@feng0531/dsh-code-review 0.87.5 → 0.87.7

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.87.7 — 清晰结论与有界复核纠正
+
+- 报告区分已复核不确定与复核未完成；尚未成立的候选使用待证条件、影响假说与待验证方案，不再以确定影响和必改建议呈现。
+- 开启协议纠正时，不完整复核批次可在原调用额度内纠正一次，复用本次已读原文及回执，不重启取证；完整响应仍须全部严格校验。最终答复模式不追加纠正。
+- 保留原预算、截止时间和来源授权，记录纠正成本；本版不宣称真实审核提速，组取证续跑涉及分配安全边界，未贸然上线。
+
+## 0.87.6 — 迁移复核成套取证
+
+- 复用宿主已校验的迁移契约，为匹配候选有界预取旧入口、旧委托实现和新入口；同套证据原子接纳，容量、预算或输入不满足时回退普通检索，减少模型重新寻找已知路径的往返。
+- 保留共享总账、独立新回执、最终原文复验与迁移分类限制；成套预取成功不等于模型已调用或候选成立。诊断区分预取接纳和回退，不记录源码。
+- 优化按同任务直接审核对照耗时、具体触发链、最小修复建议、覆盖与可读性；本版离线回归不代表真实业务审核已经提速或确认既往候选。
+
 ## 0.87.5 — 主审优先与依赖感知续审
 
 - 先完成所有文件的主审扫描，再执行跨窗口／跨文件综合，避免后续分析在尚有文件未主审时抢先消耗模型调用；继续保留有限续跑、原截止时间和完整覆盖分母。

package/DEVELOPMENT.md

@@ -24,11 +24,15 @@
 - `confirmed:true` 是 Agent 对当前人类明确授权且本次预览匹配的声明，不是取消确认参数或无授权绕过。保留 preview→execute 两阶段与 service 确认参数，不新增一键执行 API；宿主／会话工具权限、模型发送许可、快照新鲜度、会话／目录／路由身份及预算校验均不变。
 - 源变化、预览过期或身份变化须生成新 preview 并重新核对当前授权，不能将旧预览批准用于新快照。保存的后台记录、`resumeFromJobId`、自动续跑及 host 重启本身都不授予外发权限；显式续审须有当前人类授权和新预览，匹配时无需重复询问。私有模型工件的源码提示与独立明确同意要求保持不变。
 
+## 同任务质量与效率对照
+
+每轮优化以相同固定范围、模型和尽量相同运行条件下的直接 Agent 审核作参照，分开记录用户请求到交付、工具执行和审查阶段墙钟，不将并发累计调用时间当作墙钟。比较具体触发条件、新旧入口行为、反证、最小可行动建议、主审／跨文件覆盖和默认报告可读性。直接审核结论也需证据核验，不作为绝对真值；合成响应只验证协议与接线，不证明模型召回或真实提速。测试不复制私有业务源码或模型工件。
+
 ## 变更审查调度与离线对照
 
 生产 changes 服务默认 `changesConcurrency=2`，配置范围 1～4；底层 `reviewSnapshot` 未传该选项时保持串行兼容。所有文件共用原批准快照 reader，不能按 worker 重置额度。业务分组先完成，交互 owner 等待此前成员链结束；窗口、轮次与复核仍串行依赖，固定索引归并结果。取消或 checkpoint 失败必须先排空所有在途链再释放锁。
 
-`maxRetrievalRounds` 默认 3、范围 0～50；主审/综合/复核分别使用该轮数上限，独立风险规划为一次待证问题生成而非检索对话，保留最终答复回合与 partial/uncertain。复核预取仅来自本次 reader 的候选同侧锚点范围，受输入/输出和最终校验预留约束；缺少事务、超预算或非行锚点回退普通检索，不信任模型自报证据。全范围风险计划仅限本次不可变文件调用内复用，规划元数据超过输入预算回退原窗口；预览与执行估算使用相同规划输入。
+`maxRetrievalRounds` 默认 3、范围 0～50；主审/综合/复核分别使用该轮数上限，独立风险规划为一次待证问题生成而非检索对话，保留最终答复回合与 partial/uncertain。复核预取来自本次 reader 的候选同侧锚点；对于匹配宿主已校验迁移契约的候选，优先原子预取完整旧入口、旧委托实现和新入口。全局仍限 8 次种子读取、16 KiB 和每次 200 行，受输入/输出及最终原文校验预留约束；角色不完整、缺事务或超预算回退普通检索，不信任模型自报契约或证据。预取接纳仅为宿主步骤，不代表已外发、已复核或已确认新增回归；删除导出路由仍仅允许 uncertain。全范围风险计划仅限本次不可变文件调用内复用，规划元数据超过输入预算回退原窗口；预览与执行估算使用相同规划输入。
 
 运行 `node scripts/changes-speed-benchmark.mjs [baseline-directory]` 比较真实 review 入口上的 8 文件 SVN 受控候选/反驳夹具，包含 receipt 复核与最终精确原文校验；每次模型响应模拟 20ms。可先将冻结版本的 src 解包到独立目录作为 baseline。比较调用数、峰值并发和原文证据，不把离线计时或 mock 结论一致当作真实质量、token 成本或 45→12 分钟保证。`model-start/model-end` 检查点只记录计时、字节、状态及阶段，不写入源码或推理；各文件 `modelMetrics` 是提供方实际调用（含纠错）累计时间，并行时不可相加当作墙钟耗时。
 

package/RELEASE-NOTES.md

@@ -1,19 +1,17 @@
-# v0.87.5 发布说明
+# v0.87.7 发布说明
 
-## 修复审核执行链路，而不只是整理报告
+## 先看清楚结论，再减少复核返工
 
-先完成全体文件的主审扫描，再运行跨窗口、跨文件综合，减少后续分析挤占尚未主审文件的模型调用。续审队列按真实依赖就绪集合排队，不再让依赖未满足的 verifier 队头阻挡可运行的 primary；精确已知请求可使用自身保留容量或缓存首次恢复，不扩大共享预算。
+报告区分复核支持、已复核不确定、复核未完成与已反驳。候选未成立时，以待证条件、影响假说与待验证方案表达，避免把主审描述误读为独立确认的缺陷；完整证据仍保留在技术附录。
 
-跟进取证超出输入上限时，移除重复的初始源码正文，保留身份、精确编辑、调用／风险线索、已读取证据正文及回执；初始输入和可容纳的小请求不变。
+## 不完整批次的有界纠正
 
-阶段停止原因按 fileIds 关联回报告，明确区分前置依赖、读取分配等待、调用预算、超时和尝试耗尽。一个阶段的检索限制不再阻止其他健康阶段缓存已接受生成；原文件仍如实保留受限状态。
+启用协议纠正时，复核返回不完整批次可再请求一次完整判定。使用同次调用最后已发送的证据与新鲜回执，不重启检索、不重新签发整套证据；仍计入相同模型调用额度、输入限制和截止时间。仅接纳少项且已有成员均为合法身份、无证据无归因的 uncertain 批次进行纠正；含支持、回执或归因的部分响应仍直接失败，避免漏项掩盖非法证据。身份、回执、原文及修改前后归因继续严格校验；再次不完整即失败。检索最终答复模式不追加纠正。
 
-## 参考与边界
+执行诊断单列复核批次纠正的调用与原因，不将纠正当成缺陷成立。正常完整批次不增加调用；纠正可能增加一次模型往返，不承诺每次审核更快。
 
-参考用户指定的 [Open Code Review](https://github.com/alibaba/open-code-review) 的冻结覆盖清单、结构化停止和预算耗尽后保全发现机制；核查本地 a758d9cb 与远端 5c039e815023a05a169b1240ae6b4b24c28270b6 的相关变更。采用独立实现，未复制其源码或模板。不照搬“已有评论即完成”的覆盖推断，也不将 Git merge-base 流程移植为 SVN revision 语义。
+## 验证与边界
 
-本次不增加读取总额、不重置检索轮数或重试次数、不放宽证据与新增归因校验。Git／SVN 固定批准范围和独立复核回执仍有效；预算、超时或证据不足时仍可能 partial／uncertain。离线受控回归不是原业务 r7364 的重跑，不承诺真实模型必定查完或固定提速比例。
+本版采用离线正反回归、全量测试、真实宿主离线兼容检查及冻结标签四矩阵门禁。没有重新运行真实业务审核，也没有将直接审核的历史结论当作真值。分组取证续跑需要可回滚的额度转移，尚未改动该失败回退语义。
 
-## 验证与升级
-
-新增 Git／SVN 主审优先、依赖队头阻塞、精确恢复公平性、完整阶段取证输入与停止原因关联回归，并执行全量测试和冻结标签四矩阵 CI。发布不自动安装或重启当前宿主。安装见 [README](README.md)，门禁见 [开发说明](DEVELOPMENT.md)。
+发布不自动安装或重启当前宿主。安装见 [README](README.md)，门禁见 [开发说明](DEVELOPMENT.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.87.5",
+  "version": "0.87.7",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/candidate-verification.mjs

@@ -1,9 +1,9 @@
 import { validateRegressionAssessment } from './regression-assessment.mjs';
 import { validateEvidenceReference } from './evidence-reference.mjs';
 // Offline only. Candidate ids come from the host, not the model.
-export function validateCandidateVerification(value, candidateIds, read, resolveEvidence = value => value, comparison = {}) {
+export function validateCandidateVerificationEnvelope(value, candidateIds) {
   if (!Array.isArray(candidateIds) || candidateIds.length > 50 || candidateIds.some(id => typeof id !== 'string' || !id || id.length > 200) || new Set(candidateIds).size !== candidateIds.length) throw new Error('Invalid candidate identities');
-  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== 1 || !Array.isArray(value.verdicts) || value.verdicts.length !== candidateIds.length) throw new Error('Incomplete verification response');
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== 1 || !Array.isArray(value.verdicts) || value.verdicts.length !== candidateIds.length) throw Object.assign(new Error('Incomplete verification response'), { code: 'MODEL_INCOMPLETE_VERIFICATION' });
   const seen = new Set();
   // Validate the entire envelope before any budgeted evidence read.
   for (const item of value.verdicts) {
@@ -13,6 +13,10 @@ export function validateCandidateVerification(value, candidateIds, read, resolve
     if (!['supported', 'refuted', 'uncertain'].includes(item.verdict) || typeof item.reason !== 'string' || !item.reason.trim() || item.reason.length > 8000) throw new Error('Invalid verdict explanation');
     if (!Array.isArray(item.evidence) || item.evidence.length > 8 || (item.verdict !== 'uncertain' && !item.evidence.length)) throw new Error('Missing or excessive evidence');
   }
+}
+
+export function validateCandidateVerification(value, candidateIds, read, resolveEvidence = value => value, comparison = {}) {
+  validateCandidateVerificationEnvelope(value, candidateIds);
   const results = new Map(value.verdicts.map(item => {
     const evidence = item.evidence.map(ref => validateEvidenceReference(resolveEvidence(ref), read));
     const regression = validateRegressionAssessment(item.regression, evidence, comparison.catalog ?? [], comparison.fileIds?.[item.candidateId], { ...comparison, candidateId: item.candidateId });

package/src/migration-regression.mjs

@@ -128,6 +128,36 @@ export function migrationRegressionMetadata(context) {
   return context.contracts.map(contract => ({ ...structuredClone(contract), old: [structuredClone(contract.old)], new: [structuredClone(contract.new)], status: 'navigation-only', causality: 'unverified' }));
 }
 
+// Host-only read plans. The capability, candidate attribution and coordinates all
+// come from this compiler invocation, never from a later candidate/contract copy.
+export function migrationVerificationPlans(context) {
+  if (!contexts.has(context)) fail();
+  return context.candidates.map((candidate, index) => {
+    const candidateId = 'c' + (index + 1);
+    const matches = context.contracts.filter(contract => contract.candidateFileIds.includes(candidate.fileId) &&
+      candidate.attribution?.status === 'references-validated' && Array.isArray(candidate.attribution.editIds) &&
+      [contract.old, contract.new].some(role => role.fileId === candidate.fileId && role.edits.some(edit =>
+        candidate.attribution.editIds.includes(edit.editId) && candidate.anchor?.kind === 'line' &&
+        candidate.anchor.side === (role.side === 'old' ? 'old' : 'new') &&
+        positive(candidate.anchor.start) && positive(candidate.anchor.end) && candidate.anchor.end >= candidate.anchor.start &&
+        overlap({ start: candidate.anchor.start, count: candidate.anchor.end - candidate.anchor.start + 1 }, edit.range))));
+    const contract = matches[0];
+    if (!contract) return { candidateId, candidate, reason: 'NO_MATCHING_CONTRACT' };
+    const roles = [contract.old, contract.new, ...(contract.baseline ?? [])];
+    const identity = { candidateId, candidate, contractId: contract.id, kind: contract.kind ?? 'migration', rolesCount: roles.length };
+    if (roles.some(role => !positive(role.startLine) || !positive(role.endLine) || role.endLine < role.startLine)) return { ...identity, reason: 'INCOMPLETE_ROLE_RANGE' };
+    const requests = new Map();
+    for (const role of roles) {
+      for (let start = role.startLine; start <= role.endLine; start += 200) {
+        const request = { kind: 'read', id: role.sourceId, start, count: Math.min(200, role.endLine - start + 1) };
+        requests.set(JSON.stringify(request), request);
+        if (requests.size > 8) return { ...identity, reason: 'EVIDENCE_LIMIT' };
+      }
+    }
+    return { ...identity, requests: [...requests.values()] };
+  });
+}
+
 export function validateMigrationRegression(value, evidence, fileId, context, candidateId) {
   if (!contexts.has(context) || typeof value.migrationContractId !== 'string') fail();
   const contract = context.contracts.find(contract => contract.id === value.migrationContractId && contract.candidateFileIds.includes(fileId));

package/src/migration-verification-seeds.mjs

@@ -0,0 +1,90 @@
+import { createEvidenceReceipts } from './evidence-receipts.mjs';
+import { migrationVerificationPlans } from './migration-regression.mjs';
+
+const size = value => Buffer.byteLength(JSON.stringify(value));
+const key = request => JSON.stringify(request);
+const capacity = reason => Object.assign(new Error('Optional migration seed capacity exceeded'), { code: 'VERIFICATION_SEED_CAPACITY', reason });
+const optional = error => ['VERIFICATION_SEED_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code) || error?.message === 'Line range outside source';
+
+// No external plans are accepted: only the compiled context selects candidates.
+export function migrationVerificationSeeds(context, scope, { signal, fits, onReceipt = () => {}, onMigrationSeeds = () => {} }) {
+  signal?.throwIfAborted();
+  const plans = migrationVerificationPlans(context), catalog = scope.catalog();
+  const seeds = [], selected = new Map(), assignments = new Map();
+  const ordinary = candidate => {
+    const anchor = candidate.anchor;
+    if (anchor?.kind !== 'line' || !['old', 'new'].includes(anchor.side) || !Number.isSafeInteger(anchor.start) || !Number.isSafeInteger(anchor.end) || anchor.start < 1 || anchor.end < anchor.start) return [];
+    const sources = catalog.filter(source => source.fileId === candidate.fileId && source.side === anchor.side);
+    if (sources.length !== 1) return [];
+    const start = Math.max(1, anchor.start - 4);
+    return [{ kind: 'read', id: sources[0].id, start, count: Math.min(200, anchor.end - start + 5) }];
+  };
+  const notify = (plan, status, reason) => {
+    // Deliberately reconstruct a source-free allowlist, never spread a plan.
+    onMigrationSeeds({ candidateId: plan.candidateId, ...(plan.contractId ? { contractId: plan.contractId } : {}), kind: plan.kind ?? 'migration', status, reason, rolesCount: plan.rolesCount ?? 0 });
+    signal?.throwIfAborted();
+  };
+  const admit = (plan, requests, complete) => {
+    if (!requests.length || typeof scope.transaction !== 'function' || typeof scope.preflight !== 'function') throw capacity('TRANSACTION_UNAVAILABLE');
+    const fresh = requests.filter(request => !selected.has(key(request)));
+    if (seeds.length + fresh.length > 8) throw capacity('SEED_LIMIT');
+    const receipts = createEvidenceReceipts(scope.read, { limit: Math.max(1, fresh.length) });
+    const items = scope.transaction(() => {
+      signal?.throwIfAborted();
+      if (fresh.length) scope.preflight(fresh);
+      const items = fresh.map(request => {
+        const result = receipts.read(request);
+        signal?.throwIfAborted();
+        if (result.sourceId !== request.id || result.start !== request.start || !result.text || (complete ? result.count !== request.count : result.start + result.count <= plan.candidate.anchor.start)) throw capacity('INCOMPLETE_READ');
+        return { request, result };
+      });
+      const proposed = [...seeds, ...items], lookup = new Map(proposed.map(item => [key(item.request), item]));
+      const nextAssignments = new Map(assignments).set(plan.candidateId, requests.map(key));
+      // Reserve repeated candidates now, not after the first set has consumed
+      // headroom. Exact shared plans need no additional materialization call.
+      for (const other of plans) {
+        // A prior fallback does not limit what this candidate may reference from
+        // the globally visible role set admitted by a later candidate. Upgrade its
+        // reserve whenever its complete plan becomes available.
+        const completeReferences = other.requests?.map(key);
+        const references = completeReferences?.every(reference => lookup.has(reference)) ? completeReferences : nextAssignments.get(other.candidateId) ?? ordinary(other.candidate).map(key);
+        if (references.length && references.every(reference => lookup.has(reference))) nextAssignments.set(other.candidateId, references);
+      }
+      let calls = plans.length - nextAssignments.size, bytes = 0;
+      // Every candidate reference is a final delivery, even for shared cached
+      // results. EOF-clamped validation counts have their own exact cache key.
+      for (const references of nextAssignments.values()) for (const reference of references) {
+        const result = lookup.get(reference).result;
+        const cost = scope.preflight([{ kind: 'read', id: result.sourceId, start: result.start, count: result.count }]);
+        if (!Number.isSafeInteger(cost?.calls) || cost.calls < 0) throw capacity('FINAL_RESERVE');
+        calls += cost.calls;
+        bytes += size(result);
+      }
+      const budget = scope.budget?.();
+      if (budget && (budget.remainingCalls < calls || budget.remainingOutputBytes < bytes)) throw capacity('FINAL_RESERVE');
+      if (size(proposed) > 16 * 1024 || !fits(proposed)) throw capacity('INPUT_CAPACITY');
+      signal?.throwIfAborted();
+      return items;
+    });
+    for (const item of items) {
+      selected.set(key(item.request), item);
+      seeds.push(item);
+      onReceipt(item.result.receiptId, receipts.resolve);
+    }
+    assignments.set(plan.candidateId, requests.map(key));
+  };
+  for (const plan of plans) {
+    signal?.throwIfAborted();
+    let reason = plan.reason;
+    if (plan.requests) {
+      let accepted = false;
+      try { admit(plan, plan.requests, true); accepted = true; }
+      catch (error) { signal?.throwIfAborted(); if (!optional(error)) throw error; reason = error.reason ?? error.code ?? 'INCOMPLETE_READ'; }
+      if (accepted) { notify(plan, 'accepted', 'COMPLETE_ROLE_SET'); continue; }
+    }
+    notify(plan, 'fallback', reason ?? 'NO_MATCHING_CONTRACT');
+    try { admit(plan, ordinary(plan.candidate), false); }
+    catch (error) { signal?.throwIfAborted(); if (!optional(error)) throw error; }
+  }
+  return seeds;
+}

package/src/report-findings.mjs

@@ -1,5 +1,5 @@
 import { groupDuplicateFindings } from './finding-groups.mjs';
-import { comparisonValidated } from './report-summary.mjs';
+import { comparisonValidated, verificationPresentation } from './report-summary.mjs';
 
 const safe = value => Array.from(String(value ?? '')).map(c => {
   if (c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127) return ' ';
@@ -30,23 +30,32 @@ export function findingsMarkdown(report) {
   const findings = Array.isArray(report.findings) ? report.findings : [];
   const duplicate = new Map();
   for (const group of groupDuplicateFindings(findings)) for (const i of group.findingIndices.slice(1)) duplicate.set(i, group.findingIndices[0]);
-  const sections = new Map([['本次新增（复核支持）',[]],['当前源码问题（复核支持）',[]],['待核实',[]],['原有问题（复核支持）',[]],['已反驳',[]]]);
-  findings.forEach((f,i)=>{ if (!duplicate.has(i)) sections.get(findingDisposition(f,report)).push({f,i}); });
+  const sections = new Map([['本次新增（复核支持）',[]],['当前源码问题（复核支持）',[]],['复核后不确定',[]],['复核未完成',[]],['原有问题（复核支持）',[]],['已反驳',[]]]);
+  findings.forEach((f,i)=>{
+    const state = verificationPresentation(f, report);
+    const label = state === 'uncertain' ? '复核后不确定' : state === 'incomplete' ? '复核未完成' : findingDisposition(f,report);
+    if (!duplicate.has(i)) sections.get(label).push({f,i});
+  });
   const output = ['', '## 审查发现'];
   if (!findings.length) return [...output, '本轮没有形成问题记录；这不等于已经排除未完成范围内的问题。'];
-  output.push('以下区分复核支持、待核实和已反驳的记录；证据引用通过校验不等于运行复现或因果证明。');
+  output.push('以下分开列示复核支持、复核后不确定、复核未完成和已反驳的记录；证据引用通过校验不等于运行复现或因果证明。');
   for (const [label, items] of sections) {
     if (!items.length) continue;
     output.push('', '### ' + label);
     for (const {f,i} of items) {
       const severity = ({critical:'严重',high:'高',medium:'中',low:'低'})[f.severity] ?? safe(f.severity ?? '未分级');
-      output.push('', '#### ' + (i+1) + '. ' + safe(f.title) + '（严重程度：' + severity + '）', '- 位置：' + location(f));
-      for (const [key,title] of [['trigger','什么情况下发生'],['impact','可能造成的影响'],['evidence','已看到的依据']]) if (f[key]) output.push('- ' + title + '：' + safe(f[key]));
-      if (label === '待核实') output.push('- 尚未确定：' + safe(f.verification?.reason ?? '候选尚未完成有效的独立复核或修改前后对照，不能作为已确认缺陷。'));
+      const hypothesis = label === '复核后不确定' || label === '复核未完成' || label === '已反驳';
+      output.push('', '#### ' + (i+1) + '. ' + (hypothesis ? '主审假说：' : '') + safe(f.title) + '（' + (hypothesis ? '主审拟议严重程度' : '严重程度') + '：' + severity + '）', '- 位置：' + location(f));
+      if (hypothesis) output.push('- 阅读方式：以下为主审记录的线索和假说，不是确定事实或必改建议；原始字段及完整证据保留在技术附录。');
+      const fields = hypothesis ? [['evidence','已知差异／线索（主审记录，非缺陷证明）'],['trigger','待证触发条件'],['impact','影响假说']] : [['trigger','什么情况下发生'],['impact','可能造成的影响'],['evidence','已看到的依据']];
+      for (const [key,title] of fields) if (f[key]) output.push('- ' + title + '：' + safe(f[key]));
+      if (label === '复核后不确定') output.push('- 复核结论：本候选已完成复核记录，但缺陷或新增归因仍未确定。' + safe(f.verification?.reason ?? '现有证据不足以支持或排除该假说。'));
+      if (label === '复核未完成') output.push('- 复核进度：尚未完成有效复核，不能当作已复核不确定或已确认缺陷。' + safe(f.verification?.reason ?? '尚无有效复核结论。'));
       if (label === '已反驳') output.push('- 反证结论：' + safe(f.verification?.reason ?? '复核反驳该候选；不计为待修缺陷。'));
-      if (f.attribution?.beforeBehavior) output.push('- 修改前：' + safe(f.attribution.beforeBehavior));
-      if (f.attribution?.afterBehavior) output.push('- 修改后：' + safe(f.attribution.afterBehavior));
-      if (f.suggestion) output.push('- 建议：' + safe(f.suggestion));
+      if (f.attribution?.beforeBehavior) output.push('- 修改前' + (hypothesis ? '（主审描述，待核实）' : '') + '：' + safe(f.attribution.beforeBehavior));
+      if (f.attribution?.afterBehavior) output.push('- 修改后' + (hypothesis ? '（主审描述，待核实）' : '') + '：' + safe(f.attribution.afterBehavior));
+      if (hypothesis) output.push('- 待验证方案：先核对触发条件、实际调用路径及修改前后行为，再决定是否需要修复。' + (f.suggestion ? '原主审建议（待验证，不是必改项）：' + safe(f.suggestion) : '原记录未提供建议。'));
+      else if (f.suggestion) output.push('- 建议：' + safe(f.suggestion));
       const related = [...duplicate].filter(([,first])=>first===i).map(([index])=>location(findings[index]));
       if (related.length) output.push('- 相同证据与解释的其他位置：' + related.join('；') + '。正文合并展示，原始候选仍保留。');
       if (f.reused || f.priorRun) output.push('- 来源：包含既往审核结果，不表示本轮重新取证。');

package/src/report-summary.mjs

@@ -17,6 +17,19 @@ export function comparisonValidated(finding) {
   return old.every(i => typeof evidence[i].sourceId === 'string' && evidence[i].sourceId) && fresh.every(i => typeof evidence[i].sourceId === 'string' && evidence[i].sourceId && old.every(j => evidence[j].sourceId !== evidence[i].sourceId));
 }
 
+// Rendering-only states. A completed uncertain verdict may legitimately have no
+// evidence (the verifier contract allows this); it is not an unfinished run.
+export function verificationPresentation(finding, report = {}) {
+  const v = finding?.verification;
+  if (v?.status !== 'completed' || !['supported', 'uncertain', 'refuted'].includes(v.verdict)) return 'incomplete';
+  const evidenceValid = rows(v.evidence).length > 0 && v.evidence.every(ref => ref?.status === 'references-validated');
+  if (v.verdict === 'refuted' && evidenceValid) return 'refuted';
+  if (v.verdict !== 'supported' || !evidenceValid) return 'uncertain';
+  if (report.mode === 'project' || report.reviewMode === 'project' || report.projectScope || finding.attribution?.causality === 'current-source-only') return 'current';
+  if (comparisonValidated(finding) && ['introduced', 'preexisting'].includes(v.regression.classification)) return v.regression.classification;
+  return 'uncertain';
+}
+
 /**
  * Pure presentation data for Markdown/Lead renderers. Counts are candidate records,
  * not proven defects. coverage counts main-review entries (directories included in
@@ -86,6 +99,11 @@ export function reportSummaryMarkdown(report = {}) {
     const labels = { introduced: '复核支持本次新增', unresolved: '待核实', preexisting: '复核支持原有', refuted: '复核反驳', current: '当前源码复核支持' };
     output.push('- 候选复核：' + Object.entries(labels).filter(([key]) => counts[key] > 0).map(([key, label]) => label + ' ' + counts[key]).join('；') + '。');
   }
+  const states = rows(report.findings).map(finding => verificationPresentation(finding, report));
+  const uncertain = states.filter(state => state === 'uncertain').length;
+  const incomplete = states.filter(state => state === 'incomplete').length;
+  output.push('- 复核状态分列：复核支持 ' + (counts.introduced + counts.preexisting + counts.current) + '；已复核不确定 ' + uncertain + '；复核未完成（未复核或未完成有效复核） ' + incomplete + (counts.refuted ? '；已反驳 ' + counts.refuted : '') + '。');
+  if (counts.unresolved) output.push('- “待核实”为合计：已复核不确定与复核未完成分开列示，前者不表示复核未执行；均不能直接视为缺陷或必改项。');
   const unit = coverage.unit === 'files' ? '个文件' : '个变更条目（含目录）';
   const labels = { completed: '主审完成', excluded: '排除', blocked: '阻断', failed: '失败', cancelled: '取消', pending: '待审', running: '执行中', interrupted: '中断', unaccounted: '状态未记账' };
   output.push('- 覆盖：' + coverage.total + ' ' + unit + '；' + Object.entries(labels).filter(([key]) => coverage[key] > 0).map(([key, label]) => label + ' ' + coverage[key]).join('，') + (coverage.total ? '。' : '未执行。'));

package/src/review-diagnostics.mjs

@@ -1,9 +1,9 @@
 import { REVIEW_RUNTIME } from './runtime-identity.mjs';
 const PHASES = ['business-grouping', 'risk-planning', 'primary', 'group-primary', 'file-interaction', 'window-synthesis', 'verification'];
-const PURPOSES = ['primary-initial', 'retrieval-followup', 'budget-finalization', 'json-correction', 'business-grouping', 'risk-planning', 'group-primary', 'window-synthesis', 'file-interaction', 'verification'];
+const PURPOSES = ['primary-initial', 'retrieval-followup', 'budget-finalization', 'json-correction', 'business-grouping', 'risk-planning', 'group-primary', 'window-synthesis', 'file-interaction', 'verification', 'verification-correction'];
 const READER_FIELDS = ['calls', 'outputBytes', 'maxCalls', 'maxOutputBytes', 'remainingCalls', 'remainingOutputBytes', 'maxResultBytes', 'cacheHits', 'deliveries', 'cacheEntries', 'cacheBytes'];
 const JSON_ISSUES = ['property-name', 'colon', 'separator', 'invalid-escape', 'control-character', 'unterminated-string', 'unexpected-end', 'trailing-content', 'syntax'];
-const CORRECTION_CODES = ['MODEL_INVALID_JSON', 'MODEL_INVALID_REVIEW_RESPONSE', 'MODEL_INVALID_FINDING_IDENTITY', 'MODEL_INVALID_FINDING_SEVERITY', 'MODEL_MISSING_FINDING_FIELD', 'MODEL_INVALID_ANCHOR', 'MODEL_ANCHOR_MISMATCH', 'RETRIEVAL_PROTOCOL_ERROR'];
+const CORRECTION_CODES = ['MODEL_INVALID_JSON', 'MODEL_INVALID_REVIEW_RESPONSE', 'MODEL_INVALID_FINDING_IDENTITY', 'MODEL_INVALID_FINDING_SEVERITY', 'MODEL_MISSING_FINDING_FIELD', 'MODEL_INVALID_ANCHOR', 'MODEL_ANCHOR_MISMATCH', 'RETRIEVAL_PROTOCOL_ERROR', 'MODEL_INCOMPLETE_VERIFICATION'];
 const LIMIT_CODES = ['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED', 'RETRIEVAL_ROUND_BUDGET_EXCEEDED'];
 const RECOVERY_KINDS = ['native-tool', 'text-compatible', 'trailing-prose'];
 const FALLBACK_REASONS = ['mode-notauto', 'smallchange', 'disabled', 'project', 'laterround', 'multi-batch', 'incomplete-edit-scope', 'input-budget'];
@@ -29,7 +29,7 @@ export function reviewDiagnostics(report, { reviewWallMs = null, executionWallMs
   const readerBudget = Object.fromEntries(READER_FIELDS.map(field => [field, number(report.readerBudget?.[field])]));
   const correctionCounts = new Map();
   for (const event of sources.flatMap(f => f.modelCorrections ?? [])) {
-    if (!['explicit-json-correction', 'retrieval-protocol-correction', 'review-format-correction'].includes(event?.action) || !CORRECTION_CODES.includes(event.code)) continue;
+    if (!['explicit-json-correction', 'retrieval-protocol-correction', 'review-format-correction', 'verification-response-correction'].includes(event?.action) || !CORRECTION_CODES.includes(event.code)) continue;
     const jsonIssue = JSON_ISSUES.includes(event.jsonIssue) ? event.jsonIssue : null;
     const key = JSON.stringify([event.code, jsonIssue]);
     correctionCounts.set(key, (correctionCounts.get(key) ?? 0) + 1);
@@ -41,11 +41,21 @@ export function reviewDiagnostics(report, { reviewWallMs = null, executionWallMs
   const riskPlanningFallbackReasons = FALLBACK_REASONS.flatMap(reason => { const calls = (report.files ?? []).filter(f => f.riskPlanningFallbackReason === reason).length; return calls ? [{ reason, calls }] : []; });
   const recoveryEvents = sources.flatMap(source => source.modelRecoveries ?? []);
   const transportRecoveries = RECOVERY_KINDS.flatMap(kind => { const calls = recoveryEvents.filter(event => event?.action === 'json-transport-recovery' && event.kind === kind).length; return calls ? [{ kind, calls }] : []; });
+  const migrationEvents = sources.flatMap(source => Array.isArray(source.migrationSeedEvents) ? source.migrationSeedEvents : []);
+  const migrationSeeds = ['entry-migration', 'old-delegation', 'deleted-export-route'].flatMap(kind =>
+    ['accepted', 'fallback'].flatMap(status => {
+      const count = migrationEvents.filter(event => event?.kind === kind && event.status === status).length;
+      return count ? [{ kind, status, count }] : [];
+    }));
+  const migrationSeedReasons = ['COMPLETE_ROLE_SET', 'NO_MATCHING_CONTRACT', 'INCOMPLETE_ROLE_RANGE', 'EVIDENCE_LIMIT', 'TRANSACTION_UNAVAILABLE', 'SEED_LIMIT', 'INCOMPLETE_READ', 'FINAL_RESERVE', 'INPUT_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED', 'OTHER'].flatMap(reason => {
+    const count = migrationEvents.filter(event => ['accepted', 'fallback'].includes(event?.status) && ['entry-migration', 'old-delegation', 'deleted-export-route'].includes(event.kind) && event.reason === reason).length;
+    return count ? [{ reason, count }] : [];
+  });
   const resume = { reusedFiles: number(report.resume?.reusedFiles) };
   const artifactRecords = Array.isArray(report.artifacts) ? report.artifacts : null;
   const artifacts = { retained: artifactRecords ? artifactRecords.filter(record => record?.omitted === false && record.recorded === true).length : null, omitted: artifactRecords ? artifactRecords.filter(record => record?.omitted === true).length : null };
   return { schemaVersion: 2, resume, artifacts, transportRecoveries, pluginVersion: REVIEW_RUNTIME.version, reviewWallMs: number(reviewWallMs), executionWallMs: number(executionWallMs),
-    modelCalls: number(report.modelCalls), observedModelCalls, phases, modelCallPurposes, readerBudget, correctionReasons, readerLimitReasons, readerLimits, riskPlanningFallbackReasons,
+    modelCalls: number(report.modelCalls), observedModelCalls, phases, modelCallPurposes, readerBudget, correctionReasons, readerLimitReasons, readerLimits, riskPlanningFallbackReasons, migrationSeeds, migrationSeedReasons,
     planning: { completed: plans.filter(p => p.status === 'completed' && p.method !== 'inline').length, inline: plans.filter(p => p.method === 'inline' && p.status === 'completed').length, inlineAbsent: plans.filter(p => p.method === 'inline' && p.status === 'absent').length, inlineInvalid: plans.filter(p => p.method === 'inline' && p.status === 'invalid').length, fallback: plans.filter(p => p.status === 'fallback').length, skipped: plans.filter(p => p.status === 'skipped').length },
     callPurposeNotice: 'primary-initial is the first call of a retrieval-enabled stage, not only primary review; phase identifies the stage. Correction reason counts include actual correction invocation records only, not both failures and completion notices.',
     timingNotice: 'Observed call wall sums overlap under concurrency and include lifecycle observation; not pure provider latency. Missing values are unavailable, not zero.' };
@@ -60,7 +70,7 @@ export function diagnosticsMarkdown(d) {
     output.push('', '累计调用墙钟可能并发重叠，且包含生命周期观察／初始检查点等待，不是纯提供方耗时，也不能从总耗时中相减当作本地开销。');
   } else output.push('- 逐阶段模型观测不可用（未产生或旧报告未记录），不按零耗时解释。');
   if (d.modelCallPurposes?.length) {
-    const labels = { 'primary-initial': '阶段初始', 'retrieval-followup': '检索后续', 'budget-finalization': '预算受限最终答复', 'json-correction': 'JSON纠正', 'business-grouping': '业务分组', 'risk-planning': '风险计划', 'group-primary': '分组主审', 'window-synthesis': '窗口综合', 'file-interaction': '跨文件综合', verification: '复核' };
+    const labels = { 'primary-initial': '阶段初始', 'retrieval-followup': '检索后续', 'budget-finalization': '预算受限最终答复', 'json-correction': 'JSON纠正', 'business-grouping': '业务分组', 'risk-planning': '风险计划', 'group-primary': '分组主审', 'window-synthesis': '窗口综合', 'file-interaction': '跨文件综合', verification: '复核', 'verification-correction': '复核批次纠正' };
     output.push('- 调用目的：' + d.modelCallPurposes.filter(row => PURPOSES.includes(row.purpose)).map(row => labels[row.purpose] + ' ' + (number(row.calls) ?? '不可用')).join('；') + '。');
   }
   if (d.readerBudget && READER_FIELDS.some(field => number(d.readerBudget[field]) !== null)) {
@@ -73,6 +83,16 @@ export function diagnosticsMarkdown(d) {
   if (number(d.readerLimits?.maxRounds) !== null) output.push('- 每阶段最大检索轮次：' + number(d.readerLimits.maxRounds) + '；调用数／输出字节耗尽与轮次耗尽分别记录，不能混同。');
   if (d.riskPlanningFallbackReasons?.length) output.push('- 风险策略回退原因：' + d.riskPlanningFallbackReasons.filter(r => FALLBACK_REASONS.includes(r.reason)).map(r => r.reason + ' ' + (number(r.calls) ?? '不可用')).join('；') + '。');
   if (d.transportRecoveries?.length) output.push('- 本地结果传输：' + d.transportRecoveries.filter(row => RECOVERY_KINDS.includes(row.kind)).map(row => row.kind + ' ' + (number(row.calls) ?? '不可用')).join('；') + '；仅计成功解析的传输事件，不表示额外模型调用或缺陷确认。');
+  if (d.migrationSeeds?.length) {
+    const labels = { 'entry-migration': '入口迁移', 'old-delegation': '旧入口委托', 'deleted-export-route': '删除导出导航' };
+    const rows = d.migrationSeeds.filter(row => Object.hasOwn(labels, row.kind) && ['accepted', 'fallback'].includes(row.status) && Number.isSafeInteger(row.count) && row.count >= 0);
+    if (d.migrationSeedReasons?.length) {
+      const reasons = { COMPLETE_ROLE_SET: '完整角色接纳', NO_MATCHING_CONTRACT: '无匹配契约', INCOMPLETE_ROLE_RANGE: '角色范围不完整', EVIDENCE_LIMIT: '证据条数上限', TRANSACTION_UNAVAILABLE: '无事务能力', SEED_LIMIT: '种子数量上限', INCOMPLETE_READ: '读取不完整', FINAL_RESERVE: '最终复验预留不足', INPUT_CAPACITY: '输入容量不足', READER_CALL_BUDGET_EXCEEDED: '读取调用不足', READER_OUTPUT_BUDGET_EXCEEDED: '读取字节不足', OTHER: '其他回退' };
+      const details = d.migrationSeedReasons.filter(row => Object.hasOwn(reasons, row.reason) && Number.isSafeInteger(row.count) && row.count >= 0);
+      if (details.length) output.push('- 迁移种子原因：' + details.map(row => reasons[row.reason] + ' ' + row.count).join('；') + '。');
+    }
+    if (rows.length) output.push('- 迁移证据成套预取：' + rows.map(row => labels[row.kind] + ' ' + (row.status === 'accepted' ? '预取接纳' : '回退普通检索') + ' ' + row.count).join('；') + '；计预取尝试，不表示模型已调用、复核通过或新增缺陷成立，删除导出导航仍仅允许不确定归因。');
+  }
   if (number(d.resume?.reusedFiles) !== null) output.push('- 续审复用已完成文件：' + number(d.resume.reusedFiles) + '；复用成果不计为本次模型调用或新读取证据。');
   if (number(d.artifacts?.retained) !== null || number(d.artifacts?.omitted) !== null) output.push('- 私有模型工件：已留存 ' + (number(d.artifacts.retained) ?? '不可用') + '，未留存 ' + (number(d.artifacts.omitted) ?? '不可用') + '；诊断仅含计数，不包含正文或访问标识。');
   output.push('- primary-initial 表示启用检索的某阶段初始调用，不仅是主审；具体阶段以阶段统计为准。');

package/src/review.mjs

@@ -312,6 +312,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       const onProtocolEvent = async info => {
         if (info.action === 'json-transport-recovery') (state.modelRecoveries ??= []).push(info);
         if (info.action === 'retrieval-protocol-correction') pendingStageCorrection = { action: info.action, code: 'RETRIEVAL_PROTOCOL_ERROR' };
+        if (info.action === 'verification-response-correction' && info.code === 'MODEL_INCOMPLETE_VERIFICATION') (state.modelCorrections ??= []).push({ action: info.action, code: info.code });
         await options.onProgress?.({ stage: 'protocol-correction', fileId: file.id, path: file.path, ...info });
       };
       const trackedModel = request => {
@@ -608,6 +609,13 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             const verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, stageScope('verification:' + file.id), {
               correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, onBudgetLimited, yieldOnBudget: options.enableStageContinuation === true,
               enableMigrationRegression: options.enableMigrationRegression === true, migrationContracts: report.migrationContracts?.contracts ?? [], migrationSnapshot: input,
+              onMigrationSeeds: event => {
+                // Source-free host events only; never persist model text or reader bodies.
+                if (!['accepted', 'fallback'].includes(event?.status)) return;
+                const kind = ['old-delegation', 'deleted-export-route'].includes(event.kind) ? event.kind : 'entry-migration';
+                const reason = ['COMPLETE_ROLE_SET', 'NO_MATCHING_CONTRACT', 'INCOMPLETE_ROLE_RANGE', 'EVIDENCE_LIMIT', 'TRANSACTION_UNAVAILABLE', 'SEED_LIMIT', 'INCOMPLETE_READ', 'FINAL_RESERVE', 'INPUT_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(event.reason) ? event.reason : 'OTHER';
+                (state.migrationSeedEvents ??= []).push({ status: event.status, kind, reason });
+              },
               onRetrieved: records => { (state.retrievalAudit ??= []).push(...records); },
               onTruncated: () => { result.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
             });

package/src/verification-loop.mjs

@@ -6,7 +6,7 @@ import { modelWireBudget } from './model-wire-budget.mjs';
 import { createEvidenceReceipts } from './evidence-receipts.mjs';
 import { retrievalLoop, retrievalRequest } from './retrieval-loop.mjs';
 import { verificationSeeds } from './verification-seeds.mjs';
-import { validateCandidateVerification } from './candidate-verification.mjs';
+import { validateCandidateVerification, validateCandidateVerificationEnvelope } from './candidate-verification.mjs';
 
 export { VERIFICATION_INSTRUCTIONS };
 
@@ -31,6 +31,8 @@ export async function verificationLoop(model, request, candidates, scope, option
   // permits no retrieval rounds. Do not spend its budget on optional prefetch.
   const initialRetrieved = options.maxRounds === 0 ? [] : verificationSeeds(candidates, scope, {
     signal: request.signal,
+    migrationContext,
+    onMigrationSeeds: options.onMigrationSeeds,
     onReceipt: (id, resolve) => seedReceipts.set(id, resolve),
     fits: seeds => {
       const next = retrievalRequest(verificationRequest, scope, seeds);
@@ -42,7 +44,34 @@ export async function verificationLoop(model, request, candidates, scope, option
   const resolveEvidence = value => (seedReceipts.get(value?.receiptId) ?? receipts.resolve)(value);
   // No caller/model-supplied seed inputs: every initial result above was freshly
   // read under this invocation's receipt table and the shared approved budget.
-  const response = await retrievalLoop(model, verificationRequest, retrievalScope, { ...options, initialRetrieved });
+  let lastRequest;
+  const response = await retrievalLoop(value => { lastRequest = value; return model(value); }, verificationRequest, retrievalScope, { ...options, initialRetrieved });
+  let accepted = response;
+  try { validateCandidateVerificationEnvelope(response, ids); } catch (error) {
+    request.signal?.throwIfAborted();
+    // Correct only a structurally incomplete batch, before any final evidence
+    // reads. Never retry bad identities, invented receipts or regression failures.
+    if (options.correctProtocol !== true || error.code !== 'MODEL_INCOMPLETE_VERIFICATION' || JSON.parse(lastRequest.input).retrievalFinalization) throw error;
+    // Admit only an otherwise valid subset of evidence-free uncertain entries.
+    // Do not let a missing member hide an invalid identity, receipt or regression.
+    if (!response || Object.keys(response).length !== 1 || !Array.isArray(response.verdicts) || response.verdicts.length >= ids.length) throw error;
+    const subset = response.verdicts.map(item => item?.candidateId);
+    validateCandidateVerificationEnvelope(response, subset);
+    if (subset.some(id => !ids.includes(id)) || response.verdicts.some(item => item.verdict !== 'uncertain' || item.evidence.length || Object.hasOwn(item, 'regression'))) throw error;
+    const correction = { ...lastRequest, callPurpose: 'verification-correction', instructions: lastRequest.instructions + '\n本次仅纠正不完整的候选复核批次。必须为本次 candidates 每个 candidateId 恰好返回一个 verdict；不可漏项、重复或添加身份。仅返回完整 verdicts，不得 requests，不得再次检索。沿用已提供的原文回执；缺证据的候选明确 uncertain 并说明缺失条件，不得编造支持或删除候选。全部结果仍须通过原校验。' };
+    const max = options.maxInputBytes ?? 96 * 1024;
+    if (!(request.nativeOutputTools === true ? modelWireBudget(correction, max).fits : Buffer.byteLength(correction.input) + Buffer.byteLength(correction.instructions) <= max)) throw error;
+    options.beforeCall?.();
+    request.signal?.throwIfAborted();
+    await request.onProtocolEvent?.({ action: 'verification-response-correction', code: error.code });
+    request.signal?.throwIfAborted();
+    const next = await model(correction);
+    request.signal?.throwIfAborted();
+    const serialized = typeof next === 'string' ? next : JSON.stringify(next);
+    if (typeof serialized !== 'string' || Buffer.byteLength(serialized) > 128 * 1024) throw new Error('Verification response too large');
+    accepted = JSON.parse(serialized);
+    validateCandidateVerificationEnvelope(accepted, ids);
+  }
   request.signal?.throwIfAborted();
-  return validateCandidateVerification(response, ids, scope.read, resolveEvidence, { enableMigrationRegression: options.enableMigrationRegression === true && !project, migrationContext, catalog: scope.catalog(), fileIds: Object.fromEntries(ids.map((id, i) => [id, candidates[i].fileId])) });
+  return validateCandidateVerification(accepted, ids, scope.read, resolveEvidence, { enableMigrationRegression: options.enableMigrationRegression === true && !project, migrationContext, catalog: scope.catalog(), fileIds: Object.fromEntries(ids.map((id, i) => [id, candidates[i].fileId])) });
 }

package/src/verification-seeds.mjs

@@ -1,4 +1,5 @@
 import { createEvidenceReceipts } from './evidence-receipts.mjs';
+import { migrationVerificationSeeds } from './migration-verification-seeds.mjs';
 
 // Host-only optional prefetch. Only approved catalog identities and actual line
 // coordinates select reads; candidate prose/snippets/receipts never become evidence.
@@ -7,8 +8,9 @@ const MAX_SEED_BYTES = 16 * 1024;
 const optionalFailure = error => ['VERIFICATION_SEED_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code);
 const capacityError = () => Object.assign(new Error('Optional verification seed capacity exceeded'), { code: 'VERIFICATION_SEED_CAPACITY' });
 
-export function verificationSeeds(candidates, scope, { signal, fits, onReceipt = () => {} }) {
+export function verificationSeeds(candidates, scope, { signal, fits, onReceipt = () => {}, migrationContext, onMigrationSeeds }) {
   signal?.throwIfAborted();
+  if (migrationContext !== undefined) return migrationVerificationSeeds(migrationContext, scope, { signal, fits, onReceipt, onMigrationSeeds });
   // Without atomic rollback an optional seed could consume the budget and then
   // fail its model-input fit check. Leave those readers on ordinary retrieval.
   if (typeof scope.transaction !== 'function') return [];