Approval keeps the fork where the work happened

The migration is risky, so the agent doesn't run it on the real machine. It copies the container from last night's snapshot: POST /copy with source_snapshot: and runs the migration on the fork. The fork has its own URL. You click through it: schema right, data intact, app serving.

Here's the part that changes the shape: approving it doesn't mean "now run it again on prod." The domain moves to the fork; the original is retired. The work happened once, was inspected once, and shipped as-is. Rejection is a DELETE.

Dry runs rehearse a change, and then you perform it live, hoping the rehearsal held. Here there is no second performance.