in2-agent-server 0.20260821.185429

package/dist/direct/sessionProjection.js

@@ -0,0 +1,126 @@
+import path from "node:path";
+import { promises as fs } from "node:fs";
+import { harvestProvenInto, knownTokensFrom, readProjectionManifest } from "./knownTokens.js";
+const emptyView = () => ({ components: new Map(), objects: new Set(), sources: [] });
+/** Fold one projection into the view. Later calls win — the caller orders by freshness. */
+function mergeInto(view, source) {
+    const dir = path.resolve(source.dir);
+    view.sources.push(dir);
+    for (const obj of source.manifest.objects ?? [])
+        view.objects.add(obj.objectApiName);
+    for (const c of source.manifest.components ?? []) {
+        view.components.set(`${c.typeName}:${c.fullName}`, {
+            typeName: c.typeName,
+            fullName: c.fullName,
+            found: c.found,
+            // A row with no snapshot file still carries its EXISTENCE, which is the load-bearing half.
+            // Losing the snapshot costs precedent for one component; throwing here would cost the caller
+            // its whole lint, and grounding must never fail closed on a malformed row.
+            snapshotPath: typeof c.file === "string" && c.file ? path.resolve(dir, c.file) : "",
+            sourceDir: dir
+        });
+    }
+}
+/** Build a view from already-loaded manifests, applied in the order given (last wins). */
+export function projectionView(sources) {
+    const view = emptyView();
+    for (const s of sources)
+        mergeInto(view, s);
+    return view;
+}
+/**
+ * The projection directories a session holds: `project_org` runs for `orgAlias`, plus every wave
+ * bundle's post-image.
+ *
+ * `orgAlias` scopes the project_org side and MUST be passed when it is known. A session can project
+ * MORE than its target org — Campfire reads project the consultant org — and a component existing
+ * over there is not evidence about the deploy target. The wave posts need no such scoping: a bundle
+ * only ever deploys to the session's target org.
+ */
+async function sessionProjectionDirs(sessionRoot, orgAlias) {
+    const dirs = [];
+    if (orgAlias) {
+        const projRoot = path.join(sessionRoot, "org-projection", orgAlias);
+        try {
+            for (const e of await fs.readdir(projRoot, { withFileTypes: true })) {
+                if (e.isDirectory())
+                    dirs.push(path.join(projRoot, e.name));
+            }
+        }
+        catch {
+            /* no project_org run for this org yet */
+        }
+    }
+    try {
+        const directRoot = path.join(sessionRoot, "direct");
+        for (const e of await fs.readdir(directRoot, { withFileTypes: true })) {
+            if (e.isDirectory())
+                dirs.push(path.join(directRoot, e.name, "post"));
+        }
+    }
+    catch {
+        /* first wave of the session — nothing has been delivered yet */
+    }
+    return dirs;
+}
+/**
+ * The session's view of the target org.
+ *
+ * `extra` sources are the CALLER'S OWN read — `direct_apply`'s pre-projection, taken seconds ago —
+ * and are applied last, after everything on disk, regardless of timestamps. That is deliberate:
+ * they are the freshest observation that exists, and ordering them by a manifest field would make
+ * grounding depend on clock skew between a projection and the tool that just ran one.
+ *
+ * Everything else is ordered by the manifest's `createdAt`, tie-broken on the directory path so the
+ * result never depends on readdir order — the same defect that let dual-claimed Configuration Items
+ * be settled silently by filesystem order.
+ */
+export async function collectSessionProjection(sessionRoot, orgAlias, extra = []) {
+    const loaded = [];
+    for (const dir of await sessionProjectionDirs(sessionRoot, orgAlias)) {
+        // Best-effort per directory: a half-written bundle must not take out the whole view and turn a
+        // narrower-than-ideal warning into no warning at all.
+        try {
+            const manifest = await readProjectionManifest(dir);
+            loaded.push({ dir, manifest, createdAt: typeof manifest.createdAt === "string" ? manifest.createdAt : "" });
+        }
+        catch {
+            /* not a readable projection (wave never got past the deploy, or a partial write) */
+        }
+    }
+    loaded.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.dir.localeCompare(b.dir));
+    return projectionView([...loaded, ...extra]);
+}
+/**
+ * The view's sources as short labels — `ground`, `w2/post` — for a result line that says what was
+ * grounded against without pasting a screenful of absolute paths into every lint.
+ */
+export function describeSources(view, max = 8) {
+    const labels = view.sources.map((dir) => path.basename(dir) === "post" ? `${path.basename(path.dirname(dir))}/post` : path.basename(dir));
+    return labels.length > max ? `${labels.slice(0, max).join(", ")}, +${labels.length - max} more` : labels.join(", ");
+}
+/** Every custom API token this view vouches for — the referential tier's ground truth. */
+export function viewKnownTokens(view) {
+    return knownTokensFrom([...view.components.values()], [...view.objects]);
+}
+/**
+ * Values for org-enforced elements (`CustomTab.motif`, `FlexiPage.componentName`), proven by
+ * components that exist in this org. Only the freshest snapshot of each component is read, so a
+ * component seen by three projections costs one file read rather than three.
+ */
+export async function viewProvenValues(view) {
+    const out = new Map();
+    for (const c of view.components.values()) {
+        if (!c.found || !c.snapshotPath)
+            continue;
+        try {
+            const snap = JSON.parse(await fs.readFile(c.snapshotPath, "utf8"));
+            if (snap.state.metadata)
+                harvestProvenInto(snap.state.metadata, out, c.typeName);
+        }
+        catch {
+            /* unreadable snapshot contributes nothing */
+        }
+    }
+    return out;
+}

package/dist/direct/snapshotComparability.js

@@ -0,0 +1,165 @@
+// IS THIS PAIR OF SNAPSHOTS EVIDENCE ABOUT THE ORG, OR ABOUT THE READER? (live-caught, PV Arm B)
+//
+// `MATERIALIZER_VERSION` versions the WRITE side — how bundles become commits. Nothing versioned the
+// READ side, and the mirror compares a snapshot captured months ago against one captured today. When
+// the reader changes in between, the two describe the same org state in two different shapes, and
+// `computeDrift`'s byte comparison reports the difference as CHANGED-OUTSIDE-HISTORY — a claim that
+// someone edited the component. R15's whole discipline is that a drift card is a claim about
+// somebody's work; a claim produced by our own refactor is a false accusation.
+//
+// LIVE-CAUGHT 2026-08-02, PV corpus Arm B, session ses_20df7fb1b75daf736c8f1cd7 wave w3, org
+// 00Dfn00000BFjbBEAT: `Drift: Layout:PV_Asset__c-PV Asset Layout`. The mirror's copy was captured by
+// the pre-#21 Layout reader; w3's pre-image by the new one. The complete delta, diffed from the two
+// artifacts on disk:
+//
+//   family   "generic"       -> "layout"
+//   source   "metadata.read" -> "metadata.read + tooling:Layout.Metadata.relatedLists"
+//   relatedLists[*]          gained  quickActions: [], sortField: null, sortOrder: null
+//
+// Zero org-state bytes. Every `layoutSection`, every `layoutItem`, the related-list SET itself —
+// byte-identical. The card was 100% reader shape. 13 of the 14 Layouts mirrored in that org are
+// still recorded under the old reader and would each produce the same false card on their next read.
+//
+// WHY NOT NORMALIZE THE DIFFERENCE AWAY (the comparatorNoise.ts approach)
+//
+// Because the old value is not a differently-shaped truth, it is NOT EVIDENCE. #21 exists because
+// SOAP `readMetadata` silently omits Layout related lists — measured that day across all 436 layouts
+// in the reference org: 12 disagreed with the deploy-symmetric source, 56 related-list items missing,
+// and NOT all-or-nothing (17 of 20, 23 of 34, 18 of 26 on three separate layouts). Declaring the old
+// `relatedLists` equal to the new one would therefore assert something false on 12 layouts in 436 —
+// and on exactly those, the assertion would silently swallow a REAL related-list deletion. The
+// noise budget's own bar is "a MEASURED org behaviour, not a plausible one"; here the measurement
+// says the two values are not the same fact, so normalization is the wrong instrument.
+//
+// The right answer is the honest one: say the two reads are not comparable, and say what differed.
+//
+// WHAT THIS IS NOT
+//
+// Not suppression. A component gated here is NEVER reported as clean — it is reported as its own
+// finding (`IncomparableSnapshot`), carrying both reader identities and the state keys that actually
+// differ, so a real third-party edit hiding behind the reader change is visible to the supervisor
+// rather than deleted from the record. And the blindness is one wave wide: the wave commits its
+// post-image under the CURRENT reader, so the next comparison of that component is fully comparable.
+//
+// A SECOND GATE, on what a snapshot admits it does not contain. `readLayoutSnapshot` DROPS the
+// facet it could not verify and declares `INCOMPLETE_FACET relatedLists: ...`; orgrepo-v4 persists
+// that declaration into the committed snapshot as `incompleteFacets`, so it survives on the
+// recorded side too. Both sides are consulted (`FACET_UNREAD`) — a facet EITHER read never held is
+// not evidence about the org, and comparing against it would card a probe outage as a related-list
+// deletion, or a probe RECOVERY as someone adding related lists.
+//
+// The gate key is `(family, source)` — READ OFF THE STORED SNAPSHOT rather than stamped as a new
+// version field. That is deliberate and it is what makes this work at all: all 272 blobs already in
+// the live mirror carry both fields, so the gate applies to history already on disk, with no rebuild
+// and no "an unstamped blob means old" amnesty rule. A version field added today would be absent
+// from every snapshot the problem is actually about. Same reasoning as `harnessVersion()` — a
+// measurement of what the reader did beats a number someone has to remember to bump.
+import { incompleteFacetsOf } from "../orgread/layoutSnapshot.js";
+export const readerIdentityLabel = (id) => `${id.family}|${id.source}`;
+/**
+ * The facets a snapshot DECLARES it does not contain, read off the snapshot itself.
+ *
+ * `canonicalSnapshot` persists this as `incompleteFacets` (orgrepo-v4), so both sides of a
+ * comparison can speak. Absent on every pre-v4 blob, which is correct: an old snapshot makes no
+ * declaration, and `[]` is exactly "declares nothing" rather than "declares completeness".
+ */
+function declaredIncompleteFacets(parsed) {
+    const value = parsed?.incompleteFacets;
+    // A malformed marker is not a declaration. Trusting one would silence a real difference, and
+    // doubt here fails towards the card.
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((f) => typeof f === "string");
+}
+function readerIdentityOf(parsed) {
+    const s = parsed;
+    if (!s || typeof s.family !== "string" || typeof s.source !== "string")
+        return null;
+    return { family: s.family, source: s.source };
+}
+/**
+ * The metadata keys whose values differ — the evidence a reader of the finding needs.
+ *
+ * Top level of `state.metadata` where a snapshot has one (every metadata-API read does), the top of
+ * `state` otherwise. Deliberately shallow: this is not a diff, it is the answer to "which facets are
+ * involved", which is what tells a supervisor whether the reader change explains the whole thing.
+ */
+function differingKeys(a, b) {
+    const facetsOf = (parsed) => {
+        const state = parsed?.state;
+        if (!state || typeof state !== "object" || Array.isArray(state))
+            return {};
+        const metadata = state.metadata;
+        const target = metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata : state;
+        return target;
+    };
+    const left = facetsOf(a);
+    const right = facetsOf(b);
+    const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+    const out = [];
+    for (const key of keys) {
+        // Both sides are already canonicalized (keys sorted deep), so a string compare of the serialized
+        // values is an exact value compare and needs no deep-equality helper.
+        if (JSON.stringify(left[key]) !== JSON.stringify(right[key]))
+            out.push(key);
+    }
+    return out.sort();
+}
+/**
+ * Are these two snapshots of one component comparable as claims about the ORG?
+ *
+ * Only ever asked of a pair that already differs — an equal pair raises no question. Every failure
+ * path returns COMPARABLE, because "drift stands" is the direction a doubt here must fail in: a
+ * missed gate costs a false card that a supervisor classifies, while a gate that fires on garbage
+ * would silence a real one.
+ *
+ * BOTH SIDES DECLARE. `canonicalSnapshot` persists an INCOMPLETE_FACET declaration as
+ * `incompleteFacets` (orgrepo-v4), so the recorded snapshot says what it does not contain and the
+ * gate is symmetric. It closes the asymmetry this comment used to bound: previously only the fresh
+ * side could speak, and the case that reached past the identity gate — a reader declaring a facet
+ * unread WITHOUT varying its `source` — had no answer at all. Now a facet EITHER side never read is
+ * withheld, which is the only honest reading: a difference in a facet one side never held is not
+ * evidence about the org in either direction.
+ *
+ * `observedErrors` is still taken separately, and it is not redundant: the fresh pre-image is
+ * compared BEFORE it is committed, so on the live path its declaration exists only in `errors`. The
+ * two sources are unioned rather than ranked — a marker anywhere in the pair is a gap in the pair.
+ *
+ * Pre-v4 blobs carry no `incompleteFacets`, and that reads as "declares nothing" rather than
+ * "declares completeness" — the same direction every other unknown here fails in.
+ */
+export function assessComparability(args) {
+    let recorded;
+    let observed;
+    try {
+        recorded = JSON.parse(args.recorded);
+        observed = JSON.parse(args.observed);
+    }
+    catch {
+        return { kind: "COMPARABLE" };
+    }
+    const recordedId = readerIdentityOf(recorded);
+    const observedId = readerIdentityOf(observed);
+    if (!recordedId || !observedId)
+        return { kind: "COMPARABLE" };
+    const keys = differingKeys(recorded, observed);
+    if (recordedId.family !== observedId.family || recordedId.source !== observedId.source) {
+        return { kind: "READER_CHANGED", recorded: recordedId, observed: observedId, differingKeys: keys };
+    }
+    // Same reader, same surfaces — but either side may still have declared a facet unreadable. A facet
+    // one of them says it never read is not evidence about that facet, in either direction, and it
+    // does not matter which side is the one that could not read it.
+    const facets = [
+        ...new Set([
+            ...incompleteFacetsOf(args.observedErrors),
+            ...declaredIncompleteFacets(observed),
+            ...declaredIncompleteFacets(recorded)
+        ])
+    ];
+    if (facets.length > 0 && keys.length > 0 && keys.every((k) => facets.includes(k))) {
+        return { kind: "FACET_UNREAD", facets: facets.filter((f) => keys.includes(f)).sort(), differingKeys: keys };
+    }
+    // Differences outside the unread facets are real differences. The card stands on those, and the
+    // unread facet does not get to shelter them.
+    return { kind: "COMPARABLE" };
+}

package/dist/direct/sourceTree.js

@@ -0,0 +1,113 @@
+import path from "node:path";
+import { promises as fs } from "node:fs";
+import { childByDirectory, lookupType, typesByDirectory } from "./registry.js";
+// Map a source-format RELATIVE path (package-root-relative, e.g. "objects/X__c/fields/F__c.field-meta.xml"
+// or "flows/My.flow-meta.xml" or "email/unfiled$public/T.email") back to its component identity.
+// Registry-driven so it covers any type the forward resolver writes. Returns null for a path the
+// walker does not recognize (surfaced as `skipped`, never silently dropped).
+export function resolveComponentFromRelPath(relPath) {
+    const segs = relPath.split(/[\\/]/).filter(Boolean);
+    const [top, ...rest] = segs;
+    if (!top || rest.length === 0)
+        return null;
+    // objects/OBJ/… — the CustomObject folderPerType decomposition (object + nested children).
+    if (top === "objects") {
+        const [obj, childDir, fileName] = rest;
+        if (!obj)
+            return null;
+        if (rest.length === 2 && childDir === `${obj}.object-meta.xml`) {
+            return { typeName: "CustomObject", fullName: obj, role: "meta" };
+        }
+        if (rest.length === 3 && childDir && fileName) {
+            const co = lookupType("CustomObject");
+            if (!co)
+                return null;
+            const child = childByDirectory(co, childDir);
+            if (!child?.suffix)
+                return null;
+            const tail = `.${child.suffix}-meta.xml`;
+            if (!fileName.endsWith(tail))
+                return null;
+            return { typeName: child.name, fullName: `${obj}.${fileName.slice(0, -tail.length)}`, role: "meta" };
+        }
+        return null;
+    }
+    // Top-level type by its directory name. A directory can host multiple types, so pick the
+    // candidate whose SUFFIX fits the file — meta files first (their `.suffix-meta.xml` is more
+    // specific than a bare `.suffix`), then content files. `remainder` may carry a folder segment
+    // for folder types (email/<Folder>/<Name>.email-meta.xml → fullName "<Folder>/<Name>").
+    const candidates = typesByDirectory(top).filter((c) => Boolean(c.suffix));
+    const remainder = rest.join("/");
+    for (const entry of candidates) {
+        const metaTail = `.${entry.suffix}-meta.xml`;
+        if (remainder.endsWith(metaTail))
+            return { typeName: entry.name, fullName: remainder.slice(0, -metaTail.length), role: "meta" };
+    }
+    for (const entry of candidates) {
+        const contentTail = `.${entry.suffix}`;
+        if (remainder.endsWith(contentTail))
+            return { typeName: entry.name, fullName: remainder.slice(0, -contentTail.length), role: "content" };
+    }
+    return null;
+}
+// Path relative to the package root: tolerate either a bare tree (objects/… directly under
+// sourceDir) or a full SFDX layout (force-app/main/default/objects/…) by stripping a
+// `main/default/` prefix when present.
+function relFromPackageRoot(abs, rootDir) {
+    const rel = path.relative(rootDir, abs).split(path.sep).join("/");
+    const marker = rel.indexOf("main/default/");
+    return marker >= 0 ? rel.slice(marker + "main/default/".length) : rel;
+}
+async function listFilesRecursive(dir) {
+    const out = [];
+    const walk = async (d) => {
+        const entries = await fs.readdir(d, { withFileTypes: true });
+        for (const e of entries) {
+            const abs = path.join(d, e.name);
+            if (e.isDirectory())
+                await walk(abs);
+            else if (e.isFile())
+                out.push(abs);
+        }
+    };
+    await walk(dir);
+    return out;
+}
+// Walk a source-format tree into ComponentEdit[]. Content-file types (EmailTemplate, …) pair
+// their `-meta.xml` (→ `xml`) with the sibling content file (→ `content`). Unrecognized files
+// and content files with no meta are reported in `skipped` — fail-loud, never silently dropped.
+export async function walkSourceTree(rootDir) {
+    const abs = path.resolve(rootDir);
+    const files = await listFilesRecursive(abs);
+    const byKey = new Map();
+    const skipped = [];
+    for (const fileAbs of files.sort()) {
+        const rel = relFromPackageRoot(fileAbs, abs);
+        const resolved = resolveComponentFromRelPath(rel);
+        if (!resolved) {
+            skipped.push({ file: rel, reason: "unrecognized source path (not a known type/child layout)" });
+            continue;
+        }
+        const key = `${resolved.typeName}:${resolved.fullName}`;
+        const group = byKey.get(key) ?? { typeName: resolved.typeName, fullName: resolved.fullName };
+        if (resolved.role === "meta")
+            group.metaAbs = fileAbs;
+        else
+            group.contentAbs = fileAbs;
+        byKey.set(key, group);
+    }
+    const components = [];
+    for (const g of [...byKey.values()].sort((a, b) => `${a.typeName}:${a.fullName}`.localeCompare(`${b.typeName}:${b.fullName}`))) {
+        if (!g.metaAbs) {
+            skipped.push({ file: `${g.typeName}:${g.fullName}`, reason: "content file without a -meta.xml sibling" });
+            continue;
+        }
+        const edit = { typeName: g.typeName, fullName: g.fullName, xml: await fs.readFile(g.metaAbs, "utf8") };
+        if (g.contentAbs) {
+            edit.content = await fs.readFile(g.contentAbs, "utf8");
+            edit.contentEncoding = "utf8";
+        }
+        components.push(edit);
+    }
+    return { components, skipped };
+}

package/dist/direct/unstatedChanges.js

@@ -0,0 +1,106 @@
+import { canonJson, diffMetadata, isChildCollectionPath } from "../projection/diff.js";
+import { PLATFORM_DEFAULT_WHEN_OMITTED, canonicalizeCurrencyish, coerceLeaf, isEmptyish, isPlainObj } from "./comparatorNoise.js";
+/**
+ * Both sides through the same shape normalizations, so only CONTENT differences survive.
+ *
+ * `null` collapses to `undefined` deliberately: diffMetadata renders the latter as `(absent)`, and a
+ * facet that went absent belongs to findRemovals — one rendering keeps that filter honest instead of
+ * having it match two spellings of the same thing.
+ */
+function canonicalize(v) {
+    if (v === null || v === undefined)
+        return undefined;
+    if (Array.isArray(v)) {
+        const items = v.map(canonicalize);
+        // The Metadata API collapses a one-element collection to a bare object on read-back, and which
+        // side of a deploy gets which shape is not something the author controls. compareIntent
+        // normalizes the same pair; here it must be done on both sides at once.
+        const shaped = items.length === 1 ? items[0] : items;
+        return isEmptyish(shaped) ? "" : shaped;
+    }
+    if (isPlainObj(v)) {
+        const rec = coerceLeaf(v);
+        if (!isPlainObj(rec))
+            return canonicalize(rec); // {_, $} text-node collapsed to its scalar
+        const out = {};
+        for (const [k, x] of Object.entries(rec))
+            out[k] = canonicalize(x);
+        return isEmptyish(out) ? "" : out;
+    }
+    return coerceLeaf(canonicalizeCurrencyish(v));
+}
+/**
+ * Did the org MATERIALIZE this key, rather than the deploy changing it?
+ *
+ * Only asked where the pre-image had nothing at all, so this can never suppress a value that moved —
+ * it decides whether a newly-present facet carries content or is the platform writing down a default
+ * it had previously left implicit.
+ */
+function isMaterialized(key, value, container) {
+    // "Absent means false" — the org drops a boolean equal to the platform default and can materialize
+    // it back on a later read. compareIntent treats exactly this pair as agreement.
+    if (value === "false" || value === false)
+        return true;
+    // A skeleton is not content: `controllingFieldValues: []` appearing is the org describing its own
+    // data model, not a change to the component (a class named in the run's noise catalogue).
+    if (isEmptyish(value))
+        return true;
+    if (key in PLATFORM_DEFAULT_WHEN_OMITTED && canonJson(PLATFORM_DEFAULT_WHEN_OMITTED[key]) === canonJson(value)) {
+        return true;
+    }
+    // Value-set entries: the org stamps `label` = `fullName` onto every customValue on read-back
+    // (stress-caught case E, 2026-07-22), the same materialization normalizeIntent mirrors.
+    if (key === "label" && typeof value === "string" && container.fullName === value)
+        return true;
+    return false;
+}
+/** Drop from the post-image every key the pre-image never had AND the org merely materialized. */
+function withoutMaterialized(before, after) {
+    if (Array.isArray(before) && Array.isArray(after) && before.length === after.length) {
+        return after.map((el, i) => withoutMaterialized(before[i], el));
+    }
+    if (!isPlainObj(before) || !isPlainObj(after))
+        return after;
+    const out = {};
+    for (const [k, v] of Object.entries(after)) {
+        if (before[k] === undefined) {
+            if (!isMaterialized(k, v, after))
+                out[k] = v;
+            continue;
+        }
+        out[k] = withoutMaterialized(before[k], v);
+    }
+    return out;
+}
+/** Root facet of a diff path — `metadata.foo[bar=x].baz` → `foo`. */
+function rootOf(path) {
+    return path.split(".")[1]?.replace(/\[.*$/, "") ?? "";
+}
+export function findUnstatedChanges(typeName, pre, post, intent) {
+    if (!pre || !post)
+        return []; // a create has no pre-image — nothing can have changed
+    const statedRoots = new Set(Object.keys(intent ?? {}));
+    const before = canonicalize(pre);
+    const after = withoutMaterialized(before, canonicalize(post));
+    return diffMetadata(before, after)
+        .filter((c) => !c.orderOnly)
+        .filter((c) => !statedRoots.has(rootOf(c.path)))
+        // A disappearance is findRemovals' finding — it blocks the same verdict and says the one thing
+        // that matters about it (content was LOST, not changed). Two alarms for one event cost more
+        // attention than they buy.
+        .filter((c) => c.after !== "(absent)")
+        // The CustomObject read-back EMBEDS the child collections (fields, listViews, validationRules,
+        // …) that the projection also captures as their own components. Without this, a wave that
+        // deploys an object plus its fields reports every field as an unstated change on the parent.
+        // diffProjections excludes them from the object diff for the same reason.
+        .filter((c) => !(typeName === "CustomObject" && isChildCollectionPath(c.path)))
+        .map(({ path, before: b, after: a }) => ({ path, before: b, after: a }));
+}
+export function renderUnstatedChanges(component, changes) {
+    // Named individually, with BOTH values: a count sends the reader to the bundle to find out which
+    // setting moved and to what, which is the manual diff-reading this check exists to retire. Past a
+    // handful it inverts and would bury every other finding, so it collapses.
+    const shown = changes.slice(0, 8).map((c) => `${c.path} (${c.before} → ${c.after})`);
+    const more = changes.length > shown.length ? ` …and ${changes.length - shown.length} more` : "";
+    return `${component}: ${shown.join(", ")}${more}`;
+}