PR #1175 - unbraind/pm-cli

Summary

expose exact, bounded, privacy-safe invalid receipt evidence through the public SDK, pm merge report, health, and validation
classify each rejected candidate by source and stable reason while preserving complete counts and truncation receipts
detect append-only history references whose pending or reconciled evidence is missing, with item/line coordinates and non-destructive recovery guidance
make missing-store classification portable across Windows and POSIX by inspecting the nearest existing ancestor instead of trusting ENOENT versus ENOTDIR spellings
govern the new diagnostic in generated SDK, error-catalog, agent-capability, refusal-census, and full contract snapshots

Project context

Closes #1173.
Closes #1174.

Verification

594 test files and 8,244 tests passed
exact coverage: 60,700/60,700 statements, 45,900/45,900 branches, 12,629/12,629 functions, 58,439/58,439 lines
full pnpm quality:static passed, including zero duplication, 100% source/export/member docstrings, contract snapshots, SDK/package boundaries, refusal closure, token budgets, tracker graph quality, and record integrity
temporary Git repository acceptance proved two distinct invalid candidates, privacy-safe record locators, one missing history reference, and executable non-destructive remediation
focused linked PM suites passed 39/39 and 10/10

Summary by cubic

Makes merge-receipt evidence diagnostics actionable and portable: health, merge report, and validation now expose bounded, privacy-safe details for each rejected receipt instead of only an opaque count.

Exports the new invalid-evidence contract from the public merge SDK.
Each rejected candidate reports a stable reason, its source (clone_local, durable, or copy-consistency), a safe receipt_id, or a candidate_name_hash for unsafe names; the detail list caps at 100 rows while invalid_evidence_count stays exact.
A single documented predicate decides whether a receipt id is safe to expose, shared by merge-evidence and missing-history diagnostics.
Detects append-only history references whose evidence is missing, with item/line coordinates and non-destructive recovery guidance.
Fixes Windows vs POSIX classification by inspecting the requested store coordinate and nearest existing ancestor instead of relying on ENOENT vs ENOTDIR.
The merge_receipt_evidence_invalid remediation now recommends pm merge report --include-reconciled --json instead of the full health check.
Adds the merge_receipt_history_reference_missing error code and regenerates SDK, error-catalog, refusal-census, and contract snapshots.
Closes GH-1173 and GH-1174.

Summary by Sourcery

Make merge receipt diagnostics actionable, privacy-safe, bounded, and portable across SDK and CLI surfaces.

New Features:

Expose bounded, privacy-safe diagnostics for rejected merge receipt evidence through the SDK, merge reports, health checks, and validation.
Detect missing merge receipt references in append-only history and provide record-level coordinates and recovery guidance.

Bug Fixes:

Classify missing or inaccessible receipt stores portably across Windows and POSIX by inspecting existing ancestors rather than relying on platform-specific error codes.

Enhancements:

Add stable evidence-source and rejection-reason classifications while preserving exact invalid-evidence counts and truncation status.
Protect diagnostic output by exposing safe receipt IDs or hashed candidate names without returning malformed contents.

Documentation:

Document the new merge receipt evidence and history-reference diagnostics, privacy guarantees, bounded detail, and non-destructive recovery behavior.

Tests:

Add integration and unit coverage for invalid evidence classification, privacy-safe truncation, missing history references, copy mismatches, unreadable candidates, and cross-platform traversal behavior.

Chores:

Regenerate SDK, error-catalog, refusal-census, capability, and contract snapshots for the new diagnostic contract.