Release: Deterministic Review-Auto Apply Flow

Forgeflow 4.3.59 lands Phase 6 of the review-auto sandbox path. The pipeline now supports deterministic exact-replacement proposal creation and an explicit one-proposal apply command with rollback on failed validation.

Deterministic Executors

• New build-review-autofix-proposal.js creates exact-replacement proposal JSON for docs/reference, command-wrapper parity, manifest/runtime-helper parity, and fixture expectation drift.
• Proposal creation reuses the Phase 4 policy contract and writes deterministic operations[] and validations[] inputs for the Phase 5 sandbox runner.
• Phase 5 proposal artifacts now preserve original operations and requested validations so apply can replay the selected proposal safely.

Explicit Apply Path

• New /forgeflow-review-autofix-apply --proposal <json> applies one selected, validated sandbox proposal to the local checkout.
• The apply helper refuses tracked dirty worktrees by default, checks exact source text before changing a file, runs requested validation after the change, and rolls back when validation fails.
• Apply writes local evidence under .forgeflow/<project>/review-auto/applied/ plus append-only apply history.

Safety Boundaries

• Apply v1 supports one deterministic replace operation per invocation.
• It refuses non-proposed artifacts, unsafe paths, unsupported operations, source symlinks, source mismatch, and non-eligible proposal evidence.
• It never commits, pushes, publishes, calls GitHub, dispatches workers, generates patches from prose, or batches fixes.

Validation

• Full scripts/forgeflow/test-*.js suite
• node scripts/forgeflow/test-apply-review-autofix-proposal.js
• node scripts/forgeflow/test-build-review-autofix-proposal.js
• node scripts/forgeflow/test-run-review-autofix-sandbox.js
• node scripts/forgeflow/test-install-manifest.js
• node scripts/forgeflow/test-command-coverage.js
• node scripts/forgeflow/test-doc-links.js
• node scripts/forgeflow/smoke-check.js --mode source --json
• node scripts/forgeflow/render-release-readiness.js --json
• git diff --check