@unbrained/pm-cli 2026.9.4 → 2026.9.6

package/dist/sdk/merge/receipts.d.ts

@@ -1,8 +1,8 @@
 import type { Stats } from "node:fs";
 import { type ItemMergeConflictDecision, type ItemScalarConflictResolution, type MergePreferredSide } from "./three-way.js";
-/** Return whether a receipt id is safe to expose in cleartext diagnostics. */
-export declare function isSafeReceiptId(value: string): boolean;
-declare const DURABLE_VALUE_POLICY: "bounded_non_sensitive_scalars_v1";
+import type { MergeReceiptOperation } from "./receipt-operation.js";
+import { DURABLE_VALUE_POLICY } from "./receipt-schema.js";
+export { isSafeReceiptId } from "./receipt-schema.js";
 /** One clone-local merge receipt with recoverable branch values. */
 export interface MergeDecisionReceipt {
     /** Receipt schema version. */
@@ -29,7 +29,11 @@ export interface MergeDecisionReceipt {
     merged_field_hashes?: Record<string, string>;
     /** Full recoverable scalar decisions, retained only in the clone. */
     decisions: ItemMergeConflictDecision[];
-    /** Whether a merge reconciliation history event consumed this receipt. */
+    /** Immutable original Git coordinates captured while the driver runs during a rebase. */
+    operation?: MergeReceiptOperation;
+    /** Explicit audited disposition when the original Git state was restored instead of merging. */
+    settlement?: "original_git_state_restored";
+    /** Whether a reconciliation history event settled this receipt. */
     state: "pending" | "reconciled";
     /** Receipt creation timestamp. */
     created_at: string;
@@ -121,7 +125,9 @@ export interface MergeReceiptInvalidEvidence {
     /** Stable failure class suitable for remediation routing and graph analytics. */
     reason: "directory_unreadable" | "candidate_not_bounded_regular_file" | "candidate_unreadable" | "candidate_invalid_json" | "schema_or_identity_invalid" | "schema_invalid" | "identity_invalid" | "copy_provenance_mismatch";
     /** Exact validation boundary when schema or identity evidence is rejected. */
-    validation_error?: "required_fields" | "receipt_id" | "item_id" | "item_path" | "filename" | "collections" | "enums" | "timestamps" | "durable_decisions";
+    validation_error?: "required_fields" | "receipt_id" | "item_id" | "item_path" | "filename" | "collections" | "enums" | "timestamps" | "durable_decisions" | "operation";
+    /** Exact schema coordinate, excluding rejected values and user-controlled field names. */
+    validation_path?: string;
     /** Receipt identity when the bounded filename itself is a valid receipt id. */
     receipt_id?: string;
     /** SHA-256 locator for an unsafe or malformed candidate filename. */
@@ -133,11 +139,13 @@ declare function prepareReceiptSettlement(params: {
     receiptId: string;
     evidenceSource: "clone_local" | "durable";
     reconciledAt: string;
+    settlement?: "original_git_state_restored";
     readReceipt?: (receiptPath: string) => Promise<string | null>;
 }): Promise<{
     path: string;
     content: string;
-    fingerprint: string;
+    fingerprints: string[];
+    modern: boolean;
 } | null>;
 /** Convert a raw receipt into privacy-safe history context. */
 export declare function summarizeMergeReceipt(receipt: MergeDecisionReceipt): MergeDecisionReceiptSummary;
@@ -151,6 +159,7 @@ export declare function writeMergeReceipt(params: {
     unionFields: string[];
     mergedFieldHashes?: Record<string, string>;
     decisions: ItemMergeConflictDecision[];
+    operation?: MergeReceiptOperation;
 }): Promise<MergeDecisionReceipt | null>;
 /** Distinguish a missing optional receipt store from an unreadable one. */
 declare function receiptDirectoryFailureMeansAbsent(directory: string, error: unknown, inspectAncestor?: (ancestor: string) => Promise<Pick<Stats, "isDirectory">>): Promise<boolean>;
@@ -179,6 +188,7 @@ export declare function partitionMergeReceipts(receipts: MergeDecisionReceipt[])
 /** Mark a receipt as represented by a committed merge history event. */
 export declare function markMergeReceiptReconciled(cwd: string, receipt: MergeDecisionReceipt, options?: {
     requireExisting?: boolean;
+    settlement?: "original_git_state_restored";
 }): Promise<void>;
 /** Report pending or historical clone-local merge decisions. */
 export declare function runMergeReceiptReport(options: {
@@ -199,4 +209,3 @@ export declare const _testOnlyMergeReceipts: {
     prepareReceiptSettlement: typeof prepareReceiptSettlement;
     receiptDirectoryFailureMeansAbsent: typeof receiptDirectoryFailureMeansAbsent;
 };
-export {};

package/dist/sdk/merge/receipts.js

@@ -7,7 +7,7 @@
  * value for the coordinator that performed the merge.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dfdd6f10-e11f-59e8-a16f-507dc40d5b31")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e7fe0fee-9519-593d-ac72-b3c7fb63563e")}catch(e){}}();
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { readdir, stat } from "node:fs/promises";
@@ -15,74 +15,14 @@ import path from "node:path";
 import { promisify } from "node:util";
 import { ensureDir, isFileAbsentError, isFileMissingError, pathExists, writeFileAtomic, } from "../../core/fs/fs-utils.js";
 import { sha256Hex, stableStringify } from "../../core/shared/serialization.js";
-import { isRfc3339DateTime, nowIso } from "../../core/shared/time.js";
-import { hashItemScalarDecisionValue, isItemScalarMissingValue, } from "./three-way.js";
+import { nowIso } from "../../core/shared/time.js";
+import { encodeItemScalarDecisionValue, hashItemScalarDecisionValue, isItemScalarMissingValue, } from "./three-way.js";
 import { readBoundedRegularFile } from "./receipt-file-boundary.js";
+import { DURABLE_VALUE_POLICY, durableValueEvidence, isSafeReceiptId, isMergeDecisionReceipt, isPrehashedValue, normalizeLegacyReceipt, receiptCollectionValidationPath, receiptValidationError } from "./receipt-schema.js";
+export { isSafeReceiptId } from "./receipt-schema.js";
 const execFileAsync = promisify(execFile);
-const RECEIPT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
-const RECEIPT_ITEM_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u;
-const RECEIPT_FIELD_MAX = 2_048;
 const RECEIPT_FILE_MAX_BYTES = 16 * 1024 * 1024;
-const RECEIPT_VALUE_MAX_DEPTH = 64;
-const RECEIPT_VALUE_MAX_NODES = 100_000;
 const RECEIPT_INVALID_EVIDENCE_DETAIL_LIMIT = 100;
-const RECEIPT_KEYS = new Set([
-    "version",
-    "id",
-    "item_path",
-    "item_id",
-    "requested_preference",
-    "requested_preference_applied",
-    "preferred",
-    "conflict_resolution",
-    "fields_from_theirs",
-    "union_fields",
-    "merged_field_hashes",
-    "decisions",
-    "state",
-    "created_at",
-    "reconciled_at",
-    "value_availability",
-    "value_policy",
-    "evidence_source",
-]);
-/** Return whether a receipt id is safe to expose in cleartext diagnostics. */
-export function isSafeReceiptId(value) {
-    return RECEIPT_ID_PATTERN.test(value);
-}
-const RECEIPT_DECISION_KEYS = new Set([
-    "field",
-    "base",
-    "ours",
-    "theirs",
-    "retained",
-    "discarded",
-    "retained_side",
-    "resolution_basis",
-]);
-const DURABLE_VALUE_POLICY = "bounded_non_sensitive_scalars_v1";
-const REVIEWABLE_BUILTIN_STATUSES = new Set([
-    "open",
-    "in_progress",
-    "blocked",
-    "closed",
-    "canceled",
-]);
-const REVIEWABLE_ORDINAL_FIELDS = new Set(["risk", "confidence", "severity"]);
-const REVIEWABLE_ORDINAL_VALUES = new Set([
-    "low",
-    "medium",
-    "high",
-    "critical",
-]);
-const REVIEWABLE_DURABLE_VALUES_BY_FIELD = new Map([
-    ["priority", new Set([0, 1, 2, 3, 4].map(stableStringify))],
-    ["status", new Set([...REVIEWABLE_BUILTIN_STATUSES].map(stableStringify))],
-    ...[...REVIEWABLE_ORDINAL_FIELDS].map((field) => [
-        field,
-        new Set([...REVIEWABLE_ORDINAL_VALUES].map(stableStringify)),
-    ]),
-]);
 /** Resolve the clone-local receipt store without crossing a Git worktree boundary. */
 async function resolveReceiptDirectory(cwd) {
     try {
@@ -119,246 +59,13 @@ function durableReceiptDirectory(pmRoot) {
 function receiptFileName(id) {
     return `${id}.json`;
 }
-/** Narrow untrusted JSON to a non-array object before schema inspection. */
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Refuse receipt extensions outside the versioned schema key set. */
-function hasOnlyKeys(value, allowed) {
-    return Object.keys(value).every((key) => allowed.has(key));
-}
-/** Validate bounded dense string collections used in receipt coordinates. */
-function isStringArray(value) {
-    return (Array.isArray(value) &&
-        value.length <= RECEIPT_FIELD_MAX &&
-        value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= 256));
-}
-/** Bound JSON depth and node count before retaining untrusted decision values. */
-function hasBoundedJsonStructure(value) {
-    const pending = [
-        { value, depth: 0 },
-    ];
-    let nodes = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        nodes += 1;
-        if (nodes > RECEIPT_VALUE_MAX_NODES ||
-            current.depth > RECEIPT_VALUE_MAX_DEPTH) {
-            return false;
-        }
-        if (Array.isArray(current.value)) {
-            for (const entry of current.value) {
-                pending.push({ value: entry, depth: current.depth + 1 });
-            }
-        }
-        else if (isRecord(current.value)) {
-            for (const entry of Object.values(current.value)) {
-                pending.push({ value: entry, depth: current.depth + 1 });
-            }
-        }
-    }
-    return true;
-}
-/** Validate one clone-local scalar decision and its optional resolution evidence. */
-function isMergeDecision(value) {
-    if (!isRecord(value))
-        return false;
-    const retainedSides = [undefined, "ours", "theirs"];
-    const resolutionBases = [
-        undefined,
-        "requested_preference",
-        "document_updated_at",
-        "stable_value_tiebreak",
-    ];
-    return [
-        hasOnlyKeys(value, RECEIPT_DECISION_KEYS),
-        typeof value.field === "string",
-        typeof value.field === "string" && value.field.length > 0,
-        typeof value.field === "string" && value.field.length <= 256,
-        Object.hasOwn(value, "base"),
-        Object.hasOwn(value, "ours"),
-        Object.hasOwn(value, "theirs"),
-        Object.hasOwn(value, "retained"),
-        Object.hasOwn(value, "discarded"),
-        hasBoundedJsonStructure(value.base),
-        hasBoundedJsonStructure(value.ours),
-        hasBoundedJsonStructure(value.theirs),
-        hasBoundedJsonStructure(value.retained),
-        hasBoundedJsonStructure(value.discarded),
-        retainedSides.includes(value.retained_side),
-        resolutionBases.includes(value.resolution_basis),
-    ].every(Boolean);
-}
-/** Validate the complete field-to-SHA-256 proof map used during repair. */
-function isMergedFieldHashes(value) {
-    if (!isRecord(value))
-        return false;
-    const entries = Object.entries(value);
-    return (entries.length <= RECEIPT_FIELD_MAX &&
-        entries.every(([field, hash]) => field.length > 0 &&
-            field.length <= 256 &&
-            typeof hash === "string" &&
-            /^[a-f0-9]{64}$/u.test(hash)));
-}
-/** Require a normalized tracker item path whose basename matches the receipt item. */
-function isSafeReceiptItemPath(value, itemId) {
-    if (typeof value !== "string" ||
-        value.length === 0 ||
-        value.length > 4_096 ||
-        value.includes("\0") ||
-        value.includes("\\") ||
-        path.posix.isAbsolute(value)) {
-        return false;
-    }
-    const normalized = path.posix.normalize(value);
-    return (normalized !== ".." &&
-        !normalized.startsWith("../") &&
-        path.posix.basename(normalized, path.posix.extname(normalized)) === itemId);
-}
-/** Validate receipt arrays and optional merged-field proof coverage. */
-function hasValidReceiptCollections(value) {
-    return !isStringArray(value.fields_from_theirs) ||
-        !isStringArray(value.union_fields) ||
-        !Array.isArray(value.decisions) ||
-        value.decisions.length > RECEIPT_FIELD_MAX ||
-        !value.decisions.every(isMergeDecision)
-        ? false
-        : value.merged_field_hashes === undefined ||
-            isMergedFieldHashes(value.merged_field_hashes);
-}
-/** Validate every closed-domain lifecycle and merge-policy field. */
-function hasValidReceiptEnums(value) {
-    const preferences = [undefined, "ours", "theirs"];
-    const resolutions = [
-        undefined,
-        "preferred_side",
-        "stable_value_order",
-        "latest_document_update",
-    ];
-    const availabilities = [
-        undefined,
-        "clone_local",
-        "hash_only",
-        "bounded_inline",
-        "mixed",
-    ];
-    const sources = [undefined, "clone_local", "durable"];
-    return (preferences.includes(value.requested_preference) &&
-        preferences.includes(value.preferred) &&
-        (value.requested_preference_applied === undefined ||
-            typeof value.requested_preference_applied === "boolean") &&
-        resolutions.includes(value.conflict_resolution) &&
-        (value.state === "pending" || value.state === "reconciled") &&
-        availabilities.includes(value.value_availability) &&
-        (value.value_policy === undefined ||
-            value.value_policy === DURABLE_VALUE_POLICY) &&
-        sources.includes(value.evidence_source));
-}
-/** Validate creation and optional settlement timestamps as RFC 3339 values. */
-function hasValidReceiptTimestamps(value) {
-    return (typeof value.created_at === "string" &&
-        isRfc3339DateTime(value.created_at) &&
-        (value.reconciled_at === undefined ||
-            (typeof value.reconciled_at === "string" &&
-                isRfc3339DateTime(value.reconciled_at))));
-}
-/** Validate one hash-only or policy-bounded durable decision value. */
-function hasDurableDecisionValue(field, value) {
-    if (!isRecord(value) || isPrehashedValue(value) === undefined)
-        return false;
-    const keys = Object.keys(value);
-    if (!keys.every((key) => key === "pm_value_hash" || key === "pm_value")) {
-        return false;
-    }
-    if (!Object.hasOwn(value, "pm_value"))
-        return keys.length === 1;
-    const preview = value.pm_value;
-    const allowed = preview === null ||
-        REVIEWABLE_DURABLE_VALUES_BY_FIELD.get(field)?.has(stableStringify(preview)) === true;
-    return (allowed && hashItemScalarDecisionValue(preview) === value.pm_value_hash);
-}
-/** Validate durable decision redaction and the declared availability summary. */
-function hasValidDurableDecisions(receipt) {
-    if (!receipt.decisions.every((decision) => decision.base === null &&
-        decision.ours === null &&
-        decision.theirs === null &&
-        hasDurableDecisionValue(decision.field, decision.retained) &&
-        hasDurableDecisionValue(decision.field, decision.discarded))) {
-        return false;
-    }
-    const inlineValueCount = receipt.decisions.reduce((count, decision) => count +
-        (isRecord(decision.retained) &&
-            Object.hasOwn(decision.retained, "pm_value")
-            ? 1
-            : 0) +
-        (isRecord(decision.discarded) &&
-            Object.hasOwn(decision.discarded, "pm_value")
-            ? 1
-            : 0), 0);
-    const expectedAvailability = inlineValueCount === 0
-        ? "hash_only"
-        : inlineValueCount === receipt.decisions.length * 2
-            ? "bounded_inline"
-            : "mixed";
-    return (receipt.value_availability === expectedAvailability &&
-        (inlineValueCount === 0 || receipt.value_policy === DURABLE_VALUE_POLICY));
-}
-/** Return the narrowest validation class for untrusted receipt evidence. */
-function receiptValidationError(value, evidenceSource) {
-    if (!isRecord(value))
-        return "required_fields";
-    for (const key of [
-        "version",
-        "id",
-        "item_path",
-        "item_id",
-        "fields_from_theirs",
-        "union_fields",
-        "decisions",
-        "state",
-        "created_at",
-    ]) {
-        if (!Object.hasOwn(value, key))
-            return "required_fields";
-    }
-    if (value.version !== 1 || !hasOnlyKeys(value, RECEIPT_KEYS)) {
-        return "required_fields";
-    }
-    if (typeof value.id !== "string" || !isSafeReceiptId(value.id)) {
-        return "receipt_id";
-    }
-    if (typeof value.item_id !== "string" ||
-        !RECEIPT_ITEM_ID_PATTERN.test(value.item_id)) {
-        return "item_id";
-    }
-    if (!isSafeReceiptItemPath(value.item_path, value.item_id)) {
-        return "item_path";
-    }
-    if (!hasValidReceiptCollections(value))
-        return "collections";
-    if (!hasValidReceiptEnums(value))
-        return "enums";
-    if (!hasValidReceiptTimestamps(value))
-        return "timestamps";
-    if (evidenceSource === "durable" &&
-        !hasValidDurableDecisions(value)) {
-        return "durable_decisions";
-    }
-    return null;
-}
-/** Validate a complete receipt against its clone-local or durable evidence policy. */
-function isMergeDecisionReceipt(value, evidenceSource) {
-    return receiptValidationError(value, evidenceSource) === null;
-}
-/** Read one receipt through the no-follow bounded regular-file guard. */
-async function readBoundedRegularReceiptFile(receiptPath) {
-    return readBoundedRegularFile(receiptPath, RECEIPT_FILE_MAX_BYTES);
-}
 /** Revalidate one receipt and stage its atomic reconciled-state replacement. */
 async function prepareReceiptSettlement(params) {
     let raw;
     try {
-        raw = await (params.readReceipt ?? readBoundedRegularReceiptFile)(params.receiptPath);
+        raw = params.readReceipt
+            ? await params.readReceipt(params.receiptPath)
+            : await readBoundedRegularFile(params.receiptPath, RECEIPT_FILE_MAX_BYTES);
     }
     catch (error) {
         if (isFileAbsentError(error))
@@ -370,29 +77,32 @@ async function prepareReceiptSettlement(params) {
     }
     let parsed;
     try {
-        parsed = JSON.parse(raw);
+        parsed = normalizeLegacyReceipt(JSON.parse(raw));
     }
     catch {
         throw new Error(`Receipt ${params.receiptId} settlement source is not valid JSON.`);
     }
     if (!isMergeDecisionReceipt(parsed, params.evidenceSource) ||
         parsed.id !== params.receiptId ||
+        (params.settlement !== undefined && parsed.operation === undefined) ||
         path.basename(params.receiptPath) !== receiptFileName(parsed.id)) {
         throw new Error(`Receipt ${params.receiptId} settlement source failed schema or identity validation.`);
     }
     const { evidence_source: _evidenceSource, ...persistedReceipt } = parsed;
     return {
         path: params.receiptPath,
-        fingerprint: receiptProvenanceFingerprint(parsed),
+        fingerprints: receiptProvenanceFingerprints(parsed),
+        modern: parsed.value_policy !== undefined,
         content: `${JSON.stringify({
             ...persistedReceipt,
             state: "reconciled",
             reconciled_at: params.reconciledAt,
+            ...(params.settlement ? { settlement: params.settlement } : {}),
         }, null, 2)}\n`,
     };
 }
 /** Fingerprint immutable receipt provenance while excluding lifecycle state. */
-function receiptProvenanceFingerprint(receipt) {
+function receiptProvenanceFingerprint(receipt, legacy = false) {
     return sha256Hex(stableStringify({
         id: receipt.id,
         item_id: receipt.item_id,
@@ -403,15 +113,31 @@ function receiptProvenanceFingerprint(receipt) {
         fields_from_theirs: receipt.fields_from_theirs,
         union_fields: receipt.union_fields,
         merged_field_hashes: receipt.merged_field_hashes ?? null,
-        decisions: summarizeMergeReceipt(receipt).decisions,
+        operation: receipt.operation ?? null,
+        decisions: legacy
+            ? receipt.decisions.map((decision) => ({
+                field: decision.field,
+                retained_hash: sha256Hex(stableStringify(encodeItemScalarDecisionValue(decision.retained))),
+                discarded_hash: sha256Hex(stableStringify(encodeItemScalarDecisionValue(decision.discarded))),
+            }))
+            : summarizeMergeReceipt(receipt).decisions,
     }));
 }
+/** Compare historical plain-scalar and current presence-domain hashes without changing stored evidence. */
+function receiptProvenanceFingerprints(receipt) {
+    const fingerprints = [receiptProvenanceFingerprint(receipt)];
+    if (receipt.value_policy === undefined &&
+        (receipt.value_availability === undefined || receipt.value_availability === "clone_local")) {
+        fingerprints.push(receiptProvenanceFingerprint(receipt, true));
+    }
+    return fingerprints;
+}
 /** Merge clone-local and durable lifecycle state without losing pending work. */
 function mergeReceiptCopyLifecycle(local, durable) {
-    if (local.state === "reconciled" && durable.state === "reconciled") {
+    if (local.state === "reconciled" && durable.state === "reconciled" && local.settlement === durable.settlement) {
         return local;
     }
-    const { reconciled_at: _reconciledAt, ...pendingLocal } = local;
+    const { reconciled_at: _reconciledAt, settlement: _settlement, ...pendingLocal } = local;
     return { ...pendingLocal, state: "pending" };
 }
 /** Convert a raw receipt into privacy-safe history context. */
@@ -440,30 +166,6 @@ export function summarizeMergeReceipt(receipt) {
         })),
     };
 }
-/** Extract a structurally valid precomputed SHA-256 decision hash. */
-function isPrehashedValue(value) {
-    if (typeof value !== "object" ||
-        value === null ||
-        Array.isArray(value) ||
-        !("pm_value_hash" in value)) {
-        return undefined;
-    }
-    const hash = value.pm_value_hash;
-    return typeof hash === "string" && /^[a-f0-9]{64}$/u.test(hash)
-        ? hash
-        : undefined;
-}
-/** Convert a raw scalar into hashed evidence with an allowlisted preview. */
-function durableValueEvidence(field, value) {
-    const missing = isItemScalarMissingValue(value);
-    const pmValueHash = hashItemScalarDecisionValue(missing ? undefined : value);
-    const reviewable = !missing &&
-        (value === null ||
-            REVIEWABLE_DURABLE_VALUES_BY_FIELD.get(field)?.has(stableStringify(value)) === true);
-    return reviewable
-        ? { pm_value_hash: pmValueHash, pm_value: value }
-        : { pm_value_hash: pmValueHash };
-}
 /** Persist one item-driver outcome in the clone-local Git directory. */
 export async function writeMergeReceipt(params) {
     const directory = await resolveReceiptDirectory(params.cwd);
@@ -486,7 +188,15 @@ export async function writeMergeReceipt(params) {
         ...(params.mergedFieldHashes
             ? { merged_field_hashes: { ...params.mergedFieldHashes } }
             : {}),
-        decisions: structuredClone(params.decisions),
+        decisions: structuredClone(params.decisions).map((decision) => ({
+            ...decision,
+            base: encodeItemScalarDecisionValue(decision.base),
+            ours: encodeItemScalarDecisionValue(decision.ours),
+            theirs: encodeItemScalarDecisionValue(decision.theirs),
+            retained: encodeItemScalarDecisionValue(decision.retained),
+            discarded: encodeItemScalarDecisionValue(decision.discarded),
+        })),
+        ...(params.operation ? { operation: params.operation } : {}),
         state: "pending",
         created_at: nowIso(),
         value_availability: "clone_local",
@@ -552,6 +262,7 @@ async function readReceiptsFromDirectory(directory, evidenceSource) {
         invalidEvidence.push({
             evidence_source: evidenceSource,
             reason: candidate.reason,
+            ...(candidate.validation_path ? { validation_path: candidate.validation_path } : {}),
             ...(candidate.validation_error === undefined
                 ? {}
                 : { validation_error: candidate.validation_error }),
@@ -601,7 +312,7 @@ async function receiptDirectoryFailureMeansAbsent(directory, error, inspectAnces
 async function inspectReceiptCandidate(directory, name, evidenceSource) {
     let raw;
     try {
-        raw = await readBoundedRegularReceiptFile(path.join(directory, name));
+        raw = await readBoundedRegularFile(path.join(directory, name), RECEIPT_FILE_MAX_BYTES);
     }
     catch {
         return { reason: "candidate_unreadable" };
@@ -610,7 +321,7 @@ async function inspectReceiptCandidate(directory, name, evidenceSource) {
         return { reason: "candidate_not_bounded_regular_file" };
     let parsed;
     try {
-        parsed = JSON.parse(raw);
+        parsed = normalizeLegacyReceipt(JSON.parse(raw));
     }
     catch {
         return { reason: "candidate_invalid_json" };
@@ -623,6 +334,7 @@ async function inspectReceiptCandidate(directory, name, evidenceSource) {
                 ? "identity_invalid"
                 : "schema_invalid",
             validation_error: validationError,
+            ...(validationError === "collections" ? { validation_path: receiptCollectionValidationPath(parsed) } : {}),
         };
     }
     const receipt = parsed;
@@ -660,8 +372,8 @@ export async function inspectMergeReceiptEvidence(cwd, options = {}) {
     for (const receipt of local.receipts) {
         const durableCopy = receipts.get(receipt.id);
         if (durableCopy !== undefined &&
-            receiptProvenanceFingerprint(durableCopy) !==
-                receiptProvenanceFingerprint(receipt)) {
+            !(durableCopy.value_policy === undefined ? receiptProvenanceFingerprints(receipt)
+                : [receiptProvenanceFingerprint(receipt)]).includes(receiptProvenanceFingerprint(durableCopy))) {
             receipts.delete(receipt.id);
             divergentCopyCount += 1;
             if (local.invalid_evidence.length +
@@ -742,6 +454,7 @@ export async function markMergeReceiptReconciled(cwd, receipt, options = {}) {
             receiptId: receipt.id,
             evidenceSource: "clone_local",
             reconciledAt,
+            settlement: options.settlement,
         }),
         ...(durablePath === null
             ? []
@@ -751,6 +464,7 @@ export async function markMergeReceiptReconciled(cwd, receipt, options = {}) {
                     receiptId: receipt.id,
                     evidenceSource: "durable",
                     reconciledAt,
+                    settlement: options.settlement,
                 }),
             ]),
     ]);
@@ -761,9 +475,9 @@ export async function markMergeReceiptReconciled(cwd, receipt, options = {}) {
         }
         return;
     }
-    const expectedFingerprint = receiptProvenanceFingerprint(receipt);
-    if (new Set([expectedFingerprint, ...writes.map((write) => write.fingerprint)])
-        .size !== 1) {
+    const expectedFingerprints = writes.some((write) => write.modern)
+        ? [receiptProvenanceFingerprint(receipt)] : receiptProvenanceFingerprints(receipt);
+    if (!expectedFingerprints.some((fingerprint) => writes.every((write) => write.fingerprints.includes(fingerprint)))) {
         throw new Error(`Receipt ${receipt.id} settlement copies disagree on immutable merge provenance.`);
     }
     for (const write of writes) {
@@ -809,4 +523,4 @@ export const _testOnlyMergeReceipts = {
     receiptDirectoryFailureMeansAbsent,
 };
 //# sourceMappingURL=receipts.js.map
-//# debugId=dfdd6f10-e11f-59e8-a16f-507dc40d5b31
+//# debugId=e7fe0fee-9519-593d-ac72-b3c7fb63563e

package/dist/sdk/merge/reconcile.d.ts

@@ -29,6 +29,8 @@ export interface MergeReconcileResult {
     receipts: {
         pending_before: number;
         reconciled: number;
+        /** Receipts proven to restore their original Git state; these do not represent applied merges. */
+        abandoned: number;
         summaries: MergeDecisionReceiptSummary[];
         /** Missing durable references discovered before this reconciliation. */
         missing_history_references_before: number;

package/dist/sdk/merge/reconcile.js

@@ -5,7 +5,8 @@
  * item-history stream, then verifies history and storage integrity in one call.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3a3372be-37e4-578a-8be9-9ad7bc585dbd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2696d75a-02f4-5c16-b77e-7798e7d020f9")}catch(e){}}();
+import { settleAbandonedMergeReceipts } from "./abandoned-receipts.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { EXIT_CODE } from "../../core/shared/constants.js";
@@ -229,8 +230,13 @@ export async function runMergeReconcile(options, global) {
         global,
     });
     const pendingReceipts = receiptEvidence.receipts;
+    const abandonedReceiptIds = await settleAbandonedMergeReceipts({
+        cwd: gitWorkspaceRoot, receipts: pendingReceipts, dryRun,
+        author: options.author, message: options.message, global,
+    });
+    const abandonedIds = new Set(abandonedReceiptIds);
     const receiptsByItem = new Map();
-    for (const receipt of pendingReceipts) {
+    for (const receipt of pendingReceipts.filter((entry) => !abandonedIds.has(entry.id))) {
         const receipts = receiptsByItem.get(receipt.item_id) ?? [];
         receipts.push(receipt);
         receiptsByItem.set(receipt.item_id, receipts);
@@ -291,7 +297,7 @@ export async function runMergeReconcile(options, global) {
     const mergeChecksGreen = validation.checks.every((check) => check.status === "ok");
     const receiptSettlementComplete = dryRun
         ? pendingReceipts.length === 0
-        : reconciledReceiptCount === pendingReceipts.length;
+        : reconciledReceiptCount + abandonedReceiptIds.length === pendingReceipts.length;
     const ok = [
         repair.totals.failed === 0,
         mergeChecksGreen,
@@ -331,6 +337,7 @@ export async function runMergeReconcile(options, global) {
         receipts: {
             pending_before: pendingReceipts.length,
             reconciled: reconciledReceiptCount,
+            abandoned: abandonedReceiptIds.length,
             summaries: pendingReceipts.map(summarizeMergeReceipt),
             missing_history_references_before: missingBefore.count,
             legacy_disposition_eligible: legacyDispositionCandidates.length,
@@ -343,4 +350,4 @@ export async function runMergeReconcile(options, global) {
     };
 }
 //# sourceMappingURL=reconcile.js.map
-//# debugId=3a3372be-37e4-578a-8be9-9ad7bc585dbd
+//# debugId=2696d75a-02f4-5c16-b77e-7798e7d020f9