S15/S17 part: migration-aware recovery check and incident evidence model (pure, unwired)

[im-tyler]

Changes

• src/recovery-compat.ts: pure check of whether rollback to the retained version stays compatible with applied migrations. Unread or unclassified state => hold. A newer contract/irreversible migration => incompatible (a recorded specific recovery plan is reported but is never a pass). Newer additive (expand) migrations or none => compatible. It never claims to prove the artifact rollback (provesArtifactRollback: false).
• src/incident-evidence.ts: observations (health, log excerpt, deploys, migration state) become a record that separates facts, hypotheses (type forbids high; correlation caveat; medium needs two evidence kinds), unknowns, set-aside other-service evidence, an ordered read-only timeline (unparseable times kept last and flagged), a candidate-only proposal and an actionable escalation.
• Both modules are pure and UNWIRED: no flag needed, default behaviour unchanged, no storage, no I/O, no model.

Checks

• pnpm run lint clean. Clean build, node --test over dist: 2002 pass, 0 fail (19 new tests).
• 8 negative controls, each verified by mutating the code and watching a test fail, then restoring: unknown-to-hold gate, blocking class, unclassified class, thin-sample healthy, service attribution filter, high confidence, deploy-after-onset/failed filter, medium-needs-corroboration.
• Skipped scripts/grader-sensitivity (fixed port 8901 collision between agents); CI runs it.

Not verified / still open

• Nothing is wired: no delivery rollback gate, no incident page timeline, no migration-state reader on a real target. No live observation, deploys or model calls. Only "checked", not "verified outcome".
• Log redaction is the caller's responsibility (excerpts are clamped only).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VqsBNqvaWezf1DwQrAnVgX

---

Generated by Claude Code