Test pack and publish prepare paths after launcher updates

.agents/pm/chores/pm-beads-8h18.toon

@@ -6,11 +6,11 @@ status: in_progress
 priority: 2
 tags: []
 created_at: "2026-09-26T23:48:03.601Z"
-updated_at: "2026-10-04T11:35:52.538Z"
+updated_at: "2026-10-17T09:55:09.544Z"
 author: codex
 acceptance_criteria: "The package-local pm CLI is exactly 2026.10.4; release:check and strict PM health pass; npm and native Bun packed entrypoints work against real tracker data; development pins are exact; both npm audits are clean; CHANGELOG remains generated by pm-changelog; the PR links this item and final-head review evidence."
 actual_result: "Restart candidate: PM CLI, pm-ops and pm-changelog all exact 2026.10.4; Node types 26.6.4 and other devDependencies exact; Dependabot #125/#126/#127/#129 consolidated. Locked direct release:check PASS 352/352, zero failures/skips, V8 lines/branches/functions 100% (statement coverage is not independently measured). Full and production npm audits: zero vulnerabilities. Strict pinned health PASS. Packed npm/native Bun exports, strict workspace diffs, validate and import --validate-only PASS for all 89 real tracker records; scratch deleted. Managed pm-github 2026.10.4 preview: planned=0/synced=0. Source-head Node 22/26 and CodeQL CI pass. Handoff: source-head CI green at b76b13ef9796, zero unresolved threads. NOT READY: Sourcery weekly quota; Cubic monthly quota/skip; Gemini and Copilot have no response after the requested review round. Independent statement coverage remains unmeasured by the three-metric gate. Claim released; item remains open for orchestrator."
-comments[9]{created_at,author,text}:
+comments[14]{created_at,author,text}:
   "2026-09-28T05:54:11.433Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch."
   "2026-10-02T18:23:26.486Z",pi-land-a,"Merge-readiness verification pass by pi-land-a (fleet PR landing session): exact head 5c61a0e is up to date with origin/main (merge-base equals main tip), mergeable and CLEAN; Node 22/26, CodeQL, Greptile, Semgrep, DeepScan and Hound CI are green; both review threads are resolved (the ancestor-path finding was withdrawn by Greptile); Greptile's exact-head summary rates this PR 5/5 'safe to merge' (pm-beads#124 issuecomment-5864334208) and CodeRabbit's full review of this head finished with no new actionable findings (issuecomment-5864302041). Sourcery budget exhausted (quota notice, not a review); Gemini not active."
   "2026-10-02T21:45:06.008Z",codex-sol,"Restart by codex-sol: retained pushed head d29e031 inspected, no local/unpushed work. Rebase origin/main up to date. Preserve prior CodeRabbit literal-version refusal: exact package pin, installed SDK identity and peer-floor checks already enforce the repository contract without duplicating the literal. Revalidating full CI release gate and current review state."
@@ -20,6 +20,11 @@ comments[9]{created_at,author,text}:
   "2026-10-04T10:52:56.406Z",codex-sol,"Restart verification: retained changes and existing evidence inspected; exact-pin all devDependencies, use published pm-changelog 2026.10.4, then rerun the full CI gate, pinned health, audits and packed real-tracker npm/Bun acceptance. Preserve prior comments and avoid duplicate Dependabot superseded comments."
   "2026-10-04T11:03:51.337Z",codex-sol,"Restart validation complete: flock /tmp/claude-1000/heavy-gate.lock npm run release:check passes 352/352 with zero skipped; configured V8 lines/branches/functions at 100%. npx pm health --strict-exit --require-merge-drivers passes, npm audit and npm audit --omit=dev zero vulnerabilities. PM-linked launcher suite passed 8/8. Exact-pinned devDependencies and updated pm-changelog to 2026.10.4; the launcher remains byte-identical to published pm-ops 2026.10.4. Packed real-data receipt: npm pack --silent, install tarball with @unbrained/pm-cli@2026.10.4 into a copied .agents/pm; npx -y @unbrained/pm-cli@2026.10.4 package install <tarball> --project complete:true. Both npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun -y @unbrained/pm-cli@2026.10.4 beads export -o <runtime>.beads.jsonl exported 89; beads diff <file> --against-workspace --strict reported 89/89 unchanged and drift:false; beads validate <file> and beads import <file> --validate-only passed 89 records. Scratch copy removed. Read-only pm github sync --repo unbraind/pm-beads --dry-run planned 0, synced 0. The prior synthetic two-record import/upsert receipt is retained; this new round verifies the complete actual tracker."
   "2026-10-04T11:35:50.192Z",codex-sol,"Orchestrator handoff for PR #131: source head b76b13ef9796cce9308e9ae01ab742f7bda351dc has green Node 22/26 and CodeQL CI; local release/health/audit/dogfood receipts are recorded above. No actionable bot findings. Zero unresolved review threads. Required review quorum is unavailable: Sourcery weekly quota; Cubic monthly quota/skip; Gemini and Copilot have no response after the requested review round. Independent statement coverage remains unmeasured by the three-metric gate. All bot comments/reviews/inline findings inspected; useful findings/summaries reacted positively, skip/quota notices negatively, concrete replies posted, addressed threads resolved. Initial review requests sent once per repo; pm-ops received one second-round request after its valid fix. No merge, close, auto-merge, publication or release. Release the claim for orchestrator verification; the certification item remains in progress. Final metadata head will be checked separately before removing the worktree."
+  "2026-10-17T09:26:34.182Z",codex-agent,"Investigating the pm-toolchain Dependabot failure against current main and the last green CI job. Reusing this dependency certification item. Will retain dependency ownership with Dependabot, reproduce the exact dependency and generated-template diff in a scratch worktree, add behavioral regression evidence, and verify npm and Bun release checks with isolated Git identity."
+  "2026-10-17T09:29:27.231Z",codex-agent,"Shared root cause with pm-ado#30: Dependabot refreshes the canonical prepare template for pm-ops 2026.10.12, adding pack/publish branches at line 28. Install-only tests leave the notice and both artifact conditions unexecuted (launcher 98.65% lines, 75% branches). Add lifecycle behavior tests on real configured Git checkouts, compatible with both template generations; retain byte equality and all broken-install refusal tests. Pins and thresholds unchanged."
+  "2026-10-17T09:48:44.653Z",codex-agent,"The shared host reached process timeouts during full local validation. Focused behavioral revert evidence is complete; full fix-plus-Dependabot dependency validation is moving to a temporary read-only GitHub Actions validation branch running npm run release:check and bun run release:check with isolated Git identity. The temporary workflow and dependency overlay will remain outside the fix PR."
+  "2026-10-17T09:49:46.385Z",codex-agent,"Revert proof: the shared canonical launcher is byte-identical to pm-ado. With Dependabot #144 dependencies installed, keep both new artifact tests and remove only lifecycle-command injection from the prepare helper. The focused 100-percent coverage gate exits 1 at 98.65% launcher lines and 75% branches, missing line 28. Restore the helper for full npm and Bun validation. The current-pin focused suite passed 10/10, including a pm-linked run with a 900-second limit. The original full local baseline reached its 15-minute subprocess timeout under host load; that incomplete run is not counted as passing evidence."
+  "2026-10-17T09:54:57.365Z",codex-agent,"Complete fix-plus-Dependabot validation passed both env HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 npm run release:check and the equivalent bun run release:check. Each passed 354/354 tests with zero failures/skips/cancellations/todos and 100-percent configured coverage. Proof: https://github.com/unbraind/pm-beads/actions/runs/39022664012 . Behavioral revert evidence and shared launcher root cause are recorded in docs/dependabot-root-cause.md. Pins and thresholds remain unchanged. Implementation is ready for PR CI; releasing the claim without closing the item."
 notes[4]{created_at,author,text}:
   "2026-09-26T23:53:55.032Z",codex,"PM CLI/SDK 2026.9.26, pm-ops 2026.9.26, pm-changelog 2026.9.25 are installed and exact-pinned. Full local release:check passed 350/350 tests, zero skips, 100% measured lines/branches/functions, zero production audit vulnerabilities, changelog, provenance and date gates. Disposable packed-package installation via npx CLI 2026.9.26 activated pm-beads; Bun CLI imported two real open pm-cli GitHub issues, npx exported them, strict Beads diff found no drift, repeat Bun upsert created zero and updated two, complete tracker read returned two unique items, and strict health had no warnings. Package tracker strict health is ok=true with two existing stale-item advisories and one provenance value advisory. The preexisting package gate initially failed on the new canonical pm-ops launcher and stale literal host-version test; both were corrected and full gate rerun passed."
   "2026-09-26T23:55:23.677Z",codex,"PM-linked npm run release:check executed in the CLI isolated test environment: 1/1 passed, exit 0, 66.4 seconds; 350/350 package tests and the full gate passed again. The configured coverage gate measures lines, branches, and functions at 100%; statement coverage is not separately reported, so a four-metric 100/100/100/100 claim is not established. Strict tracker health remains ok=true with stale-item and provenance advisories; those are not upgrade regressions demonstrated by this change."
@@ -36,7 +41,9 @@ tests[3]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
   "npm run release:check",project,codex,"2026-09-26T23:53:54.379Z",local_mutation,chore/pm-beads-cli-sdk-2026-9-26
   node --test test/packaging.test.ts,project,codex-sol,"2026-10-02T21:49:03.667Z",local_mutation,land-124
   node --test test/prepare-merge-driver.test.ts,project,pi-cert-a,"2026-10-04T10:25:25.981Z",local_mutation,chore/pm-beads-pm-cli-2026-10-4
-docs[3]:
+docs[4]:
+  - path: docs/dependabot-root-cause.md
+    scope: project
   - path: "https://github.com/unbraind/pm-beads/blob/main/.agents/pm/issues/pm-beads-vb7j.toon"
     scope: project
     note: Earlier literal-version pin contract history