create-agdf 0.20.1 → 0.30.0

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-relationship-correction.js

@@ -1,74 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { canonicalJson } from "./approval-command-contract.js";
-import { readArtefactBindings } from "./artefact-bindings.js";
-import { exactApprovedArtefacts, validateBindingProof } from "./artefact-binding-proof.js";
-import { APPROVAL_GATES, runSealState } from "./run-seal.js";
-import { readRun, appendTableRow, guardedWrite, rejected } from "./run-state-edits.js";
-import { prepareRunContentState } from "../control-evaluation/run-state.js";
-import { parseControlState } from "./run-state-parser.js";
-import { runPath } from "./run-state-reader.js";
-import { flushRunCommit, withRunLock, writeRunLocked } from "./run-state-writer.js";
-import { sameRelationship } from "../control-evaluation/delivery-relationships.js";
-import { transitionDecisionForRunState } from "../control-evaluation/gate-policy.js";
-
-const controlFor = (root, run) => ({ ...prepareRunContentState(root, run.content, run.path), meta: run.meta });
-
-// Mutation owner for authorized bound continuation only. Evaluators never call it.
-export function correctRunRelationship(root, { runId, revisionId }, { evaluateGateCheck, checkpoint, confirmCommit = flushRunCommit } = {}) {
-  const locked = guardedWrite(runId, () => withRunLock(runPath(root, runId), () => {
-    const run = readRun(root, runId);
-    if (run.rejection) return run.rejection;
-    if (run.meta.revision_id !== revisionId) return rejected(runId, "stale_revision");
-    if (runSealState(root, run.content).status !== "valid") return rejected(runId, "seal_invalid");
-    const report = evaluateGateCheck(root, { runId });
-    const decisive = (report.delivery_map?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity));
-    const missing = (report.delivery_map?.relationships ?? []).filter(row => row.required && row.status === "missing");
-    if (missing.length === 0 && decisive.length === 0) return { schema_version: "1", outcome: "unchanged", run_id: runId, revision_id: revisionId };
-    const unrelatedDoctor = (report.doctor_report?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity)
-      && row.code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING");
-    if (unrelatedDoctor.length || decisive.length !== 1 || decisive[0].code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING"
-        || missing.length !== 1 || report.blocking_reason !== "AGDF_DELIVERY_RELATIONSHIP_MISSING") return rejected(runId, "correction_not_eligible");
-    const control = controlFor(root, run), expected = missing[0];
-    if (control.artefact_chain.some(row => row.from === expected.from)) return rejected(runId, "correction_not_eligible");
-    const history = readArtefactBindings(run.content);
-    const eligible = history.active.filter(receipt => receipt.run_id === runId && receipt.operation.revision <= Number(run.meta.revision)
-      && sameRelationship(receipt.relationship, expected));
-    if (!history.valid || eligible.length !== 1) return rejected(runId, "binding_proof_missing_or_ambiguous");
-    const receipt = eligible[0], destinationGate = expected.from === "QA_REPORT" ? "QA" : expected.from;
-    const destination = control.artefacts.get(destinationGate), source = control.artefacts.get(expected.to);
-    if (destination?.path !== receipt.destination.path || source?.path !== receipt.source.path
-        || !validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)) return rejected(runId, "artefact_binding_proof_invalid");
-    const before = canonicalJson(transitionDecisionForRunState(control));
-    let next = appendTableRow(run.content, "Artefact Chain", [expected.from, expected.relationship, expected.to,
-      `binding ${receipt.binding_id}; exact sealed reviewed mapping ${receipt.review.path}`]);
-    if (!next) return rejected(runId, "run_layout_unsupported");
-    const nextRevisionId = randomUUID();
-    next = appendTableRow(next, "Evidence", ["Relationship correction", receipt.review.path,
-      `binding ${receipt.binding_id}; ${expected.from} ${expected.relationship} ${expected.to}; revision ${revisionId} -> ${nextRevisionId}`, "exact sealed reviewed mapping"]);
-    if (!next || canonicalJson(transitionDecisionForRunState(controlFor(root, { ...run, content: next }))) !== before) return rejected(runId, "correction_permission_changed");
-    let written, recoveredCommit = false;
-    try { written = writeRunLocked(run.path, next, revisionId, { expectedContent: run.content, nextRevisionId, checkpoint,
-      validateBeforeWrite: () => {
-        if (!validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)
-            || runSealState(root, run.content).status !== "valid") throw new Error("AGDF_ARTEFACT_BINDING_PROOF_INVALID");
-      } }); }
-    catch (error) {
-      const actual = readRun(root, runId);
-      if (actual.rejection || actual.meta.revision_id !== nextRevisionId || runSealState(root, actual.content).status !== "valid") throw error;
-      // Reuse the existing owner's durability confirmation; never retry into another revision.
-      try { confirmCommit(run.path); }
-      catch {
-        const unconfirmed = new Error("AGDF_CORRECTION_COMMIT_UNCONFIRMED");
-        unconfirmed.committed_revision_id = nextRevisionId;
-        throw unconfirmed;
-      }
-      written = { meta: actual.meta }; recoveredCommit = true;
-    }
-    return { schema_version: "1", outcome: "corrected", run_id: runId, binding_id: receipt.binding_id,
-      backlog: "pending", backlog_reason: "run_only_relationship_correction",
-      backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${written.meta.revision_id}.`,
-      relationship: receipt.relationship, previous_revision_id: revisionId, revision_id: written.meta.revision_id, revision: written.meta.revision,
-      ...(recoveredCommit ? { recovered_commit: true } : {}) };
-  }));
-  return locked.rejection ?? locked.state;
-}

package/generated/plugins/copilot/agdf/control/templates/AGDF_RUN.md

@@ -1,139 +0,0 @@
-# AGDF Run State
-
-## Run Meta
-
-- run_id:
-- started_at:
-- mode: `quick_task | verified_change | structured_delivery`
-- current_gate: `none | UR | Brownfield Review | Mode/Slice Decision | PRD | SD | TP | Quick Task Execution | Verified Change Execution | Brownfield Analysis | CD+Tests | CR | QA | UAT | OR`
-- decision: `pass | revise | block | in_progress`
-- owner:
-
-## Objective
-
-What outcome is this run trying to make trustworthy?
-
-## Current Control State
-
-| Question | Answer |
-|---|---|
-| What is known? |  |
-| What is approved? |  |
-| What is missing? |  |
-| What is the next allowed action? |  |
-| What is explicitly forbidden right now? |  |
-
-## Source And Scope State
-
-- normative_instruction_source:
-- multi_scope_state: `clear | ambiguous | blocked`
-- active_scope_evidence:
-- competing_scope_lines:
-- branch_workspace_evidence:
-- branch_workspace_scope_effect: `supports | conflicts | insufficient | not_checked`
-
-## Run Status Card
-
-This is a compact projection of the control state. It does not replace gate-check, QA, OR or approvals.
-
-| Run status | Value |
-|---|---|
-| Status |  |
-| Current gate |  |
-| Allowed now |  |
-| Blocked by |  |
-| Missing approval |  |
-| Next step |  |
-| Quality outlook |  |
-
-## Approvals
-
-Valid approval format for new runs: `Approval: <GateName>`.
-
-| Gate | Status | Evidence |
-|---|---|---|
-| UR | `missing | approved | not_applicable` |  |
-| PRD | `missing | approved | not_applicable` |  |
-| SD | `missing | approved | not_applicable` |  |
-| TP | `missing | approved | not_applicable` |  |
-| QA | `missing | approved | not_applicable` |  |
-| UAT | `missing | approved | not_applicable` |  |
-
-## Artefacts
-
-| Type | Path | Status | Notes |
-|---|---|---|---|
-| UR |  | `draft | approved | superseded | not_applicable` |  |
-| PRD |  | `draft | approved | superseded | not_applicable` |  |
-| SD |  | `draft | approved | superseded | not_applicable` |  |
-| TP |  | `draft | approved | superseded | not_applicable` |  |
-| Brownfield Review |  | `missing | draft | done | not_applicable | superseded` |  |
-| Verified Change |  | `missing | draft | eligible | executed | escalated` |  |
-| Review |  | `missing | done | not_applicable` |  |
-| QA |  | `missing | pass | revise | block | not_applicable` |  |
-| OR |  | `missing | done | not_applicable` |  |
-
-## Mode / Slice Decision
-
-Set this after Brownfield Review. Do not assume the full gate chain before the existing-system impact is understood.
-Quick Task execution or implementation is not allowed until this decision is visible with scope reason and evidence.
-
-- decision: `undecided | quick_task | verified_change | structured_slice | structured_delivery | block`
-- required_next_gate: `none | PRD | SD | TP | Brownfield Analysis`
-- scope_reason:
-- evidence:
-- transparency_note:
-
-## Artefact Chain
-
-Keep the active work item traceable. A gate may open only when the previous gate has both exact approval and a durable or linked artefact.
-
-| From | Relationship | To | Evidence |
-|---|---|---|---|
-| UR | `approved_by` | `Approval: UR` |  |
-| PRD | `derived_from` | UR |  |
-| SD | `derived_from` | PRD |  |
-| TP | `derived_from` | SD |  |
-| QA_REPORT | `tests` | TP |  |
-
-## Evidence
-
-| Evidence | Source | Covers | Strength |
-|---|---|---|---|
-|  |  |  | `direct | indirect | weak` |
-
-## Missing Evidence
-
-| Missing evidence | Impact | Required next step |
-|---|---|---|
-|  | `warn | revise | block` |  |
-
-## Risks
-
-| Risk | Impact | Mitigation or owner |
-|---|---|---|
-|  | `warn | revise | block` |  |
-
-## Context Graph Impact
-
-- context_graph_impact: `none | link_only | update_existing_node | new_node_required | sot_drift`
-- context_graph_refs:
-- context_graph_reconciliation: `resolved | not_applicable | open_gap`
-- context_graph_required_action: `none | link | update | create | resolve_drift`
-- context_graph_gate_effect: `none | warning | revise | block`
-- context_graph_evidence:
-
-## Knowledge Persistence Decision
-
-- memory_target: `context_graph | sot_registry | scope_artifact | open_questions | none`
-- memory_reason:
-- memory_refs:
-
-## Closeout
-
-- delivered:
-- not_delivered:
-- verification_performed:
-- unverified:
-- next_allowed_action:
-- quality_outlook:

package/generated/plugins/copilot/agdf/control/templates/MASTER_BACKLOG.md

@@ -1,39 +0,0 @@
-# AGDF Master Backlog
-
-This file is the living control pointer for active AGDF delivery work. Detailed UR, Brownfield Review, PRD, SD, TP, QA and OR artefacts should live in stable paths and be linked from here.
-
-## Rules
-
-1. New product semantics, functional change or user-visible behaviour change starts as a new UR draft in a stable local artefact path, for example `.agdf/control/artefacts/<key>/UR.md`, unless an authoritative repository SoT already exists and is linked here.
-2. `Approval: UR` adds or updates exactly one steering row with a document-relative Markdown link to the UR.
-3. Brownfield Review is created for the same work item after UR approval when existing-system impact must be sized before PRD depth or Quick Task execution.
-4. PRD, SD, TP and QA report artefacts are created for the same work item after the previous gate is approved and persisted or linked.
-5. `Approval: PRD`, `Approval: SD`, `Approval: TP` and `Approval: QA` require the corresponding durable artefact or linked repository SoT before the next gate can open.
-6. Generic consent such as "ok", "go ahead", "do it", "continue", "leg los" or "approved" does not update a gate. Only `Approval: <GateName>` does.
-7. Keep only steering-relevant work in `Active Backlog`.
-8. Every active item has exactly one linked current spec and a visible linked artefact chain.
-9. Historical artefacts remain linkable but do not override the current pointer.
-10. If an item is superseded, mark the replacement.
-11. If active work grows beyond roughly ten items, triage the backlog.
-12. `Status` must be one of the human-readable labels normalized by `packages/core/lib/control-evaluation/shared.js`: Needs UR, Awaiting Brownfield Review, Awaiting PRD, Awaiting PRD Approval, Awaiting SD, Awaiting SD Approval, Awaiting TP, Awaiting TP Approval, In Progress, Blocked, Awaiting QA, Awaiting UAT, Awaiting OR, Completed, Superseded, Abandoned. Generated observations also use Work pending, Approval pending, QA report pending, QA evidence open, QA correction open, QA source decision required, QA blocked, Source unconfirmed, Closeout pending, Unconfirmed, and phase-specific Brownfield Analysis/CD+Tests/CR/Quick Task Execution/Verified Change Execution/Mode/Slice Decision work pending. The parser module is authoritative; this list only mirrors it for readability.
-13. `Artefacts` link labels must be one of the labels normalized by the same parser module: `ur`, `brownfield`, `prd`, `sd`, `tp`, `qa`, `or` (case-insensitive). Do not invent other labels such as a raw artefact filename.
-14. After writing or updating this file, run `doctor --json` (or the locally available equivalent) and resolve any `AGDF_BACKLOG_STATUS_UNKNOWN` or `AGDF_BACKLOG_ARTEFACT_LABEL_UNKNOWN` finding before treating the edit as done.
-15. A `Work item` cell may optionally start with a bracketed scope tag, one of `[framework-maintenance]` or `[external-delivery]`, so the split between AGDF's own maintenance work and external product delivery stays visible at a glance. The tag is never required retroactively on `Completed / Superseded Pointers` rows. `packages/core/lib/control-evaluation/shared.js` is authoritative for the accepted values.
-16. After writing or updating this file, also resolve any `AGDF_BACKLOG_SCOPE_LABEL_UNKNOWN` finding, which fires only for a present-but-unrecognized bracketed tag, never for an absent one.
-
-17. Core writers may place a bounded `agdf-backlog-summary-v1` comment after a complete table, separated by a blank line. It records the addressed row, target, actual Run revision, observation time and consumed source digests; it never authorizes. Preserve it with its row. Older rows remain readable without it. Invalid/foreign/ambiguous observations remain visibly unconfirmed; reading does not synchronize or scan all Runs.
-
-## Active Backlog
-
-| Priority | Key | Work item | Status | Artefacts | Current spec | Next step |
-|---:|---|---|---|---|---|---|
-
-## Planned / Parking Lot
-
-| Priority | Key | Work item | Status | Artefacts | Current spec | Next step |
-|---:|---|---|---|---|---|---|
-
-## Completed / Superseded Pointers
-
-| Key | Work item | Final status | Historical record | Outcome |
-|---|---|---|---|---|

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/interaction.js

@@ -1,28 +0,0 @@
-import { createInterface } from "node:readline/promises";
-import process from "node:process";
-import { interactionLocales } from "#agdf-core/resources/context.js";
-import { selectControlMigration, selectControlRepair } from "#agdf-core/control-maintenance/interaction.js";
-export * from "#agdf-core/control-maintenance/interaction.js";
-export async function promptControlMigration(plan, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlMigration(plan, { registry, language,
-      write(value) { output.write(`${value}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}
-
-export async function promptControlRepair(value, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en", phase = "offer",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlRepair(value, { registry, language, phase,
-      write(text) { output.write(`${text}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/repair.js

@@ -1,4 +0,0 @@
-import { inspectControlRepair as inspect, repairInstallationControl as repair } from "#agdf-core/control-maintenance/repair.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const inspectControlRepair = (root, options = {}) => inspect(root, { readGitOriginals, ...options });
-export const repairInstallationControl = (control, options = {}) => repair(control, { readGitOriginals, ...options });

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/service.js

@@ -1,3 +0,0 @@
-import { runControlMaintenance as run } from "#agdf-core/control-maintenance/service.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const runControlMaintenance = (target, options = {}) => run(target, { readGitOriginals, ...options });

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-state/run-recovery.js

@@ -1,5 +0,0 @@
-import { inspectRunRecovery as inspect, previewRunRecovery as preview } from "#agdf-core/control-state/run-recovery.js";
-import { readGitHistory } from "../runtime/git-history.js";
-export { applyRunRecovery, inspectSelfReferenceRecovery } from "#agdf-core/control-state/run-recovery.js";
-export const inspectRunRecovery = (root, runId, options = {}) => inspect(root, runId, { readGitHistory, ...options });
-export const previewRunRecovery = (root, runId, options = {}) => preview(root, runId, { readGitHistory, ...options });

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-maintenance/interaction.js

@@ -1,57 +0,0 @@
-import { interactionLocales } from "../resources/context.js";
-import { localePack } from "../interaction-presentation.js";
-import { renderMaintenanceOffer, renderControlMigrationDecision, renderControlRepairOffer, renderControlRepairPlan } from "./presentation.js";
-
-export async function selectControlMaintenance(control, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_MAINTENANCE_INTERACTION_REQUIRED");
-  const copy = localePack(registry, language).repositoryMaintenance;
-  write(renderMaintenanceOffer(control, { registry, language }));
-  while (true) {
-    let raw;
-    try { raw = await readChoice({ prompt: copy.prompt, default: null }); } catch { return "skip"; }
-    const choice = typeof raw === "string" ? raw.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (["1", "start"].includes(choice)) return "start";
-    if (["3", "d", "details"].includes(choice)) write(renderMaintenanceOffer(control, { registry, language, details: true }));
-    else write(copy.invalid);
-  }
-}
-
-export async function selectControlMigration(plan, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_CONTROL_MIGRATION_READER_REQUIRED");
-  const copy = localePack(registry, language).installSetup.controlMigration;
-  write(renderControlMigrationDecision(plan, { registry, language }));
-  while (true) {
-    let value;
-    try { value = await readChoice({ prompt: copy.batchPrompt, default: null }); } catch { return "skip"; }
-    const choice = typeof value === "string" ? value.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (["1", "migrate"].includes(choice)) return "migrate";
-    if (["3", "d", "details"].includes(choice)) write(renderControlMigrationDecision(plan, { registry, language, details: true }));
-    else write(copy.invalidChoice);
-  }
-}
-
-export async function selectControlRepair(value, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en", phase = "offer",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_CONTROL_REPAIR_READER_REQUIRED");
-  if (!["offer", "plan"].includes(phase)) throw new Error("AGDF_CONTROL_REPAIR_PHASE_INVALID");
-  const copy = localePack(registry, language).installSetup.controlRepair;
-  const render = phase === "offer" ? renderControlRepairOffer : renderControlRepairPlan;
-  write(render(value, { registry, language }));
-  while (true) {
-    let raw;
-    try { raw = await readChoice({ prompt: copy.prompt, default: null }); } catch { return "skip"; }
-    const choice = typeof raw === "string" ? raw.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (choice === "1" && (phase === "offer" || value.items.some((item) => item.available))) return phase === "offer" ? "start" : "repair";
-    if (["3", "d", "details"].includes(choice)) write(render(value, { registry, language, details: true }));
-    else write(copy.invalidChoice);
-  }
-}
-

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-maintenance/migration.js

@@ -1,85 +0,0 @@
-import { join } from "node:path";
-import { regularFileSnapshot } from "../control-state/run-store-inspection.js";
-import { applyRunRecovery, inspectRunRecovery, previewRunRecovery } from "../control-state/run-recovery.js";
-import { inspectControlMigration, safeApprovalReset } from "./compatibility.js";
-
-export async function migrateInstallationControl(root, { mode = "inspect", confirmMigration } = {}) {
-  if (!["inspect", "safe"].includes(mode)) throw new Error("AGDF_CONTROL_MIGRATION_MODE_INVALID");
-  const before = inspectControlMigration(root);
-  if (mode === "inspect" || !root) return before;
-  const changes = [];
-  const errors = [];
-  // A structural inventory failure never authorizes a partial migration of an incomplete inventory.
-  if (before.diagnostics.some((finding) => finding.code !== "AGDF_LEGACY_MIGRATION_REQUIRED")) return before;
-  const candidates = before.runs.filter((entry) => entry.status === "migration_required" || entry.pending_recoveries?.length);
-  // Bind the single decision to read-only snapshots. Declining must not even create journals.
-  // The canonical recovery writer still checks each selected revision under its own lock.
-  let selected;
-  if (typeof confirmMigration === "function" && candidates.length) {
-    selected = new Map();
-    for (const run of candidates) {
-      try {
-        if (run.pending_recoveries?.length > 1) throw new Error("AGDF_RECOVERY_JOURNAL_CONFLICT");
-        const pending = run.pending_recoveries?.[0];
-        const journalContent = pending ? regularFileSnapshot(join(root, pending.journal)).content.toString("utf8") : null;
-        const journal = pending ? JSON.parse(journalContent) : null;
-        const inspection = pending ? null : inspectRunRecovery(root, run.run_id, { inspectHistory: false });
-        selected.set(run.run_id, {
-          run_id: run.run_id, pending, journalContent,
-          source_revision_id: journal?.source_revision_id ?? inspection.revision_id,
-          source_content_digest: journal?.source_content_digest ?? inspection.content_digest,
-          source_artefacts: journal?.source_artefacts ?? inspection.artefacts,
-          prior_approvals: journal?.prior_approvals ?? inspection.approvals,
-          next_gate: journal?.next_gate ?? inspection.next_gate_if_recovered,
-        });
-      } catch (error) { errors.push({ run_id: run.run_id, code: String(error.code ?? error.message) }); }
-    }
-    if (selected.size) {
-      const plan = { target: root, control: before, runs: [...selected.values()], diagnostics: errors,
-        approval_reset_count: [...selected.values()].filter((run) => !safeApprovalReset(run.prior_approvals)).length,
-        authorizes: false };
-      if (await confirmMigration(structuredClone(plan)) !== "migrate") return before;
-    }
-  }
-  for (const run of candidates) {
-    if (selected && !selected.has(run.run_id)) continue;
-    if (run.pending_recoveries?.length > 1) { errors.push({ run_id: run.run_id, code: "AGDF_RECOVERY_JOURNAL_CONFLICT" }); continue; }
-    if (run.pending_recoveries?.length) run.safe_to_migrate = safeApprovalReset(run.pending_recoveries[0].prior_approvals ?? []);
-    if (!selected && !run.safe_to_migrate) continue;
-    try {
-      const snapshot = selected?.get(run.run_id);
-      const pending = run.pending_recoveries?.[0];
-      if (snapshot) {
-        if (pending) {
-          if (regularFileSnapshot(join(root, pending.journal)).content.toString("utf8") !== snapshot.journalContent) {
-            throw new Error("AGDF_STALE_RUN_REVISION");
-          }
-        } else {
-          const current = inspectRunRecovery(root, run.run_id, { inspectHistory: false });
-          if (current.revision_id !== snapshot.source_revision_id || current.content_digest !== snapshot.source_content_digest
-              || JSON.stringify(current.artefacts) !== JSON.stringify(snapshot.source_artefacts)) throw new Error("AGDF_STALE_RUN_REVISION");
-        }
-      }
-      const preview = pending ?? previewRunRecovery(root, run.run_id);
-      if (snapshot && !pending && (preview.source_content_digest !== snapshot.source_content_digest
-          || JSON.stringify(preview.source_artefacts) !== JSON.stringify(snapshot.source_artefacts))) throw new Error("AGDF_STALE_RUN_REVISION");
-      // A concurrent approval change must never turn a safe migration into approval invalidation.
-      const journal = JSON.parse(regularFileSnapshot(join(root, preview.journal)).content.toString("utf8"));
-      const safe = safeApprovalReset(journal.prior_approvals);
-      const confirmation = selected || safe ? preview.confirmation : null;
-      if (confirmation !== preview.confirmation) continue;
-      const applied = applyRunRecovery(root, { runId: run.run_id, previewId: preview.preview_id, confirmation });
-      if (applied.seal_status !== "valid" && applied.outcome !== "already_recovered") throw new Error("AGDF_CONTROL_MIGRATION_VERIFICATION_FAILED");
-      changes.push({ run_id: run.run_id, outcome: applied.outcome, revision_id: applied.revision_id,
-        backup: preview.journal, next_gate: preview.next_gate });
-    } catch (error) {
-      errors.push({ run_id: run.run_id, code: String(error.code ?? error.message) });
-    }
-  }
-  const after = inspectControlMigration(root);
-  after.changes = changes;
-  after.diagnostics.push(...errors);
-  if (errors.length) after.status = "repair_required";
-  return after;
-}
-