#605 SDK crash-recoverable workspace transactions and atomic VCS merges

Summary

• add the public commitWorkspaceTransaction SDK primitive with durable replay journals, configurable writer locking, ordered idempotent steps, semantic transition telemetry, and reverse append-only compensation
• expose the coordinator through extension command SDK contexts and migrate pm-vcs changeset merges to atomic item-plus-relationship commits
• document the transaction/recovery contract, close the VCS primitive waiver, and add exhaustive crash, conflict, compensation, and packed-consumer acceptance coverage
• reconcile GitHub reports #595-#597 into canonical tracker lineage without expanding this implementation scope

pm items

• pm-4e12 — delivered and closed
• pm-ju83 — relationship recovery tranche; broader feature remains open
• pm-8ngt — VCS acceptance tranche; broader story remains open
• pm-ds3b — transaction documentation tranche; broader task remains open
• pm-ukml and pm-d9g9 — GH-596/GH-597 intake, open and unclaimed

Verification

• 311 test files / 5,914 tests; exact 100% statements, branches, functions, and lines
• TypeScript, ESLint, jscpd zero clones, CodeFactor/static quality, 100% docstrings, package-boundary, token-budget, dependency audit, and secret scan gates
• packed npm consumer imported and replayed the SDK transaction, installed vcs, ran ref/create/propose/merge/log, and passed deep isolated package doctor
• 13-package packed smoke and 88-command dogfood suite
• pre-push Greptile: first round five findings fixed; corrected and exact-head reviews both 5/5 with no comments
• pm-changelog 2026.7.18 generated and check-clean

---

Summary by cubic

Adds a public commitWorkspaceTransaction SDK primitive for crash‑recoverable, atomic item+relationship commits, and migrates @unbrained/pm-vcs merges to use it. Latest changes persist compensation provenance, enforce exact step identity, and harden runtime boundaries with strict JSON fidelity, input snapshots, and locked rollback for safe recovery.

• New Features

  • commitWorkspaceTransaction(...): durable journal with writer lock, ordered idempotent steps, reverse append‑only compensation.
  • Exposed via extension command SDK; docs cover the transaction and recovery contract.
  • @unbrained/pm-vcs merge now commits items and relationships atomically via the new coordinator; closes the GAP waiver.

• Bug Fixes

  • Recovery hardening: validate journal lifecycle, preserve adversarial result keys, rebuild completion from live inspections.
  • Transaction‑owned merge compensation: persist pre‑mutation provenance; restore original refs; preserve concurrent winners; validate item/relationship state; make discovery updates atomic; accept partial projections; gate to the active merge; add crash‑boundary coverage.
  • Inspection‑conflict recovery: persist compensating state before inspection; conflicted journals reach compensated; next attempt commits without manual cleanup.
  • Enforce exact step identity: reject padded step IDs before journal creation; align the SDK approval example with its open‑state compensation precondition.
  • Runtime boundaries and serialization: JSON‑clone inputs; reject lossy/non‑finite values; snapshot transaction inputs; capture VCS rollback state under the transaction lock; preserve forward and compensation failures; skip irrelevant compensation writes; add regressions for BigInt, mutable plans, invalid roots, dual failures, and post‑preflight VCS races.