ADR-0040: offline database-first review between explicit versions

Status: accepted. Focused hosted run 38164485726 at bcb396c passes 193 tooling units and 15 tooling-suite cases, artifact checks and complete fixture cleanup. Retained Movies review captures match actual finalized-model fingerprints and all committed generated bytes. The first local attempt was stopped by the reserve guard; it was not counted as acceptance. See evidence provenance (maintainer-local record).

Add GraphScaffoldReview.Compare and the offline scaffold-review command rather than expanding inference heuristics. Require explicit baseline/current snapshot and policy pairs. Reuse strict bounded interchange, existing inference diagnostics, generated C# compilation and finalized EF storage manifests. Check that serializing/reading each pair preserves diagnostics, fingerprints and exact artifact bytes.

Separate observed schema/sample differences, actual generated storage-model differences and generated-artifact hash differences. Use semantic names for manifest collection paths, preserving ordered keys. When a side is invalid or DTO-only, model comparison is unavailable, never equivalent by default. Invalid proposals retain diagnostic actions for reviewed keys/constraints, conflicting scalar kinds, endpoint membership/direction and unknown cardinality.

Review only writes JSON to the caller's output stream. Existing scaffold publication/overwrite protection is unchanged. A valid model difference is not a migration, a whole-database integrity check, a breaking-change classification or automatic deployment authorization. Keep future model-to-migration synthesis separate in FUT-17/FUT-18.

Repeated offline compilation adds deliberate review cost; it is outside runtime query paths. Full IDE interaction and large-schema incremental review remain separate investigations. The review contract documents JSON/exit semantics and the Movies example.