@unbrained/pm-cli 2026.8.24 → 2026.8.26

package/dist/sdk/merge/receipts.js

@@ -7,16 +7,49 @@
  * value for the coordinator that performed the merge.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7b87b458-164a-5332-8803-6b0695481644")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="145a6d31-5e14-5b0b-95fb-6f837d11e2f4")}catch(e){}}();
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { readdir, readFile } from "node:fs/promises";
+import { readdir } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
-import { ensureDir, pathExists, writeFileAtomic, } from "../../core/fs/fs-utils.js";
+import { ensureDir, isFileAbsentError, pathExists, writeFileAtomic, } from "../../core/fs/fs-utils.js";
 import { sha256Hex, stableStringify } from "../../core/shared/serialization.js";
-import { nowIso } from "../../core/shared/time.js";
+import { isRfc3339DateTime, nowIso } from "../../core/shared/time.js";
+import { readBoundedRegularFile } from "./receipt-file-boundary.js";
 const execFileAsync = promisify(execFile);
+const RECEIPT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+const RECEIPT_ITEM_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u;
+const RECEIPT_FIELD_MAX = 2_048;
+const RECEIPT_FILE_MAX_BYTES = 16 * 1024 * 1024;
+const RECEIPT_VALUE_MAX_DEPTH = 64;
+const RECEIPT_VALUE_MAX_NODES = 100_000;
+const RECEIPT_KEYS = new Set([
+    "version",
+    "id",
+    "item_path",
+    "item_id",
+    "requested_preference",
+    "preferred",
+    "conflict_resolution",
+    "fields_from_theirs",
+    "union_fields",
+    "merged_field_hashes",
+    "decisions",
+    "state",
+    "created_at",
+    "reconciled_at",
+    "value_availability",
+    "evidence_source",
+]);
+const RECEIPT_DECISION_KEYS = new Set([
+    "field",
+    "base",
+    "ours",
+    "theirs",
+    "retained",
+    "discarded",
+]);
 async function resolveReceiptDirectory(cwd) {
     try {
         const { stdout } = await execFileAsync("git", [
@@ -49,6 +82,200 @@ function durableReceiptDirectory(pmRoot) {
 function receiptFileName(id) {
     return `${id}.json`;
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key));
+}
+function isStringArray(value) {
+    return (Array.isArray(value) &&
+        value.length <= RECEIPT_FIELD_MAX &&
+        value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= 256));
+}
+function hasBoundedJsonStructure(value) {
+    const pending = [
+        { value, depth: 0 },
+    ];
+    let nodes = 0;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        nodes += 1;
+        if (nodes > RECEIPT_VALUE_MAX_NODES ||
+            current.depth > RECEIPT_VALUE_MAX_DEPTH) {
+            return false;
+        }
+        if (Array.isArray(current.value)) {
+            for (const entry of current.value) {
+                pending.push({ value: entry, depth: current.depth + 1 });
+            }
+        }
+        else if (isRecord(current.value)) {
+            for (const entry of Object.values(current.value)) {
+                pending.push({ value: entry, depth: current.depth + 1 });
+            }
+        }
+    }
+    return true;
+}
+function isMergeDecision(value) {
+    return (isRecord(value) &&
+        hasOnlyKeys(value, RECEIPT_DECISION_KEYS) &&
+        typeof value.field === "string" &&
+        value.field.length > 0 &&
+        value.field.length <= 256 &&
+        Object.hasOwn(value, "base") &&
+        Object.hasOwn(value, "ours") &&
+        Object.hasOwn(value, "theirs") &&
+        Object.hasOwn(value, "retained") &&
+        Object.hasOwn(value, "discarded") &&
+        hasBoundedJsonStructure(value.base) &&
+        hasBoundedJsonStructure(value.ours) &&
+        hasBoundedJsonStructure(value.theirs) &&
+        hasBoundedJsonStructure(value.retained) &&
+        hasBoundedJsonStructure(value.discarded));
+}
+function isMergedFieldHashes(value) {
+    if (!isRecord(value))
+        return false;
+    const entries = Object.entries(value);
+    return (entries.length <= RECEIPT_FIELD_MAX &&
+        entries.every(([field, hash]) => field.length > 0 &&
+            field.length <= 256 &&
+            typeof hash === "string" &&
+            /^[a-f0-9]{64}$/u.test(hash)));
+}
+function isSafeReceiptItemPath(value, itemId) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 4_096 ||
+        value.includes("\0") ||
+        value.includes("\\") ||
+        path.posix.isAbsolute(value)) {
+        return false;
+    }
+    const normalized = path.posix.normalize(value);
+    return (normalized !== ".." &&
+        !normalized.startsWith("../") &&
+        path.posix.basename(normalized, path.posix.extname(normalized)) === itemId);
+}
+function hasValidReceiptIdentity(value) {
+    return !hasOnlyKeys(value, RECEIPT_KEYS) || value.version !== 1
+        ? false
+        : typeof value.id === "string" &&
+            RECEIPT_ID_PATTERN.test(value.id) &&
+            typeof value.item_id === "string" &&
+            RECEIPT_ITEM_ID_PATTERN.test(value.item_id) &&
+            isSafeReceiptItemPath(value.item_path, value.item_id);
+}
+function hasValidReceiptCollections(value) {
+    return !isStringArray(value.fields_from_theirs) ||
+        !isStringArray(value.union_fields) ||
+        !Array.isArray(value.decisions) ||
+        value.decisions.length > RECEIPT_FIELD_MAX ||
+        !value.decisions.every(isMergeDecision)
+        ? false
+        : value.merged_field_hashes === undefined ||
+            isMergedFieldHashes(value.merged_field_hashes);
+}
+function hasValidReceiptEnums(value) {
+    const preferences = [undefined, "ours", "theirs"];
+    const resolutions = [undefined, "preferred_side", "stable_value_order"];
+    const availabilities = [undefined, "clone_local", "hash_only"];
+    const sources = [undefined, "clone_local", "durable"];
+    return (preferences.includes(value.requested_preference) &&
+        preferences.includes(value.preferred) &&
+        resolutions.includes(value.conflict_resolution) &&
+        (value.state === "pending" || value.state === "reconciled") &&
+        availabilities.includes(value.value_availability) &&
+        sources.includes(value.evidence_source));
+}
+function hasValidReceiptTimestamps(value) {
+    return (typeof value.created_at === "string" &&
+        isRfc3339DateTime(value.created_at) &&
+        (value.reconciled_at === undefined ||
+            (typeof value.reconciled_at === "string" &&
+                isRfc3339DateTime(value.reconciled_at))));
+}
+function hasHashOnlyDurableDecisions(receipt) {
+    return (receipt.value_availability === "hash_only" &&
+        receipt.decisions.every((decision) => decision.base === null &&
+            decision.ours === null &&
+            decision.theirs === null &&
+            isExactPrehashedValue(decision.retained) &&
+            isExactPrehashedValue(decision.discarded)));
+}
+function isMergeDecisionReceipt(value, evidenceSource) {
+    if (!isRecord(value) ||
+        !hasValidReceiptIdentity(value) ||
+        !hasValidReceiptCollections(value) ||
+        !hasValidReceiptEnums(value) ||
+        !hasValidReceiptTimestamps(value)) {
+        return false;
+    }
+    const receipt = value;
+    return evidenceSource !== "durable" || hasHashOnlyDurableDecisions(receipt);
+}
+async function readBoundedRegularReceiptFile(receiptPath) {
+    return readBoundedRegularFile(receiptPath, RECEIPT_FILE_MAX_BYTES);
+}
+async function prepareReceiptSettlement(params) {
+    let raw;
+    try {
+        raw = await (params.readReceipt ?? readBoundedRegularReceiptFile)(params.receiptPath);
+    }
+    catch (error) {
+        if (isFileAbsentError(error))
+            return null;
+        throw error;
+    }
+    if (raw === null) {
+        throw new Error(`Receipt ${params.receiptId} settlement source is not a bounded regular file.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Receipt ${params.receiptId} settlement source is not valid JSON.`);
+    }
+    if (!isMergeDecisionReceipt(parsed, params.evidenceSource) ||
+        parsed.id !== params.receiptId ||
+        path.basename(params.receiptPath) !== receiptFileName(parsed.id)) {
+        throw new Error(`Receipt ${params.receiptId} settlement source failed schema or identity validation.`);
+    }
+    const { evidence_source: _evidenceSource, ...persistedReceipt } = parsed;
+    return {
+        path: params.receiptPath,
+        fingerprint: receiptProvenanceFingerprint(parsed),
+        content: `${JSON.stringify({
+            ...persistedReceipt,
+            state: "reconciled",
+            reconciled_at: params.reconciledAt,
+        }, null, 2)}\n`,
+    };
+}
+function receiptProvenanceFingerprint(receipt) {
+    return sha256Hex(stableStringify({
+        id: receipt.id,
+        item_id: receipt.item_id,
+        item_path: receipt.item_path,
+        created_at: receipt.created_at,
+        requested_preference: receipt.requested_preference ?? receipt.preferred ?? "ours",
+        conflict_resolution: receipt.conflict_resolution ?? "preferred_side",
+        fields_from_theirs: receipt.fields_from_theirs,
+        union_fields: receipt.union_fields,
+        merged_field_hashes: receipt.merged_field_hashes ?? null,
+        decisions: summarizeMergeReceipt(receipt).decisions,
+    }));
+}
+function mergeReceiptCopyLifecycle(local, durable) {
+    if (local.state === "reconciled" && durable.state === "reconciled") {
+        return local;
+    }
+    const { reconciled_at: _reconciledAt, ...pendingLocal } = local;
+    return { ...pendingLocal, state: "pending" };
+}
 /** Convert a raw receipt into privacy-safe history context. */
 export function summarizeMergeReceipt(receipt) {
     return {
@@ -81,6 +308,11 @@ function isPrehashedValue(value) {
         ? hash
         : undefined;
 }
+function isExactPrehashedValue(value) {
+    return (isRecord(value) &&
+        Object.keys(value).length === 1 &&
+        isPrehashedValue(value) !== undefined);
+}
 /** Persist one item-driver outcome in the clone-local Git directory. */
 export async function writeMergeReceipt(params) {
     const directory = await resolveReceiptDirectory(params.cwd);
@@ -103,6 +335,9 @@ export async function writeMergeReceipt(params) {
         conflict_resolution: params.conflictResolution ?? "preferred_side",
         fields_from_theirs: [...params.fieldsFromTheirs],
         union_fields: [...params.unionFields],
+        ...(params.mergedFieldHashes
+            ? { merged_field_hashes: { ...params.mergedFieldHashes } }
+            : {}),
         decisions: structuredClone(params.decisions),
         state: "pending",
         created_at: nowIso(),
@@ -131,53 +366,86 @@ export async function writeMergeReceipt(params) {
     }
     return receipt;
 }
-async function readReceiptsFromDirectory(directory, options) {
-    if (!(await pathExists(directory)))
-        return [];
+async function readReceiptsFromDirectory(directory, evidenceSource) {
+    if (!(await pathExists(directory))) {
+        return { receipts: [], invalid_evidence_count: 0 };
+    }
     let names;
     try {
         names = await readdir(directory);
     }
     catch {
-        return [];
+        return { receipts: [], invalid_evidence_count: 1 };
     }
     const receipts = [];
+    let invalidEvidenceCount = 0;
     for (const name of names.sort((left, right) => left.localeCompare(right))) {
         if (!name.endsWith(".json"))
             continue;
         try {
-            const parsed = JSON.parse(await readFile(path.join(directory, name), "utf8"));
-            const { preferred: legacyPreference, ...receiptWithoutLegacyKey } = parsed;
+            const receiptPath = path.join(directory, name);
+            const raw = await readBoundedRegularReceiptFile(receiptPath);
+            if (raw === null) {
+                invalidEvidenceCount += 1;
+                continue;
+            }
+            const parsed = JSON.parse(raw);
+            if (!isMergeDecisionReceipt(parsed, evidenceSource) ||
+                name !== receiptFileName(parsed.id)) {
+                invalidEvidenceCount += 1;
+                continue;
+            }
+            const { preferred: legacyPreference, evidence_source: _serializedEvidenceSource, ...receiptWithoutRuntimeKeys } = parsed;
             const normalizedReceipt = {
-                ...receiptWithoutLegacyKey,
+                ...receiptWithoutRuntimeKeys,
                 requested_preference: parsed.requested_preference ?? legacyPreference ?? "ours",
                 conflict_resolution: parsed.conflict_resolution ?? "preferred_side",
+                evidence_source: evidenceSource,
             };
-            if (normalizedReceipt.version === 1 &&
-                (options.includeReconciled || normalizedReceipt.state === "pending") &&
-                (options.includeLossless !== false ||
-                    normalizedReceipt.decisions.length > 0)) {
-                receipts.push(normalizedReceipt);
-            }
+            receipts.push(normalizedReceipt);
         }
         catch {
-            // Malformed evidence remains an integrity concern for a future schema.
+            invalidEvidenceCount += 1;
         }
     }
-    return receipts;
+    return { receipts, invalid_evidence_count: invalidEvidenceCount };
 }
-/** Read clone-local receipts with explicit reconciled/lossless classification controls. */
-export async function listMergeReceipts(cwd, options = {}) {
+/** Inspect valid receipts and count invalid evidence without returning untrusted file contents. */
+export async function inspectMergeReceiptEvidence(cwd, options = {}) {
     const directory = await resolveReceiptDirectory(cwd);
     const local = directory === null
-        ? []
-        : await readReceiptsFromDirectory(directory, options);
+        ? { receipts: [], invalid_evidence_count: 0 }
+        : await readReceiptsFromDirectory(directory, "clone_local");
     const trackerRoot = options.pmRoot ?? path.join(cwd, ".agents", "pm");
-    const durable = await readReceiptsFromDirectory(durableReceiptDirectory(trackerRoot), options);
-    const receipts = new Map(durable.map((receipt) => [receipt.id, receipt]));
-    for (const receipt of local)
-        receipts.set(receipt.id, receipt);
-    return [...receipts.values()].sort((left, right) => left.created_at.localeCompare(right.created_at));
+    const durable = await readReceiptsFromDirectory(durableReceiptDirectory(trackerRoot), "durable");
+    const receipts = new Map(durable.receipts.map((receipt) => [receipt.id, receipt]));
+    let divergentCopyCount = 0;
+    for (const receipt of local.receipts) {
+        const durableCopy = receipts.get(receipt.id);
+        if (durableCopy !== undefined &&
+            receiptProvenanceFingerprint(durableCopy) !==
+                receiptProvenanceFingerprint(receipt)) {
+            receipts.delete(receipt.id);
+            divergentCopyCount += 1;
+            continue;
+        }
+        receipts.set(receipt.id, durableCopy === undefined
+            ? receipt
+            : mergeReceiptCopyLifecycle(receipt, durableCopy));
+    }
+    return {
+        receipts: [...receipts.values()]
+            .filter((receipt) => (options.includeReconciled || receipt.state === "pending") &&
+            (options.includeLossless !== false || receipt.decisions.length > 0))
+            .sort((left, right) => left.created_at.localeCompare(right.created_at)),
+        invalid_evidence_count: local.invalid_evidence_count +
+            durable.invalid_evidence_count +
+            divergentCopyCount,
+    };
+}
+/** Read clone-local receipts with explicit reconciled/lossless classification controls. */
+export async function listMergeReceipts(cwd, options = {}) {
+    return (await inspectMergeReceiptEvidence(cwd, options)).receipts;
 }
 /** Split merge provenance into receipts with discarded values and receipts whose composition was lossless. */
 export function partitionMergeReceipts(receipts) {
@@ -191,19 +459,56 @@ export function partitionMergeReceipts(receipts) {
     return { pendingDecisions, lossless };
 }
 /** Mark a receipt as represented by a committed merge history event. */
-export async function markMergeReceiptReconciled(cwd, receipt) {
+export async function markMergeReceiptReconciled(cwd, receipt, options = {}) {
     const directory = await resolveReceiptDirectory(cwd);
     if (directory === null) {
+        if (options.requireExisting === true) {
+            throw new Error(`Receipt ${receipt.id} disappeared before settlement.`);
+        }
         return;
     }
-    await writeFileAtomic(path.join(directory, receiptFileName(receipt.id)), `${JSON.stringify({ ...receipt, state: "reconciled", reconciled_at: nowIso() }, null, 2)}\n`);
+    const receiptEvidenceSource = receipt.evidence_source ?? "clone_local";
+    if (!isMergeDecisionReceipt(receipt, receiptEvidenceSource)) {
+        throw new Error("Merge receipt trusted settlement input failed schema validation.");
+    }
+    const reconciledAt = nowIso();
+    const localPath = path.join(directory, receiptFileName(receipt.id));
     const trackerRoot = await resolveTrackerRootFromItemPath(cwd, receipt.item_path);
-    if (trackerRoot !== null) {
-        const durablePath = path.join(durableReceiptDirectory(trackerRoot), receiptFileName(receipt.id));
-        if (await pathExists(durablePath)) {
-            const durable = JSON.parse(await readFile(durablePath, "utf8"));
-            await writeFileAtomic(durablePath, `${JSON.stringify({ ...durable, state: "reconciled", reconciled_at: nowIso() }, null, 2)}\n`);
+    const durablePath = trackerRoot === null
+        ? null
+        : path.join(durableReceiptDirectory(trackerRoot), receiptFileName(receipt.id));
+    const prepared = await Promise.all([
+        prepareReceiptSettlement({
+            receiptPath: localPath,
+            receiptId: receipt.id,
+            evidenceSource: "clone_local",
+            reconciledAt,
+        }),
+        ...(durablePath === null
+            ? []
+            : [
+                prepareReceiptSettlement({
+                    receiptPath: durablePath,
+                    receiptId: receipt.id,
+                    evidenceSource: "durable",
+                    reconciledAt,
+                }),
+            ]),
+    ]);
+    const writes = prepared.filter((entry) => entry !== null);
+    if (writes.length === 0) {
+        if (options.requireExisting === true) {
+            throw new Error(`Receipt ${receipt.id} disappeared before settlement.`);
         }
+        return;
+    }
+    const expectedFingerprint = receiptProvenanceFingerprint(receipt);
+    if (new Set([expectedFingerprint, ...writes.map((write) => write.fingerprint)])
+        .size !== 1) {
+        throw new Error(`Receipt ${receipt.id} settlement copies disagree on immutable merge provenance.`);
+    }
+    for (const write of writes) {
+        await writeFileAtomic(write.path, write.content);
     }
 }
 /** Report pending or historical clone-local merge decisions. */
@@ -219,5 +524,7 @@ export async function runMergeReceiptReport(options) {
         generated_at: nowIso(),
     };
 }
+/** Test-only seams for deterministic receipt-boundary fault coverage. */
+export const _testOnlyMergeReceipts = { prepareReceiptSettlement };
 //# sourceMappingURL=receipts.js.map
-//# debugId=7b87b458-164a-5332-8803-6b0695481644
+//# debugId=145a6d31-5e14-5b0b-95fb-6f837d11e2f4

package/dist/sdk/merge/reconcile.js

@@ -1,10 +1,76 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c5620467-6c8c-5702-b742-57fba9e302c5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c3ec7d9d-f276-5e97-8e97-507925e5d33a")}catch(e){}}();
 import { EXIT_CODE } from "../../core/shared/constants.js";
 import { PmCliError } from "../../core/shared/errors.js";
+import { resolvePmRoot } from "../../core/store/paths.js";
 import { runHistoryRepair, runHistoryRepairAll, } from "../history-repair.js";
 import { runValidate } from "../governance/validate.js";
-import { listMergeReceipts, markMergeReceiptReconciled, partitionMergeReceipts, summarizeMergeReceipt, } from "./receipts.js";
+import { inspectMergeReceiptEvidence, markMergeReceiptReconciled, partitionMergeReceipts, summarizeMergeReceipt, } from "./receipts.js";
+import { findGitWorkspaceRoot } from "./install.js";
+import { mapWithFixedConcurrency } from "../extension/concurrency.js";
+const RECEIPT_ONLY_REPAIR_CONCURRENCY = 4;
+async function runReceiptOnlyRepair(params) {
+    try {
+        return {
+            status: "fulfilled",
+            value: await runHistoryRepair(params.id, {
+                dryRun: params.dryRun,
+                author: params.options.author ?? params.global.author,
+                message: params.options.message ??
+                    "record field-aware branch merge provenance",
+                force: params.options.force,
+                auditOperation: "merge_reconcile",
+                auditContext: params.auditContext,
+                forceAuditEntry: true,
+                mergeReceiptProof: params.mergeReceiptProof,
+            }, params.global),
+        };
+    }
+    catch (reason) {
+        return { status: "rejected", reason };
+    }
+}
+function appendReceiptOnlyResults(params) {
+    params.results.forEach((settled, index) => {
+        const id = params.receiptOnlyIds[index];
+        if (settled.status === "fulfilled") {
+            const outcome = settled.value.changed ? "repaired" : "skipped_clean";
+            params.repair.streams.push({
+                id,
+                outcome,
+                entries_rehashed: settled.value.history.entries_rehashed,
+                entries_patch_repaired: settled.value.history.entries_patch_repaired,
+                reconciled_with_item: settled.value.history.reconciled_with_item,
+                ...(settled.value.merge_receipt_proof
+                    ? { merge_receipt_proof: settled.value.merge_receipt_proof }
+                    : {}),
+                warnings: settled.value.warnings,
+            });
+            params.repair.totals[outcome] += 1;
+            return;
+        }
+        params.repair.streams.push({
+            id,
+            outcome: "failed",
+            error: settled.reason instanceof Error
+                ? settled.reason.message
+                : String(settled.reason),
+        });
+        params.repair.totals.failed += 1;
+    });
+}
+async function settleProvenReceipts(params) {
+    if (params.dryRun || params.repair.totals.failed > 0)
+        return 0;
+    const trustedReceiptIds = new Set(params.repair.streams.flatMap((stream) => stream.merge_receipt_proof?.trusted
+        ? stream.merge_receipt_proof.receipt_ids
+        : []));
+    const receiptsToSettle = params.force
+        ? params.pendingReceipts
+        : params.pendingReceipts.filter((receipt) => trustedReceiptIds.has(receipt.id));
+    await Promise.all(receiptsToSettle.map((receipt) => markMergeReceiptReconciled(params.gitWorkspaceRoot ?? process.cwd(), receipt, { requireExisting: true })));
+    return receiptsToSettle.length;
+}
 /**
  * Preview or apply post-merge history reconciliation and immediately validate
  * the two merge-critical invariants. The default remains explicit and safe:
@@ -13,9 +79,22 @@ import { listMergeReceipts, markMergeReceiptReconciled, partitionMergeReceipts,
  */
 export async function runMergeReconcile(options, global) {
     const dryRun = options.dryRun === true;
-    const pendingReceipts = await listMergeReceipts(process.cwd(), {
+    const pmRoot = resolvePmRoot(process.cwd(), global.path);
+    const gitWorkspaceRoot = await findGitWorkspaceRoot(pmRoot);
+    const receiptEvidence = await inspectMergeReceiptEvidence(gitWorkspaceRoot ?? process.cwd(), {
         includeLossless: true,
+        pmRoot,
     });
+    if (receiptEvidence.invalid_evidence_count > 0) {
+        throw new PmCliError(`Merge reconciliation refused ${receiptEvidence.invalid_evidence_count} invalid receipt evidence file(s).`, EXIT_CODE.CONFLICT, {
+            code: "merge_receipt_evidence_invalid",
+            required: "Every clone-local and durable receipt candidate must pass bounded-file, schema, and identity validation.",
+            recovery: {
+                suggested_retry: "pm health --check-only --full",
+            },
+        });
+    }
+    const pendingReceipts = receiptEvidence.receipts;
     const { pendingDecisions: discardedReceipts } = partitionMergeReceipts(pendingReceipts);
     if (!dryRun && options.force !== true && discardedReceipts.length > 0) {
         throw new PmCliError(`Merge reconciliation would accept ${discardedReceipts.length} receipt(s) containing discarded scalar values. Review pm merge report and rerun with --force only after deciding which values to retain or re-apply.`, EXIT_CODE.CONFLICT, {
@@ -29,11 +108,13 @@ export async function runMergeReconcile(options, global) {
             },
         });
     }
-    const receiptsByItem = pendingReceipts.reduce((groups, receipt) => {
-        (groups[receipt.item_id] ??= []).push(receipt);
-        return groups;
-    }, {});
-    const auditContextById = Object.fromEntries(Object.entries(receiptsByItem).map(([id, receipts]) => [
+    const receiptsByItem = new Map();
+    for (const receipt of pendingReceipts) {
+        const receipts = receiptsByItem.get(receipt.item_id) ?? [];
+        receipts.push(receipt);
+        receiptsByItem.set(receipt.item_id, receipts);
+    }
+    const auditContextById = Object.fromEntries([...receiptsByItem].map(([id, receipts]) => [
         id,
         {
             merge: {
@@ -41,6 +122,10 @@ export async function runMergeReconcile(options, global) {
             },
         },
     ]));
+    const mergeReceiptProofById = Object.fromEntries([...receiptsByItem].map(([id, receipts]) => [
+        id,
+        { gitWorkspaceRoot, receipts },
+    ]));
     const repair = await runHistoryRepairAll({
         dryRun,
         author: options.author ?? global.author,
@@ -49,51 +134,36 @@ export async function runMergeReconcile(options, global) {
         force: options.force,
         auditOperation: "merge_reconcile",
         auditContextById,
+        ...(pendingReceipts.length > 0 ? { mergeReceiptProofById } : {}),
     }, global);
     const representedIds = new Set(repair.streams.map((stream) => stream.id));
-    const receiptOnlyIds = Object.keys(receiptsByItem).filter((id) => !representedIds.has(id));
-    const receiptOnlyResults = await Promise.allSettled(receiptOnlyIds.map((id) => runHistoryRepair(id, {
+    const receiptOnlyIds = [...receiptsByItem.keys()].filter((id) => !representedIds.has(id));
+    const receiptOnlyResults = await mapWithFixedConcurrency(receiptOnlyIds, RECEIPT_ONLY_REPAIR_CONCURRENCY, (id) => runReceiptOnlyRepair({
+        id,
         dryRun,
-        author: options.author ?? global.author,
-        message: options.message ?? "record field-aware branch merge provenance",
-        force: options.force,
-        auditOperation: "merge_reconcile",
+        options,
+        global,
         auditContext: auditContextById[id],
-        forceAuditEntry: true,
-    }, global)));
-    receiptOnlyResults.forEach((settled, index) => {
-        const id = receiptOnlyIds[index];
-        if (settled.status === "fulfilled") {
-            const outcome = settled.value.changed ? "repaired" : "skipped_clean";
-            repair.streams.push({
-                id,
-                outcome,
-                entries_rehashed: settled.value.history.entries_rehashed,
-                entries_patch_repaired: settled.value.history.entries_patch_repaired,
-                reconciled_with_item: settled.value.history.reconciled_with_item,
-                warnings: settled.value.warnings,
-            });
-            repair.totals[outcome] += 1;
-        }
-        else {
-            repair.streams.push({
-                id,
-                outcome: "failed",
-                error: settled.reason instanceof Error
-                    ? settled.reason.message
-                    : String(settled.reason),
-            });
-            repair.totals.failed += 1;
-        }
+        mergeReceiptProof: mergeReceiptProofById[id],
+    }));
+    appendReceiptOnlyResults({
+        receiptOnlyIds,
+        results: receiptOnlyResults,
+        repair,
+    });
+    const reconciledReceiptCount = await settleProvenReceipts({
+        dryRun,
+        force: options.force === true,
+        pendingReceipts,
+        repair,
+        gitWorkspaceRoot,
     });
-    let reconciledReceiptCount = 0;
-    if (!dryRun && repair.totals.failed === 0) {
-        await Promise.all(pendingReceipts.map((receipt) => markMergeReceiptReconciled(process.cwd(), receipt)));
-        reconciledReceiptCount = pendingReceipts.length;
-    }
     const validation = await runValidate({ checkHistoryDrift: true, checkStorageIntegrity: true }, global);
     const mergeChecksGreen = validation.checks.every((check) => check.status === "ok");
-    const ok = repair.totals.failed === 0 && mergeChecksGreen;
+    const receiptSettlementComplete = dryRun
+        ? pendingReceipts.length === 0
+        : reconciledReceiptCount === pendingReceipts.length;
+    const ok = repair.totals.failed === 0 && mergeChecksGreen && receiptSettlementComplete;
     const guidance = dryRun
         ? [
             "Review repair.streams, then rerun pm merge reconcile without --dry-run to apply audited repairs.",
@@ -123,4 +193,4 @@ export async function runMergeReconcile(options, global) {
     };
 }
 //# sourceMappingURL=reconcile.js.map
-//# debugId=c5620467-6c8c-5702-b742-57fba9e302c5
+//# debugId=c3ec7d9d-f276-5e97-8e97-507925e5d33a