2026.9.22

Fixed

  • Prevent dogfood telemetry workers from recreating disposable workspaces Eintrag pm-idj82e
  • GH-1287: Release evidence integration test depends on mutable repository changelog state Eintrag pm-lq10y3
  • GH-1284: release notes must read complete tracker evidence beyond default output budgets Eintrag pm-svxdsx
  • Fix smoke and contract workspace cleanup on exits and interrupts Eintrag pm-14dnbh

Security

  • Refresh pinned Codecov CodeQL and TruffleHog actions with dependency-update-safe workflow contracts Eintrag pm-mwdout

Other

  • Extend owned workspace cleanup across release gates and interruptible test runners Eintrag pm-xjy565
  • Refresh fast-check and tsx patches under unchanged dependency policy Eintrag pm-kpoj19
  • Repair calendar shortcut package discovery and upgrade migration guidance Eintrag pm-o3fh
  • Prune src/cli/commands/index.ts barrel dead re-exports and adopt knip as a dead-export gate Eintrag pm-f4yn
  • Diagnose abandoned build leases before the full acquisition timeout Eintrag pm-63i8nr

2026.9.21

Fixed

  • GH-1280: preserve literal completion across Bash versions and package helper paths Eintrag pm-t6jl1f

Other

  • Refresh compatible September 20 validation tooling alongside portability regressions Eintrag pm-cljdn3
  • Bound replication-gate Git work independently of tracker migration size Eintrag pm-26y269

2026.9.20

Changed

  • Refresh jscpd 5.3 and verify decomposed source with zero-clone gates Eintrag pm-xgbzxs
  • Decompose CLI bootstrap, SDK dispatch, extension loading, and shell completion Eintrag pm-yh8r
  • Decompose SDK search into query, retrieval, and response modules Eintrag pm-jt3b

Fixed

Other

  • Resolve validate duplicate issue-code GH-209 warning without changelog drag Eintrag pm-pivf
  • Deterministic closed_at backfill for legacy closed items derived from history streams Eintrag pm-wrbe

2026.9.19

Fixed

  • Workspace singleton files (settings.json, schema, session-state, checkpoints) are lock-free read-modify-write — parallel pm config set demonstrably loses updates Eintrag pm-bgcu
  • The close-time blocker-clear warning names one deleted ordering edge out of N, so silent multi-blocker data loss is indistinguishable from single-blocker clearing Eintrag pm-scbr0s
  • Declare and enforce shared default bounds across graph queries Eintrag pm-mfy1ux
  • Isolate published MCP verification from the caller global skill catalog Eintrag pm-prmt1y
  • The --profile timer reports a fraction of real invocation latency and is documented nowhere, so every latency judgement built on it is calibrated against the wrong number Eintrag pm-ag9nka
  • Count successful provenance resolutions so historical health advisories can clear Eintrag pm-4f1l7f
  • Isolated release acceptance inherits npm allow-scripts through npm run Eintrag pm-64qsbl
  • macOS registry acceptance rejects empty optional flags under Bash nounset Eintrag pm-q4avk2
  • Windows transport-floor contract test batches 78 fixtures under one deadline Eintrag pm-lgyaw8

Other

  • Fail repository tests on undeclared MCP options including reporter overrides Eintrag pm-v0s2rm
  • Reconcile provenance delivery metadata with reviewed implementation Eintrag pm-senomv
  • Refresh Node declarations to 26.6.1 for SDK and process timing validation Eintrag pm-8p629e

2026.9.18

Fixed

  • Allow canonical JSON/TOON encoding on mutations Eintrag pm-1rta7z
  • Omit redundant read receipts when canonical output flags do not compact results Eintrag pm-g8oh0f
  • Keep the largest list prefix that fits the output budget Eintrag pm-15yuly
  • Reject ambiguous event durations with explicit minute and month units Eintrag pm-jkjt
  • Packed telemetry acceptance must await completion across delivery batches Eintrag pm-07m41m
  • GH-1264: enforce next ready-queue token budgets and disclose omitted recommendations Eintrag pm-v53h9j
  • Reject malformed linked-test JSON paths instead of silently normalizing assertions Eintrag pm-czr31p

Security

  • Reject inherited array elements in linked-test assertions Eintrag pm-1skc
  • Read linked-test JSON assertions without invoking accessors Eintrag pm-xxrq
  • Prevent prototype traversal in nested settings reads and writes Eintrag pm-3kk6
  • Share secret and private-context detection between mutation preflight and repository scanning Eintrag pm-wwooxx

Other

  • Verify explicit calendar duration in package-first dogfood Eintrag pm-d9bg0i
  • Move meet/event/remind calendar shortcuts from core surface into the builtin-calendar package as create sugar Eintrag pm-o3fh
  • ADR: Require explicit minute and month units for event durations Eintrag pm-j1vw3a
  • Context judgment corpus: small, real-shaped, scale, and returning-agent continuity scenarios for pm context/next Eintrag pm-lixy
  • Refresh Sentry 10.75 and CLI 3.8 with Unicorn 75 compatibility proof Eintrag pm-1wypwu
  • Serialize the complete build pipeline so overlapping validation cannot consume partially rewritten dist artifacts Eintrag pm-cxc4jc
  • Released-artifact acceptance: the exact published tarball is installed clean and driven through a scripted agent session before the release is advertised Eintrag pm-ygli86

2026.9.17

Fixed

2026.9.16

Fixed

  • Preserve oversized standard item reads with a brief projection and explicit omission receipts Eintrag pm-8eclqf

Other

  • As an agent on a minutes-old scratch project, pm init, quick-capture create, and next are near-zero ceremony and token-cheap at three-item scale Eintrag pm-z436

2026.9.15

Fixed

  • Preserve telemetry identity and runtime acceptance across Node and npm versions Eintrag pm-7msh7k
  • Automatically bound high-frequency read-only telemetry volume Eintrag pm-um3teu
  • Prevent stale cleanup from reclaiming a lock during owner metadata initialization Eintrag pm-v2pg4f

Other

2026.9.14

Changed

Fixed

  • Preserve telemetry events across concurrent queue rewrites Eintrag pm-utxk3h
  • Honor revoked telemetry consent across capture and identity initialization Eintrag pm-yjq2x0
  • Explain rejected telemetry source-context overrides without leaking raw values Eintrag pm-bw8lsb
  • Destination census rows cite terminal consolidation owners for five live commands, so the grammar gate certifies consolidations no open item will deliver Eintrag pm-3ig9b6
  • Package-declared internal commands leak into default runtime contracts Eintrag pm-34xisz
  • Allow non-colliding extension leaves beneath core command groups Eintrag pm-bwkmp4
  • Compact default list receipts and avoid repeated recovery argument echoes Eintrag pm-4f86c4
  • Canonicalize unknown-command recovery with replacement flags Eintrag pm-zsic8h

Other

  • Give assurance a declared noun placement and history-author-acknowledge a history leaf: the two live commands whose consolidation owners closed without moving them Eintrag pm-djyvbk

2026.9.13

Fixed

  • Suppress inferred test telemetry before identity creation and export Eintrag pm-745epp
  • Honor DO_NOT_TRACK across telemetry capture flush and diagnostics Eintrag pm-ikgitf
  • Expose privacy-bounded agent harness and CI telemetry dimensions Eintrag pm-nnn9nf
  • Published-package verification gives up before npm metadata propagates: two consecutive scheduled cuts were recorded as failed and re-run by hand while the artifact was already live Eintrag pm-wzmbvn

Deprecated

  • Permanent hot-path aliases print the migration hint reserved for deprecated spellings on every human-readable call, so the project's own skills cost an extra stderr line per invocation Eintrag pm-crd6bf

Other

  • Expose explicit paired sampling for core-only telemetry reads Eintrag pm-wrdctq
  • Consolidate item annotation facets: comments/notes/learnings/files/docs/deps/append/test become one facet grammar (old spellings aliased) Eintrag pm-yql1
  • Hide runtime completion helper entrypoints from the default agent-facing command surface Eintrag pm-szdc
  • Hide internal test-runs-worker from default help/contracts and route it under the test execution plumbing Eintrag pm-lp4j