Write and independently verify sorted-union resolutions in Go #902

Problem

The resolver at packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/resolve-union.sh:76 writes a proven union and independently reads it back before staging. The second proof at packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/resolve-union.sh:118 catches missing, extra, duplicate or misordered lines. It must not become a comparison against the writer's own cached answer.

Part of #588 and #326.

Acceptance criteria

1. AC1: Given no path or no supported stopped operation, when union resolution runs, then it returns the frozen refusal.
2. AC2: Given a path lacking any of the three conflict stages, when union resolution runs, then that path is refused without writing it.
3. AC3: Given the proof rejects a path, when a batch resolves, then that path remains unresolved while later eligible paths are still attempted.
4. AC4: Given the proof tool fails operationally, when a batch resolves, then processing stops with a tool-failure diagnostic.
5. AC5: Given a provable path, when it is written, then disk content matches the frozen union result.
6. AC6: Given a written result differs from the independently derived side union in membership, uniqueness or order, when verification runs, then the path is not staged.
7. AC7: Given a verified written result, when resolution completes for that path, then only that named path is staged.
8. AC8: Given a batch with both accepted and refused paths, when resolution returns, then it reports the frozen partial-success outcome.
9. AC9: Given a successful batch, when resolution returns, then it reports the remaining conflicts.
10. AC10: Given Go and Git are available without Python or uv, when a valid native resolution runs, then it succeeds.
11. AC11: Non-functional: resolution never advances, aborts or retries the replay.
12. AC12: Non-functional: native resolution cases execute without skips on macOS, Linux and Windows.

Scope and non-goals

Scope: the sorted-union writer, independent disk verification and named staging under agentrepo rebase.

Non-goal: token application, semantic conflict decisions, taking a whole side or continuing a replay. Keep shell and coupled Python frozen through N-2, with no new shell logic. Do not switch callers or retire tests in this child.

Approach

Use child 05 for eligibility and result construction. Re-derive expected membership from saved stage bytes and read the written bytes independently, preserving the checks at packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/resolve-union.sh:137. A writer-corruption injection must fail before staging. Preserve partial success and the distinction between refusal and tool failure. The supported operation contexts include stopped cherry-picks, as tests/skills/resolve-rebase-conflicts/scripts/resolve-workflow.bats:52 requires.

Dependencies

Blocked by: #899, #753.

Prerequisite: #321's repository-context deliverable. Child 07 is not needed to implement the writer; both use the same proof.

Size

M. Forecast 630 code lines: 250 implementation, 330 tests and fixtures, 50 integration. Measured source baseline: 124 code lines including the embedded Python proof. Prose allowance: 200 lines.

scc could not run in the isolated checkout. Measured baselines count non-blank lines other than full-line # comments, including Python docstrings and embedded code conservatively. Forecasts include implementation, tests, fixtures and registration; they are estimates, not measured future Go. Generated output is excluded only under packages/agents/claude/.apm/skills/, packages/agents/codex/.apm/skills/, .claude/skills/, .agents/skills/ and tokens.json. The source under packages/agents/source/ and copies anywhere else count. The final diff must be at most 800 code lines and 2,000 prose lines, with no exception; split before implementation if either forecast grows beyond its limit.

Verify plan

• AC1, AC2, AC3, AC4: test missing arguments, unsupported operation, missing stages, refusal-then-success and tool failure before a later path.
• AC5, AC6, AC7: compare written bytes and index entries; inject missing, extra, duplicate and out-of-order lines between write and independent read.
• AC8, AC9: compare mixed-batch and fully successful transcripts/statuses with the frozen resolver.
• AC10: run native cases with no Python or uv executable available.
• AC11: inspect the command trace for named staging only and no replay advancement or retries.
• AC12: inspect executing native cases in the three-platform CI matrix.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Reusing the writer's answer as proof can hide data loss. An incorrect readback could stage a malformed resolution. Undo: revert this port before activation; after a failed resolution preserve the unstaged file and conflict stages for inspection.

Operator authority

None.