fix(sdk): preserve package replacements and physical workspace scopes
Package replacement verification could discard a working installation before activation finished. Replacements now keep the previous package tree and exact managed/settings state until verification succeeds. A failed replacement restores that state; a failed rollback retains a recoverable backup and exposes typed recovery details plus the original failure code and non-enumerable cause. Multi-package receipts preserve the same evidence.
Disabled package compatibility findings are advisory in health and doctor, while enabled incompatibilities still fail admission. Workspace cache exclusions now resolve physical directory ancestry before containment checks, preserve literal Git ignore patterns, and refuse file ancestors without changing ignore bytes on Linux, macOS, or Windows.
Complete nightly validation now uses 14 explicit native partitions within the existing 20-minute limits. The aggregate accepts only a successful complete matrix, merges all four coverage blobs, and enforces exact 100% statements, branches, functions, and lines with zero uncovered counts. Aggregate alerts require successful admission so native failures do not create a duplicate Linux alert. Reliability measurements retain retired families and original failed attempts.
The requested scope also includes the live GitHub/PM, dependency, release and observability census, canonical follow-ups, and reviewed closure evidence. Those tracker updates belong to this grouped delivery.
Tracking and closure evidence:
- pm-c9wz5ef4ulnv: verified replacement preservation.
- pm-5xn8we1wue0m: disabled compatibility diagnostics.
- pm-p8s5k7e6lhda: physical workspace/cache scopes.
- pm-gxq0dt: bounded complete nightly allocation and strict aggregation.
- pm-4vymxc: original rollback provenance and real directory ancestry from review.
Validation:
- Complete native validation on final reviewed head e26fecbc3 succeeds: 11,035 passing tests, three existing skips, 852 files, and exact 100/100/100/100 global coverage. No timeout, assertion, coverage denominator, or retry policy was relaxed.
- Linked SDK acceptance passes 42 replacement/workspace cases plus 17 SDK-surface controls; workflow/reliability/registry acceptance passes 67 cases. Public receipt/context type fixtures and all four TypeScript projects pass.
- Required PR CI is successful on the final head, including all six native packed-consumer legs. The first smoke-job twenty-minute timeout and native Windows thirty-second test failure are retained; one unchanged retry per affected run passes without changing policy.
- Maintained packed consumer acceptance passes all nine npm/npx and Bun/bunx package workflows. Generated contracts and SDK surface checks, defect evidence, context quality, graph composition, record integrity, and secret checks pass.
- All five actionable review findings have fixes and resolved threads. Final-head full review is complete: the flag-policy finding was withdrawn after checking the existing PM contract and fresh controls, and exact-head native acceptance settles the remaining evidence request. Diff-function docstring coverage is 93.33%, above the unchanged 80% threshold. Two generated-file exclusions are checked by the repository generators. Optional provider quota/trial refusals remain unavailable, not approvals.
- The scoped pm-dvwm continuation documents all three previously undocumented touched private helpers. Its existing build, docstring census and negative controls pass; comment-stripped TypeScript syntax is unchanged in all three modules. The broader semantic documentation debt remains open and unclaimed.
- pm-changelog 2026.10.21, the current registry version, generates and checks all five change entries through the configured package-owned commands.
SDK migration: reserved details.previous_state_preserved and details.rollback are now typed optional receipt fields; constructors and test doubles using those keys must match the boolean/discriminated recovery shape. PmCliErrorContext.original_code is additive and optional. The generated emitted-error vocabulary includes ENOTDIR.
Independent open work remains explicit: pm-gh1549 records a reproduced stale mutation lease overwrite, and pm-bj7rq0 retains qualified local startup misses and unrelated Windows timing failures. This delivery does not claim those are fixed or erase historical Release Reliability failures. Today's published 2026.10.22 predates these changes; the next eligible daily release will include them.