[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.15 to 2026.10.20

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.20

@​unbrained/pm-cli 2026.10.20

Source range: v2026.10.19...v2026.10.20

Changelog

Changed

• Refresh seven-day-eligible marked 18.1.1 Markdown tooling (pm-argzmt)

Fixed

• GH-1500: Preserve null, empty and reserved JSON row facts through host rendering (pm-4euctr)
• GH-1501: Compact default brief-list TOON envelopes without hiding source completeness (pm-6pycus)
• Align token-budget recovery declaration states with the public runtime guard (pm-8jzcwv)
• Preserve authoritative history after native SQLite transaction startup failures (pm-0orupq)
• Bound recovery probes by missing-reference rendering retries (pm-k6uglj)
• Probe canonical include-mode retries with their actual packing policy (pm-0bbc53)
• Enforce rendered relationship budgets with expected SDK usage recovery (pm-odw3j8)
• Preserve expected check publishers in PR readiness receipts (pm-5p48kf)
• Bound complete macOS nightly validation with two shards (pm-qrirz8)
• Run Git-heavy merge regression files after parallel contract workers (pm-89297t)
• Show failed required PR checks before waiting on pending optional reviewers (pm-jm7m3o)
• item mutate --dry-run does not surface per-row advisory duplicate-detection warnings (pm-ekf2gu)

Security

• GH-1504: Refresh eligible Actions and executed secret-scanner contracts (pm-396dil)

Other

• Assemble complete review receipts without mutating the base receipt (pm-gfksc7)
• Qualify Unicorn 78 after its exact release-age boundary (pm-afshwe)
• Refresh newly matured TypeScript-ESLint 8.71.2 quality tooling (pm-vcy3vq)
• Run the command-example corpus scan after parallel coverage workers (pm-a3c6g4)
• Transaction preview refusal should identify a safe relative offending path (pm-fa9olc)

PM Tracker Evidence

Closed pm items in release window: 17 By type: Task=11, Chore=5, Issue=1 By status: closed=17

Selected release-related tracker items:

• pm-afshwe [Chore/closed] Qualify Unicorn 78 after its exact release-age boundary

v2026.10.19

@​unbrained/pm-cli 2026.10.19

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.20 - 2026-10-20

Changed

• Refresh seven-day-eligible marked 18.1.1 Markdown tooling (pm-argzmt)

Fixed

• GH-1500: Preserve null, empty and reserved JSON row facts through host rendering (pm-4euctr)
• GH-1501: Compact default brief-list TOON envelopes without hiding source completeness (pm-6pycus)
• Align token-budget recovery declaration states with the public runtime guard (pm-8jzcwv)
• Preserve authoritative history after native SQLite transaction startup failures (pm-0orupq)
• Bound recovery probes by missing-reference rendering retries (pm-k6uglj)
• Probe canonical include-mode retries with their actual packing policy (pm-0bbc53)
• Enforce rendered relationship budgets with expected SDK usage recovery (pm-odw3j8)
• Preserve expected check publishers in PR readiness receipts (pm-5p48kf)
• Bound complete macOS nightly validation with two shards (pm-qrirz8)
• Run Git-heavy merge regression files after parallel contract workers (pm-89297t)
• Show failed required PR checks before waiting on pending optional reviewers (pm-jm7m3o)
• item mutate --dry-run does not surface per-row advisory duplicate-detection warnings (pm-ekf2gu)

Security

• GH-1504: Refresh eligible Actions and executed secret-scanner contracts (pm-396dil)

Other

• Assemble complete review receipts without mutating the base receipt (pm-gfksc7)
• Qualify Unicorn 78 after its exact release-age boundary (pm-afshwe)
• Refresh newly matured TypeScript-ESLint 8.71.2 quality tooling (pm-vcy3vq)
• Run the command-example corpus scan after parallel coverage workers (pm-a3c6g4)
• Transaction preview refusal should identify a safe relative offending path (pm-fa9olc)

2026.10.19 - 2026-10-19

Fixed

• GH-1475: settle authenticated lossless merges within one reviewed delivery (pm-gh1475)
• GH-1491: Preserve both add/add snapshots on ambiguous creation ancestry (pm-gh1491)
• Recognize literal dynamic imports in module-usage evidence (pm-f38ovr)
• Keep recovery and help examples on canonical list commands (pm-mw5gip)
• Accept encoding format aliases on core item collections and mutations (pm-frbf0j)

2026.10.18 - 2026-10-18

Fixed

• Retain tested optional-peer closures in the published runtime bundle (pm-iceees)
• Fail the required coverage aggregate when any shard fails or is skipped (pm-0p4aal)
• Invalidate shared history projections when writers lack SQLite (pm-f7shxf)

... (truncated)

Commits

• a627deb chore(release): cut 2026.10.20
• 26fda75 Fix context recovery and review readiness; stabilize native validation (#1508)
• e321723 Align recovery declaration states with validated budget evidence
• 5f9cb46 refactor: assemble complete review receipts as fresh results
• fd5508f docs: record complete native acceptance for reviewed SDK fixes
• dd097e4 fix: bound reference recovery work and preserve history after SQLite startup ...
• e30d553 fix: verify context retry budgets with canonical include modes
• 6385def Complete context recovery, mature tooling and reviewed closeout
• 22edcd0 Honor explicit TOON policy in dependency budget accounting
• a235a7e Verify context-budget retries and preserve invocation scope
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.16 to 2026.10.20

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.20

No release notes provided.

pm-changelog v2026.10.19

No release notes provided.

pm-changelog v2026.10.19-1

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

pm-changelog v2026.10.17

No release notes provided.

Changelog

Sourced from pm-changelog's changelog.

Changelog

Compatibility: explicit tag options (--all-release-tags, --since-previous-tag, --until-release-tag) now require an accessible Git repository and fail with MissingTagHistoryError in source archives and container contexts without Git history. Use tracker-only generation or --milestones there.

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

• Record pi-land-a merge-readiness verification pass for PR 215 (pmc-wgte)
• Certify pm-changelog on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pmc-38z4)

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

... (truncated)

Commits

• 55c4fac Release pm-changelog v2026.10.20
• 0362c96 chore(deps-dev): bump pm-ops (#260)
• d80fdea fix(release): select latest for numeric calendar suffixes
• 62831c1 Release pm-changelog v2026.10.19-1
• 38b0a89 fix(changelog): retain complete tracker fields in generation
• cd60a26 Release pm-changelog v2026.10.19
• 6273a9b chore(deps-dev): bump the pm-toolchain group with 2 updates (#255)
• 17f2f7a chore(deps-dev): bump the pm-toolchain group across 1 directory with 2 update...
• b9c91c5 Keep the release version regex readable by the workflow auditor (#254)
• 4711012 Release pm-changelog v2026.10.17
• Additional commits viewable in compare view

Updates pm-ops from 2026.10.16 to 2026.10.20

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.19

Changelog

2026.10.15 - 2026-10-15

Security

• Remove the unpatched braces chain with built-in fs.glob and jscpd 5 only (ops-braces-audit)

2026.10.14 - 2026-10-14

Fixed

• Reject unresolved alias and function publish indirection in canonical attestation auditor (ops-publish-indirection)
• Keep merge-driver prepare read-only during npm pack and publish (ops-pack-prepare)

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

... (truncated)

Commits

• ee02973 Release pm-ops v2026.10.20
• ace3231 chore(deps-dev): bump eslint (#185)
• f422ab4 chore(deps-dev): bump the pm-toolchain group with 2 updates (#184)
• c3af218 Release pm-ops v2026.10.19
• 61bda59 chore(deps-dev): bump the pm-toolchain group with 2 updates (#181)
• 298461d Release pm-ops v2026.10.18
• 5baf921 chore(deps): bump the codeql-actions group with 2 updates (#179)
• 5194c35 Release pm-ops v2026.10.17
• 2ea3939 Freeze merge-driver bootstrap and accept released launcher copies (#177)
• 5cc0b8f Repin gated sync to pm-github 2026.10.16 and add the daily gated closeout cal...
• See full diff in compare view

Maintenance verification: the toolchain update already changed the tracked pm-ops launcher, but its self-host archive still carried the old launcher bytes. Regenerating the archive fixes the consumer snapshot without changing the launcher, dependency contracts, or audit assertions.

The operational entry-point test fails on the original Dependabot head with the exact launcher hash mismatch and passes after regeneration (1 passed, 0 failed/skipped). The changelog was regenerated and remains unchanged while the tracking item is in progress. Full npm/Bun release gates passed on the updated head. This maintenance adds one SteveBot commit; the PR is held in draft to prevent automatic merging.

PM item: pm-vcs-toolchain137.

CI receipt for 14170d4: CI run 39974286807 passed all 4 jobs. Node 22 and 26 each passed npm run release:check and bun run release:check with 1,855/1,855 tests per gate, zero failures/skips, and 100% measured coverage in all four dimensions. Each also passed 8 native Bun lens tests. The unchanged operational entry-point regression passed locally (1/1), and reverting the archive reproduces the original launcher mismatch. The redundant local full-suite run was stopped after exact-head CI success. The PR remains draft with auto-merge off; no merge was performed.

Main synchronization receipt for 31ca26caad01c191af6327b2183f6309b5c8afef:

Main advanced after the earlier maintenance verification, leaving the self-host archive conflicted. This standard two-parent SteveBot merge joins PR head 14170d429349e67cb1cb86e25831b1eefcc3d420 and main e2a126ce48aaa7b5ee47c161c2c89530e2f5ae57 (including PR 146).

Only selfhost.bundle conflicted; it was regenerated with npm run self-host:write after the tracker and changelog updates were staged. The manifests merged cleanly, retaining the higher version for every differing shared dependency; npm install --package-lock-only made no changes. CHANGELOG.md was regenerated without a content change. No production function changed in this synchronization, so no new behavioral revert proof applies; the existing exact-gates regressions continue to prove stale archives are rejected.

On the final commit, node --test test/self-host.test.ts test/exact-gates.test.ts passed 68/68 with zero failures, cancellations, skips or todos, using isolated Git identity configuration. npm run changelog:check passed. The additional local full-release run was stopped after exact-head CI succeeded; it is not counted as a local pass.

CI run 39990006759 passed all four jobs. Both test (22) and test (26) passed npm run release:check and bun run release:check: 1,856/1,856 tests per gate, zero failures/cancellations/skips/todos, and 100% statements, branches, functions and lines. Each job also passed 8/8 native Bun lens tests and the Bun install check. Both Windows launcher checks passed.

PM item pm-vcs-toolchain137 was enriched and released, remaining in progress for orchestrator verification. The automatic merge workflow triggered by the push was canceled and auto-merge disabled to preserve the requested stop boundary. No PR merge was performed.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 579ce355-e63d-40af-9a9d-6f3cff953139

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

PR author is in the excluded authors list.

[unbraind]

@dependabot recreate

[unbraind]

Current-head hosted CI evidence for 34a2cce (Node 22 and 26 are both failing; Node 22 log examined directly): https://github.com/unbraind/pm-vcs/actions/runs/39862414141/job/120116144622

Two actionable adoption gates fail:

1. the prepare launcher is the unmodified pm-ops template fails strict equality. The dependency update needs the matching canonical launcher rather than weakening this repository's existing assertion.
2. Both real changelog date controls refuse omission_receipt.has_omissions=true; count=155 of total=155, although the command already passes --pm-arg=--output-budget --pm-arg=unbounded --pm-arg=--output-limit --pm-arg=unbounded. Equal item counts do not establish a complete field/history projection, so retain the fail-closed guard. The flagged/unflagged comparison cannot prove date correctness while both commands refuse.

This is hosted failure evidence for this proposed toolchain, not a newly reproduced application defect or evidence that main is broken. The PR proposes PM CLI 2026.10.19; no claim about current 2026.10.22 behavior. Existing all-status issue/PR records and this conversation were checked; canonical code search was incomplete, so this evidence stays on the existing adoption PR rather than creating another issue.

Acceptance: reconcile the launcher with the chosen pm-ops version, obtain genuinely complete changelog input with truthful omission receipts, and pass both date controls plus unchanged full release/coverage gates on the final head. Do not suppress omission reporting or lower coverage thresholds. The same job also reports 98.73% branch coverage in scripts/verify-release-changelog-date.ts; preserve its 100% gate.

[unbraind]

@dependabot recreate

[unbraind]

Current-head follow-through for acb354f: both Node 22 and 26 release jobs fail. The directly inspected Node 22 log now identifies a different adoption blocker from the earlier launcher/omission report.

The operational-entry-point test at test/exact-gates.test.ts:175 refuses the committed self-host archive because scripts/prepare-merge-driver.ts differs:

• committed source SHA256: 06563853320667bca3055c5b3cc6ab703ae7f034e9a53de9147c40b82aeba044
• bundled SHA256: 44c198f1da5d4099b8a061cd279f67a309ec8cbac42f300c47d96875b63186a9

This is hosted CI evidence, not a new local reproduction or a claim that released/main behavior is broken. The existing gate is correctly fail-closed. The current repository contract explicitly requires ordinary source changes to carry a matching committed selfhost.bundle; its manifest-only and trusted immutable-action exceptions do not cover this launcher. The canonical verify-only task also requires verification without archive regeneration.

Impact: the proposed toolchain adoption remains blocked despite the launcher update. Acceptance: reconcile the package-owned source/archive using the documented workflow, preserve exact source verification and existing coverage thresholds, and pass the full Node 22/26 release gates on the final immutable head. Do not regenerate during verification or exempt this ordinary source file. All-status issues/PRs and canonical records were checked; this evidence stays on the existing adoption PR rather than opening a duplicate.

[sourcery-ai]

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 hours and 57 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[unbraind]

Orchestrator review (built-in Claude review agent, verified by the orchestrator; bots are not waited for since 2026-10-22):

Pre-merge review (codex gpt-6.1-sol read-only batch review agent: code for maintenance PRs; tracker-only diff, append-only history and spot-checked delivery evidence for reconciliation PRs).

PR: #137
VERDICT: MERGE
FINDINGS:

• none

[unbraind]

Orchestrator review (built-in Claude review agent, verified by the orchestrator; bots are not waited for since 2026-10-22):

VERDICT: MERGE

Merge-only update after the batch review MERGE verdict: one two-parent merge of main with selfhost.bundle regenerated by npm run self-host:write; self-host and exact-gates tests 68/68, CI 1,856/1,856 per gate on Node 22/26 (npm and Bun). The only failing check is the advisory enable-auto-merge job (auto-merge is intentionally disabled for this PR).