[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.11.6 to 2026.11.10

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.11.10

@​unbrained/pm-cli 2026.11.10

Source range: v2026.11.9...v2026.11.10

Changelog

Fixed

• Distinguish Vitest coverage-threshold exits from test assertion failures in combined runner verdicts (pm-qmb6h8)
• GH-1694: recover pinned Bun and verified uploader downloads after GitHub asset gateway failures (pm-gh1694)
• GH-1693: preserve complete flag tokens in bounded close-refusal headlines (pm-gh1693)
• GH-1689: redact leading-slash regex sources with indexed safe refusals (pm-gh1689)
• GH-1695: accept settings paths and provide bounded config-key recovery (pm-gh1695)

Other

• Stabilize alias clear/prune race verification under monolithic release coverage (pm-01kwb2)
• Restore publication headroom with lossless declaration delimiter compaction (pm-5aze0q)
• Adopt the next mature tooling maintenance cohort after registry cooldown (pm-ogzvx6)

PM Tracker Evidence

Closed pm items in release window: 8 By type: Chore=2, Issue=5, Task=1 By status: closed=8

Selected release-related tracker items:

• pm-01kwb2 [Chore/closed] Stabilize alias clear/prune race verification under monolithic release coverage
• pm-gh1694 [Issue/closed] GH-1694: recover pinned Bun and verified uploader downloads after GitHub asset gateway failures

v2026.11.9

@​unbrained/pm-cli 2026.11.9

Source range: v2026.11.8...v2026.11.9

Changelog

Fixed

• MCP pm_comments lists only the newest 20 comments by default: the backward output cursor stops at that producer page and the last page reports has_more without a continuation (pm-sbqn4h)
• Combining an annotation or linked-artifact mutation with a universal output control is refused untyped: code command_failed and pm --help examples instead of a stable code and a retry without the control (pm-rrwh2o)
• TOON get --fields drops an empty child collection nested inside a selected object field, while JSON keeps it (pm-fkhdy8)
• TOON annotation listings drop null rows while count reports them, so a malformed collection renders fewer rows than its count (pm-e3hfv8)
• Release verification shares the build job's timeout and waits fifteen minutes while npm's publish-time scan can hold a version longer: 2026.11.8 was published but the job was cancelled before acceptance (pm-0jzl5t)
• A malformed comments, notes or learnings entry in an item document crashes annotation reads with unknown_error (sortLogValues calls localeCompare on a missing text) (pm-30tjoh)

Other

• Exclude the dated ecosystem planning review from the npm tarball to restore publication headroom (pm-1ke3mz)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.11.10 - 2026-11-10

Fixed

• Distinguish Vitest coverage-threshold exits from test assertion failures in combined runner verdicts (pm-qmb6h8)
• GH-1694: recover pinned Bun and verified uploader downloads after GitHub asset gateway failures (pm-gh1694)
• GH-1693: preserve complete flag tokens in bounded close-refusal headlines (pm-gh1693)
• GH-1689: redact leading-slash regex sources with indexed safe refusals (pm-gh1689)
• GH-1695: accept settings paths and provide bounded config-key recovery (pm-gh1695)

Other

• Stabilize alias clear/prune race verification under monolithic release coverage (pm-01kwb2)
• Restore publication headroom with lossless declaration delimiter compaction (pm-5aze0q)
• Adopt the next mature tooling maintenance cohort after registry cooldown (pm-ogzvx6)

2026.11.9 - 2026-11-09

Fixed

• MCP pm_comments lists only the newest 20 comments by default: the backward output cursor stops at that producer page and the last page reports has_more without a continuation (pm-sbqn4h)
• Combining an annotation or linked-artifact mutation with a universal output control is refused untyped: code command_failed and pm --help examples instead of a stable code and a retry without the control (pm-rrwh2o)
• TOON get --fields drops an empty child collection nested inside a selected object field, while JSON keeps it (pm-fkhdy8)
• TOON annotation listings drop null rows while count reports them, so a malformed collection renders fewer rows than its count (pm-e3hfv8)
• Release verification shares the build job's timeout and waits fifteen minutes while npm's publish-time scan can hold a version longer: 2026.11.8 was published but the job was cancelled before acceptance (pm-0jzl5t)
• A malformed comments, notes or learnings entry in an item document crashes annotation reads with unknown_error (sortLogValues calls localeCompare on a missing text) (pm-30tjoh)

Other

• Exclude the dated ecosystem planning review from the npm tarball to restore publication headroom (pm-1ke3mz)

2026.11.8 - 2026-11-08

Fixed

• MCP annotation and linked-artifact tools silently read when add is passed at the top level: the strict schema declares add/text but dispatch only hoists ifAbsent (pm-wsqxwb)
• pm comments --edit/--delete take an absolute index while a budget-truncated listing reports count as the page size and shows no row index, so 'edit the last comment' by count rewrites an older comment (pm-hka7ep)
• Bare pm comments / pm notes reads keep the oldest page when output must be bounded, withholding the newest entries (GH-1605 fixed this for history only) (pm-8s53lj)
• CLI argv keeps one value silently when two spellings of one extension flag differ (--status-filter a -s b), while direct callers are refused with extension_option_spelling_conflict (pm-wlxf8f)
• pm comments/notes <id> --add --file <path> is refused as positional-and---add conflict instead of naming the swallowed --file flag, so the annotation flag-like check from pm-vcu7 loses precedence (pm-y26mvc)
• GH-1667: sdk/graph does not export ProjectedGraphResult, the public return type of runGraph, and the merge conflict_resolution union has no public name, so extensions derive both (pm-gh1667)
• GH-1666: per-command help and contracts for extension commands omit the inherited host flags (--json, --author, --pm-path) the command accepts and mark no flag as host- or extension-owned (pm-gh1666)
• GH-1665: extension flag contracts omit the SDK option key, so PmClient.run and the extension test harness silently ignore a CLI-spelled option such as status-filter and fall back to the default (pm-gh1665)
• TOON get --fields spends four lines on a complete omission receipt and drops requested empty collections, so a narrow read is two-thirds receipt and absent-vs-empty depends on that receipt (pm-sj66lm)
• GH-1662: an infeasible --token-budget on context --for orient exits 0 with no context and contradictory receipts, its restore_with retry fails, and get/list intent receipts undercount the emitted envelope (pm-gh1662)
• GH-1678: a scoped registerRenderer replacement bypasses --output-budget and its read_output receipt reports within_budget for the native payload, not the delivered bytes (pm-gh1678)

Other

• Restore package headroom by excluding the generated refusal-closure census from the npm tarball (pm-dwy8kb)

... (truncated)

Commits

• 2786b53 chore(release): cut 2026.11.10
• ccb5f76 fix: make release assertion and coverage verdicts accurate (#1698)
• baf182d fix: improve SDK recovery and restore release acceptance
• 620fbd2 chore(release): cut 2026.11.9
• f2ea007 Merge pull request #1688 from unbraind/fix/annotation-read-fidelity
• c47c086 docs(read-output): qualify pm_comments windows and budgets; tighten review specs
• c5e2198 fix(read-output): withhold mutation retries for any token that may carry URL ...
• c7e12d2 fix(read-output): enumerate URL scheme starts linearly; never leave a control...
• 6daccc0 fix(read-output): scan credential candidates in linear time, through git+ wra...
• 90df1f3 fix(read-output): detect URL credentials in every parser-normalized spelling
• Additional commits viewable in compare view

Updates pm-changelog from 2026.11.5 to 2026.11.10

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.11.10

2026.11.10 - 2026-11-10

Dependencies

• Bump the pm-toolchain group with 2 updates (#335)
• Bump the pm-toolchain group with 2 updates (#334)

pm-changelog v2026.11.7

2026.11.7 - 2026-11-07

Dependencies

• Bump unbraind/pm-github/.github/workflows/pm-github-sync.yml (#330)
• Bump unbraind/pm-github/.github/workflows/pm-github-closeout.yml (#331)
• Bump the codeql-action group with 2 updates (#329)

pm-changelog v2026.11.6

2026.11.6 - 2026-11-06

Dependencies

• Bump the pm-toolchain group across 1 directory with 2 updates (#325)
• Bump marked (#326)

Changelog

Sourced from pm-changelog's changelog.

2026.11.10 - 2026-11-10

Changed

• Render declared contract changes with migration guidance (pmc-contract-changes)
• Keep changelog checks stable when an empty release is tagged (pmc-stable-itemless-check)

Dependencies

• Bump the pm-toolchain group with 2 updates (#335)
• Bump the pm-toolchain group with 2 updates (#334)

2026.11.7 - 2026-11-07

Changed

• Order section entries by completion time; regenerate CHANGELOG.md once after upgrading (pmc-total-item-order)

Dependencies

• Bump unbraind/pm-github/.github/workflows/pm-github-sync.yml (#330)
• Bump unbraind/pm-github/.github/workflows/pm-github-closeout.yml (#331)
• Bump the codeql-action group with 2 updates (#329)

2026.11.6 - 2026-11-06

Dependencies

• Bump the pm-toolchain group across 1 directory with 2 updates (#325)
• Bump marked (#326)

Commits

• 542ec84 Release pm-changelog v2026.11.10
• 98ddb6a chore(deps-dev): bump the pm-toolchain group with 2 updates (#335)
• 3147676 fix: render declared contract changes with migration guidance (#328)
• fa8acb9 Keep changelog checks stable after empty release tags (#333)
• f9422fd chore(deps-dev): bump the pm-toolchain group with 2 updates (#334)
• f72c710 Release pm-changelog v2026.11.7
• 7d3fd51 chore(deps): bump unbraind/pm-github/.github/workflows/pm-github-sync.yml (#330)
• 45ec90b chore(deps): bump unbraind/pm-github/.github/workflows/pm-github-closeout.yml...
• 977a5e4 chore(deps): bump the codeql-action group with 2 updates (#329)
• 93fab7e fix: keep section order stable across pm metadata writes (#324)
• Additional commits viewable in compare view

Updates pm-ops from 2026.11.5 to 2026.11.6

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.11.06

Changelog

2026.11.6 - 2026-11-06

No tracked changes.

Changelog

Sourced from pm-ops's changelog.

2026.11.6 - 2026-11-06

Dependencies

• Bump semver (#252)
• Bump @​unbrained/pm-cli (#251)

Commits

• 274c158 Release pm-ops v2026.11.06
• 07f965b chore(deps): bump semver (#252)
• 6f08d33 chore(deps-dev): bump @​unbrained/pm-cli (#251)
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ef497cd1-e785-4216-9eeb-9e4e0b06dc4b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sourcery-ai]

Reviewer's Guide

Configuration

Update the development toolchain dependency versions in the package manifest.

• package.json L57-62

Lock files and vendored code

Refresh the lockfile to record the updated dependency versions and resolutions.

• package-lock.json L21-26 (+5 small edits)

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[unbraind]

Current-head adoption check at 4754d02115f3cb10f0d092ed305bf0054a0be919 (base 5766ef01f8fff0b4dd2c1c07474b2d55636ab535): the locked PM CLI bump 2026.11.6 → 2026.11.10 does not clear the existing atomic-compensation problem tracked in #197 and pm-cli #1656. The Node 22 job reports two exact failures: test/import-fidelity.test.ts:470 (restore source lifecycle/remove newly created items after an injected finalization failure) and test/refresh.test.ts:663 (remove the replay plan after successful compensation). The actual result reports incomplete compensation and refusal to safely compensate an incomplete step, before the later restoration and cleanup assertions run. This is hosted synthetic-fixture evidence, not evidence of production data loss or proof the SDK ownership guard is wrong. The grouped update also changes other dev tools, so this does not isolate single-package causality.

Before merging the bump, rerun these exact controls on the proposed locked SDK, verify item/history/journal state and cleanup after ordinary injected failures, and retain the guarded incomplete outcome when an intervening write makes rollback unsafe. Please keep the existing assertions and coordinate the transaction-owned finalizer under the existing SDK issue rather than adding a second recovery mechanism.