@synergenius/flow-weaver-pack-weaver 0.8.1

package/src/node-types/genesis-check-threshold.ts

@@ -0,0 +1,34 @@
+import type { GenesisConfig, GenesisProposal, GenesisImpactLevel, GenesisContext } from '../bot/types.js';
+
+const IMPACT_ORDER: Record<GenesisImpactLevel, number> = {
+  COSMETIC: 0,
+  MINOR: 1,
+  BREAKING: 2,
+  CRITICAL: 3,
+};
+
+/**
+ * Compares the proposal's impact level against the configured approval
+ * threshold to decide if human approval is required.
+ *
+ * @flowWeaver nodeType
+ * @expression
+ * @label Genesis Check Threshold
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with approvalRequired (JSON)
+ * @output onFailure [hidden]
+ */
+export function genesisCheckThreshold(ctx: string): { ctx: string } {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const config = JSON.parse(context.genesisConfigJson) as GenesisConfig;
+  const proposal = JSON.parse(context.proposalJson!) as GenesisProposal;
+
+  const proposalLevel = IMPACT_ORDER[proposal.impactLevel] ?? 0;
+  const thresholdLevel = IMPACT_ORDER[config.approvalThreshold] ?? 0;
+  const approvalRequired = proposalLevel >= thresholdLevel;
+
+  console.log(`\x1b[36m→ Impact ${proposal.impactLevel} vs threshold ${config.approvalThreshold}: approval ${approvalRequired ? 'required' : 'not required'}\x1b[0m`);
+
+  context.approvalRequired = approvalRequired;
+  return { ctx: JSON.stringify(context) };
+}

package/src/node-types/genesis-commit.ts

@@ -0,0 +1,71 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import type { GenesisConfig, GenesisContext } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+
+/**
+ * Commits the modified workflow to git if approved, or restores from
+ * the snapshot if rejected. Commit messages are prefixed with "genesis:".
+ *
+ * @flowWeaver nodeType
+ * @label Genesis Commit
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with commitResultJson (JSON)
+ * @output onSuccess [order:-2] - On Success
+ * @output onFailure [order:-1] [hidden] - On Failure
+ */
+export async function genesisCommit(
+  execute: boolean,
+  ctx: string,
+): Promise<{
+  onSuccess: boolean; onFailure: boolean;
+  ctx: string;
+}> {
+  const context = JSON.parse(ctx) as GenesisContext;
+
+  if (!execute) {
+    context.commitResultJson = JSON.stringify({ committed: false, reason: 'dry run' });
+    return { onSuccess: true, onFailure: false, ctx: JSON.stringify(context) };
+  }
+
+  const { env } = context;
+  const config = JSON.parse(context.genesisConfigJson) as GenesisConfig;
+  const targetPath = path.resolve(env.projectDir, config.targetWorkflow);
+
+  if (!context.approved) {
+    // Restore from snapshot
+    const store = new GenesisStore(env.projectDir);
+    const snapshot = store.loadSnapshot(context.snapshotPath!);
+    if (snapshot) {
+      fs.writeFileSync(targetPath, snapshot, 'utf-8');
+      console.log('\x1b[33m→ Restored from snapshot (not approved)\x1b[0m');
+    }
+    context.commitResultJson = JSON.stringify({ committed: false, reason: 'not approved' });
+    return { onSuccess: false, onFailure: true, ctx: JSON.stringify(context) };
+  }
+
+  try {
+    execFileSync('git', ['add', targetPath], {
+      cwd: env.projectDir,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    const message = `genesis: evolve ${path.basename(config.targetWorkflow)}`;
+    execFileSync('git', ['commit', '-m', message], {
+      cwd: env.projectDir,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    console.log(`\x1b[32m→ Committed: ${message}\x1b[0m`);
+    context.commitResultJson = JSON.stringify({ committed: true, message });
+    return { onSuccess: true, onFailure: false, ctx: JSON.stringify(context) };
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\x1b[31m→ Commit failed: ${msg}\x1b[0m`);
+    context.commitResultJson = JSON.stringify({ committed: false, reason: msg });
+    return { onSuccess: false, onFailure: true, ctx: JSON.stringify(context) };
+  }
+}

package/src/node-types/genesis-compile-validate.ts

@@ -0,0 +1,77 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import type { WeaverEnv, GenesisConfig } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+
+/**
+ * Runs flow-weaver validate and compile on the target workflow after
+ * operations have been applied. On failure, restores from the snapshot
+ * and fires the failure path.
+ *
+ * @flowWeaver nodeType
+ * @label Genesis Compile & Validate
+ * @input env [order:0] - Weaver environment bundle
+ * @input genesisConfigJson [order:1] - Genesis configuration (JSON)
+ * @input snapshotPath [order:2] - Path to the pre-apply snapshot
+ * @input applyResultJson [order:3] - Apply result (JSON)
+ * @output env [order:0] - Weaver environment bundle (pass-through)
+ * @output genesisConfigJson [order:1] - Genesis configuration (pass-through)
+ * @output snapshotPath [order:2] - Path to the snapshot (pass-through)
+ * @output onSuccess [order:-2] - On Success
+ * @output onFailure [order:-1] - On Failure
+ */
+export async function genesisCompileValidate(
+  execute: boolean,
+  env: WeaverEnv,
+  genesisConfigJson: string,
+  snapshotPath: string,
+  applyResultJson: string,
+): Promise<{
+  onSuccess: boolean; onFailure: boolean;
+  env: WeaverEnv;
+  genesisConfigJson: string;
+  snapshotPath: string;
+}> {
+  if (!execute) {
+    return { onSuccess: true, onFailure: false, env, genesisConfigJson, snapshotPath };
+  }
+
+  const config = JSON.parse(genesisConfigJson) as GenesisConfig;
+  const targetPath = path.resolve(env.projectDir, config.targetWorkflow);
+
+  try {
+    // Validate
+    execFileSync('flow-weaver', ['validate', targetPath], {
+      cwd: env.projectDir,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 30_000,
+    });
+    console.log('\x1b[32m→ Validation passed\x1b[0m');
+
+    // Compile
+    execFileSync('flow-weaver', ['compile', targetPath], {
+      cwd: env.projectDir,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 60_000,
+    });
+    console.log('\x1b[32m→ Compilation passed\x1b[0m');
+
+    return { onSuccess: true, onFailure: false, env, genesisConfigJson, snapshotPath };
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\x1b[31m→ Compile/validate failed: ${msg}\x1b[0m`);
+
+    // Restore from snapshot
+    const store = new GenesisStore(env.projectDir);
+    const snapshot = store.loadSnapshot(snapshotPath);
+    if (snapshot) {
+      fs.writeFileSync(targetPath, snapshot, 'utf-8');
+      console.log('\x1b[33m→ Restored from snapshot\x1b[0m');
+    }
+
+    return { onSuccess: false, onFailure: true, env, genesisConfigJson, snapshotPath };
+  }
+}

package/src/node-types/genesis-diff-fingerprint.ts

@@ -0,0 +1,67 @@
+import type { GenesisFingerprint, GenesisContext } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+
+/**
+ * Compares the current project fingerprint against the last saved one,
+ * producing a diff summary of file and state changes.
+ *
+ * @flowWeaver nodeType
+ * @expression
+ * @label Genesis Diff Fingerprint
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with diffJson (JSON)
+ * @output onFailure [hidden]
+ */
+export function genesisDiffFingerprint(ctx: string): { ctx: string } {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const { env } = context;
+  const store = new GenesisStore(env.projectDir);
+  const current = JSON.parse(context.fingerprintJson!) as GenesisFingerprint;
+  const last = store.getLastFingerprint();
+
+  const addedFiles: string[] = [];
+  const removedFiles: string[] = [];
+  const modifiedFiles: string[] = [];
+  let gitChanged = false;
+  let workflowsChanged = false;
+
+  if (!last) {
+    const diff = {
+      addedFiles: Object.keys(current.files),
+      removedFiles: [],
+      modifiedFiles: [],
+      gitChanged: true,
+      workflowsChanged: true,
+    };
+    context.diffJson = JSON.stringify(diff);
+    return { ctx: JSON.stringify(context) };
+  }
+
+  for (const [file, hash] of Object.entries(current.files)) {
+    if (!(file in last.files)) {
+      addedFiles.push(file);
+    } else if (last.files[file] !== hash) {
+      modifiedFiles.push(file);
+    }
+  }
+  for (const file of Object.keys(last.files)) {
+    if (!(file in current.files)) {
+      removedFiles.push(file);
+    }
+  }
+
+  gitChanged = current.gitBranch !== last.gitBranch || current.gitCommit !== last.gitCommit;
+
+  const currentWfs = [...current.existingWorkflows].sort().join(',');
+  const lastWfs = [...last.existingWorkflows].sort().join(',');
+  workflowsChanged = currentWfs !== lastWfs || current.workflowHash !== last.workflowHash;
+
+  const diff = { addedFiles, removedFiles, modifiedFiles, gitChanged, workflowsChanged };
+  const hasChanges = addedFiles.length > 0 || removedFiles.length > 0 ||
+    modifiedFiles.length > 0 || gitChanged || workflowsChanged;
+
+  console.log(`\x1b[36m→ Diff: +${addedFiles.length} -${removedFiles.length} ~${modifiedFiles.length}, git=${gitChanged}, wf=${workflowsChanged}\x1b[0m`);
+
+  context.diffJson = JSON.stringify(diff);
+  return { ctx: JSON.stringify(context) };
+}

package/src/node-types/genesis-diff-workflow.ts

@@ -0,0 +1,71 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import type { GenesisConfig, GenesisContext } from '../bot/types.js';
+
+/**
+ * Runs flow-weaver diff between the snapshot and the current target
+ * workflow to produce a human-readable diff of workflow changes.
+ *
+ * @flowWeaver nodeType
+ * @expression
+ * @label Genesis Diff Workflow
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with workflowDiffJson (JSON)
+ * @output onFailure [hidden]
+ */
+export function genesisDiffWorkflow(ctx: string): { ctx: string } {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const config = JSON.parse(context.genesisConfigJson) as GenesisConfig;
+  const targetPath = path.resolve(context.env.projectDir, config.targetWorkflow);
+
+  let diffOutput = '';
+
+  // Try semantic diff via flow-weaver first
+  try {
+    diffOutput = execFileSync('flow-weaver', ['diff', context.snapshotPath!, targetPath], {
+      cwd: context.env.projectDir,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 30_000,
+    }).trim();
+  } catch (err: unknown) {
+    if (err && typeof err === 'object' && 'stdout' in err) {
+      diffOutput = String((err as { stdout: string }).stdout).trim();
+    }
+  }
+
+  // Fallback to basic text diff if semantic diff failed
+  if (!diffOutput && context.snapshotPath) {
+    try {
+      const snapshotContent = fs.readFileSync(context.snapshotPath, 'utf-8');
+      const currentContent = fs.readFileSync(targetPath, 'utf-8');
+
+      if (snapshotContent === currentContent) {
+        diffOutput = '(no changes)';
+      } else {
+        diffOutput = execFileSync('git', ['diff', '--no-index', '--no-color', context.snapshotPath, targetPath], {
+          cwd: context.env.projectDir,
+          encoding: 'utf-8',
+          stdio: ['pipe', 'pipe', 'pipe'],
+          timeout: 10_000,
+        }).trim();
+      }
+    } catch (err: unknown) {
+      // git diff exits 1 when files differ (that's normal)
+      if (err && typeof err === 'object' && 'stdout' in err) {
+        const stdout = String((err as { stdout: string }).stdout).trim();
+        if (stdout) diffOutput = stdout;
+      }
+    }
+  }
+
+  if (!diffOutput) {
+    diffOutput = '(diff unavailable)';
+  }
+
+  console.log(`\x1b[36m→ Workflow diff: ${diffOutput.split('\n').length} lines\x1b[0m`);
+
+  context.workflowDiffJson = JSON.stringify({ diff: diffOutput });
+  return { ctx: JSON.stringify(context) };
+}

package/src/node-types/genesis-escrow-grace.ts

@@ -0,0 +1,62 @@
+import * as path from 'node:path';
+import type { GenesisContext, GenesisConfig } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+import { rollbackFromBackup } from './genesis-escrow-migrate.js';
+
+/**
+ * Handles escrow grace period tracking at the end of each cycle.
+ * Decrements grace on success, triggers rollback on failure, and
+ * clears escrow once the grace period completes.
+ *
+ * @flowWeaver nodeType
+ * @expression
+ * @label Genesis Escrow Grace
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context (JSON)
+ */
+export function genesisEscrowGrace(ctx: string): { ctx: string } {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const { env } = context;
+  const config = JSON.parse(context.genesisConfigJson) as GenesisConfig;
+
+  if (!config.selfEvolve) {
+    return { ctx: JSON.stringify(context) };
+  }
+
+  const store = new GenesisStore(env.projectDir);
+  const token = store.loadEscrowToken();
+
+  if (!token || token.phase !== 'migrated' || token.graceRemaining <= 0) {
+    return { ctx: JSON.stringify(context) };
+  }
+
+  const packRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+
+  // Cycle failed during grace: rollback
+  if (context.error) {
+    rollbackFromBackup(store, token, packRoot, `Grace cycle failed: ${context.error}`);
+    return { ctx: JSON.stringify(context) };
+  }
+
+  // Cycle succeeded: decrement grace
+  token.graceRemaining--;
+  token.graceCycleIds.push(context.cycleId);
+  store.saveEscrowToken(token);
+
+  console.log(`\x1b[36m→ Grace period: ${token.graceRemaining} cycle(s) remaining\x1b[0m`);
+
+  if (token.graceRemaining <= 0) {
+    store.appendSelfMigration({
+      migrationId: token.migrationId,
+      cycleId: token.cycleId,
+      timestamp: new Date().toISOString(),
+      affectedFiles: token.affectedFiles,
+      outcome: 'grace-cleared',
+      graceCompleted: true,
+    });
+    store.clearEscrow();
+    console.log('\x1b[32m→ Grace period complete, self-modification accepted\x1b[0m');
+  }
+
+  return { ctx: JSON.stringify(context) };
+}

package/src/node-types/genesis-escrow-migrate.ts

@@ -0,0 +1,138 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { GenesisContext, EscrowToken } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+import { withFileLock } from '../bot/file-lock.js';
+
+/**
+ * Copies staged files to their actual pack locations, completing the
+ * self-modification migration. Uses a file lock to prevent concurrent access.
+ *
+ * @flowWeaver nodeType
+ * @label Genesis Escrow Migrate
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with migration result (JSON)
+ * @output onSuccess [order:-2] - On Success
+ * @output onFailure [order:-1] [hidden] - On Failure
+ */
+export async function genesisEscrowMigrate(
+  execute: boolean,
+  ctx: string,
+): Promise<{
+  onSuccess: boolean; onFailure: boolean;
+  ctx: string;
+}> {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const { env } = context;
+  const store = new GenesisStore(env.projectDir);
+  const token = store.loadEscrowToken();
+
+  if (!execute) {
+    context.escrowResultJson = JSON.stringify({ migrated: false, reason: 'dry run' });
+    return { onSuccess: true, onFailure: false, ctx: JSON.stringify(context) };
+  }
+
+  if (!token || token.phase !== 'validated') {
+    // No validated escrow: pass through (not an error, just nothing to migrate)
+    return { onSuccess: true, onFailure: false, ctx: JSON.stringify(context) };
+  }
+
+  const packRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+  const lockPath = path.join(env.projectDir, '.genesis', 'escrow', 'migrate');
+
+  try {
+    await withFileLock(lockPath, () => {
+      // Re-read token inside lock to confirm state
+      const lockedToken = store.loadEscrowToken();
+      if (!lockedToken || lockedToken.phase !== 'validated') {
+        throw new Error('Token state changed during lock acquisition');
+      }
+
+      lockedToken.phase = 'migrating';
+      store.saveEscrowToken(lockedToken);
+
+      // Copy each staged file to actual location
+      for (const relFile of lockedToken.affectedFiles) {
+        const stagedPath = store.getEscrowStagedPath(relFile);
+        const destPath = path.resolve(packRoot, relFile);
+
+        fs.mkdirSync(path.dirname(destPath), { recursive: true });
+        fs.copyFileSync(stagedPath, destPath);
+      }
+
+      lockedToken.phase = 'migrated';
+      lockedToken.migratedAt = new Date().toISOString();
+      store.saveEscrowToken(lockedToken);
+    });
+
+    console.log(`\x1b[32m→ Escrow migration complete: ${token.affectedFiles.length} file(s) swapped\x1b[0m`);
+    context.escrowResultJson = JSON.stringify({
+      migrated: true,
+      migrationId: token.migrationId,
+      files: token.affectedFiles,
+    });
+    return { onSuccess: true, onFailure: false, ctx: JSON.stringify(context) };
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\x1b[31m→ Escrow migration failed: ${msg}\x1b[0m`);
+
+    // Attempt rollback
+    rollbackFromBackup(store, token, packRoot, `Migration failed: ${msg}`);
+
+    context.error = `Escrow migration failed: ${msg}`;
+    return { onSuccess: false, onFailure: true, ctx: JSON.stringify(context) };
+  }
+}
+
+/** Restore all affected files from backup, or delete newly-created files. */
+export function rollbackFromBackup(
+  store: GenesisStore,
+  token: EscrowToken,
+  packRoot: string,
+  reason: string,
+): void {
+  for (const relFile of token.affectedFiles) {
+    const backupPath = store.getEscrowBackupPath(relFile);
+    const destPath = path.resolve(packRoot, relFile);
+
+    if (fs.existsSync(backupPath)) {
+      // Verify backup integrity
+      try {
+        const actualHash = GenesisStore.hashFile(backupPath);
+        const expectedHash = token.backupFileHashes[relFile];
+        if (expectedHash && actualHash !== expectedHash) {
+          console.error(`\x1b[31m→ Backup integrity check failed for ${relFile}\x1b[0m`);
+          continue;
+        }
+      } catch {
+        console.error(`\x1b[31m→ Cannot read backup for ${relFile}\x1b[0m`);
+        continue;
+      }
+      fs.mkdirSync(path.dirname(destPath), { recursive: true });
+      fs.copyFileSync(backupPath, destPath);
+    } else if (fs.existsSync(destPath) && !token.backupFileHashes[relFile]) {
+      // File was newly created during migration (no backup), remove it
+      try { fs.unlinkSync(destPath); } catch { /* ignore */ }
+    }
+  }
+
+  // Update token
+  const fullToken = store.loadEscrowToken();
+  if (fullToken) {
+    fullToken.phase = 'rolled-back';
+    fullToken.rollbackReason = reason;
+    store.saveEscrowToken(fullToken);
+  }
+
+  store.appendSelfMigration({
+    migrationId: token.migrationId,
+    cycleId: token.cycleId,
+    timestamp: new Date().toISOString(),
+    affectedFiles: token.affectedFiles,
+    outcome: 'rolled-back',
+    graceCompleted: false,
+    rollbackReason: reason,
+  });
+
+  console.log(`\x1b[33m→ Rolled back migration ${token.migrationId}: ${reason}\x1b[0m`);
+}

package/src/node-types/genesis-escrow-recover.ts

@@ -0,0 +1,99 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { GenesisContext, GenesisConfig } from '../bot/types.js';
+import { GenesisStore } from '../bot/genesis-store.js';
+import { rollbackFromBackup } from './genesis-escrow-migrate.js';
+
+/**
+ * Checks for interrupted escrow migrations (crash recovery) and sets
+ * grace-period context flags for downstream nodes. Runs early in the
+ * workflow so propose and other nodes can see the escrow state.
+ *
+ * @flowWeaver nodeType
+ * @expression
+ * @label Genesis Escrow Recover
+ * @input ctx [order:0] - Genesis context (JSON)
+ * @output ctx [order:0] - Genesis context with escrow state flags (JSON)
+ */
+export function genesisEscrowRecover(ctx: string): { ctx: string } {
+  const context = JSON.parse(ctx) as GenesisContext;
+  const { env } = context;
+  const config = JSON.parse(context.genesisConfigJson) as GenesisConfig;
+
+  if (!config.selfEvolve) {
+    context.escrowGraceLocked = false;
+    return { ctx: JSON.stringify(context) };
+  }
+
+  const store = new GenesisStore(env.projectDir);
+
+  // Check if max failures exceeded (disables self-evolution for this cycle)
+  const maxFailures = config.selfEvolveMaxFailures ?? 3;
+  const failureCount = store.getSelfFailureCount();
+  if (failureCount >= maxFailures) {
+    console.log(`\x1b[33m→ Self-evolution disabled: ${failureCount} consecutive failures (max ${maxFailures})\x1b[0m`);
+    context.escrowGraceLocked = true;
+    context.escrowGraceRemaining = 0;
+    return { ctx: JSON.stringify(context) };
+  }
+
+  const token = store.loadEscrowToken();
+
+  if (!token) {
+    context.escrowGraceLocked = false;
+    return { ctx: JSON.stringify(context) };
+  }
+
+  const packRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+
+  // Crash recovery: process died mid-swap
+  if (token.phase === 'migrating') {
+    console.log('\x1b[33m→ Detected interrupted migration, checking file integrity...\x1b[0m');
+
+    let needsRollback = false;
+    for (const relFile of token.affectedFiles) {
+      const absFile = path.resolve(packRoot, relFile);
+      if (!fs.existsSync(absFile)) {
+        needsRollback = true;
+        break;
+      }
+      const currentHash = GenesisStore.hashFile(absFile);
+      const stagedHash = token.stagedFileHashes[relFile];
+      const backupHash = token.backupFileHashes[relFile];
+      if (currentHash !== stagedHash && currentHash !== backupHash) {
+        needsRollback = true;
+        break;
+      }
+    }
+
+    if (needsRollback) {
+      console.log('\x1b[33m→ Inconsistent state, rolling back...\x1b[0m');
+      rollbackFromBackup(store, token, packRoot, 'Crash recovery: inconsistent file state');
+    } else {
+      // Check if all files match staged (migration was actually complete)
+      const allStaged = token.affectedFiles.every(f => {
+        const absFile = path.resolve(packRoot, f);
+        return fs.existsSync(absFile) && GenesisStore.hashFile(absFile) === token.stagedFileHashes[f];
+      });
+      if (allStaged) {
+        token.phase = 'migrated';
+        token.migratedAt = new Date().toISOString();
+        store.saveEscrowToken(token);
+        console.log('\x1b[32m→ Migration was complete, advancing to grace period\x1b[0m');
+      } else {
+        rollbackFromBackup(store, token, packRoot, 'Crash recovery: partial migration');
+      }
+    }
+  }
+
+  // Set grace state for downstream nodes
+  const current = store.loadEscrowToken();
+  if (current && current.phase === 'migrated' && current.graceRemaining > 0) {
+    context.escrowGraceLocked = true;
+    context.escrowGraceRemaining = current.graceRemaining;
+  } else {
+    context.escrowGraceLocked = false;
+  }
+
+  return { ctx: JSON.stringify(context) };
+}