Fixed
- GH-1370: validate transaction previews against staged lifecycle state item pm-gh1370
- GH-1371: compose output budget and producer pagination item pm-gh1371
- GH-1364: preserve tracker scope and valid projection in recovery item pm-gh1364
Fixed
- Control native effort in the history/activity provenance fixture item pm-6jvz55
- GH-1351: leaf get advertises empty children as omitted item pm-x8jdt8
- GH-1349: Bun 1.3.5 merge installer accepts a transient launcher item pm-aaxq4n
Security
- Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories item pm-cbzvgn
Fixed
- Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability item pm-q7c36n
- Bun merge-driver installation disagrees with strict health item pm-vks66s
- Expose host-bound audited workspace settings mutation to extension commands item pm-wtqltn
- Full-item stdin JSON update silently ignores edited notes item pm-2589e6
Fixed
- GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match item pm-1ieq24
- Persist revised linked evidence notes while preserving idempotent retries item pm-zqxlfs
- Bound Plan mutation receipts while preserving full inspection item pm-hqy7lr
Deprecated
- Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based item pm-0mox
- Extension activation attributes canonical full-list projection to deprecated --full item pm-8uwigr
Other
- Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone item pm-hen0t6
Fixed
- GH-1325: history diff cursor drops newest rows and strands the final page item pm-c3aiik
- Windows nightly merge-receipt classification test exceeds 60-second budget item pm-v0600g
- GH-1327: Windows nightly static inventory unreadable-source assertion fails item pm-ft90q2
- GH-1326: Windows nightly bundled-package init test exceeds 30 seconds item pm-kvhnb5
- MCP detached task completion coverage can miss cleanup under hosted shards item pm-tm6h9x
- Full coverage refusal-closure retry test exceeds its four-minute budget under suite contention item pm-mrrci4
- GH-1328: linked-test execution does not disclose item evidence recording item pm-aao1hy
- GH-1330: per-command JSON help inherits the root intent and init example item pm-s8ztcl
- Refuse malformed settings writes with typed recovery item pm-z329kd
- Refuse local package installation when source scan stops at entry limit item pm-erogk1
- Allow self-isolating linked package tests without inherited PM_PATH item pm-t05d8d
- Preserve every tracker merge fence during nested init and detect lost active mappings item pm-kynkl8
Security
- Exclude Git metadata from local package directory installs item pm-k7nxaz
Other
- Refresh September 27 compatible development dependency releases item pm-u9qqip
- Claude plugin spec-alignment hygiene vs 2026-07-11 official docs (minor, non-blocking) item pm-dudr
Fixed
- SDK complete-list receipt falsely reports legacy aliases for canonical helper item pm-vf9iaf
Security
- Expose static extension inventory for hosted and agent reads item pm-lhhnx9
Other
- Consolidate workspace customization discovery and commands under workspace with permanent compatibility aliases item pm-npr3
- Declare workspace, templates and guide ownership with bounded agent orientation item pm-uk9dwh
- Dispatch daily releases at 04:45 Europe/Vienna with the hosted schedule as fallback item pm-9url9h
Fixed
- Refuse unsupported schema dry-run flags before mutation item pm-s74dca
- Releases from the default branch are supported with analyzer evidence item pm-u1baah
Other
- Adapt OpenClaw test-audit skill to pm SDK and repository test governance item pm-xvibt6
- Bound embedding requests, enforce retrieval floors, and protect schema previews item pm-g0b88h
Fixed
- GH-1306: Isolate merge driver installation and health across Git worktrees item pm-c1dwbt
- GH-1305: Preserve workflow policy refusal evidence and actionable missing-field recovery item pm-o5s22y
- GH-1303: Canonical help and refreshable agent guidance item pm-80k965
- GH-1304: Deterministic release pipeline branch coverage across hosted environments item pm-m2ai6c
- Scheduled auto-release has a chronically high failure rate and no rolling measure, so a degraded pipeline reads as healthy one run at a time item pm-e70zh5
- Daily auto-release never runs in its declared window: all 84 scheduled runs fired 2.5-4 hours after the cron time, so the release clock is undocumented drift item pm-44u3wt
- GH-1294: release commit omits synchronized plugin runtime manifests item pm-t4prek
- The related ceiling is pinned to the live count with block enforcement, so recording one associative sibling relation anywhere in the tracker fails CI while the share floor it duplicates would have allowed it item pm-r3o7x4
Security
- Semgrep 874840452: Medium dependabot missing cooldown in .github/dependabot.yml\#L3 item pm-gkut
- Semgrep 874840451: Medium dependabot missing cooldown in .github/dependabot.yml\#L23 item pm-dmo5
Fixed
- Dogfood test failure must not print inherited environment secrets item pm-jiv3dw
- Claude plugin: marketplace installs fall back to npx @latest, not the advertised native MCP server item pm-l9wl
- Windows copied agent plugins cannot install pinned runtime through npm.cmd item pm-d6fd85
- Nightly coverage, quality, and Windows tests exceed serial job budgets item pm-ul9rye
- GH-1291: Windows nightly release cleanup fixture includes Node compile cache item pm-puf5rq
Security
- Scorecard Token-Permissions (0→10): declare least-privilege top-level permissions in every GitHub workflow item pm-003j
Other
- Support safe Bash completion inside quoted and escaped prefixes item pm-eswzn9
- Refresh compatible Sentry, jscpd, and TypeScript-ESLint patches for September 22 item pm-hate9s
Other
- Mutation-testing gate: prove the 100 percent coverage suite actually detects defects, with a ratcheted mutation score on SDK core item pm-zclzll
