L03-03: Add the Compare and review workspace (#29)

[mberrys]

Issue

Closes #29 (L03-03 — Add Compare and review workspace). One topic branch, one commit, base dev.

What changed

The Compare workspace was a deliberately disabled destination (legacy #560): the shell held a placeholder pane and isWorkspaceEnabled(Compare) returned false. Issue #29 is the targeted implementation issue ADR-005 Phase 4 defers the "in-app Compare boundary" to, and the protected docs/schemas/loop-shell.schema.json already admits a compare workspace (enum + minItems: 7), so no protected schema change was needed.

• LoopEditor/qml/ComparePane.qml (and its byte-identical mirror under tools/ProductQuickAccessibilitySmoke/qml/) presents the comparison Core already produced for the plan or run on screen. It reads one new read-only projection, EditorHost.compareReview(), and derives nothing.
• EditorHost::compareReview() composes the existing Core-backed accessors — fixPlanIdentity, fixPreview, fixRecheck, fixSignOff — into: before/after artifact identities, the technical finding delta, the preserved attributes and the unresolved risk, plus the guard. EditorHost::navigateCompareDelta(int) routes a material delta to the step that produced it (navigation only).
• isWorkspaceEnabled(Compare) is now true for every registered destination; the retired WorkspacePlaceholderPane is deleted from both trees.
• Docs updated to the as-built contract: docs/loop-shell.json state invariant, docs/LOOP_SHELL_CONTRACT.md, docs/WORKSPACE_SURFACES_586.md.

Where each presented fact comes from (Core DTOs)

Presented	Source
Before artifact identity	PDFActionListExecutionResult.sourceSha256, document key/revision/planned revision (fixPlanIdentity)
After artifact identity	candidate/preview digest (fixPreview), published digest + governed status (fixSignOff)
Technical finding delta	pdf::PDFRepairFindingDelta via fixRecheck (resolved/unchanged/introduced/incomplete/compared)
Preserved attributes	the plan's declared expected_changes surface, the findings carried forward unchanged (carried_forward), and the save policy that keeps the source
Unresolved risk	declared plan risk, introduced/incomplete findings, plan/step warnings and unsupported_reasons

Acceptance criteria

Criterion	State	Evidence
Presents before/after artifacts, finding delta, preserved attributes and unresolved risk using Core DTOs	built	ComparePane.qml + EditorHost::compareReview(); UnitTestsProductOperatorLoop
Operator can compare exact input and candidate identities	built	compareWorkspaceBlocksAStaleComparison asserts before.sourceSha256 equals fixPlanIdentity().sourceSha256 and the plan digest is the current one
Navigate material deltas	built	compareWorkspaceNavigatesMaterialDeltasAfterARun asserts hasMaterialDeltas and navigateCompareDelta(0) routes to the Inspect step
A stale preview or mismatched plan digest is blocked, not silently refreshed	built	compareWorkspaceBlocksAStaleComparison: after a revision change blocked is true, blockedReason names it, lifecycleStateName == "stale", and navigateCompareDelta(0) is refused
Golden comparison fixture	built	UnitTests/testdata/compare-review/golden-comparison.json + UnitTests/testdata/fixture-classes/regression/compare-review-golden.yaml; pinned by compareReviewGoldenFixtureMatchesCoreFindingDelta
Stale-preview UI test	built	compareWorkspaceBlocksAStaleComparison; a11y smoke asserts comparePane is reachable and named

Proof

Branch codex/issue-29-compare-review, commit 9b7674f7, base origin/dev (0f2f7599, confirmed as the commit's parent).

• Mirror parity: python scripts/ci/check_qml_mirror_parity.py → QML mirror-parity guard passed: 15 mirror pair(s) are byte-identical.
• Preflight-truth guard: python scripts/ci/check_preflight_truth_source.py → passed (32 GUI files); python -m unittest scripts.ci.test_check_preflight_truth_source → 32 tests OK.
• Shell contract / catalogs: python scripts/verify-loop-shell-contract.py → 7 workspaces, 107 Editor actions ...; python scripts/generate-architecture-catalogs.py --check → exit 0; python scripts/verify-command-catalog.py → exit 0.
• Architecture contracts: python scripts/agent/test_architecture_contracts.py → OK; check-architecture.py --base origin/dev --head-branch codex/issue-29-compare-review → architecture contracts ok.
• Unit tests (built with loop-build-parity.sh, run with an explicit junitxml log):
  • UnitTestsShellWorkspace — 7 tests, 0 failures.
  • UnitTestsProductOperatorLoop — 16 tests, 0 failures (3 new Compare tests).
  • UnitTestsEditorHost — 20 tests, 0 failures.
• Product Quick accessibility smoke (LOOP_BUILD_PRODUCT_QUICK_A11Y_SMOKE=ON): comparePane has_name=1 role=20 pass=1, compare_workspace_enabled=1 reachable=1, status=pass, exit 0.

Fragment and evidence

• changes/codex-issue-29-compare-review.md — Category: added, Audience: operators, Breaking-Change: no.
• changes/codex-issue-29-compare-review.evidence.yaml — quick, plugins, build_policy, fixture-lifecycle, agent-policy and documentation lanes.

Unrun / caveats

• CI agent-fast is the authoritative gate; the local check-change.py run is recorded in the evidence manifest. See the check-change report attached to this PR's evidence for any lane that stays incomplete on this host.
• The reviewed-digest and published-digest mismatch branches of the guard are implemented but not reachable through today's public API (a plan clears the review decision when it is re-planned), so the exercised acceptance trigger is the stale-preview path.

Anti-slop review (1–3 sentences)

The diff adds one composed read-only projection rather than a second comparison model, and QML only renders it and forwards navigation. No new contract was invented: the workspace and its schema entry already existed, and the only guard-state change is the state invariant going from "Compare is disabled" to "Compare is presented". Explanatory comments were kept to the invariants the code cannot show itself, and the retired placeholder pane was deleted rather than left dead.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}