'old', previous);
+    if (!oldRole || routeDefs.new.some(d => d.symbol === previous.symbol && d.params === previous.params && d.exported)) continue;
+    const missing = 'Deleted old public entry ' + oldRole.path + ':L' + previous.start + ' (' + previous.symbol + '): ';
+    const calls = previous.lines.flatMap((line, index) => {
+      const m = /^\s*([A-Za-z_]\w*)::GetInstance\(\)->([A-Za-z_]\w*)\(([^;{}]*)\);\s*$/.exec(line);
+      return m ? [{ symbol: m[1] + '::' + m[2], args: m[3].split(',').map(a => a.trim()), line: previous.bodyStartLine + index }] : [];
+    });
+    if (calls.length !== 1) { unresolved.add(missing + 'singleton delegation unsupported or ambiguous.'); continue; }
+    const call = calls[0];
+    const targets = routeDefs.old.filter(d => d.symbol === call.symbol && d.params === previous.params && d.names.length === call.args.length);
+    if (targets.length !== 1 || !call.args.every(a => /^[A-Za-z_]\w*(?:\.c_str\(\))?$/.test(a))) {
+      unresolved.add(missing + 'old implementation identity/signature unresolved.'); continue;
+    }
+    const target = targets[0];
+    const assignments = target.lines.map(line => /^\s*([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\s*;\s*$/.exec(line)).filter(Boolean)
+      .filter(m => target.names.includes(m[2]));
+    const next = routeDefs.new.filter(d => !d.exported && d.params === previous.params && assignments.some(m => d.lines.some(line => line.trim() === m[1] + ' = ' + m[2] + ';')) &&
+      d.lines.some(line => line.trim() === 'return ' + d.symbol.split('::').at(-1) + '(' + d.names.slice(0, -1).join(', ') + ');'));
+    if (next.length !== 1) { unresolved.add(missing + 'new entry candidate unsupported or ambiguous; no same-name fallback.'); continue; }
+    const current = next[0], newRole = role(current.fileId, 'new', current), src = source(target.fileId, 'old');
+    if (!newRole || !src) { unresolved.add(missing + 'changed candidate or historical implementation source unavailable.'); continue; }
+    if (result.contracts.length >= maxContracts) { unresolved.add(missing + 'contract budget exceeded.'); continue; }
+    Object.assign(oldRole, { startLine: previous.start, endLine: previous.end });
+    Object.assign(newRole, { startLine: current.start, endLine: current.end });
+    const baseline = { fileId: target.fileId, sourceId: src.id, side: 'old', path: byId.get(target.fileId).oldPath ?? byId.get(target.fileId).path,
+      sourcePath: src.path, symbol: target.symbol, line: target.start, startLine: target.start, endLine: target.end, editIds: [] };
+    result.contracts.push({ id: 'mc' + (result.contracts.length + 1), kind: 'deleted-export-route', snapshotId: snapshot.id,
+      old: [oldRole], new: [newRole], baseline: [baseline], candidateFileIds: [...new Set([previous.fileId, current.fileId])],
+      callers: [{ ...oldRole, line: call.line, callLine: call.line, editIds: [], targetFileId: target.fileId, targetSymbol: target.symbol }],
+      navigationBindings: [], sourceIds: [...new Set([oldRole.sourceId, newRole.sourceId, baseline.sourceId])], status: 'navigation-only', causality: 'unverified',
+      unresolved: ['Deleted export route is lexical candidate navigation only; singleton resolution, macros, transformed arguments, shared-state identity and cross-file causality are unsupported. Non-uncertain classification is not permitted.'] });
+  }
   for (const contract of result.contracts) contract.sourceIds = [...new Set([...contract.sourceIds, ...contract.navigationBindings.map(row => row.sourceId)])];
-  const edges = result.contracts.flatMap(c => [{ from: c.old[0].fileId, to: c.new[0].fileId, reason: 'migration-contract:' + c.id },
-    ...c.callers.filter(row => row.fileId && row.fileId !== row.targetFileId).map(row => ({ from: row.fileId, to: row.targetFileId, reason: 'migration-caller:' + c.id }))]);
+  const edges = result.contracts.flatMap(c => [...(c.old[0].fileId !== c.new[0].fileId ? [{ from: c.old[0].fileId, to: c.new[0].fileId, reason: 'migration-contract:' + c.id }] : []),
+    ...c.callers.filter(row => row.fileId && byId.has(row.targetFileId) && row.fileId !== row.targetFileId).map(row => ({ from: row.fileId, to: row.targetFileId, reason: 'migration-caller:' + c.id }))]);
   const involved = new Set(edges.flatMap(e => [e.from, e.to]));
   const grouped = buildReviewGroups(snapshot.files.filter(f => involved.has(f.id)), edges, { maxFiles: maxGroupFiles });
   result.groups = grouped.groups; result.links = grouped.links;

package/src/migration-regression.mjs

@@ -1,6 +1,8 @@
+import { isDeepStrictEqual, types } from 'node:util';
 import { changeMap } from './change-map.mjs';
 import { contextSources } from './context-identity.mjs';
 import { hash } from './content.mjs';
+import { buildMigrationContracts } from './migration-contracts.mjs';
 
 const contexts = new WeakSet();
 const positive = value => Number.isSafeInteger(value) && value > 0;
@@ -8,9 +10,42 @@ const overlap = (ref, range) => range?.count > 0 && ref.start < range.start + ra
 const fail = () => { throw new Error('Invalid approved migration regression contract'); };
 const freeze = value => { if (value && typeof value === 'object') { for (const item of Object.values(value)) freeze(item); Object.freeze(value); } return value; };
 
+// Copy only inert own data. structuredClone/JSON.stringify would invoke getters
+// before validation; custom prototypes, proxies and toJSON hooks are not input data.
+function inertData(value, state = { remaining: 100000 }, depth = 0) {
+  if (--state.remaining < 0 || depth > 32) fail();
+  if (value === null || value === undefined || ['string', 'boolean', 'number'].includes(typeof value)) return value;
+  if (typeof value !== 'object' || types.isProxy(value)) fail();
+  const array = Array.isArray(value), prototype = Object.getPrototypeOf(value);
+  if (prototype !== (array ? Array.prototype : Object.prototype) && !(prototype === null && !array)) fail();
+  const copy = array ? [] : {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== 'string' || ['__proto__', 'constructor', 'toJSON'].includes(key)) fail();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!Object.hasOwn(descriptor, 'value')) fail();
+    if (array && key === 'length') continue;
+    if (!descriptor.enumerable) fail();
+    Object.defineProperty(copy, key, { value: inertData(descriptor.value, state, depth + 1), enumerable: true, writable: true, configurable: true });
+  }
+  if (array && copy.length !== value.length) fail();
+  return copy;
+}
+
+// The original manually approved protocol has no host navigation coordinates.
+// Do not infer host origin solely from kind: that tag is removable input data.
+function legacyContract(contract) {
+  const only = (value, keys) => value && Object.keys(value).every(key => keys.includes(key));
+  const roleKeys = ['sourceId', 'fileId', 'path', 'side', 'line', 'symbol', 'editIds'];
+  return only(contract, ['id', 'snapshotId', 'status', 'causality', 'candidateFileIds', 'old', 'new', 'callers']) &&
+    [...contract.old, ...contract.new].every(role => only(role, roleKeys)) &&
+    contract.callers.every(role => only(role, [...roleKeys, 'importLine', 'targetFileId', 'targetSymbol']));
+}
+
 // Compile host navigation against the exact approved snapshot. No model-provided
 // contract object or copied input metadata can replace this invocation capability.
 export function prepareMigrationRegression(snapshot, scope, contracts, candidates) {
+  contracts = inertData(contracts);
+  candidates = inertData(candidates);
   if (!snapshot || typeof snapshot.id !== 'string' || snapshot.projectScope || snapshot.files?.some(file => file.reviewMode === 'project') || !Array.isArray(snapshot.files) || !Array.isArray(contracts) || contracts.length > 100 || !Array.isArray(candidates)) fail();
   const catalog = scope.catalog();
   const role = (value, expectedSide) => {
@@ -42,27 +77,46 @@ export function prepareMigrationRegression(snapshot, scope, contracts, candidate
     }
     const line = value.line ?? value.callLine;
     if (typeof body !== 'string' || !positive(line) || line > source.lineCount || value.importLine !== undefined && (!positive(value.importLine) || value.importLine > source.lineCount) || edits.length && !edits.some(edit => line >= edit.range.start && line < edit.range.start + edit.range.count)) fail();
-    return { sourceId: source.id, side: source.side, path: value.path, sourcePath: source.path, ...(source.fileId ? { fileId: source.fileId } : {}), line, hash: hash(body), edits };
+    if (value.startLine !== undefined && (!positive(value.startLine) || !positive(value.endLine) || value.startLine > line || value.endLine < line || value.endLine > source.lineCount)) fail();
+    return { sourceId: source.id, side: source.side, path: value.path, sourcePath: source.path, ...(source.fileId ? { fileId: source.fileId } : {}), line, ...(value.startLine !== undefined ? { startLine: value.startLine, endLine: value.endLine } : {}), hash: hash(body), edits };
   };
   const ids = new Set(), compiled = [];
+  const approvedContracts = contracts.length ? buildMigrationContracts(snapshot, { maxContracts: 100 }).contracts : [];
   for (const contract of contracts) {
     if (!contract || typeof contract.id !== 'string' || !contract.id || contract.id.length > 200 || ids.has(contract.id) || contract.snapshotId !== snapshot.id || contract.status !== 'navigation-only' || contract.causality !== 'unverified' || !Array.isArray(contract.callers) || contract.callers.length > 32) fail();
     ids.add(contract.id);
     if (!Array.isArray(contract.old) || contract.old.length !== 1 || !Array.isArray(contract.new) || contract.new.length !== 1 || !Array.isArray(contract.candidateFileIds)) fail();
     const oldValue = contract.old[0], newValue = contract.new[0];
+    // Rebuild all host shapes (ordinary navigation included), comparing the complete
+    // identity, not just roles. Renaming an ID or deleting every origin marker must
+    // not turn an independently known host route into the legacy manual protocol.
+    const approved = approvedContracts.find(item => isDeepStrictEqual(item, contract));
+    const knownRoute = approvedContracts.some(item => item.id === contract.id ||
+      item.old[0].sourceId === oldValue?.sourceId && item.new[0].sourceId === newValue?.sourceId);
+    if (!approved && (knownRoute || !legacyContract(contract))) fail();
     const old = role(oldValue, 'old'), current = role(newValue, 'new');
-    if (!old.fileId || !current.fileId || old.fileId === current.fileId || old.sourceId === current.sourceId || !old.edits.length || !current.edits.length) fail();
+    const exportRoute = contract.kind === 'deleted-export-route';
+    const delegation = contract.kind === 'old-delegation' || exportRoute;
+    if (contract.kind !== undefined && !delegation) fail();
+    let baseline = [];
+    if (delegation) {
+      // Only a complete independently rebuilt host contract can carry these roles.
+      if (!approved || (!exportRoute && old.fileId !== current.fileId) || !Array.isArray(contract.baseline) || contract.baseline.length !== 1) fail();
+      baseline = contract.baseline.map(value => role(value));
+      if (!['old', 'context-old'].includes(baseline[0].side)) fail();
+    }
+    if (!old.fileId || !current.fileId || !delegation && old.fileId === current.fileId || old.sourceId === current.sourceId || !old.edits.length || !current.edits.length) fail();
     const callers = contract.callers.map(caller => {
       const result = role(caller);
-      if (!['old', 'new', 'context-old', 'context'].includes(result.side) || caller.targetFileId !== oldValue.fileId && caller.targetFileId !== newValue.fileId) fail();
+      if (!['old', 'new', 'context-old', 'context'].includes(result.side) || !delegation && caller.targetFileId !== oldValue.fileId && caller.targetFileId !== newValue.fileId) fail();
       return result;
     });
     // The navigation chain has an explicit old-entry caller; a new-role source
     // alone cannot manufacture a migration relation between arbitrary files.
-    if (!contract.callers.some(caller => caller.targetFileId === oldValue.fileId && ['old', 'context-old'].includes(caller.side))) fail();
+    if (!contract.callers.some(caller => (delegation ? caller.sourceId === old.sourceId : caller.targetFileId === oldValue.fileId) && ['old', 'context-old'].includes(caller.side))) fail();
     const fileIds = [...new Set([old.fileId, current.fileId].filter(Boolean))];
     if (new Set(contract.candidateFileIds).size !== contract.candidateFileIds.length || contract.candidateFileIds.length !== fileIds.length || contract.candidateFileIds.some(id => !fileIds.includes(id))) fail();
-    compiled.push({ id: contract.id, snapshotId: snapshot.id, old, new: current, callers, candidateFileIds: fileIds });
+    compiled.push({ id: contract.id, snapshotId: snapshot.id, ...(delegation ? { kind: contract.kind, baseline } : {}), old, new: current, callers, candidateFileIds: fileIds });
   }
   const context = freeze({ snapshotId: snapshot.id, contracts: compiled, candidates: structuredClone(candidates) });
   contexts.add(context);
@@ -81,6 +135,7 @@ export function validateMigrationRegression(value, evidence, fileId, context, ca
   if (!contract || !candidate || candidate.attribution?.status !== 'references-validated' || !Array.isArray(candidate.attribution.editIds)) fail();
   const ownRoles = [contract.old, contract.new].filter(role => role.fileId === fileId);
   if (!ownRoles.some(role => role.edits.some(edit => candidate.attribution.editIds.includes(edit.editId) && candidate.anchor?.kind === 'line' && candidate.anchor.side === (role.side === 'old' ? 'old' : 'new') && overlap({ start: candidate.anchor.start, count: candidate.anchor.end - candidate.anchor.start + 1 }, edit.range)))) fail();
+  if (contract.kind === 'deleted-export-route' && value.classification !== 'uncertain') throw new Error('Deleted export candidate navigation permits uncertain classification only');
   let actualEdit = false;
   for (const [field, edge, sides] of [['oldEvidence', contract.old, ['old', 'context-old']], ['newEvidence', contract.new, ['new', 'context']]]) {
     const indices = value[field];
@@ -89,8 +144,8 @@ export function validateMigrationRegression(value, evidence, fileId, context, ca
     for (const index of indices) {
       if (!Number.isSafeInteger(index) || index < 0 || index >= evidence.length) fail();
       const ref = evidence[index];
-      const binding = [edge, ...contract.callers.filter(role => sides.includes(role.side))].find(role => role.sourceId === ref.sourceId && sides.includes(role.side));
-      if (!binding || ref.status !== 'references-validated' || ref.snapshotId !== context.snapshotId || ref.hash !== binding.hash || !positive(ref.start) || !positive(ref.count) || binding !== edge && !(ref.start <= binding.line && binding.line < ref.start + ref.count)) fail();
+      const binding = [edge, ...(contract.baseline ?? []), ...contract.callers.filter(role => sides.includes(role.side))].find(role => role.sourceId === ref.sourceId && sides.includes(role.side));
+      if (!binding || ref.status !== 'references-validated' || ref.snapshotId !== context.snapshotId || ref.hash !== binding.hash || !positive(ref.start) || !positive(ref.count) || binding !== edge && !(binding.startLine !== undefined ? ref.start <= binding.endLine && binding.startLine < ref.start + ref.count : ref.start <= binding.line && binding.line < ref.start + ref.count)) fail();
       if (binding === edge && ref.start <= edge.line && edge.line < ref.start + ref.count) {
         entry = true;
         if (edge.edits.some(edit => overlap(ref, edit.range))) actualEdit = true;
@@ -98,6 +153,15 @@ export function validateMigrationRegression(value, evidence, fileId, context, ca
     }
     if (value.classification !== 'uncertain' && !entry) throw new Error('Migration comparison requires both explicit entry roles');
   }
+  if (value.classification !== 'uncertain' && contract.kind === 'old-delegation') {
+    for (const required of [contract.old, contract.new, ...contract.baseline]) {
+      const indices = ['old', 'context-old'].includes(required.side) ? value.oldEvidence : value.newEvidence;
+      const ranges = indices.map(index => evidence[index]).filter(ref => ref.sourceId === required.sourceId).sort((a, b) => a.start - b.start);
+      let through = required.startLine;
+      for (const ref of ranges) { if (ref.start > through) break; through = Math.max(through, ref.start + ref.count); }
+      if (through <= required.endLine) throw new Error('Migration delegation comparison requires complete entry and baseline evidence');
+    }
+  }
   if (value.classification !== 'uncertain' && !actualEdit) throw new Error('Migration comparison requires actual changed-role evidence');
   return { ...value, oldEvidence: [...value.oldEvidence], newEvidence: [...value.newEvidence], migrationContractId: contract.id, migrationSnapshotId: context.snapshotId, status: 'comparison-references-validated', causality: 'unverified' };
 }

package/src/preview-validity.mjs

@@ -0,0 +1,9 @@
+// Preview validity is diagnostic only: it never restores approval or bypasses recapture.
+export function previewValidity(preview, current, now) {
+  const fail = (code, message) => { const error = new Error(message + '; preview again and obtain fresh confirmation'); error.code = code; throw error; };
+  if (!preview) fail('PREVIEW_MISSING', 'Preview missing or already consumed');
+  if (preview.expires <= now) fail('PREVIEW_EXPIRED', 'Preview expired');
+  if (preview.agent !== current.agent) fail('PREVIEW_OWNER_CHANGED', 'Preview owner changed');
+  if (preview.cwd !== current.cwd) fail('PREVIEW_DIRECTORY_CHANGED', 'Preview directory changed');
+  if (JSON.stringify(preview.route) !== JSON.stringify(current.route)) fail('PREVIEW_MODEL_CHANGED', 'Preview model changed');
+}

package/src/primary-input.mjs

@@ -1,6 +1,5 @@
 import { sourceSegments } from './source-segments.mjs';
 import { primaryContextFocus } from './primary-context.mjs';
-import { changeRegion } from './change-region.mjs';
 import { CONTEXT_SIDE_NOTICE } from './context-identity.mjs';
 import { approvedCallerBindings } from './caller-binding-input.mjs';
 import { REQUIREMENT_NOTICE } from './business-requirement.mjs';
@@ -12,7 +11,7 @@ import { inferContextRelations } from './context-relations.mjs';
 import { prepareWindowSynthesis } from './window-synthesis.mjs';
 import { planWindowBatches } from './window-batches.mjs';
 import { changeWindows } from './change-windows.mjs';
-import { changeMap } from './change-map.mjs';
+import { reviewChangeMap } from './review-change-map.mjs';
 import { initialInputBudget } from './input-budget.mjs';
 import { changeScopeNotice } from './git-change-scope.mjs';
 import { chooseRiskStrategy, riskPlanningMode as validateRiskPlanningMode } from './risk-strategy.mjs';
@@ -25,18 +24,7 @@ const optional = h => h.confidence === 'namespace-member-syntax-only' || h.confi
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, round, focusPrimaryContext = false }) {
   validateRiskPlanningMode(riskPlanningMode);
   if (typeof focusPrimaryContext !== 'boolean') throw new Error('focusPrimaryContext must be boolean');
-  let changes = changeMap(file.left.text, file.right.text);
-  if (changes.status === 'limited') {
-    const region = changeRegion(file.left.text, file.right.text);
-    if (region.status === 'changed') {
-      changes = {
-        status: 'changed', precision: 'envelope',
-        reason: 'Exact diff unavailable; broad region includes potentially unchanged lines, not exact edits or causal proof.',
-        edits: [{ id: 'envelope1', old: region.old, new: region.new }],
-        hunks: [{ id: 'envelope-h1', old: region.old, new: region.new, editIds: ['envelope1'] }],
-      };
-    }
-  }
+  const changes = reviewChangeMap(file.left.text, file.right.text);
 
   let base = {
     ...(input.projectScope ? { projectScope: input.projectScope, reviewNotice: 'Full current-file review; empty left is a sentinel, not a historical baseline. changes are transport coordinates only, do not infer introduced regression.' } : {}),