@unbrained/pm-cli 2026.9.3 → 2026.9.5

package/dist/core/diagnostics/remediation.js

@@ -19,7 +19,7 @@
  */
 /** Registry of every non-extension `pm health` / `pm validate` warning code and its remediation. Extension findings keep their richer, contextual `details.triage.remediation` produced by the extension health triage and are intentionally excluded here (see pm-0hnu: "all non-extension checks"). */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="24a69725-363a-59e1-96c6-1e1ca079a311")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8e57e03e-3c60-5c1b-b455-9318df8027f6")}catch(e){}}();
 export const REMEDIATION_REGISTRY = Object.freeze([
     // --- pm health: directories ---
     {
@@ -205,8 +205,8 @@ export const REMEDIATION_REGISTRY = Object.freeze([
     },
     {
         code: "merge_receipt_history_reference_missing",
-        command: "pm health --check-only --full --json",
-        summary: "One or more append-only history coordinates reference receipt evidence that is no longer present; inspect the bounded item, line, and privacy-safe receipt locator, then recover the named evidence from an authoritative clone or backup without rewriting history.",
+        command: "pm merge reconcile --dry-run",
+        summary: "Review the bounded coordinates and recover available evidence first; for exact pre-durable clone-local-only references, rerun with --force so pm appends an audited disposition and proves the health finding is cleared without rewriting history.",
     },
     {
         code: "validate_merge_decisions_unreviewed",
@@ -504,4 +504,4 @@ export function buildRemediationCommands(warnings) {
     return Object.values(buildRemediationMap(warnings));
 }
 //# sourceMappingURL=remediation.js.map
-//# debugId=24a69725-363a-59e1-96c6-1e1ca079a311
+//# debugId=8e57e03e-3c60-5c1b-b455-9318df8027f6

package/dist/core/extensions/extension-types.d.ts

@@ -839,6 +839,8 @@ export interface SchemaItemTypeDefinition {
     description?: string;
     /** Initial status assigned when the contributed item type is created. */
     default_status?: string;
+    /** Dispatch role inherited by next, context, and automatic claims. Gates track outcomes; human roles require decisions. */
+    execution_role?: "agent" | "human" | "gate";
     /** Value that configures or reports required create fields for this contract. */
     required_create_fields?: string[];
     /** Value that configures or reports required create repeatables for this contract. */

package/dist/core/extensions/extension-types.js

@@ -1,6 +1,6 @@
 /** Public contract for known extension capabilities, shared by SDK and presentation-layer consumers. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ef5c8553-c206-5bb5-913a-85afb936f6d7")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a2f05fd9-1331-5e75-b8c1-42ad6deb425e")}catch(e){}}();
 export const KNOWN_EXTENSION_CAPABILITIES = [
     "commands",
     "renderers",
@@ -100,4 +100,4 @@ export function createDefaultExtensionGovernancePolicy() {
     };
 }
 //# sourceMappingURL=extension-types.js.map
-//# debugId=ef5c8553-c206-5bb5-913a-85afb936f6d7
+//# debugId=a2f05fd9-1331-5e75-b8c1-42ad6deb425e

package/dist/core/history/drift-scan.d.ts

@@ -1,6 +1,11 @@
+import { type HistoryIdentityDiscontinuity } from "./identity.js";
 import type { ItemMetadata } from "../../types/index.js";
 /** Documents the drift scan result payload exchanged by command, SDK, and package integrations. */
 export interface DriftScanResult {
+    /** Repeated genesis ordinals and observed sequence, keyed by affected item. */
+    identityDiscontinuities?: Array<HistoryIdentityDiscontinuity & {
+        item_id: string;
+    }>;
     /** Value that configures or reports missing streams for this contract. */
     missingStreams: string[];
     /** Value that configures or reports unreadable streams for this contract. */

package/dist/core/history/drift-scan.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1c6c65ef-115b-50e2-815e-84f6e91158cd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="80648bfe-2436-5b5a-8a16-b9c2875f95fd")}catch(e){}}();
 import fs from "node:fs/promises";
 import { createHash } from "node:crypto";
 import path from "node:path";
@@ -7,12 +7,14 @@ import { getHistoryPath } from "../store/paths.js";
 import { isFileMissingError, writeFileAtomic } from "../fs/fs-utils.js";
 import { CURRENT_HISTORY_ITEM_HASH_VERSION, SUPPORTED_HISTORY_ITEM_HASH_VERSIONS, hashDocumentVerificationCandidates, } from "./history.js";
 import { verifyHistoryChainWithVersion } from "./replay.js";
+import { findHistoryIdentityDiscontinuities, } from "./identity.js";
 import { getWorkspaceHistoryPath, inspectWorkspaceHistoryState, WORKSPACE_HISTORY_ID, } from "./workspace-history.js";
-const DRIFT_CACHE_VERSION = 9;
+const DRIFT_CACHE_VERSION = 10;
 const DRIFT_CACHE_FILENAME = "history-drift-cache.json";
 function getDriftCachePath(pmRoot) {
     return path.join(pmRoot, "runtime", DRIFT_CACHE_FILENAME);
 }
+/** Discard unreadable or stale cache envelopes, including prior verification semantics. */
 async function loadDriftCache(pmRoot) {
     try {
         const raw = await fs.readFile(getDriftCachePath(pmRoot), "utf8");
@@ -123,6 +125,7 @@ async function verifyHistoryStream(historyPath) {
         : verification.item_hash_version;
     return {
         latestAfterHash,
+        identityDiscontinuities: findHistoryIdentityDiscontinuities(entries),
         chainOk: verification.ok,
         versionSkew,
         latestHashComparable: latestHashVersion !== undefined &&
@@ -153,15 +156,15 @@ async function loadFreshStreamVerification(itemId, historyPath, accumulator) {
         return null;
     }
 }
+/** Reverify invalid streams and content-sensitive cache hits; reuse only compatible healthy evidence. */
 async function resolveStreamVerification(params) {
     const cachedContentHash = typeof params.cached?.content_hash === "string" &&
         params.cached.content_hash.length > 0
         ? params.cached.content_hash
         : undefined;
     const canUseCache = cacheMetadataMatches(params.cached, params.stat) &&
-        cachedContentHash !== undefined &&
-        params.cached !== undefined;
-    if (!canUseCache || !params.cached) {
+        cachedContentHash !== undefined;
+    if (!canUseCache || !params.cached || !params.cached.chain_ok) {
         return {
             verification: await loadFreshStreamVerification(params.itemId, params.historyPath, params.accumulator),
             cacheDirty: true,
@@ -183,6 +186,7 @@ async function resolveStreamVerification(params) {
     }
     return {
         verification: {
+            identityDiscontinuities: [],
             latestAfterHash: params.cached.latest_after_hash,
             chainOk: params.cached.chain_ok,
             versionSkew: params.cached.version_skew === true,
@@ -217,6 +221,12 @@ async function scanItemHistory(pmRoot, item, cache, accumulator) {
     });
     if (!resolved.verification)
         return resolved.cacheDirty;
+    if (resolved.verification.identityDiscontinuities.length > 0) {
+        (accumulator.identityDiscontinuities ??= []).push(...resolved.verification.identityDiscontinuities.map((finding) => ({
+            ...finding,
+            item_id: item.id,
+        })));
+    }
     if (resolved.verification.versionSkew) {
         accumulator.versionSkews.push(item.id);
     }
@@ -330,4 +340,4 @@ export async function scanHistoryDrift(pmRoot, items, options = {}) {
     return { ...accumulator, driftedItems };
 }
 //# sourceMappingURL=drift-scan.js.map
-//# debugId=1c6c65ef-115b-50e2-815e-84f6e91158cd
+//# debugId=80648bfe-2436-5b5a-8a16-b9c2875f95fd

package/dist/core/history/event-classification.d.ts

@@ -10,7 +10,7 @@ export declare const HISTORY_EVENT_CLASSIFICATION_VERSION: 1;
 /** Semantic effect of an immutable history event on project recency. */
 export type HistoryEventClass = "substantive" | "maintenance";
 /** Operations whose meaning is always governance or storage maintenance. */
-export declare const MAINTENANCE_HISTORY_OPERATIONS: readonly ["docs_add", "files_add", "history:author-acknowledge", "history_author_acknowledge", "history_compact", "history_compact_baseline", "history_redact", "history_repair", "normalize", "release", "test_run_track", "tests_add", "tests_remove", "update_audit", "update_ownership_bypass"];
+export declare const MAINTENANCE_HISTORY_OPERATIONS: readonly ["docs_add", "files_add", "history:author-acknowledge", "history_author_acknowledge", "history_compact", "history_compact_baseline", "history_redact", "history_repair", "history_salvage", "normalize", "release", "test_run_track", "tests_add", "tests_remove", "update_audit", "update_ownership_bypass"];
 /** Operations whose meaning always advances lifecycle or working context. */
 export declare const SUBSTANTIVE_HISTORY_OPERATIONS: readonly ["append", "cancel", "claim", "close", "comment_add", "create", "learning_add", "note_add", "reopen"];
 /**

package/dist/core/history/event-classification.js

@@ -1,6 +1,6 @@
 /** Current version of the public history-event classification policy. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6398c65d-fb5c-5479-93c2-0be963352a92")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9ad6614e-44bc-549c-915c-6177c3a43c1f")}catch(e){}}();
 export const HISTORY_EVENT_CLASSIFICATION_VERSION = 1;
 /** Operations whose meaning is always governance or storage maintenance. */
 export const MAINTENANCE_HISTORY_OPERATIONS = [
@@ -12,6 +12,7 @@ export const MAINTENANCE_HISTORY_OPERATIONS = [
     "history_compact_baseline",
     "history_redact",
     "history_repair",
+    "history_salvage",
     "normalize",
     "release",
     "test_run_track",
@@ -106,4 +107,4 @@ export function classifyHistoryEvent(entry) {
         : "substantive";
 }
 //# sourceMappingURL=event-classification.js.map
-//# debugId=6398c65d-fb5c-5479-93c2-0be963352a92
+//# debugId=9ad6614e-44bc-549c-915c-6177c3a43c1f

package/dist/core/history/history.d.ts

@@ -1,11 +1,47 @@
 import { type AuthorSource } from "../shared/author.js";
-import type { HistoryEntry, ItemDocument } from "../../types/index.js";
+import type { HistoryEntry, HistoryPatchOp, ItemDocument } from "../../types/index.js";
 /** Hash epoch for the current canonical item surface written into immutable history. */
 export declare const CURRENT_HISTORY_ITEM_HASH_VERSION: 3;
 /** Hash epochs understood by this runtime. */
 export declare const SUPPORTED_HISTORY_ITEM_HASH_VERSIONS: readonly [1, 2, 3];
+/** Record-integrity epoch written beside new immutable history events. */
+export declare const CURRENT_HISTORY_RECORD_HASH_VERSION: 1;
+/** Record-integrity epochs understood by this runtime. */
+export declare const SUPPORTED_HISTORY_RECORD_HASH_VERSIONS: readonly [1];
 /** Restricts item hash versions accepted by history replay. */
 export type HistoryItemHashVersion = (typeof SUPPORTED_HISTORY_ITEM_HASH_VERSIONS)[number];
+/** Restricts immutable-record hash versions accepted by history replay. */
+export type HistoryRecordHashVersion = (typeof SUPPORTED_HISTORY_RECORD_HASH_VERSIONS)[number];
+/** Canonicalize and hash every immutable record field except the hash value itself. */
+export declare function hashHistoryRecord(entry: Omit<HistoryEntry, "record_hash">): string;
+/** Hash one patch representation without retaining its potentially sensitive values. */
+export declare function hashHistoryPatch(patch: readonly HistoryPatchOp[]): string;
+/** Hash an ordered history prefix for compact checkpoint provenance. */
+export declare function hashHistoryStream(entries: readonly HistoryEntry[]): string;
+/** Attach the current immutable-record integrity envelope to one history event. */
+export declare function sealHistoryRecord(entry: HistoryEntry): HistoryEntry;
+/** Verify record-level attribution coverage while accepting explicit legacy item-state-only entries. */
+export declare function verifyHistoryRecordHash(entry: HistoryEntry): {
+    ok: true;
+    coverage: "record_and_item_state" | "item_state_only";
+} | {
+    ok: false;
+    error: "incomplete_record_hash_envelope" | "record_hash_mismatch" | "unsupported_record_hash_version";
+};
+/** Reseal a maintenance rewrite and retain the anchors and patch digest it replaced. */
+export declare function resealHistoryRewrite(original: HistoryEntry, rewritten: HistoryEntry, options?: Readonly<{
+    retainOriginalPatch?: boolean;
+    retainPriorRecord?: boolean;
+    retainPriorRecordHash?: boolean;
+}>): HistoryEntry;
+/** Verify that retained rewrite evidence reconstructs every available prior record envelope. */
+export declare function verifyHistoryRewriteEvidence(entry: HistoryEntry): {
+    ok: true;
+    coverage: "complete" | "digest_only" | "legacy_anchor_only" | "none";
+} | {
+    ok: false;
+    error: "rewrite_evidence_invalid" | "rewrite_evidence_patch_hash_mismatch" | "rewrite_evidence_record_hash_mismatch";
+};
 declare function decodeJsonPointer(path: string): string[];
 declare function isDefinedPointerPath(document: unknown, path: string): boolean;
 /** Implements hash document for the public runtime surface of this module. */

package/dist/core/history/history.js

@@ -4,8 +4,10 @@
  * Implements append-only history and replay behavior for History.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1f78448d-a042-588a-84ce-369bd9ce8726")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a5449fec-c5b4-5cf4-9a7f-b7c5dc7161c2")}catch(e){}}();
 import jsonPatch from "fast-json-patch";
+import fs from "node:fs/promises";
+import path from "node:path";
 import { EXIT_CODE, ITEM_METADATA_KEY_ORDER } from "../shared/constants.js";
 import { runActiveServiceOverride } from "../extensions/index.js";
 import { appendLineAtomic } from "../fs/fs-utils.js";
@@ -26,6 +28,242 @@ const EMPTY_LEGACY_HASH_DOCUMENT = {
 export const CURRENT_HISTORY_ITEM_HASH_VERSION = 3;
 /** Hash epochs understood by this runtime. */
 export const SUPPORTED_HISTORY_ITEM_HASH_VERSIONS = [1, 2, 3];
+/** Record-integrity epoch written beside new immutable history events. */
+export const CURRENT_HISTORY_RECORD_HASH_VERSION = 1;
+/** Record-integrity epochs understood by this runtime. */
+export const SUPPORTED_HISTORY_RECORD_HASH_VERSIONS = [1];
+/** Canonicalize and hash every immutable record field except the hash value itself. */
+export function hashHistoryRecord(entry) {
+    return sha256Hex(stableStringify(entry));
+}
+/** Hash one patch representation without retaining its potentially sensitive values. */
+export function hashHistoryPatch(patch) {
+    return sha256Hex(stableStringify(patch));
+}
+/** Hash an ordered history prefix for compact checkpoint provenance. */
+export function hashHistoryStream(entries) {
+    return sha256Hex(stableStringify(entries));
+}
+/** Attach the current immutable-record integrity envelope to one history event. */
+export function sealHistoryRecord(entry) {
+    const sealed = {
+        ...entry,
+        record_hash_version: CURRENT_HISTORY_RECORD_HASH_VERSION,
+    };
+    const { record_hash: _recordHash, ...canonical } = sealed;
+    return { ...sealed, record_hash: hashHistoryRecord(canonical) };
+}
+/** Verify record-level attribution coverage while accepting explicit legacy item-state-only entries. */
+export function verifyHistoryRecordHash(entry) {
+    if (entry.record_hash_version === undefined &&
+        entry.record_hash === undefined) {
+        return { ok: true, coverage: "item_state_only" };
+    }
+    if (entry.record_hash_version === undefined ||
+        entry.record_hash === undefined) {
+        return { ok: false, error: "incomplete_record_hash_envelope" };
+    }
+    if (!SUPPORTED_HISTORY_RECORD_HASH_VERSIONS.includes(entry.record_hash_version)) {
+        return { ok: false, error: "unsupported_record_hash_version" };
+    }
+    const { record_hash: _recordHash, ...canonical } = entry;
+    return hashHistoryRecord(canonical) === entry.record_hash
+        ? { ok: true, coverage: "record_and_item_state" }
+        : { ok: false, error: "record_hash_mismatch" };
+}
+/** Build the retained coordinate and optional exact-record rewrite evidence. */
+function createHistoryRewriteEvidence(original, options) {
+    const evidence = {
+        before_hash: original.before_hash,
+        after_hash: original.after_hash,
+        patch_hash: hashHistoryPatch(original.patch),
+    };
+    if (original.item_hash_version !== undefined) {
+        evidence.item_hash_version = original.item_hash_version;
+    }
+    if (options.retainOriginalPatch) {
+        evidence.patch = structuredClone(original.patch);
+    }
+    if (options.retainPriorRecordHash !== false &&
+        original.record_hash_version !== undefined &&
+        original.record_hash !== undefined) {
+        evidence.record_hash_version = original.record_hash_version;
+        evidence.record_hash = original.record_hash;
+        evidence.record = structuredClone(original);
+    }
+    return evidence;
+}
+/** Reseal a maintenance rewrite and retain the anchors and patch digest it replaced. */
+export function resealHistoryRewrite(original, rewritten, options = {}) {
+    const originalRecordVerification = verifyHistoryRecordHash(original);
+    if (!originalRecordVerification.ok) {
+        throw new TypeError(originalRecordVerification.error);
+    }
+    const originalPatchHash = hashHistoryPatch(original.patch);
+    const retainsRewriteEvidence = options.retainPriorRecord === true ||
+        original.before_hash !== rewritten.before_hash ||
+        original.after_hash !== rewritten.after_hash ||
+        original.item_hash_version !== rewritten.item_hash_version ||
+        originalPatchHash !== hashHistoryPatch(rewritten.patch);
+    const sealed = sealHistoryRecord({
+        ...rewritten,
+        ...(retainsRewriteEvidence
+            ? {
+                reanchor_evidence: [
+                    ...(rewritten.reanchor_evidence ?? []),
+                    createHistoryRewriteEvidence(original, options),
+                ],
+            }
+            : {}),
+    });
+    const evidenceVerification = verifyHistoryRewriteEvidence(sealed);
+    if (!evidenceVerification.ok) {
+        throw new TypeError(evidenceVerification.error);
+    }
+    return sealed;
+}
+/** Return whether runtime data is a dense list of structurally valid patch operations. */
+function isHistoryPatch(value) {
+    if (!Array.isArray(value) || Object.keys(value).length !== value.length) {
+        return false;
+    }
+    return value.every((operation) => {
+        if (!isRecord(operation) || typeof operation.path !== "string") {
+            return false;
+        }
+        if (operation.op === "move" || operation.op === "copy") {
+            return typeof operation.from === "string";
+        }
+        if (["add", "replace", "test"].includes(operation.op)) {
+            return Object.hasOwn(operation, "value");
+        }
+        return operation.op === "remove";
+    });
+}
+/** Return whether a retained record has the minimum immutable event shape. */
+function isRetainedHistoryRecordShape(value) {
+    return (isRecord(value) &&
+        typeof value.ts === "string" &&
+        typeof value.author === "string" &&
+        typeof value.op === "string" &&
+        typeof value.before_hash === "string" &&
+        typeof value.after_hash === "string" &&
+        isHistoryPatch(value.patch));
+}
+/** Return whether optional retained record-hash fields form a complete pair. */
+function hasCompleteRetainedRecordHashEnvelope(evidence) {
+    const hasVersion = evidence.record_hash_version !== undefined;
+    const hasHash = evidence.record_hash !== undefined;
+    return hasVersion === hasHash;
+}
+/** Return whether runtime evidence has the bounded shape needed for verification. */
+function isHistoryReanchorEvidence(evidence) {
+    if (!isRecord(evidence) ||
+        !hasCompleteRetainedRecordHashEnvelope(evidence) ||
+        typeof evidence.before_hash !== "string" ||
+        typeof evidence.after_hash !== "string" ||
+        typeof evidence.patch_hash !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(evidence.patch_hash) ||
+        (evidence.patch !== undefined && !isHistoryPatch(evidence.patch)) ||
+        (evidence.record_hash_version !== undefined &&
+            typeof evidence.record_hash_version !== "number") ||
+        (evidence.record_hash !== undefined &&
+            (typeof evidence.record_hash !== "string" ||
+                !/^[a-f0-9]{64}$/u.test(evidence.record_hash)))) {
+        return false;
+    }
+    return (evidence.record === undefined ||
+        isRetainedHistoryRecordShape(evidence.record));
+}
+/** Return whether a retained exact record agrees with its summary coordinates. */
+function matchesRetainedHistoryRecord(evidence) {
+    const record = evidence.record;
+    return (record !== undefined &&
+        record.before_hash === evidence.before_hash &&
+        record.after_hash === evidence.after_hash &&
+        record.item_hash_version === evidence.item_hash_version &&
+        record.record_hash_version === evidence.record_hash_version &&
+        record.record_hash === evidence.record_hash &&
+        hashHistoryPatch(record.patch) === evidence.patch_hash);
+}
+/** Reconstruct one prior record represented by retained rewrite evidence. */
+function reconstructPriorHistoryRecord(current, evidence, priorEvidence) {
+    if (evidence.patch &&
+        hashHistoryPatch(evidence.patch) !== evidence.patch_hash) {
+        return { kind: "patch_hash_mismatch" };
+    }
+    if (evidence.record) {
+        if (!matchesRetainedHistoryRecord(evidence)) {
+            return { kind: "record_hash_mismatch" };
+        }
+        return { kind: "record", entry: evidence.record };
+    }
+    const priorPatch = evidence.patch ?? current.patch;
+    if (hashHistoryPatch(priorPatch) !== evidence.patch_hash) {
+        return { kind: "digest_only" };
+    }
+    const priorRecord = {
+        ...current,
+        before_hash: evidence.before_hash,
+        after_hash: evidence.after_hash,
+        patch: priorPatch,
+        ...(evidence.item_hash_version === undefined
+            ? {}
+            : { item_hash_version: evidence.item_hash_version }),
+        ...(evidence.record_hash_version === undefined
+            ? {}
+            : { record_hash_version: evidence.record_hash_version }),
+        ...(evidence.record_hash === undefined
+            ? {}
+            : { record_hash: evidence.record_hash }),
+        ...(priorEvidence.length === 0 ? {} : { reanchor_evidence: priorEvidence }),
+    };
+    if (priorEvidence.length === 0)
+        delete priorRecord.reanchor_evidence;
+    if (evidence.item_hash_version === undefined) {
+        delete priorRecord.item_hash_version;
+    }
+    return evidence.record_hash_version === undefined ||
+        evidence.record_hash === undefined
+        ? { kind: "legacy", entry: priorRecord }
+        : { kind: "record", entry: priorRecord };
+}
+/** Verify that retained rewrite evidence reconstructs every available prior record envelope. */
+export function verifyHistoryRewriteEvidence(entry) {
+    const evidenceEntries = entry.reanchor_evidence;
+    if (evidenceEntries === undefined)
+        return { ok: true, coverage: "none" };
+    if (!Array.isArray(evidenceEntries)) {
+        return { ok: false, error: "rewrite_evidence_invalid" };
+    }
+    if (evidenceEntries.length === 0)
+        return { ok: true, coverage: "none" };
+    let reconstructed = entry;
+    for (let index = evidenceEntries.length - 1; index >= 0; index -= 1) {
+        const evidence = evidenceEntries[index];
+        if (!(index in evidenceEntries) || !isHistoryReanchorEvidence(evidence)) {
+            return { ok: false, error: "rewrite_evidence_invalid" };
+        }
+        const prior = reconstructPriorHistoryRecord(reconstructed, evidence, evidenceEntries.slice(0, index));
+        if (prior.kind === "patch_hash_mismatch") {
+            return { ok: false, error: "rewrite_evidence_patch_hash_mismatch" };
+        }
+        if (prior.kind === "record_hash_mismatch") {
+            return { ok: false, error: "rewrite_evidence_record_hash_mismatch" };
+        }
+        if (prior.kind === "digest_only") {
+            return { ok: true, coverage: "digest_only" };
+        }
+        if (prior.kind === "legacy") {
+            return { ok: true, coverage: "legacy_anchor_only" };
+        }
+        if (!verifyHistoryRecordHash(prior.entry).ok) {
+            return { ok: false, error: "rewrite_evidence_record_hash_mismatch" };
+        }
+        reconstructed = prior.entry;
+    }
+    return { ok: true, coverage: "complete" };
+}
 function compareOptionalStrings(left, right) {
     return (left ?? "").localeCompare(right ?? "");
 }
@@ -78,31 +316,17 @@ function isDefinedPointerPath(document, path) {
     }
     let cursor = document;
     for (const segment of segments) {
-        if (Array.isArray(cursor)) {
-            if (segment === "-" || !/^(0|[1-9]\d*)$/.test(segment)) {
-                return false;
-            }
-            const index = Number(segment);
-            if (!Number.isInteger(index) || index < 0 || index >= cursor.length) {
-                return false;
-            }
-            const next = cursor[index];
-            if (next === undefined) {
-                return false;
-            }
-            cursor = next;
-            continue;
-        }
-        if (typeof cursor !== "object" || cursor === null) {
-            return false;
-        }
-        if (!Object.prototype.hasOwnProperty.call(cursor, segment)) {
+        const arrayIndex = /^(0|[1-9]\d*)$/.test(segment) ? Number(segment) : -1;
+        const next = Array.isArray(cursor)
+            ? arrayIndex >= 0 && arrayIndex < cursor.length
+                ? cursor[arrayIndex]
+                : undefined
+            : isRecord(cursor) &&
+                Object.prototype.hasOwnProperty.call(cursor, segment)
+                ? cursor[segment]
+                : undefined;
+        if (next === undefined)
             return false;
-        }
-        const next = cursor[segment];
-        if (next === undefined) {
-            return false;
-        }
         cursor = next;
     }
     return true;
@@ -256,7 +480,10 @@ export function createHistoryEntry(params) {
         message: params.message === undefined ? undefined : params.message,
         ...(context === undefined ? {} : { context }),
     };
-    return { ...entry, event_class: classifyHistoryEvent(entry) };
+    return sealHistoryRecord({
+        ...entry,
+        event_class: classifyHistoryEvent(entry),
+    });
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -309,51 +536,76 @@ function serializeHistoryLine(value, fallbackEntry) {
     }
     return JSON.stringify(value);
 }
+/** Apply one extension-provided append decision and report whether it consumed the write. */
+async function applyHistoryAppendOverride(historyPath, entry, result) {
+    if (result === false)
+        return true;
+    if (typeof result === "string") {
+        const line = serializeHistoryLine(result, entry);
+        await appendHistoryLineWithIdentityReservation(historyPath, line);
+        await invalidateHistoryDriftCacheForPath(historyPath);
+        await removeHistoryEventIndexForHistoryPath(historyPath);
+        return true;
+    }
+    if (typeof result !== "object" || result === null)
+        return false;
+    const record = result;
+    if (record.skip === true)
+        return true;
+    const nextHistoryPath = typeof record.history_path === "string" ? record.history_path : historyPath;
+    const line = serializeHistoryLine(typeof record.line === "string" ? record.line : (record.entry ?? entry), entry);
+    await appendHistoryLineWithIdentityReservation(nextHistoryPath, line);
+    await invalidateHistoryDriftCacheForPath(nextHistoryPath);
+    await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
+    return true;
+}
+/** Exclusively create genesis streams at their effective destination; never remove a failed partial reservation. */
+async function appendHistoryLineWithIdentityReservation(historyPath, line) {
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        // Legacy service overrides may provide non-JSON lines; verification diagnoses them.
+        record = null;
+    }
+    if (!isRecord(record) || record.op !== "create") {
+        await appendLineAtomic(historyPath, line);
+        return;
+    }
+    await fs.mkdir(path.dirname(historyPath), { recursive: true });
+    try {
+        await fs.writeFile(historyPath, `${line}\n`, { encoding: "utf8", flag: "wx" });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        throw new PmCliError("This item identity is reserved by an existing history stream.", EXIT_CODE.CONFLICT, {
+            code: "item_identity_reserved",
+            required: "Choose a new item ID or restore the original item from its history.",
+            nextSteps: ["Run pm history <id> --full, then pm restore <id> <version> to recover the original item."],
+        });
+    }
+}
 /** Implements append history entry for the public runtime surface of this module. */
 export async function appendHistoryEntry(historyPath, entry) {
     const override = await runActiveServiceOverride("history_append", {
         history_path: historyPath,
         entry,
     });
-    if (override.handled) {
-        if (override.result === false) {
-            return;
-        }
-        if (typeof override.result === "string") {
-            await appendLineAtomic(historyPath, serializeHistoryLine(override.result, entry));
-            await invalidateHistoryDriftCacheForPath(historyPath);
-            await removeHistoryEventIndexForHistoryPath(historyPath);
-            return;
-        }
-        if (typeof override.result === "object" && override.result !== null) {
-            const record = override.result;
-            if (record.skip === true) {
-                return;
-            }
-            const nextHistoryPath = typeof record.history_path === "string"
-                ? record.history_path
-                : historyPath;
-            if (typeof record.line === "string") {
-                await appendLineAtomic(nextHistoryPath, serializeHistoryLine(record.line, entry));
-                await invalidateHistoryDriftCacheForPath(nextHistoryPath);
-                await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
-                return;
-            }
-            await appendLineAtomic(nextHistoryPath, serializeHistoryLine(record.entry ?? entry, entry));
-            await invalidateHistoryDriftCacheForPath(nextHistoryPath);
-            await removeHistoryEventIndexForHistoryPath(nextHistoryPath);
-            return;
-        }
+    if (override.handled &&
+        (await applyHistoryAppendOverride(historyPath, entry, override.result))) {
+        return;
     }
     const timestampedEntry = entry.ts.trim().length > 0
         ? entry
         : { ...entry, ts: fallbackHistoryTimestamp(entry) };
-    const normalizedEntry = {
+    const normalizedEntry = sealHistoryRecord({
         ...timestampedEntry,
         event_class: classifyHistoryEvent(timestampedEntry),
-    };
+    });
     await appendHistoryEntryWithEventIndex(historyPath, normalizedEntry, async () => {
-        await appendLineAtomic(historyPath, serializeHistoryLine(normalizedEntry, normalizedEntry));
+        await appendHistoryLineWithIdentityReservation(historyPath, serializeHistoryLine(normalizedEntry, normalizedEntry));
     });
     await invalidateHistoryDriftCacheForPath(historyPath);
 }
@@ -363,4 +615,4 @@ export const _testOnly = {
     isDefinedPointerPath,
 };
 //# sourceMappingURL=history.js.map
-//# debugId=1f78448d-a042-588a-84ce-369bd9ce8726
+//# debugId=a5449fec-c5b4-5cf4-9a7f-b7c5dc7161c2