@unbrained/pm-cli 2026.9.1 → 2026.9.2

package/dist/sdk/merge/receipts.js

@@ -7,10 +7,10 @@
  * value for the coordinator that performed the merge.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="624fc190-4c46-5a55-b757-72e621aec35d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df7d5bd9-8381-5961-bda1-9e8ed335afc9")}catch(e){}}();
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { readdir } from "node:fs/promises";
+import { readdir, stat } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { ensureDir, isFileAbsentError, isFileMissingError, pathExists, writeFileAtomic, } from "../../core/fs/fs-utils.js";
@@ -24,6 +24,7 @@ const RECEIPT_FIELD_MAX = 2_048;
 const RECEIPT_FILE_MAX_BYTES = 16 * 1024 * 1024;
 const RECEIPT_VALUE_MAX_DEPTH = 64;
 const RECEIPT_VALUE_MAX_NODES = 100_000;
+const RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT = 100;
 const RECEIPT_KEYS = new Set([
     "version",
     "id",
@@ -42,6 +43,10 @@ const RECEIPT_KEYS = new Set([
     "value_availability",
     "evidence_source",
 ]);
+/** Return whether a receipt id is safe to expose in cleartext diagnostics. */
+export function isSafeReceiptId(value) {
+    return RECEIPT_ID_PATTERN.test(value);
+}
 const RECEIPT_DECISION_KEYS = new Set([
     "field",
     "base",
@@ -163,7 +168,7 @@ function hasValidReceiptIdentity(value) {
     return !hasOnlyKeys(value, RECEIPT_KEYS) || value.version !== 1
         ? false
         : typeof value.id === "string" &&
-            RECEIPT_ID_PATTERN.test(value.id) &&
+            isSafeReceiptId(value.id) &&
             typeof value.item_id === "string" &&
             RECEIPT_ITEM_ID_PATTERN.test(value.item_id) &&
             isSafeReceiptItemPath(value.item_path, value.item_id);
@@ -372,54 +377,115 @@ async function readReceiptsFromDirectory(directory, evidenceSource) {
         names = await readdir(directory);
     }
     catch (error) {
+        const absent = await receiptDirectoryFailureMeansAbsent(directory, error);
         return {
             receipts: [],
-            invalid_evidence_count: isFileMissingError(error) ? 0 : 1,
+            invalid_evidence_count: absent ? 0 : 1,
+            invalid_evidence: absent
+                ? []
+                : [{ evidence_source: evidenceSource, reason: "directory_unreadable" }],
+            invalid_evidence_truncated: false,
         };
     }
     const receipts = [];
     let invalidEvidenceCount = 0;
+    const invalidEvidence = [];
+    const recordInvalidEvidence = (name, reason) => {
+        invalidEvidenceCount += 1;
+        if (invalidEvidence.length >= RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT)
+            return;
+        const receiptId = name.slice(0, -".json".length);
+        invalidEvidence.push({
+            evidence_source: evidenceSource,
+            reason,
+            ...(isSafeReceiptId(receiptId)
+                ? { receipt_id: receiptId }
+                : { candidate_name_hash: sha256Hex(name) }),
+        });
+    };
     for (const name of names.sort((left, right) => left.localeCompare(right))) {
         if (!name.endsWith(".json"))
             continue;
+        const candidate = await inspectReceiptCandidate(directory, name, evidenceSource);
+        if (candidate.receipt !== undefined) {
+            receipts.push(candidate.receipt);
+        }
+        else {
+            recordInvalidEvidence(name, candidate.reason);
+        }
+    }
+    return {
+        receipts,
+        invalid_evidence_count: invalidEvidenceCount,
+        invalid_evidence: invalidEvidence,
+        invalid_evidence_truncated: invalidEvidenceCount > invalidEvidence.length,
+    };
+}
+async function receiptDirectoryFailureMeansAbsent(directory, error, inspectAncestor = stat) {
+    if (!isFileMissingError(error))
+        return false;
+    let ancestor = directory;
+    while (true) {
         try {
-            const receiptPath = path.join(directory, name);
-            const raw = await readBoundedRegularReceiptFile(receiptPath);
-            if (raw === null) {
-                invalidEvidenceCount += 1;
-                continue;
-            }
-            const parsed = JSON.parse(raw);
-            if (!isMergeDecisionReceipt(parsed, evidenceSource) ||
-                name !== receiptFileName(parsed.id)) {
-                invalidEvidenceCount += 1;
-                continue;
-            }
-            const { preferred: legacyPreference, evidence_source: _serializedEvidenceSource, ...receiptWithoutRuntimeKeys } = parsed;
-            const normalizedReceipt = {
-                ...receiptWithoutRuntimeKeys,
-                requested_preference: parsed.requested_preference ?? legacyPreference ?? "ours",
-                conflict_resolution: parsed.conflict_resolution ?? "preferred_side",
-                evidence_source: evidenceSource,
-            };
-            receipts.push(normalizedReceipt);
+            return (await inspectAncestor(ancestor)).isDirectory();
         }
-        catch {
-            invalidEvidenceCount += 1;
+        catch (ancestorError) {
+            if (!isFileMissingError(ancestorError))
+                return false;
+            const parent = path.dirname(ancestor);
+            if (parent === ancestor)
+                return true;
+            ancestor = parent;
         }
     }
-    return { receipts, invalid_evidence_count: invalidEvidenceCount };
+}
+async function inspectReceiptCandidate(directory, name, evidenceSource) {
+    let raw;
+    try {
+        raw = await readBoundedRegularReceiptFile(path.join(directory, name));
+    }
+    catch {
+        return { reason: "candidate_unreadable" };
+    }
+    if (raw === null)
+        return { reason: "candidate_not_bounded_regular_file" };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { reason: "candidate_invalid_json" };
+    }
+    if (!isMergeDecisionReceipt(parsed, evidenceSource) ||
+        name !== receiptFileName(parsed.id)) {
+        return { reason: "schema_or_identity_invalid" };
+    }
+    const { preferred: legacyPreference, evidence_source: _serializedEvidenceSource, ...receiptWithoutRuntimeKeys } = parsed;
+    return {
+        receipt: {
+            ...receiptWithoutRuntimeKeys,
+            requested_preference: parsed.requested_preference ?? legacyPreference ?? "ours",
+            conflict_resolution: parsed.conflict_resolution ?? "preferred_side",
+            evidence_source: evidenceSource,
+        },
+    };
 }
 /** Inspect valid receipts and count invalid evidence without returning untrusted file contents. */
 export async function inspectMergeReceiptEvidence(cwd, options = {}) {
     const directory = await resolveReceiptDirectory(cwd);
     const local = directory === null
-        ? { receipts: [], invalid_evidence_count: 0 }
+        ? {
+            receipts: [],
+            invalid_evidence_count: 0,
+            invalid_evidence: [],
+            invalid_evidence_truncated: false,
+        }
         : await readReceiptsFromDirectory(directory, "clone_local");
     const trackerRoot = options.pmRoot ?? path.join(cwd, ".agents", "pm");
     const durable = await readReceiptsFromDirectory(durableReceiptDirectory(trackerRoot), "durable");
     const receipts = new Map(durable.receipts.map((receipt) => [receipt.id, receipt]));
     let divergentCopyCount = 0;
+    const divergentCopyEvidence = [];
     for (const receipt of local.receipts) {
         const durableCopy = receipts.get(receipt.id);
         if (durableCopy !== undefined &&
@@ -427,6 +493,16 @@ export async function inspectMergeReceiptEvidence(cwd, options = {}) {
                 receiptProvenanceFingerprint(receipt)) {
             receipts.delete(receipt.id);
             divergentCopyCount += 1;
+            if (local.invalid_evidence.length +
+                durable.invalid_evidence.length +
+                divergentCopyEvidence.length <
+                RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT) {
+                divergentCopyEvidence.push({
+                    evidence_source: "clone_local_and_durable",
+                    reason: "copy_provenance_mismatch",
+                    receipt_id: receipt.id,
+                });
+            }
             continue;
         }
         receipts.set(receipt.id, durableCopy === undefined
@@ -441,6 +517,17 @@ export async function inspectMergeReceiptEvidence(cwd, options = {}) {
         invalid_evidence_count: local.invalid_evidence_count +
             durable.invalid_evidence_count +
             divergentCopyCount,
+        invalid_evidence: [
+            ...local.invalid_evidence,
+            ...durable.invalid_evidence,
+            ...divergentCopyEvidence,
+        ].slice(0, RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT),
+        invalid_evidence_truncated: local.invalid_evidence_truncated ||
+            durable.invalid_evidence_truncated ||
+            local.invalid_evidence_count +
+                durable.invalid_evidence_count +
+                divergentCopyCount >
+                RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT,
         clone_local_evidence_resolved: directory !== null,
     };
 }
@@ -538,12 +625,17 @@ export async function runMergeReceiptEvidenceReport(options) {
         complete,
         count: evidence.receipts.length,
         invalid_evidence_count: evidence.invalid_evidence_count,
+        invalid_evidence: evidence.invalid_evidence,
+        invalid_evidence_truncated: evidence.invalid_evidence_truncated,
         clone_local_evidence_resolved: evidence.clone_local_evidence_resolved,
         receipts: evidence.receipts,
         generated_at: nowIso(),
     };
 }
 /** Test-only seams for deterministic receipt-boundary fault coverage. */
-export const _testOnlyMergeReceipts = { prepareReceiptSettlement };
+export const _testOnlyMergeReceipts = {
+    prepareReceiptSettlement,
+    receiptDirectoryFailureMeansAbsent,
+};
 //# sourceMappingURL=receipts.js.map
-//# debugId=624fc190-4c46-5a55-b757-72e621aec35d
+//# debugId=df7d5bd9-8381-5961-bda1-9e8ed335afc9

package/docs/CONTEXT_RECOVERY_PRIMITIVES.md

@@ -1,6 +1,6 @@
 # Context Integrity and Recovery Primitives
 
-Tracker: [pm-hu92i3](../.agents/pm/issues/pm-hu92i3.toon), [pm-nc94mk](../.agents/pm/issues/pm-nc94mk.toon), [pm-xrjy8o](../.agents/pm/issues/pm-xrjy8o.toon), [pm-f60039](../.agents/pm/issues/pm-f60039.toon), [pm-2qahia](../.agents/pm/issues/pm-2qahia.toon), [pm-z1z96w](../.agents/pm/issues/pm-z1z96w.toon), [pm-yhle2e](../.agents/pm/issues/pm-yhle2e.toon), [pm-t7wl00](../.agents/pm/issues/pm-t7wl00.toon), [pm-hiqlkh](../.agents/pm/issues/pm-hiqlkh.toon), [pm-ntnv4k](../.agents/pm/issues/pm-ntnv4k.toon), [pm-sxg7wl](../.agents/pm/issues/pm-sxg7wl.toon), [pm-xspd](../.agents/pm/chores/pm-xspd.toon)
+Tracker: [pm-dn8rwl](../.agents/pm/issues/pm-dn8rwl.toon), [pm-r97901](../.agents/pm/issues/pm-r97901.toon), [pm-hu92i3](../.agents/pm/issues/pm-hu92i3.toon), [pm-nc94mk](../.agents/pm/issues/pm-nc94mk.toon), [pm-xrjy8o](../.agents/pm/issues/pm-xrjy8o.toon), [pm-f60039](../.agents/pm/issues/pm-f60039.toon), [pm-2qahia](../.agents/pm/issues/pm-2qahia.toon), [pm-z1z96w](../.agents/pm/issues/pm-z1z96w.toon), [pm-yhle2e](../.agents/pm/issues/pm-yhle2e.toon), [pm-t7wl00](../.agents/pm/issues/pm-t7wl00.toon), [pm-hiqlkh](../.agents/pm/issues/pm-hiqlkh.toon), [pm-ntnv4k](../.agents/pm/issues/pm-ntnv4k.toon), [pm-sxg7wl](../.agents/pm/issues/pm-sxg7wl.toon), [pm-xspd](../.agents/pm/chores/pm-xspd.toon)
 
 `project management = context management`: a successful command is useful only when the context it records and later returns is truthful, lossless, and actionable. These SDK-owned primitives are shared by the CLI and package integrations.
 
@@ -59,7 +59,16 @@ history.
 
 Health keeps the metadata-only cache path for clean history streams. A cached hash mismatch, chain mismatch, or writer-version skew is only a candidate: health rereads canonical item sources and verifies stream content hashes before reporting corruption. The `history_drift` details expose `cache_confirmation` candidate, confirmed, and resolved-false-positive item sets, while `cache_hit_verification: metadata_then_content_hash` identifies the authoritative fallback. Drift-cache envelopes carry both their schema version and the current item-hash capability, so changing legacy canonicalization invalidates prior verdicts and a runtime with incompatible hash semantics rebuilds the cache instead of trusting it.
 
-Merge reconciliation may consume a durable hash-only receipt without `--force` only when its canonical item path, complete declared-field set, and every merged-value hash exactly match the current item snapshot. Raw discarded values remain clone-local. Any incomplete or mismatched proof fails closed. SDK gates use `inspectMergeReceiptEvidence` or `runMergeReceiptEvidenceReport` to retain the distinction between no evidence, rejected evidence, and clone-local evidence whose Git directory could not be resolved; `clone_local_evidence_resolved=false` makes the loss-aware report incomplete. The list-only and legacy report compatibility projections intentionally return valid receipts only. Diverged history unions also fail closed when deterministic suffix ordering would make any patch operation inapplicable, instead of publishing a rehashed stream with a skipped branch effect.
+Merge reconciliation may consume a durable hash-only receipt without `--force` only when its canonical item path, complete declared-field set, and every merged-value hash exactly match the current item snapshot. Raw discarded values remain clone-local. Any incomplete or mismatched proof fails closed. SDK gates use `inspectMergeReceiptEvidence` or `runMergeReceiptEvidenceReport` to retain the distinction between no evidence, rejected evidence, and clone-local evidence whose Git directory could not be resolved; `clone_local_evidence_resolved=false` makes the loss-aware report incomplete. Rejected evidence carries bounded privacy-safe source, reason, and receipt-id-or-hash locators, while the exact count and truncation receipt preserve completeness under an agent token budget. Cross-platform ancestor inspection distinguishes an absent receipt store from an unreadable or non-directory root. The list-only and legacy report compatibility projections intentionally return valid receipts only. Diverged history unions also fail closed when deterministic suffix ordering would make any patch operation inapplicable, instead of publishing a rehashed stream with a skipped branch effect.
+
+History receipt summaries are durable references, not cleanup hints. Health
+checks each `context.merge.receipts[].receipt_id` against valid pending and
+reconciled authoritative evidence. A missing reference is returned with its
+item id and one-based history line; unsafe identifiers are SHA-256 locators
+rather than echoed content. Detail is capped at 100 while the exact count and a
+truncation receipt preserve loss awareness. Recovery means restoring the named
+receipt from an authoritative clone or backup. Rewriting append-only history or
+deleting sibling evidence is never an automatic remediation.
 
 ## Strict-create recovery
 

package/docs/MERGE_SAFETY.md

@@ -105,8 +105,22 @@ whose candidates were all rejected. Gates and diagnostic integrations should
 use `inspectMergeReceiptEvidence`, whose `invalid_evidence_count` preserves
 that distinction without returning malformed contents.
 `runMergeReceiptEvidenceReport` and `pm merge report --json` expose the same
-loss-aware contract through `complete`, `invalid_evidence_count`, and
-`clone_local_evidence_resolved`; the CLI
+loss-aware contract through `complete`, `invalid_evidence_count`, bounded
+`invalid_evidence[]`, `invalid_evidence_truncated`, and
+`clone_local_evidence_resolved`. Each rejected candidate reports a stable
+reason plus its `clone_local`, `durable`, or copy-consistency source. A safe
+receipt filename is returned as `receipt_id`; unsafe candidate names are
+represented only by `candidate_name_hash`, and malformed contents are never
+returned. The detail list is capped at 100 rows while the count remains exact,
+so automated gates stay token-bounded. Directory traversal distinguishes a
+truly absent store from a non-directory or unreadable ancestor on Windows and
+POSIX instead of treating platform-specific `ENOENT`/`ENOTDIR` spellings as
+equivalent. Full health also cross-checks the privacy-safe receipt summaries in
+append-only history against valid pending and reconciled evidence. Missing
+evidence emits `merge_receipt_history_reference_missing:<n>` with bounded item,
+history-line, and receipt-id-or-hash coordinates. Its remediation enumerates
+the exact references and directs recovery from an authoritative clone or
+backup; it never recommends deleting receipts or rewriting history. The CLI
 exits nonzero when evidence is incomplete, even when the valid-receipt count is
 zero. Current SDK implementations always emit the new field, while its optional
 type preserves structural compatibility for existing typed adapters and test

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 354
+- Catalog error codes: 355
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 335
-- Coverage fraction: 0.053672
+- Uncovered error codes: 336
+- Coverage fraction: 0.053521
 - Closed-domain probes: 19
 - Grammar probes: 94
 
@@ -186,6 +186,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `merge_decisions_unreviewed` | `merge_decisions_unreviewed` | uncovered | none | 0 |
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
+| `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
 | `merge_receipts_pending` | `merge_receipts_pending` | uncovered | none | 0 |
 | `merge_reconcile_receipt_evidence_untrusted` | `merge_reconcile_receipt_evidence_untrusted` | uncovered | none | 0 |
 | `merge_root_not_found` | `merge_root_not_found` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.1"
+    "version": "2026.9.2"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.1",
+      "version": "2026.9.2",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",

package/sdk/public-surface.json

@@ -1,6 +1,6 @@
 {
   "aggregate_completeness": {
-    "covered_symbols": 1824,
+    "covered_symbols": 1825,
     "excluded": [
       {
         "name": "_testOnlyCliContracts",
@@ -8,7 +8,7 @@
       }
     ],
     "missing": [],
-    "required_symbols": 1825
+    "required_symbols": 1826
   },
   "breaking_acknowledgements": [
     {
@@ -1463,6 +1463,16 @@
       ],
       "package_version": "2026.8.31",
       "reason": "Add optional host-owned cursor integrity key for deployment-stable pagination; existing callers and process-local fallback remain compatible."
+    },
+    {
+      "changes": [
+        "signature ./sdk:MergeReceiptEvidenceReport",
+        "signature ./sdk:MergeReceiptEvidenceScan",
+        "signature ./sdk/merge:MergeReceiptEvidenceReport",
+        "signature ./sdk/merge:MergeReceiptEvidenceScan"
+      ],
+      "package_version": "2026.9.1",
+      "reason": "Expose loss-aware receipt evidence details as required runtime fields so SDK gates cannot silently discard invalid candidates."
     }
   ],
   "entrypoints": {
@@ -9291,13 +9301,19 @@
           "classification": "supported",
           "kind": "interface",
           "name": "MergeReceiptEvidenceReport",
-          "signature": "export interface MergeReceiptEvidenceReport { ok: boolean; complete: boolean; count: number; invalid_evidence_count: number; clone_local_evidence_resolved?: boolean; receipts: MergeDecisionReceipt[]; generated_at: string; }"
+          "signature": "export interface MergeReceiptEvidenceReport { ok: boolean; complete: boolean; count: number; invalid_evidence_count: number; invalid_evidence: MergeReceiptInvalidEvidence[]; invalid_evidence_truncated: boolean; clone_local_evidence_resolved?: boolean; receipts: MergeDecisionReceipt[]; generated_at: string; }"
         },
         {
           "classification": "supported",
           "kind": "interface",
           "name": "MergeReceiptEvidenceScan",
-          "signature": "export interface MergeReceiptEvidenceScan { receipts: MergeDecisionReceipt[]; invalid_evidence_count: number; clone_local_evidence_resolved?: boolean; }"
+          "signature": "export interface MergeReceiptEvidenceScan { receipts: MergeDecisionReceipt[]; invalid_evidence_count: number; invalid_evidence: MergeReceiptInvalidEvidence[]; invalid_evidence_truncated: boolean; clone_local_evidence_resolved?: boolean; }"
+        },
+        {
+          "classification": "supported",
+          "kind": "interface",
+          "name": "MergeReceiptInvalidEvidence",
+          "signature": "export interface MergeReceiptInvalidEvidence { evidence_source: \"clone_local\" | \"durable\" | \"clone_local_and_durable\"; reason: \"directory_unreadable\" | \"candidate_not_bounded_regular_file\" | \"candidate_unreadable\" | \"candidate_invalid_json\" | \"schema_or_identity_invalid\" | \"copy_provenance_mismatch\"; receipt_id?: string; candidate_name_hash?: string; }"
         },
         {
           "classification": "advanced_export",
@@ -26733,13 +26749,19 @@
           "classification": "supported",
           "kind": "interface",
           "name": "MergeReceiptEvidenceReport",
-          "signature": "export interface MergeReceiptEvidenceReport { ok: boolean; complete: boolean; count: number; invalid_evidence_count: number; clone_local_evidence_resolved?: boolean; receipts: MergeDecisionReceipt[]; generated_at: string; }"
+          "signature": "export interface MergeReceiptEvidenceReport { ok: boolean; complete: boolean; count: number; invalid_evidence_count: number; invalid_evidence: MergeReceiptInvalidEvidence[]; invalid_evidence_truncated: boolean; clone_local_evidence_resolved?: boolean; receipts: MergeDecisionReceipt[]; generated_at: string; }"
         },
         {
           "classification": "supported",
           "kind": "interface",
           "name": "MergeReceiptEvidenceScan",
-          "signature": "export interface MergeReceiptEvidenceScan { receipts: MergeDecisionReceipt[]; invalid_evidence_count: number; clone_local_evidence_resolved?: boolean; }"
+          "signature": "export interface MergeReceiptEvidenceScan { receipts: MergeDecisionReceipt[]; invalid_evidence_count: number; invalid_evidence: MergeReceiptInvalidEvidence[]; invalid_evidence_truncated: boolean; clone_local_evidence_resolved?: boolean; }"
+        },
+        {
+          "classification": "supported",
+          "kind": "interface",
+          "name": "MergeReceiptInvalidEvidence",
+          "signature": "export interface MergeReceiptInvalidEvidence { evidence_source: \"clone_local\" | \"durable\" | \"clone_local_and_durable\"; reason: \"directory_unreadable\" | \"candidate_not_bounded_regular_file\" | \"candidate_unreadable\" | \"candidate_invalid_json\" | \"schema_or_identity_invalid\" | \"copy_provenance_mismatch\"; receipt_id?: string; candidate_name_hash?: string; }"
         },
         {
           "classification": "supported",
@@ -32095,6 +32117,7 @@
     "merge_decisions_unreviewed",
     "merge_git_config_unwritable",
     "merge_receipt_evidence_invalid",
+    "merge_receipt_history_reference_missing",
     "merge_receipts_pending",
     "merge_reconcile_receipt_evidence_untrusted",
     "merge_root_not_found",