@unbrained/pm-cli 2026.9.3 → 2026.9.4

package/dist/core/diagnostics/remediation.js

@@ -19,7 +19,7 @@
  */
 /** Registry of every non-extension `pm health` / `pm validate` warning code and its remediation. Extension findings keep their richer, contextual `details.triage.remediation` produced by the extension health triage and are intentionally excluded here (see pm-0hnu: "all non-extension checks"). */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="24a69725-363a-59e1-96c6-1e1ca079a311")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8e57e03e-3c60-5c1b-b455-9318df8027f6")}catch(e){}}();
 export const REMEDIATION_REGISTRY = Object.freeze([
     // --- pm health: directories ---
     {
@@ -205,8 +205,8 @@ export const REMEDIATION_REGISTRY = Object.freeze([
     },
     {
         code: "merge_receipt_history_reference_missing",
-        command: "pm health --check-only --full --json",
-        summary: "One or more append-only history coordinates reference receipt evidence that is no longer present; inspect the bounded item, line, and privacy-safe receipt locator, then recover the named evidence from an authoritative clone or backup without rewriting history.",
+        command: "pm merge reconcile --dry-run",
+        summary: "Review the bounded coordinates and recover available evidence first; for exact pre-durable clone-local-only references, rerun with --force so pm appends an audited disposition and proves the health finding is cleared without rewriting history.",
     },
     {
         code: "validate_merge_decisions_unreviewed",
@@ -504,4 +504,4 @@ export function buildRemediationCommands(warnings) {
     return Object.values(buildRemediationMap(warnings));
 }
 //# sourceMappingURL=remediation.js.map
-//# debugId=24a69725-363a-59e1-96c6-1e1ca079a311
+//# debugId=8e57e03e-3c60-5c1b-b455-9318df8027f6

package/dist/core/history/history.d.ts

@@ -1,11 +1,47 @@
 import { type AuthorSource } from "../shared/author.js";
-import type { HistoryEntry, ItemDocument } from "../../types/index.js";
+import type { HistoryEntry, HistoryPatchOp, ItemDocument } from "../../types/index.js";
 /** Hash epoch for the current canonical item surface written into immutable history. */
 export declare const CURRENT_HISTORY_ITEM_HASH_VERSION: 3;
 /** Hash epochs understood by this runtime. */
 export declare const SUPPORTED_HISTORY_ITEM_HASH_VERSIONS: readonly [1, 2, 3];
+/** Record-integrity epoch written beside new immutable history events. */
+export declare const CURRENT_HISTORY_RECORD_HASH_VERSION: 1;
+/** Record-integrity epochs understood by this runtime. */
+export declare const SUPPORTED_HISTORY_RECORD_HASH_VERSIONS: readonly [1];
 /** Restricts item hash versions accepted by history replay. */
 export type HistoryItemHashVersion = (typeof SUPPORTED_HISTORY_ITEM_HASH_VERSIONS)[number];
+/** Restricts immutable-record hash versions accepted by history replay. */
+export type HistoryRecordHashVersion = (typeof SUPPORTED_HISTORY_RECORD_HASH_VERSIONS)[number];
+/** Canonicalize and hash every immutable record field except the hash value itself. */
+export declare function hashHistoryRecord(entry: Omit<HistoryEntry, "record_hash">): string;
+/** Hash one patch representation without retaining its potentially sensitive values. */
+export declare function hashHistoryPatch(patch: readonly HistoryPatchOp[]): string;
+/** Hash an ordered history prefix for compact checkpoint provenance. */
+export declare function hashHistoryStream(entries: readonly HistoryEntry[]): string;
+/** Attach the current immutable-record integrity envelope to one history event. */
+export declare function sealHistoryRecord(entry: HistoryEntry): HistoryEntry;
+/** Verify record-level attribution coverage while accepting explicit legacy item-state-only entries. */
+export declare function verifyHistoryRecordHash(entry: HistoryEntry): {
+    ok: true;
+    coverage: "record_and_item_state" | "item_state_only";
+} | {
+    ok: false;
+    error: "incomplete_record_hash_envelope" | "record_hash_mismatch" | "unsupported_record_hash_version";
+};
+/** Reseal a maintenance rewrite and retain the anchors and patch digest it replaced. */
+export declare function resealHistoryRewrite(original: HistoryEntry, rewritten: HistoryEntry, options?: Readonly<{
+    retainOriginalPatch?: boolean;
+    retainPriorRecord?: boolean;
+    retainPriorRecordHash?: boolean;
+}>): HistoryEntry;
+/** Verify that retained rewrite evidence reconstructs every available prior record envelope. */
+export declare function verifyHistoryRewriteEvidence(entry: HistoryEntry): {
+    ok: true;
+    coverage: "complete" | "digest_only" | "legacy_anchor_only" | "none";
+} | {
+    ok: false;
+    error: "rewrite_evidence_invalid" | "rewrite_evidence_patch_hash_mismatch" | "rewrite_evidence_record_hash_mismatch";
+};
 declare function decodeJsonPointer(path: string): string[];
 declare function isDefinedPointerPath(document: unknown, path: string): boolean;
 /** Implements hash document for the public runtime surface of this module. */

package/dist/core/history/history.js

@@ -4,7 +4,7 @@
  * Implements append-only history and replay behavior for History.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1f78448d-a042-588a-84ce-369bd9ce8726")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bf6a9831-134c-5dc2-a3e2-74dca00cf22c")}catch(e){}}();
 import jsonPatch from "fast-json-patch";
 import { EXIT_CODE, ITEM_METADATA_KEY_ORDER } from "../shared/constants.js";
 import { runActiveServiceOverride } from "../extensions/index.js";
@@ -26,6 +26,242 @@ const EMPTY_LEGACY_HASH_DOCUMENT = {
 export const CURRENT_HISTORY_ITEM_HASH_VERSION = 3;
 /** Hash epochs understood by this runtime. */
 export const SUPPORTED_HISTORY_ITEM_HASH_VERSIONS = [1, 2, 3];
+/** Record-integrity epoch written beside new immutable history events. */
+export const CURRENT_HISTORY_RECORD_HASH_VERSION = 1;
+/** Record-integrity epochs understood by this runtime. */
+export const SUPPORTED_HISTORY_RECORD_HASH_VERSIONS = [1];
+/** Canonicalize and hash every immutable record field except the hash value itself. */
+export function hashHistoryRecord(entry) {
+    return sha256Hex(stableStringify(entry));
+}
+/** Hash one patch representation without retaining its potentially sensitive values. */
+export function hashHistoryPatch(patch) {
+    return sha256Hex(stableStringify(patch));
+}
+/** Hash an ordered history prefix for compact checkpoint provenance. */
+export function hashHistoryStream(entries) {
+    return sha256Hex(stableStringify(entries));
+}
+/** Attach the current immutable-record integrity envelope to one history event. */
+export function sealHistoryRecord(entry) {
+    const sealed = {
+        ...entry,
+        record_hash_version: CURRENT_HISTORY_RECORD_HASH_VERSION,
+    };
+    const { record_hash: _recordHash, ...canonical } = sealed;
+    return { ...sealed, record_hash: hashHistoryRecord(canonical) };
+}
+/** Verify record-level attribution coverage while accepting explicit legacy item-state-only entries. */
+export function verifyHistoryRecordHash(entry) {
+    if (entry.record_hash_version === undefined &&
+        entry.record_hash === undefined) {
+        return { ok: true, coverage: "item_state_only" };
+    }
+    if (entry.record_hash_version === undefined ||
+        entry.record_hash === undefined) {
+        return { ok: false, error: "incomplete_record_hash_envelope" };
+    }
+    if (!SUPPORTED_HISTORY_RECORD_HASH_VERSIONS.includes(entry.record_hash_version)) {
+        return { ok: false, error: "unsupported_record_hash_version" };
+    }
+    const { record_hash: _recordHash, ...canonical } = entry;
+    return hashHistoryRecord(canonical) === entry.record_hash
+        ? { ok: true, coverage: "record_and_item_state" }
+        : { ok: false, error: "record_hash_mismatch" };
+}
+/** Build the retained coordinate and optional exact-record rewrite evidence. */
+function createHistoryRewriteEvidence(original, options) {
+    const evidence = {
+        before_hash: original.before_hash,
+        after_hash: original.after_hash,
+        patch_hash: hashHistoryPatch(original.patch),
+    };
+    if (original.item_hash_version !== undefined) {
+        evidence.item_hash_version = original.item_hash_version;
+    }
+    if (options.retainOriginalPatch) {
+        evidence.patch = structuredClone(original.patch);
+    }
+    if (options.retainPriorRecordHash !== false &&
+        original.record_hash_version !== undefined &&
+        original.record_hash !== undefined) {
+        evidence.record_hash_version = original.record_hash_version;
+        evidence.record_hash = original.record_hash;
+        evidence.record = structuredClone(original);
+    }
+    return evidence;
+}
+/** Reseal a maintenance rewrite and retain the anchors and patch digest it replaced. */
+export function resealHistoryRewrite(original, rewritten, options = {}) {
+    const originalRecordVerification = verifyHistoryRecordHash(original);
+    if (!originalRecordVerification.ok) {
+        throw new TypeError(originalRecordVerification.error);
+    }
+    const originalPatchHash = hashHistoryPatch(original.patch);
+    const retainsRewriteEvidence = options.retainPriorRecord === true ||
+        original.before_hash !== rewritten.before_hash ||
+        original.after_hash !== rewritten.after_hash ||
+        original.item_hash_version !== rewritten.item_hash_version ||
+        originalPatchHash !== hashHistoryPatch(rewritten.patch);
+    const sealed = sealHistoryRecord({
+        ...rewritten,
+        ...(retainsRewriteEvidence
+            ? {
+                reanchor_evidence: [
+                    ...(rewritten.reanchor_evidence ?? []),
+                    createHistoryRewriteEvidence(original, options),
+                ],
+            }
+            : {}),
+    });
+    const evidenceVerification = verifyHistoryRewriteEvidence(sealed);
+    if (!evidenceVerification.ok) {
+        throw new TypeError(evidenceVerification.error);
+    }
+    return sealed;
+}
+/** Return whether runtime data is a dense list of structurally valid patch operations. */
+function isHistoryPatch(value) {
+    if (!Array.isArray(value) || Object.keys(value).length !== value.length) {
+        return false;
+    }
+    return value.every((operation) => {
+        if (!isRecord(operation) || typeof operation.path !== "string") {
+            return false;
+        }
+        if (operation.op === "move" || operation.op === "copy") {
+            return typeof operation.from === "string";
+        }
+        if (["add", "replace", "test"].includes(operation.op)) {
+            return Object.hasOwn(operation, "value");
+        }
+        return operation.op === "remove";
+    });
+}
+/** Return whether a retained record has the minimum immutable event shape. */
+function isRetainedHistoryRecordShape(value) {
+    return (isRecord(value) &&
+        typeof value.ts === "string" &&
+        typeof value.author === "string" &&
+        typeof value.op === "string" &&
+        typeof value.before_hash === "string" &&
+        typeof value.after_hash === "string" &&
+        isHistoryPatch(value.patch));
+}
+/** Return whether optional retained record-hash fields form a complete pair. */
+function hasCompleteRetainedRecordHashEnvelope(evidence) {
+    const hasVersion = evidence.record_hash_version !== undefined;
+    const hasHash = evidence.record_hash !== undefined;
+    return hasVersion === hasHash;
+}
+/** Return whether runtime evidence has the bounded shape needed for verification. */
+function isHistoryReanchorEvidence(evidence) {
+    if (!isRecord(evidence) ||
+        !hasCompleteRetainedRecordHashEnvelope(evidence) ||
+        typeof evidence.before_hash !== "string" ||
+        typeof evidence.after_hash !== "string" ||
+        typeof evidence.patch_hash !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(evidence.patch_hash) ||
+        (evidence.patch !== undefined && !isHistoryPatch(evidence.patch)) ||
+        (evidence.record_hash_version !== undefined &&
+            typeof evidence.record_hash_version !== "number") ||
+        (evidence.record_hash !== undefined &&
+            (typeof evidence.record_hash !== "string" ||
+                !/^[a-f0-9]{64}$/u.test(evidence.record_hash)))) {
+        return false;
+    }
+    return (evidence.record === undefined ||
+        isRetainedHistoryRecordShape(evidence.record));
+}
+/** Return whether a retained exact record agrees with its summary coordinates. */
+function matchesRetainedHistoryRecord(evidence) {
+    const record = evidence.record;
+    return (record !== undefined &&
+        record.before_hash === evidence.before_hash &&
+        record.after_hash === evidence.after_hash &&
+        record.item_hash_version === evidence.item_hash_version &&
+        record.record_hash_version === evidence.record_hash_version &&
+        record.record_hash === evidence.record_hash &&
+        hashHistoryPatch(record.patch) === evidence.patch_hash);
+}
+/** Reconstruct one prior record represented by retained rewrite evidence. */
+function reconstructPriorHistoryRecord(current, evidence, priorEvidence) {
+    if (evidence.patch &&
+        hashHistoryPatch(evidence.patch) !== evidence.patch_hash) {
+        return { kind: "patch_hash_mismatch" };
+    }
+    if (evidence.record) {
+        if (!matchesRetainedHistoryRecord(evidence)) {
+            return { kind: "record_hash_mismatch" };
+        }
+        return { kind: "record", entry: evidence.record };
+    }
+    const priorPatch = evidence.patch ?? current.patch;
+    if (hashHistoryPatch(priorPatch) !== evidence.patch_hash) {
+        return { kind: "digest_only" };
+    }
+    const priorRecord = {
+        ...current,
+        before_hash: evidence.before_hash,
+        after_hash: evidence.after_hash,
+        patch: priorPatch,
+        ...(evidence.item_hash_version === undefined
+            ? {}
+            : { item_hash_version: evidence.item_hash_version }),
+        ...(evidence.record_hash_version === undefined
+            ? {}
+            : { record_hash_version: evidence.record_hash_version }),
+        ...(evidence.record_hash === undefined
+            ? {}
+            : { record_hash: evidence.record_hash }),
+        ...(priorEvidence.length === 0 ? {} : { reanchor_evidence: priorEvidence }),
+    };
+    if (priorEvidence.length === 0)
+        delete priorRecord.reanchor_evidence;
+    if (evidence.item_hash_version === undefined) {
+        delete priorRecord.item_hash_version;
+    }
+    return evidence.record_hash_version === undefined ||
+        evidence.record_hash === undefined
+        ? { kind: "legacy", entry: priorRecord }
+        : { kind: "record", entry: priorRecord };
+}
+/** Verify that retained rewrite evidence reconstructs every available prior record envelope. */
+export function verifyHistoryRewriteEvidence(entry) {
+    const evidenceEntries = entry.reanchor_evidence;
+    if (evidenceEntries === undefined)
+        return { ok: true, coverage: "none" };
+    if (!Array.isArray(evidenceEntries)) {
+        return { ok: false, error: "rewrite_evidence_invalid" };
+    }
+    if (evidenceEntries.length === 0)
+        return { ok: true, coverage: "none" };
+    let reconstructed = entry;
+    for (let index = evidenceEntries.length - 1; index >= 0; index -= 1) {
+        const evidence = evidenceEntries[index];
+        if (!(index in evidenceEntries) || !isHistoryReanchorEvidence(evidence)) {
+            return { ok: false, error: "rewrite_evidence_invalid" };
+        }
+        const prior = reconstructPriorHistoryRecord(reconstructed, evidence, evidenceEntries.slice(0, index));
+        if (prior.kind === "patch_hash_mismatch") {
+            return { ok: false, error: "rewrite_evidence_patch_hash_mismatch" };
+        }
+        if (prior.kind === "record_hash_mismatch") {
+            return { ok: false, error: "rewrite_evidence_record_hash_mismatch" };
+        }
+        if (prior.kind === "digest_only") {
+            return { ok: true, coverage: "digest_only" };
+        }
+        if (prior.kind === "legacy") {
+            return { ok: true, coverage: "legacy_anchor_only" };
+        }
+        if (!verifyHistoryRecordHash(prior.entry).ok) {
+            return { ok: false, error: "rewrite_evidence_record_hash_mismatch" };
+        }
+        reconstructed = prior.entry;
+    }
+    return { ok: true, coverage: "complete" };
+}
 function compareOptionalStrings(left, right) {
     return (left ?? "").localeCompare(right ?? "");
 }
@@ -78,31 +314,17 @@ function isDefinedPointerPath(document, path) {
     }
     let cursor = document;
     for (const segment of segments) {
-        if (Array.isArray(cursor)) {
-            if (segment === "-" || !/^(0|[1-9]\d*)$/.test(segment)) {
-                return false;
-            }
-            const index = Number(segment);
-            if (!Number.isInteger(index) || index < 0 || index >= cursor.length) {
-                return false;
-            }
-            const next = cursor[index];
-            if (next === undefined) {
-                return false;
-            }
-            cursor = next;
-            continue;
-        }
-        if (typeof cursor !== "object" || cursor === null) {
-            return false;
-        }
-        if (!Object.prototype.hasOwnProperty.call(cursor, segment)) {
+        const arrayIndex = /^(0|[1-9]\d*)$/.test(segment) ? Number(segment) : -1;
+        const next = Array.isArray(cursor)
+            ? arrayIndex >= 0 && arrayIndex < cursor.length
+                ? cursor[arrayIndex]
+                : undefined
+            : isRecord(cursor) &&
+                Object.prototype.hasOwnProperty.call(cursor, segment)
+                ? cursor[segment]
+                : undefined;
+        if (next === undefined)
             return false;
-        }
-        const next = cursor[segment];
-        if (next === undefined) {
-            return false;
-        }
         cursor = next;
     }
     return true;
@@ -256,7 +478,10 @@ export function createHistoryEntry(params) {
         message: params.message === undefined ? undefined : params.message,
         ...(context === undefined ? {} : { context }),
     };
-    return { ...entry, event_class: classifyHistoryEvent(entry) };
+    return sealHistoryRecord({
+        ...entry,
+        event_class: classifyHistoryEvent(entry),
+    });
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -309,49 +534,44 @@ function serializeHistoryLine(value, fallbackEntry) {
     }
     return JSON.stringify(value);
 }
+/** Apply one extension-provided append decision and report whether it consumed the write. */
+async function applyHistoryAppendOverride(historyPath, entry, result) {
+    if (result === false)
+        return true;
+    if (typeof result === "string") {
+        await appendLineAtomic(historyPath, serializeHistoryLine(result, entry));
+        await invalidateHistoryDriftCacheForPath(historyPath);
+        await removeHistoryEventIndexForHistoryPath(historyPath);
+        return true;
+    }
+    if (typeof result !== "object" || result === null)
+        return false;
+    const record = result;
+    if (record.skip === true)
+        return true;
+    const nextHistoryPath = typeof record.history_path === "string" ? record.history_path : historyPath;
+    await appendLineAtomic(nextHistoryPath, serializeHistoryLine(typeof record.line === "string" ? record.line : (record.entry ?? entry), entry));
+    await invalidateHistoryDriftCacheForPath(nextHistoryPath);
+    await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
+    return true;
+}
 /** Implements append history entry for the public runtime surface of this module. */
 export async function appendHistoryEntry(historyPath, entry) {
     const override = await runActiveServiceOverride("history_append", {
         history_path: historyPath,
         entry,
     });
-    if (override.handled) {
-        if (override.result === false) {
-            return;
-        }
-        if (typeof override.result === "string") {
-            await appendLineAtomic(historyPath, serializeHistoryLine(override.result, entry));
-            await invalidateHistoryDriftCacheForPath(historyPath);
-            await removeHistoryEventIndexForHistoryPath(historyPath);
-            return;
-        }
-        if (typeof override.result === "object" && override.result !== null) {
-            const record = override.result;
-            if (record.skip === true) {
-                return;
-            }
-            const nextHistoryPath = typeof record.history_path === "string"
-                ? record.history_path
-                : historyPath;
-            if (typeof record.line === "string") {
-                await appendLineAtomic(nextHistoryPath, serializeHistoryLine(record.line, entry));
-                await invalidateHistoryDriftCacheForPath(nextHistoryPath);
-                await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
-                return;
-            }
-            await appendLineAtomic(nextHistoryPath, serializeHistoryLine(record.entry ?? entry, entry));
-            await invalidateHistoryDriftCacheForPath(nextHistoryPath);
-            await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
-            return;
-        }
+    if (override.handled &&
+        (await applyHistoryAppendOverride(historyPath, entry, override.result))) {
+        return;
     }
     const timestampedEntry = entry.ts.trim().length > 0
         ? entry
         : { ...entry, ts: fallbackHistoryTimestamp(entry) };
-    const normalizedEntry = {
+    const normalizedEntry = sealHistoryRecord({
         ...timestampedEntry,
         event_class: classifyHistoryEvent(timestampedEntry),
-    };
+    });
     await appendHistoryEntryWithEventIndex(historyPath, normalizedEntry, async () => {
         await appendLineAtomic(historyPath, serializeHistoryLine(normalizedEntry, normalizedEntry));
     });
@@ -363,4 +583,4 @@ export const _testOnly = {
     isDefinedPointerPath,
 };
 //# sourceMappingURL=history.js.map
-//# debugId=1f78448d-a042-588a-84ce-369bd9ce8726
+//# debugId=bf6a9831-134c-5dc2-a3e2-74dca00cf22c

package/dist/core/history/replay.js

@@ -4,13 +4,13 @@
  * Implements append-only history and replay behavior for Replay.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c9488ed4-8228-5e7c-9717-69dd7a3275c4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ce8dfbdf-8471-5843-8179-5608140330e1")}catch(e){}}();
 import jsonPatch from "fast-json-patch";
 import { ITEM_METADATA_KEY_ORDER } from "../shared/constants.js";
 import { canonicalDocument } from "../item/item-format.js";
 import { toItemRecord } from "../item/item-record.js";
 import { orderObject, sha256Hex, stableStringify, } from "../shared/serialization.js";
-import { CURRENT_HISTORY_ITEM_HASH_VERSION, SUPPORTED_HISTORY_ITEM_HASH_VERSIONS, hashDocumentVerificationCandidates, } from "./history.js";
+import { CURRENT_HISTORY_ITEM_HASH_VERSION, SUPPORTED_HISTORY_ITEM_HASH_VERSIONS, hashDocumentVerificationCandidates, resealHistoryRewrite, verifyHistoryRecordHash, verifyHistoryRewriteEvidence, } from "./history.js";
 /** Public contract for empty replay document, shared by SDK and presentation-layer consumers. */
 export const EMPTY_REPLAY_DOCUMENT = {
     metadata: {},
@@ -165,6 +165,31 @@ function historyEntryHashCandidates(explicitVersion, authoritativeVersion) {
         ? [...SUPPORTED_HISTORY_ITEM_HASH_VERSIONS]
         : [authoritativeVersion];
 }
+/** Return the first record or retained-rewrite integrity failure for one entry. */
+function historyEntryIntegrityError(entry) {
+    const recordVerification = verifyHistoryRecordHash(entry);
+    if (!recordVerification.ok)
+        return recordVerification.error;
+    const rewriteVerification = verifyHistoryRewriteEvidence(entry);
+    return rewriteVerification.ok ? undefined : rewriteVerification.error;
+}
+/** Validate immutable metadata and apply one patch for chain verification. */
+function verifyHistoryEntryInput(entry, replay) {
+    const integrityError = historyEntryIntegrityError(entry);
+    if (integrityError)
+        return { ok: false, error: integrityError };
+    const applied = tryApplyReplayPatch(replay, entry.patch);
+    return applied.ok
+        ? { ok: true, document: applied.document }
+        : { ok: false, error: "patch_apply_failed" };
+}
+/** Refuse any entry whose current or retained immutable envelope is invalid. */
+function assertHistoryEntryIntegrity(entry, index) {
+    const integrityError = historyEntryIntegrityError(entry);
+    if (integrityError) {
+        throw new TypeError(`${integrityError}:entry_${index + 1}`);
+    }
+}
 /** Deterministically verify a history chain: each entry's before_hash must equal the prior replayed after_hash, the patch must strictly apply, and the recorded after_hash must equal the replayed result. */
 /** Verify a chain and report the explicit or auto-detected item hash epoch. */
 export function verifyHistoryChainWithVersion(entries) {
@@ -179,18 +204,15 @@ export function verifyHistoryChainWithVersion(entries) {
         if (unsupportedVersion) {
             errors.push(`verify_failed:unsupported_item_hash_version:${String(explicitVersion)}:entry_${index + 1}`);
         }
-        const applied = tryApplyReplayPatch(replay, entry.patch);
-        if (!applied.ok) {
+        const input = verifyHistoryEntryInput(entry, replay);
+        if (!input.ok) {
             return {
                 ok: false,
-                errors: [
-                    ...errors,
-                    `verify_failed:patch_apply_failed:entry_${index + 1}`,
-                ],
+                errors: [...errors, `verify_failed:${input.error}:entry_${index + 1}`],
             };
         }
         if (unsupportedVersion) {
-            replay = applied.document;
+            replay = input.document;
             detectedVersion = undefined;
             authoritativeExplicitVersion = undefined;
             continue;
@@ -201,7 +223,7 @@ export function verifyHistoryChainWithVersion(entries) {
         const candidates = historyEntryHashCandidates(explicitVersion, authoritativeExplicitVersion);
         const candidateMatches = candidates.map((version) => ({
             version,
-            match: matchReplayHashCandidates(replay, applied.document, version, entry),
+            match: matchReplayHashCandidates(replay, input.document, version, entry),
         }));
         const matchingVersion = candidateMatches.find(({ match }) => match.pairIndex >= 0);
         if (matchingVersion === undefined) {
@@ -215,7 +237,7 @@ export function verifyHistoryChainWithVersion(entries) {
             };
         }
         const version = matchingVersion.version;
-        replay = applied.document;
+        replay = input.document;
         detectedVersion = version;
         authoritativeExplicitVersion =
             explicitVersion ??
@@ -304,6 +326,27 @@ export function resolveHistoryRepairItemHashVersion(entries) {
     }
     return CURRENT_HISTORY_ITEM_HASH_VERSION;
 }
+/** Apply one patch strictly or return its deterministic lenient repair projection. */
+function applyReanchorPatch(replay, entry) {
+    const strict = tryApplyReplayPatch(replay, entry.patch);
+    if (strict.ok) {
+        return {
+            next: strict.document,
+            patch: entry.patch,
+            repaired: false,
+            converted: 0,
+            skipped: 0,
+        };
+    }
+    const lenient = lenientApplyReplayPatch(replay, entry.patch);
+    return {
+        next: lenient.document,
+        patch: jsonPatch.compare(replay, lenient.document),
+        repaired: true,
+        converted: lenient.convertedReplaceToAdd,
+        skipped: lenient.skippedOps,
+    };
+}
 /** Re-anchor a drifted history chain: replay every entry from empty, recompute the before/after hashes, and only rewrite a patch when the original op set no longer strictly applies (legacy drift). Clean entries keep their patch verbatim so the on-disk diff stays minimal. The returned chain verifies via verifyHistoryChain. */
 export function reanchorHistoryEntries(entries, itemHashVersion = resolveHistoryRepairItemHashVersion(entries), options = {}) {
     const unsupportedIndex = entries.findIndex((entry) => isUnsupportedExplicitHistoryItemHashVersion(entry.item_hash_version));
@@ -322,27 +365,12 @@ export function reanchorHistoryEntries(entries, itemHashVersion = resolveHistory
         entries.some((entry) => entry.item_hash_version !== undefined);
     for (let index = 0; index < entries.length; index += 1) {
         const entry = entries[index];
-        const strict = tryApplyReplayPatch(replay, entry.patch);
-        let next;
-        let outPatch;
-        let patchRepaired = false;
-        let entryConverted = 0;
-        let entrySkipped = 0;
-        if (strict.ok) {
-            next = strict.document;
-            outPatch = entry.patch;
-        }
-        else {
-            const lenient = lenientApplyReplayPatch(replay, entry.patch);
-            next = lenient.document;
-            outPatch = jsonPatch.compare(replay, next);
-            patchRepaired = true;
-            entryConverted = lenient.convertedReplaceToAdd;
-            entrySkipped = lenient.skippedOps;
-            convertedReplaceToAdd += entryConverted;
-            skippedOps += entrySkipped;
-            entriesPatchRepaired += 1;
-        }
+        assertHistoryEntryIntegrity(entry, index);
+        const patchApplication = applyReanchorPatch(replay, entry);
+        const { next, patch: outPatch, repaired: patchRepaired, converted: entryConverted, skipped: entrySkipped, } = patchApplication;
+        convertedReplaceToAdd += entryConverted;
+        skippedOps += entrySkipped;
+        entriesPatchRepaired += Number(patchRepaired);
         const hashMatch = matchReplayHashCandidates(replay, next, itemHashVersion, entry);
         if (semanticIndex === undefined || options.continuousHashSurface !== true) {
             semanticIndex = [
@@ -361,7 +389,7 @@ export function reanchorHistoryEntries(entries, itemHashVersion = resolveHistory
         if (rehashed) {
             entriesRehashed += 1;
         }
-        const rewrittenEntry = {
+        let rewrittenEntry = {
             ...entry,
             patch: outPatch,
             before_hash: beforeHash,
@@ -373,6 +401,12 @@ export function reanchorHistoryEntries(entries, itemHashVersion = resolveHistory
         else {
             delete rewrittenEntry.item_hash_version;
         }
+        const versionChanged = rewrittenEntry.item_hash_version !== entry.item_hash_version;
+        if (rehashed || patchRepaired || versionChanged) {
+            rewrittenEntry = resealHistoryRewrite(entry, rewrittenEntry, {
+                retainOriginalPatch: patchRepaired,
+            });
+        }
         rewritten.push(rewrittenEntry);
         details.push({
             index: index + 1,
@@ -403,4 +437,4 @@ export function historyEntriesToRaw(entries) {
     return `${entries.map((entry) => JSON.stringify(entry)).join("\n")}\n`;
 }
 //# sourceMappingURL=replay.js.map
-//# debugId=c9488ed4-8228-5e7c-9717-69dd7a3275c4
+//# debugId=ce8dfbdf-8471-5843-8179-5608140330e1

package/dist/core/lock/lock.d.ts

@@ -25,6 +25,15 @@ export interface ProcessIdentity {
 declare function parseLockInfo(raw: string): LockReadResult;
 declare function readLockInfo(lockPath: string, emitReadHook?: boolean): Promise<LockReadResult>;
 declare function isErrno(error: unknown, code: string): boolean;
+/**
+ * Classify exclusive-create failures that prove another lock lifecycle is in
+ * flight. Windows can report `EPERM`, `EACCES`, or `EBUSY` while a just-unlinked
+ * lock is still delete-pending; treating those as fatal makes bounded lock
+ * waiting fail nondeterministically. Existing paths are contention on every
+ * host. A missing or temporarily unstatable Windows path is contention only
+ * when its parent remains writable, preserving genuine permission failures.
+ */
+declare function isLockCreateContention(error: unknown, lockPath: string, platform?: NodeJS.Platform): Promise<boolean>;
 declare function buildLockPayload(id: string, owner: string, ttlSeconds: number, token?: string): LockInfo;
 declare function isStaleLock(info: LockInfo | null, ttlSeconds: number): boolean;
 declare function lockOwnerSuffix(info: LockInfo | null): string;
@@ -57,6 +66,7 @@ export declare const _testOnly: {
     parseLockInfo: typeof parseLockInfo;
     readLockInfo: typeof readLockInfo;
     isErrno: typeof isErrno;
+    isLockCreateContention: typeof isLockCreateContention;
     buildLockPayload: typeof buildLockPayload;
     isStaleLock: typeof isStaleLock;
     lockOwnerSuffix: typeof lockOwnerSuffix;