feat(migration): detect when archive git data is ahead of prod

Add git ancestry comparison (22-compare-git-data.sh) to determine
commit relationships between prod and archive repos. Repos where
archive is ahead are now correctly classified as ready-for-migration
since ngit-grasp only accepts git data authorized by state events.

Previously, repos with different git data were flagged as needs-resync
even when archive had newer/better data than prod.

3 files changed, 481 insertions, 9 deletions

diff --git a/docs/how-to/migration-scripts/22-compare-git-data.sh b/docs/how-to/migration-scripts/22-compare-git-data.sh
new file mode 100755
index 0000000..76521d4
--- /dev/null
+++ b/docs/how-to/migration-scripts/22-compare-git-data.sh
@@ -0,0 +1,390 @@
+#!/usr/bin/env bash
+#
+# 22-compare-git-data.sh - Compare actual git data between prod and archive relays
+#
+# PHASE 3c of the GRASP relay to ngit-grasp migration analysis pipeline.
+# Compares actual git commits between prod and archive to determine which is ahead.
+#
+# KEY INSIGHT:
+#   Archive (ngit-grasp) enforces GRASP - git data ALWAYS matches a state event.
+#   If archive has different/newer data than prod, it means:
+#   - A state event authorized those commits at some point
+#   - Archive is actually MORE up-to-date than prod
+#   - Migration should use archive data (it's already correct)
+#
+# USAGE:
+#   ./22-compare-git-data.sh <prod-git-base> <archive-git-base> <repo-list> <output-dir>
+#
+# EXAMPLES:
+#   ./22-compare-git-data.sh /var/lib/grasp-relay/git /var/lib/ngit-grasp/git \
+#       output/comparison/complete-prod-incomplete-archive.txt output/comparison
+#
+# INPUT:
+#   prod-git-base     Base directory for prod git repos (e.g., /var/lib/grasp-relay/git)
+#   archive-git-base  Base directory for archive git repos (e.g., /var/lib/ngit-grasp/git)
+#   repo-list         File with repos to compare (format: "repo | npub | ...")
+#
+# OUTPUT:
+#   <output-dir>/git-ancestry.tsv - Tab-separated values:
+#     repo<TAB>npub<TAB>relationship<TAB>details
+#
+#   Relationship values:
+#     archive-ahead    - Archive has all prod commits plus more (GOOD - use archive)
+#     in-sync          - Both have identical commits
+#     prod-ahead       - Prod has commits archive is missing (needs re-sync)
+#     diverged         - Both have unique commits (manual review)
+#     archive-only     - Only archive has git data
+#     prod-only        - Only prod has git data
+#     both-empty       - Neither has git data
+#
+# PREREQUISITES:
+#   - git (for ref comparison)
+#   - Read access to both git directories (may need sudo)
+#
+# RUNTIME: Depends on number of repos to compare
+#
+# SEE ALSO:
+#   docs/how-to/migrate-to-ngit-grasp.md - Full migration guide
+#   21-compare-relays.sh - Phase 3b script that identifies repos to compare
+#
+
+set -euo pipefail
+
+# Colors for output (disabled if not a terminal)
+if [[ -t 1 ]]; then
+    RED='\033[0;31m'
+    GREEN='\033[0;32m'
+    YELLOW='\033[0;33m'
+    BLUE='\033[0;34m'
+    NC='\033[0m'
+else
+    RED=''
+    GREEN=''
+    YELLOW=''
+    BLUE=''
+    NC=''
+fi
+
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $*" >&2
+}
+
+log_success() {
+    echo -e "${GREEN}[OK]${NC} $*" >&2
+}
+
+log_warn() {
+    echo -e "${YELLOW}[WARN]${NC} $*" >&2
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $*" >&2
+}
+
+log_progress() {
+    echo -ne "\r${BLUE}[PROGRESS]${NC} $*" >&2
+}
+
+usage() {
+    echo "Usage: $0 <prod-git-base> <archive-git-base> <repo-list> <output-dir>"
+    echo ""
+    echo "Arguments:"
+    echo "  prod-git-base     Base directory for prod git repos"
+    echo "  archive-git-base  Base directory for archive git repos"
+    echo "  repo-list         File with repos to compare (format: 'repo | npub | ...')"
+    echo "  output-dir        Directory to store output files"
+    echo ""
+    echo "Examples:"
+    echo "  $0 /var/lib/grasp-relay/git /var/lib/ngit-grasp/git \\"
+    echo "      output/comparison/complete-prod-incomplete-archive.txt output/comparison"
+    echo ""
+    echo "Output:"
+    echo "  git-ancestry.tsv - TSV with: repo, npub, relationship, details"
+    exit 1
+}
+
+# Get all branch refs from a git directory
+# Args: $1=git_dir
+# Returns: sorted list of "ref_name commit_hash" lines
+get_git_refs() {
+    local git_dir="$1"
+    
+    if [[ ! -d "$git_dir" ]]; then
+        return
+    fi
+    
+    git --git-dir="$git_dir" show-ref --heads 2>/dev/null | sort || true
+}
+
+# Check if commit A is ancestor of commit B
+# Args: $1=git_dir, $2=commit_a, $3=commit_b
+# Returns: 0 if A is ancestor of B, 1 otherwise
+is_ancestor() {
+    local git_dir="$1"
+    local commit_a="$2"
+    local commit_b="$3"
+    
+    git --git-dir="$git_dir" merge-base --is-ancestor "$commit_a" "$commit_b" 2>/dev/null
+}
+
+# Compare git data between prod and archive for a single repo
+# Args: $1=prod_git_dir, $2=archive_git_dir
+# Returns: relationship string
+compare_repo_git() {
+    local prod_git="$1"
+    local archive_git="$2"
+    
+    local prod_exists=false
+    local archive_exists=false
+    
+    [[ -d "$prod_git" ]] && prod_exists=true
+    [[ -d "$archive_git" ]] && archive_exists=true
+    
+    # Handle cases where one or both don't exist
+    if [[ "$prod_exists" == "false" && "$archive_exists" == "false" ]]; then
+        echo "both-empty"
+        return
+    fi
+    
+    if [[ "$prod_exists" == "false" ]]; then
+        echo "archive-only"
+        return
+    fi
+    
+    if [[ "$archive_exists" == "false" ]]; then
+        echo "prod-only"
+        return
+    fi
+    
+    # Both exist - get refs
+    local prod_refs archive_refs
+    prod_refs=$(get_git_refs "$prod_git")
+    archive_refs=$(get_git_refs "$archive_git")
+    
+    # Handle empty refs
+    if [[ -z "$prod_refs" && -z "$archive_refs" ]]; then
+        echo "both-empty"
+        return
+    fi
+    
+    if [[ -z "$prod_refs" ]]; then
+        echo "archive-only"
+        return
+    fi
+    
+    if [[ -z "$archive_refs" ]]; then
+        echo "prod-only"
+        return
+    fi
+    
+    # Compare refs - check if they're identical
+    if [[ "$prod_refs" == "$archive_refs" ]]; then
+        echo "in-sync"
+        return
+    fi
+    
+    # Refs differ - need to check ancestry
+    # Strategy: For each branch, check if one is ancestor of the other
+    # If all archive branches are ahead of or equal to prod branches, archive is ahead
+    # If all prod branches are ahead of or equal to archive branches, prod is ahead
+    # Otherwise, they've diverged
+    
+    local archive_ahead=true
+    local prod_ahead=true
+    local has_common_branch=false
+    
+    # Create temporary file to use archive as reference repo for ancestry checks
+    # We need a repo that has both sets of commits to check ancestry
+    # Use archive since it's the target and should have the superset
+    
+    # Check each prod branch against archive
+    while read -r prod_hash prod_ref; do
+        [[ -z "$prod_hash" ]] && continue
+        
+        # Get the same branch from archive
+        local archive_hash
+        archive_hash=$(echo "$archive_refs" | grep " $prod_ref$" | awk '{print $1}' || echo "")
+        
+        if [[ -z "$archive_hash" ]]; then
+            # Branch exists in prod but not archive - prod has something archive doesn't
+            # But this could be a deleted branch, so don't immediately say prod is ahead
+            continue
+        fi
+        
+        has_common_branch=true
+        
+        if [[ "$prod_hash" == "$archive_hash" ]]; then
+            # Same commit - neither ahead for this branch
+            continue
+        fi
+        
+        # Different commits - check ancestry
+        # First, try to check if prod is ancestor of archive (archive ahead)
+        if is_ancestor "$archive_git" "$prod_hash" "$archive_hash" 2>/dev/null; then
+            # Prod commit is ancestor of archive commit - archive is ahead for this branch
+            prod_ahead=false
+        elif is_ancestor "$archive_git" "$archive_hash" "$prod_hash" 2>/dev/null; then
+            # Archive commit is ancestor of prod commit - prod is ahead for this branch
+            archive_ahead=false
+        else
+            # Neither is ancestor - diverged
+            archive_ahead=false
+            prod_ahead=false
+        fi
+    done <<< "$prod_refs"
+    
+    # Also check for branches only in archive (archive has extra branches)
+    while read -r archive_hash archive_ref; do
+        [[ -z "$archive_hash" ]] && continue
+        
+        local prod_hash
+        prod_hash=$(echo "$prod_refs" | grep " $archive_ref$" | awk '{print $1}' || echo "")
+        
+        if [[ -z "$prod_hash" ]]; then
+            # Branch exists in archive but not prod - archive has something prod doesn't
+            # This means archive is ahead (has extra branches)
+            prod_ahead=false
+        fi
+    done <<< "$archive_refs"
+    
+    # Determine final relationship
+    if [[ "$has_common_branch" == "false" ]]; then
+        # No common branches - completely different
+        echo "diverged"
+        return
+    fi
+    
+    if [[ "$archive_ahead" == "true" && "$prod_ahead" == "false" ]]; then
+        echo "archive-ahead"
+    elif [[ "$prod_ahead" == "true" && "$archive_ahead" == "false" ]]; then
+        echo "prod-ahead"
+    elif [[ "$archive_ahead" == "true" && "$prod_ahead" == "true" ]]; then
+        # Both true means all common branches are identical
+        # But one might have extra branches
+        echo "in-sync"
+    else
+        echo "diverged"
+    fi
+}
+
+# Main
+main() {
+    if [[ $# -ne 4 ]]; then
+        usage
+    fi
+    
+    local prod_git_base="$1"
+    local archive_git_base="$2"
+    local repo_list="$3"
+    local output_dir="$4"
+    
+    # Validate inputs
+    if [[ ! -d "$prod_git_base" ]]; then
+        log_error "Prod git base directory not found: $prod_git_base"
+        exit 1
+    fi
+    
+    if [[ ! -d "$archive_git_base" ]]; then
+        log_error "Archive git base directory not found: $archive_git_base"
+        exit 1
+    fi
+    
+    if [[ ! -f "$repo_list" ]]; then
+        log_error "Repo list file not found: $repo_list"
+        exit 1
+    fi
+    
+    log_info "=== Git Data Comparison ==="
+    log_info "Prod git base: $prod_git_base"
+    log_info "Archive git base: $archive_git_base"
+    log_info "Repo list: $repo_list"
+    log_info "Output: $output_dir"
+    log_info "Started: $(date)"
+    echo ""
+    
+    # Create output directory
+    mkdir -p "$output_dir"
+    
+    # Output file
+    local tsv_file="$output_dir/git-ancestry.tsv"
+    
+    # Initialize TSV with header
+    echo -e "repo\tnpub\trelationship\tdetails" > "$tsv_file"
+    
+    # Count repos
+    local total_repos
+    total_repos=$(grep -c -v '^#' "$repo_list" 2>/dev/null || echo "0")
+    log_info "Processing $total_repos repos..."
+    echo ""
+    
+    # Counters
+    local count=0
+    local count_archive_ahead=0
+    local count_in_sync=0
+    local count_prod_ahead=0
+    local count_diverged=0
+    local count_archive_only=0
+    local count_prod_only=0
+    local count_both_empty=0
+    
+    # Process each repo
+    while IFS='|' read -r repo npub rest || [[ -n "$repo" ]]; do
+        # Skip comments and empty lines
+        [[ "$repo" =~ ^# ]] && continue
+        [[ -z "$repo" ]] && continue
+        
+        # Clean up whitespace
+        repo="${repo// /}"
+        npub="${npub// /}"
+        
+        [[ -z "$repo" || -z "$npub" ]] && continue
+        
+        count=$((count + 1))
+        
+        # Build git paths
+        local prod_git="$prod_git_base/${npub}/${repo}.git"
+        local archive_git="$archive_git_base/${npub}/${repo}.git"
+        
+        # Compare
+        local relationship details=""
+        relationship=$(compare_repo_git "$prod_git" "$archive_git")
+        
+        # Count by relationship
+        case "$relationship" in
+            archive-ahead) count_archive_ahead=$((count_archive_ahead + 1)) ;;
+            in-sync) count_in_sync=$((count_in_sync + 1)) ;;
+            prod-ahead) count_prod_ahead=$((count_prod_ahead + 1)) ;;
+            diverged) count_diverged=$((count_diverged + 1)) ;;
+            archive-only) count_archive_only=$((count_archive_only + 1)) ;;
+            prod-only) count_prod_only=$((count_prod_only + 1)) ;;
+            both-empty) count_both_empty=$((count_both_empty + 1)) ;;
+        esac
+        
+        # Output TSV line
+        printf '%s\t%s\t%s\t%s\n' "$repo" "$npub" "$relationship" "$details" >> "$tsv_file"
+        
+        # Progress indicator every 10 repos
+        if [[ $((count % 10)) -eq 0 ]]; then
+            log_progress "Processed $count/$total_repos repos..."
+        fi
+    done < "$repo_list"
+    
+    # Clear progress line
+    echo "" >&2
+    
+    # Summary
+    echo ""
+    log_info "=== Comparison Summary ==="
+    log_success "Archive ahead (use archive data): $count_archive_ahead"
+    log_success "In sync: $count_in_sync"
+    log_warn "Prod ahead (needs re-sync): $count_prod_ahead"
+    log_error "Diverged (manual review): $count_diverged"
+    log_info "Archive only: $count_archive_only"
+    log_info "Prod only: $count_prod_only"
+    log_info "Both empty: $count_both_empty"
+    echo ""
+    log_info "Total: $count repos"
+    log_info "Output: $tsv_file"
+}
+
+main "$@"
diff --git a/docs/how-to/migration-scripts/40-classify-actions.sh b/docs/how-to/migration-scripts/40-classify-actions.sh
index b1348f8..07ae7c9 100755
--- a/docs/how-to/migration-scripts/40-classify-actions.sh
+++ b/docs/how-to/migration-scripts/40-classify-actions.sh
@@ -10,16 +10,25 @@
 #   - Empty in prod (prod=cat2, any archive status)
 #   - Archive-only (archive=any, prod=missing)
 #   - Not in prod (purgatory-only, prod=missing)
+#   - Archive ahead (archive has newer git data than prod - GRASP enforced)
 #
 # Tier 2: Action Required (needs-resync.txt)
 #   - Complete in prod, missing from archive (with purgatory context)
-#   - Complete in prod, incomplete in archive (with purgatory context)
+#   - Complete in prod, incomplete in archive AND prod is ahead (with purgatory context)
 #
 # Tier 3: Manual Investigation (manual-review.txt)
 #   - Partial in prod (prod=cat3)
 #   - No-match in prod (prod=cat4)
 #   - Parse failures
 #   - Conflicting states
+#   - Diverged git history (both have unique commits)
+#
+# KEY INSIGHT:
+#   Archive (ngit-grasp) enforces GRASP - git data ALWAYS matches a state event.
+#   If archive has different/newer data than prod, it means:
+#   - A state event authorized those commits at some point
+#   - Archive is actually MORE up-to-date than prod
+#   - Migration should use archive data (it's already correct)
 #
 # Usage: ./40-classify-actions.sh <analysis-dir>
 #
@@ -231,6 +240,25 @@ DELETED_COUNT=0
 [[ ${#DELETED[@]} -gt 0 ]] && DELETED_COUNT=${#DELETED[@]}
 log_info "Loaded $DELETED_COUNT deletion entries"
 
+# Build git ancestry lookup: repo|npub -> relationship (archive-ahead, prod-ahead, diverged, etc.)
+# This data comes from 22-compare-git-data.sh which compares actual git commits
+declare -A GIT_ANCESTRY
+GIT_ANCESTRY_COUNT=0
+if [[ -f "$COMPARISON_DIR/git-ancestry.tsv" ]]; then
+    while IFS=$'\t' read -r repo npub relationship details || [[ -n "$repo" ]]; do
+        # Skip header and comments
+        [[ "$repo" == "repo" ]] && continue
+        [[ "$repo" =~ ^# ]] && continue
+        [[ -z "$repo" || -z "$npub" ]] && continue
+        GIT_ANCESTRY["$repo|$npub"]="$relationship"
+        GIT_ANCESTRY_COUNT=$((GIT_ANCESTRY_COUNT + 1))
+    done < "$COMPARISON_DIR/git-ancestry.tsv"
+    log_info "Loaded $GIT_ANCESTRY_COUNT git ancestry entries"
+else
+    log_warn "No git-ancestry.tsv found - will not check if archive is ahead of prod"
+    log_warn "Run 22-compare-git-data.sh to enable archive-ahead detection"
+fi
+
 # ============================================================================
 # Phase 2: Build unique repo list from all sources
 # ============================================================================
@@ -263,12 +291,14 @@ COUNTS[ready_deleted]=0
 COUNTS[ready_empty_prod]=0
 COUNTS[ready_archive_only]=0
 COUNTS[ready_not_in_prod]=0
+COUNTS[ready_archive_ahead]=0
 COUNTS[resync_missing_archive]=0
 COUNTS[resync_incomplete_archive]=0
 COUNTS[review_partial_prod]=0
 COUNTS[review_nomatch_prod]=0
 COUNTS[review_parse_failure]=0
 COUNTS[review_conflicting]=0
+COUNTS[review_diverged]=0
 
 # Output arrays
 declare -a READY_LINES
@@ -381,14 +411,48 @@ for key in "${!ALL_REPOS[@]}"; do
                     REVIEW_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | complete in prod with parse failure")
                     COUNTS[review_parse_failure]=$((COUNTS[review_parse_failure] + 1))
                 else
-                    # Needs resync - include purgatory context
-                    context=$(get_context "$key" "$prod_status" "$archive_status")
-                    if [[ "$archive_cat" == "missing" ]]; then
-                        RESYNC_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | trigger re-sync to archive")
-                        COUNTS[resync_missing_archive]=$((COUNTS[resync_missing_archive] + 1))
+                    # Check git ancestry to see if archive is actually ahead
+                    local git_relationship="${GIT_ANCESTRY[$key]:-unknown}"
+                    
+                    if [[ "$git_relationship" == "archive-ahead" || "$git_relationship" == "in-sync" ]]; then
+                        # Archive has newer/same git data - this is GOOD
+                        # Archive's git data was authorized by a state event (GRASP enforced)
+                        context=$(get_context "$key" "$prod_status" "$archive_status")
+                        if [[ -n "$context" && "$context" != "none" ]]; then
+                            context="$context, git=$git_relationship"
+                        else
+                            context="git=$git_relationship"
+                        fi
+                        READY_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | archive ahead (use archive data)")
+                        COUNTS[ready_archive_ahead]=$((COUNTS[ready_archive_ahead] + 1))
+                    elif [[ "$git_relationship" == "diverged" ]]; then
+                        # Git histories diverged - needs manual review
+                        context=$(get_context "$key" "$prod_status" "$archive_status")
+                        if [[ -n "$context" && "$context" != "none" ]]; then
+                            context="$context, git=diverged"
+                        else
+                            context="git=diverged"
+                        fi
+                        REVIEW_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | git histories diverged (manual review)")
+                        COUNTS[review_diverged]=$((COUNTS[review_diverged] + 1))
                     else
-                        RESYNC_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | trigger re-sync (archive incomplete)")
-                        COUNTS[resync_incomplete_archive]=$((COUNTS[resync_incomplete_archive] + 1))
+                        # prod-ahead, archive-only, prod-only, both-empty, or unknown
+                        # These need resync - include purgatory context
+                        context=$(get_context "$key" "$prod_status" "$archive_status")
+                        if [[ "$git_relationship" != "unknown" ]]; then
+                            if [[ -n "$context" && "$context" != "none" ]]; then
+                                context="$context, git=$git_relationship"
+                            else
+                                context="git=$git_relationship"
+                            fi
+                        fi
+                        if [[ "$archive_cat" == "missing" ]]; then
+                            RESYNC_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | trigger re-sync to archive")
+                            COUNTS[resync_missing_archive]=$((COUNTS[resync_missing_archive] + 1))
+                        else
+                            RESYNC_LINES+=("$repo | $npub | $prod_status | $archive_status | $context | trigger re-sync (archive incomplete)")
+                            COUNTS[resync_incomplete_archive]=$((COUNTS[resync_incomplete_archive] + 1))
+                        fi
                     fi
                 fi
             fi
@@ -498,6 +562,7 @@ fi
     echo "| Reason | Count |"
     echo "|--------|-------|"
     echo "| complete in both prod and archive | ${COUNTS[ready_complete_both]} |"
+    echo "| archive ahead (has newer git data) | ${COUNTS[ready_archive_ahead]} |"
     echo "| deleted by user | ${COUNTS[ready_deleted]} |"
     echo "| empty in prod (user never pushed) | ${COUNTS[ready_empty_prod]} |"
     echo "| archive-only (not in prod) | ${COUNTS[ready_archive_only]} |"
@@ -527,6 +592,7 @@ fi
     echo "| partial in prod (cat3) | ${COUNTS[review_partial_prod]} |"
     echo "| no-match in prod (cat4) | ${COUNTS[review_nomatch_prod]} |"
     echo "| complete in prod with parse failure | ${COUNTS[review_parse_failure]} |"
+    echo "| git histories diverged | ${COUNTS[review_diverged]} |"
     echo ""
     echo "## Input Data Summary"
     echo ""
@@ -571,6 +637,7 @@ echo ""
 echo "=== Summary ==="
 echo "Ready for Migration: $TOTAL_READY ($PCT_READY%)"
 echo "  - Complete in both: ${COUNTS[ready_complete_both]}"
+echo "  - Archive ahead: ${COUNTS[ready_archive_ahead]}"
 echo "  - Deleted by user: ${COUNTS[ready_deleted]}"
 echo "  - Empty in prod: ${COUNTS[ready_empty_prod]}"
 echo "  - Archive-only: ${COUNTS[ready_archive_only]}"
@@ -584,6 +651,7 @@ echo "Manual Review: $TOTAL_REVIEW ($PCT_REVIEW%)"
 echo "  - Partial in prod: ${COUNTS[review_partial_prod]}"
 echo "  - No-match in prod: ${COUNTS[review_nomatch_prod]}"
 echo "  - Parse failures: ${COUNTS[review_parse_failure]}"
+echo "  - Git diverged: ${COUNTS[review_diverged]}"
 echo ""
 echo "Total: $TOTAL repos"
 echo ""
diff --git a/docs/how-to/migration-scripts/run-migration-analysis.sh b/docs/how-to/migration-scripts/run-migration-analysis.sh
index 089b553..acc5e44 100755
--- a/docs/how-to/migration-scripts/run-migration-analysis.sh
+++ b/docs/how-to/migration-scripts/run-migration-analysis.sh
@@ -320,7 +320,7 @@ check_prerequisites() {
     fi
     
     # Check scripts exist
-    for script in 01-fetch-events.sh 10-check-git-sync.sh 20-categorize.sh 21-compare-relays.sh 30-extract-parse-failures.sh 31-extract-purgatory-expiry.sh 40-classify-actions.sh; do
+    for script in 01-fetch-events.sh 10-check-git-sync.sh 20-categorize.sh 21-compare-relays.sh 22-compare-git-data.sh 30-extract-parse-failures.sh 31-extract-purgatory-expiry.sh 40-classify-actions.sh; do
         if [[ ! -x "$SCRIPT_DIR/$script" ]]; then
             log_error "Script not found or not executable: $SCRIPT_DIR/$script"
             missing=1
@@ -551,6 +551,20 @@ run_phase_3() {
     fi
     
     run_phase 3 "Categorize & Compare (fast)" "${cmds[@]}"
+    
+    # Phase 3c: Compare git data between relays (requires git paths)
+    # This determines if archive is ahead of prod for repos with mismatched state
+    if [[ -n "$PROD_GIT" && -n "$ARCHIVE_GIT" ]]; then
+        # Build list of repos to compare: those where prod=complete but archive is not
+        local repos_to_compare="$OUTPUT_DIR/comparison/complete-prod-incomplete-archive.txt"
+        if [[ -f "$repos_to_compare" ]] && [[ ! -f "$OUTPUT_DIR/comparison/git-ancestry.tsv" ]]; then
+            log_info "Running git ancestry comparison (Phase 3c)..."
+            run_phase 3 "Git Ancestry Comparison" "'$SCRIPT_DIR/22-compare-git-data.sh' '$PROD_GIT' '$ARCHIVE_GIT' '$repos_to_compare' '$OUTPUT_DIR/comparison'"
+        fi
+    else
+        log_warn "Git paths not provided - skipping git ancestry comparison"
+        log_warn "Without git comparison, repos where archive is ahead will be incorrectly flagged as needing re-sync"
+    fi
 }
 
 # Phase 4: Extract logs