npm - @unbrained/pm-cli - Versions diffs - 2026.11.4 → 2026.11.5 - Mend

@unbrained/pm-cli 2026.11.4 → 2026.11.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (219) hide show

package/docs/DIAGNOSTIC_OUTPUT_CONTRACTS.md CHANGED Viewed

@@ -7,12 +7,12 @@ Tracker references: [pm-cha95z](../.agents/pm/tasks/pm-cha95z.toon), [pm-5t33or]
 Failures are context-management surfaces. Every diagnostic family now declares
 a format-aware token ceiling and one degradation ladder in the public SDK:
-| Class                | Text | JSON | Corrective action that survives degradation |
-| -------------------- | ---: | ---: | ------------------------------------------- |
-| `error`              |  768 | 2000 | required action, retry/domain, or next step |
-| `warning`            |  768 | 2000 | required action, retry/domain, or next step |
+| Class | Text | JSON | Corrective action that survives degradation |
+|---|---:|---:|---|
+| `error` | 768 | 2000 | required action, retry/domain, or next step |
+| `warning` | 768 | 2000 | required action, retry/domain, or next step |
 | `validation_summary` | 1500 | 3000 | required action, retry/domain, or next step |
-| `recovery_bundle`    |  768 | 2000 | required action, retry/domain, or next step |
+| `recovery_bundle` | 768 | 2000 | required action, retry/domain, or next step |
 The smallest explicit ceiling is 192 estimated tokens. At that floor, the
 projector may reduce the diagnostic to its code, required action, compact

package/docs/ECOSYSTEM_PLANNING_REVIEW.md CHANGED Viewed

@@ -38,7 +38,7 @@ canonical GitHub file URL under the [documentation policy](../AGENTS.md#document
 so installed readers can access the data without a broken package-relative path.
 | Measure | Initial observation | Interpretation |
-| --- | ---: | --- |
+|---|---:|---|
 | Directed graph edges | 14,097 | Deduplicated directed basis |
 | Ordering layers / critical-path edges | 12 / 11 | Acyclic prerequisite graph |
 | Missing graph endpoints / isolated items | 0 / 0 | Across all statuses |
@@ -98,7 +98,7 @@ measured evidence govern promotion. Priority measures impact; horizon measures
 readiness and uncertainty. Review monthly and when a material observation changes.
 | Horizon | Illustrative window | Canonical outcomes and promotion evidence |
-| --- | --- | --- |
+|---|---|---|
 | Current | 0–3 months | [Agent-legible grammar](../.agents/pm/milestones/pm-j82fd3.toon), active readiness, retrieval failures, release diagnosis and current protocol proof. Require completed-task token comparisons, preserved compatibility and actual installed-consumer evidence. |
 | Emerging | 3–12 months | [Provable history](../.agents/pm/milestones/pm-w7ccmv.toon), reproducible observations and [measured self-improvement](../.agents/pm/milestones/pm-zzylb9.toon). Require independent replay, mutation coverage and three consecutive measured improvement cycles. |
 | Expansion | 12–36 months | [Proven scale](../.agents/pm/milestones/pm-o87av6.toon), [universal domain platform](../.agents/pm/milestones/pm-t4d7nz.toon), [federated agents](../.agents/pm/milestones/pm-z1kr34.toon). Require published million-item/fleet distributions and SDK-only domain exemplars. |
@@ -151,7 +151,7 @@ it does not prove the outstanding 100k/1M performance acceptance.
 Five project golden queries were evaluated at k=10:
 | Mode | Mean nDCG | Mean MRR | Mean recall | Broad history/episode query recall |
-| --- | ---: | ---: | ---: | ---: |
+|---|---:|---:|---:|---:|
 | Keyword | 0.7451 | 0.80 | 0.8727 | 4/11 |
 | Semantic | 0.7944 | 0.85 | 0.8182 | 1/11 |
 | Hybrid | 0.8405 | 0.90 | 0.8364 | 2/11 |

package/docs/EXTENSION_AUTHOR_CONTRACTS.md CHANGED Viewed

@@ -44,7 +44,7 @@ Every `pm` command records a telemetry event. Extension commands use the same te
 Allowed values:
 | Value | Meaning |
-|-------|---------|
+|---|---|
 | `redacted` | Default. Records sanitized command args, options, result summary, and runtime environment. |
 | `minimal` | Records structural metadata and one-way digests only. No readable command text, args, options, result summary, or runtime environment is kept. |
 | `max` | Same as `redacted`, but raises the per-string truncation cap from 512 to 2048 characters. Redaction still applies. |
@@ -77,7 +77,7 @@ Create path:
 - Used by `pm update`, `pm close`, `pm claim`, `pm release`, `pm restore`, `pm delete`, and other mutations of existing items.
 - Locates the item, acquires the lock, reads the item through the `onRead` hook, enforces ownership and history policy, applies the mutation, enters the commit fence, consults `item_store_write`, writes the item atomically, appends history, fires `onWrite` for the item and history stream, records the after-command affected-item snapshot, then releases the lock.
-- `item_store_write` handlers can redirect the target path, replace serialized contents, or skip the physical item write.
+- `item_store_write` handlers can redirect the target path, replace serialized contents, or skip the physical item write. Inside an expected-revision scope (`withExpectedItemRevisions`, `--expect-hash`) the scope then advances to the item read back from storage, not the pre-override document, so the caller's next guarded write is admitted while the item stays readable in the tracker with the id the commit kept. A handler that rewrites the embedded id leaves no revision to bind to, so that write refuses with `item_revision_conflict` although no other writer ran. An item moved out of the tracker advances the scope to the empty tombstone, and a later guarded `update`, `close` or `delete` cannot locate it. Contents the store cannot parse back make the next guarded `update`, `close` or `delete` fail with `item_document_invalid` before any revision check, and a guarded `restore` refuse with `item_revision_conflict`. An `item_store_delete` handler that skips or redirects the removal advances the scope to the item that remains.
 - The commit fence verifies the lock lease and the stored item revision first. When the lease was taken over (`lock_lost`) or the item changed after the read (`stale_revision`), the mutation refuses before `item_store_write` or `item_store_delete` (non-dry-run) runs, so a handler that persists the payload itself never commits a refused write.
 Both paths guarantee:
@@ -91,7 +91,7 @@ Both paths guarantee:
 `changed_fields` sentinel values:
 | Value | Meaning |
-|-------|---------|
+|---|---|
 | `["imported"]` | Item came from an importer. |
 | `["restored"]` | Item was restored from a previous state. |
 | `["deleted"]` | Item was deleted. |
@@ -99,7 +99,7 @@ Both paths guarantee:
 Surface matrix:
 | Surface | Create path | `mutateItem` path |
-|---------|-------------|-------------------|
+|---|---|---|
 | `onRead` hook | No | Yes |
 | `item_store_write` service override | No | Yes |
 | `history_append` service override | Yes | Yes |

package/docs/HISTORY_ATTESTATION.md CHANGED Viewed

@@ -77,7 +77,7 @@ server-local proof paths are available only to local CLI and SDK callers.
 The JSON document has exactly these fields:
 | Field | Meaning |
-| --- | --- |
+|---|---|
 | `format` | Literal `pm-history-attestation` |
 | `version` | Integer `1` |
 | `hash_algorithm` | `sha256` or `sha512`, for bundle commitments |

package/docs/HISTORY_MAINTENANCE.md CHANGED Viewed

@@ -10,7 +10,7 @@ these policies; the CLI exposes the same operations through one history family.
 ## Command paths
 | Native command | Permanent compatibility spelling | Purpose |
-| --- | --- | --- |
+|---|---|---|
 | `pm history <id>` | unchanged | Read or verify one item stream |
 | `pm history activity` | `pm activity` | Read activity across streams |
 | `pm history redact <id>` | `pm history-redact <id>` | Remove selected sensitive content |

package/docs/LIFECYCLE_COMMANDS.md CHANGED Viewed

@@ -17,7 +17,7 @@ pm contracts --command 'close many' --flags-only --json
 ## Command migration
 | Canonical invocation | Compatibility invocation |
-| --- | --- |
+|---|---|
 | `pm update many --ids <ids> --priority 1` | `pm update-many --ids <ids> --priority 1` |
 | `pm close many --ids <ids> --reason "Verified"` | `pm close-many --ids <ids> --reason "Verified"` |
 | `pm close delete <id> --dry-run` | `pm delete <id> --dry-run` |

package/docs/MCP_2026_07_28.md CHANGED Viewed

@@ -49,10 +49,10 @@ Legacy means every revision that establishes a session with an `initialize`
 handshake, which the canonical revision defines as `2025-11-25` and earlier.
 The stdio adapter therefore accepts the full initialize-era set, newest first:
-| Revision     | Accepted at `initialize` | Notes                                                                |
-| ------------ | ------------------------ | -------------------------------------------------------------------- |
-| `2025-11-25` | yes                      | Final legacy revision; offered when a client omits `protocolVersion` |
-| `2025-06-18` | yes                      | Earlier legacy revision retained for existing consumers              |
+| Revision | Accepted at `initialize` | Notes |
+|---|---|---|
+| `2025-11-25` | yes | Final legacy revision; offered when a client omits `protocolVersion` |
+| `2025-06-18` | yes | Earlier legacy revision retained for existing consumers |
 `initialize` answers with the revision the client requested, because a legacy
 client has no fall-forward mechanism and treats the answered version as the
@@ -101,18 +101,18 @@ windows. Removal is a reviewed compatibility change, never a history rewrite.
 ## Removed, migrated, and deprecated behavior
-| Prior behavior                                                    | Disposition                                                                                                 |
-| ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `initialize` and `notifications/initialized`                      | Legacy stdio adapter only; absent from modern behavior.                                                     |
-| `Mcp-Session-Id` and protocol sessions                            | Removed; explicit application handles are ordinary arguments.                                               |
-| `ping`                                                            | Legacy adapter only; modern calls return Method Not Found.                                                  |
-| `resources/subscribe` and `resources/unsubscribe`                 | Replaced by the implemented `subscriptions/listen` filter.                                                  |
-| SSE event ids and `Last-Event-ID` replay                          | Removed; callers retry with a new request id.                                                               |
-| Reverse `roots/list`, sampling, and elicitation requests          | Migrate to MRTR `input_required` under `pm-rz9gep`.                                                         |
-| Core tasks                                                        | Migrate to `io.modelcontextprotocol/tasks` under `pm-rzs24j`.                                               |
-| `logging/setLevel`                                                | Removed; optional request-local log metadata is never shared, and remote operations use host OpenTelemetry. |
-| Roots, Sampling, Logging, HTTP+SSE, and non-none `includeContext` | Retain only in bounded legacy compatibility while `pm-vzcisw` drives deprecation removal.                   |
-| Dynamic Client Registration                                       | Legacy authorization fallback; Client ID Metadata Documents are canonical under `pm-3zh9s4`.                |
+| Prior behavior | Disposition |
+|---|---|
+| `initialize` and `notifications/initialized` | Legacy stdio adapter only; absent from modern behavior. |
+| `Mcp-Session-Id` and protocol sessions | Removed; explicit application handles are ordinary arguments. |
+| `ping` | Legacy adapter only; modern calls return Method Not Found. |
+| `resources/subscribe` and `resources/unsubscribe` | Replaced by the implemented `subscriptions/listen` filter. |
+| SSE event ids and `Last-Event-ID` replay | Removed; callers retry with a new request id. |
+| Reverse `roots/list`, sampling, and elicitation requests | Migrate to MRTR `input_required` under `pm-rz9gep`. |
+| Core tasks | Migrate to `io.modelcontextprotocol/tasks` under `pm-rzs24j`. |
+| `logging/setLevel` | Removed; optional request-local log metadata is never shared, and remote operations use host OpenTelemetry. |
+| Roots, Sampling, Logging, HTTP+SSE, and non-none `includeContext` | Retain only in bounded legacy compatibility while `pm-vzcisw` drives deprecation removal. |
+| Dynamic Client Registration | Legacy authorization fallback; Client ID Metadata Documents are canonical under `pm-3zh9s4`. |
 ## Rollout, rollback, and proof

package/docs/MCP_2026_07_28_CONFORMANCE.md CHANGED Viewed

@@ -5,25 +5,25 @@ Tracker: [pm-55yf1t](../.agents/pm/tasks/pm-55yf1t.toon). The official
 every revision-level change to one canonical pm owner and records executable
 evidence or an explicit open obligation.
-| Requirement family                                                                                 | Canonical owner                                     | Current disposition                                                                                                      | Executable evidence                                                                       |
-| -------------------------------------------------------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
-| Stateless per-request version, client capabilities, and identity                                   | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon)  | Implemented                                                                                                              | `tests/unit/sdk/mcp/protocol.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts` |
-| Mandatory `server/discover`, deterministic capabilities and identity                               | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon)  | Implemented                                                                                                              | direct SDK/server tests plus plugin and release real-process probes                       |
-| Unsupported version `-32022`                                                                       | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon)  | Implemented                                                                                                              | SDK and server negative controls                                                          |
-| Header mismatch `-32020` and missing capability `-32021`                                           | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon)  | Implemented in SDK, stdio, and Streamable HTTP                                                                            | SDK negative controls and `tests/integration/mcp-streamable-http.spec.ts`                 |
-| Required result `resultType`; legacy omission means complete only at compatibility boundary        | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon)  | Implemented for modern pm results                                                                                        | SDK unit and modern direct-server tests                                                   |
-| No modern initialize, initialized notification, ping, or protocol session                          | [pm-sqvshj](../.agents/pm/decisions/pm-sqvshj.toon) | Implemented with bounded legacy stdio adapter                                                                            | modern removed-method and legacy handshake tests                                          |
-| Legacy interoperability covers every initialize-era revision the spec names   | [pm-edywqn](../.agents/pm/issues/pm-edywqn.toon)   | Implemented: `2025-11-25` and `2025-06-18` accepted, requested revision echoed                                            | `tests/integration/mcp-handshake.spec.ts` handshake matrix plus the plugin smoke `assertProtocolHandshakeMatrix` real-process gate and its negative control |
-| MRTR `input_required`, retry state, and reverse-request removal                                    | [pm-rz9gep](../.agents/pm/features/pm-rz9gep.toon)  | Implemented for SDK and stateless stdio adapter                                                                          | `tests/unit/sdk/mcp/interactions.spec.ts`; direct server negative controls                |
-| `subscriptions/listen`, request-scoped streams, no SSE resumability                                | [pm-v7e337](../.agents/pm/features/pm-v7e337.toon)  | Implemented; consumer acceptance remains a per-release gate                                                             | subscription SDK, stdio, HTTP, backpressure, disconnect, and retry tests                  |
-| Official `io.modelcontextprotocol/tasks` extension                                                 | [pm-rzs24j](../.agents/pm/features/pm-rzs24j.toon)  | Implemented for eligible tool calls, durable lifecycle, and stdio methods; notifications remain with subscriptions owner | `tests/unit/sdk/mcp/tasks.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts`    |
-| Cacheable list/read results, deterministic tools, JSON Schema 2020-12, any JSON structured content | [pm-hv1x1x](../.agents/pm/features/pm-hv1x1x.toon)  | Implemented for current pm tool/resource/prompt surfaces                                                                 | SDK schema/cache tests and direct modern server surface suite                             |
-| Issuer-bound authorization, client metadata documents, consent, headers, OpenTelemetry             | [pm-3zh9s4](../.agents/pm/features/pm-3zh9s4.toon)  | Implemented; deployment-specific identity-provider verification remains host-owned                                       | authorization SDK adversarial tests, real HTTP bearer suite, and threat model             |
-| Stable MCP Apps negotiation, tool/resource metadata, fallback, sandboxing, and accessible views    | [pm-pznhee](../.agents/pm/features/pm-pznhee.toon)  | Implemented in the public SDK and stateless server; exact-version journeys run in the published-release verifier           | `tests/unit/sdk/mcp/apps.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts`      |
-| Draft Skills over MCP list/get/read, compatibility, provenance, digests, bounds, and pagination    | [pm-8nzivt](../.agents/pm/features/pm-8nzivt.toon)  | Implemented against exact SEP-2640 draft revision; the published-release verifier checks negotiation and content digests   | `tests/unit/sdk/mcp/skills.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts`    |
-| Per-request `io.modelcontextprotocol/logLevel`; omission forbids `notifications/message`          | [pm-pd7nh0](../.agents/pm/tasks/pm-pd7nh0.toon)    | SDK validates the eight severity values and rejects malformed metadata with `-32602`; pm emits no protocol log notifications | `tests/unit/sdk/mcp/protocol.spec.ts`, real stdio and Streamable HTTP negative controls |
-| Deprecated Roots, Sampling, Logging, HTTP+SSE, `includeContext`, dynamic registration              | [pm-vzcisw](../.agents/pm/chores/pm-vzcisw.toon)    | Canonical source ratcheted; bounded stdio adapter and dated migration policy remain                                      | generated inventory, negative controls, adapter tests, and migration guide                |
-| Official schema, real stdio/HTTP, packed/published, npx/bunx, negative controls                    | [pm-55yf1t](../.agents/pm/tasks/pm-55yf1t.toon)     | Conformance and released-consumer gates implemented; each release must produce its own acceptance evidence                 | SDK/server suites, plugin smokes, published-release verifier                              |
+| Requirement family | Canonical owner | Current disposition | Executable evidence |
+|---|---|---|---|
+| Stateless per-request version, client capabilities, and identity | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon) | Implemented | `tests/unit/sdk/mcp/protocol.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts` |
+| Mandatory `server/discover`, deterministic capabilities and identity | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon) | Implemented | direct SDK/server tests plus plugin and release real-process probes |
+| Unsupported version `-32022` | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon) | Implemented | SDK and server negative controls |
+| Header mismatch `-32020` and missing capability `-32021` | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon) | Implemented in SDK, stdio, and Streamable HTTP | SDK negative controls and `tests/integration/mcp-streamable-http.spec.ts` |
+| Required result `resultType`; legacy omission means complete only at compatibility boundary | [pm-vae5ec](../.agents/pm/features/pm-vae5ec.toon) | Implemented for modern pm results | SDK unit and modern direct-server tests |
+| No modern initialize, initialized notification, ping, or protocol session | [pm-sqvshj](../.agents/pm/decisions/pm-sqvshj.toon) | Implemented with bounded legacy stdio adapter | modern removed-method and legacy handshake tests |
+| Legacy interoperability covers every initialize-era revision the spec names | [pm-edywqn](../.agents/pm/issues/pm-edywqn.toon) | Implemented: `2025-11-25` and `2025-06-18` accepted, requested revision echoed | `tests/integration/mcp-handshake.spec.ts` handshake matrix plus the plugin smoke `assertProtocolHandshakeMatrix` real-process gate and its negative control |
+| MRTR `input_required`, retry state, and reverse-request removal | [pm-rz9gep](../.agents/pm/features/pm-rz9gep.toon) | Implemented for SDK and stateless stdio adapter | `tests/unit/sdk/mcp/interactions.spec.ts`; direct server negative controls |
+| `subscriptions/listen`, request-scoped streams, no SSE resumability | [pm-v7e337](../.agents/pm/features/pm-v7e337.toon) | Implemented; consumer acceptance remains a per-release gate | subscription SDK, stdio, HTTP, backpressure, disconnect, and retry tests |
+| Official `io.modelcontextprotocol/tasks` extension | [pm-rzs24j](../.agents/pm/features/pm-rzs24j.toon) | Implemented for eligible tool calls, durable lifecycle, and stdio methods; notifications remain with subscriptions owner | `tests/unit/sdk/mcp/tasks.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts` |
+| Cacheable list/read results, deterministic tools, JSON Schema 2020-12, any JSON structured content | [pm-hv1x1x](../.agents/pm/features/pm-hv1x1x.toon) | Implemented for current pm tool/resource/prompt surfaces | SDK schema/cache tests and direct modern server surface suite |
+| Issuer-bound authorization, client metadata documents, consent, headers, OpenTelemetry | [pm-3zh9s4](../.agents/pm/features/pm-3zh9s4.toon) | Implemented; deployment-specific identity-provider verification remains host-owned | authorization SDK adversarial tests, real HTTP bearer suite, and threat model |
+| Stable MCP Apps negotiation, tool/resource metadata, fallback, sandboxing, and accessible views | [pm-pznhee](../.agents/pm/features/pm-pznhee.toon) | Implemented in the public SDK and stateless server; exact-version journeys run in the published-release verifier | `tests/unit/sdk/mcp/apps.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts` |
+| Draft Skills over MCP list/get/read, compatibility, provenance, digests, bounds, and pagination | [pm-8nzivt](../.agents/pm/features/pm-8nzivt.toon) | Implemented against exact SEP-2640 draft revision; the published-release verifier checks negotiation and content digests | `tests/unit/sdk/mcp/skills.spec.ts`, `tests/integration/mcp-stateless-protocol.spec.ts` |
+| Per-request `io.modelcontextprotocol/logLevel`; omission forbids `notifications/message` | [pm-pd7nh0](../.agents/pm/tasks/pm-pd7nh0.toon) | SDK validates the eight severity values and rejects malformed metadata with `-32602`; pm emits no protocol log notifications | `tests/unit/sdk/mcp/protocol.spec.ts`, real stdio and Streamable HTTP negative controls |
+| Deprecated Roots, Sampling, Logging, HTTP+SSE, `includeContext`, dynamic registration | [pm-vzcisw](../.agents/pm/chores/pm-vzcisw.toon) | Canonical source ratcheted; bounded stdio adapter and dated migration policy remain | generated inventory, negative controls, adapter tests, and migration guide |
+| Official schema, real stdio/HTTP, packed/published, npx/bunx, negative controls | [pm-55yf1t](../.agents/pm/tasks/pm-55yf1t.toon) | Conformance and released-consumer gates implemented; each release must produce its own acceptance evidence | SDK/server suites, plugin smokes, published-release verifier |
 This matrix describes implementation coverage, not a blanket certification of
 every deployed artifact. Programme completion requires each owner's positive

package/docs/MCP_REMOTE_TRANSPORT_SECURITY.md CHANGED Viewed

@@ -43,16 +43,16 @@ pm-mcp-http
 Configuration is explicit and environment-only:
-| Variable                      | Meaning                                             | Default            |
-| ----------------------------- | --------------------------------------------------- | ------------------ |
-| `PM_MCP_HTTP_HOST`            | Bind host                                           | `127.0.0.1`        |
-| `PM_MCP_HTTP_PORT`            | Bind port, including `0` for an ephemeral test port | `3000`             |
-| `PM_MCP_HTTP_ALLOWED_ORIGINS` | Comma-separated exact browser origins               | none               |
-| `PM_MCP_HTTP_BEARER_TOKEN`    | Opaque deployment token for the bundled verifier    | none               |
-| `PM_MCP_HTTP_AUTH_ISSUER`     | Exact HTTPS authorization-server issuer             | none               |
-| `PM_MCP_HTTP_RESOURCE`        | Canonical MCP resource/audience URI                 | none               |
-| `PM_MCP_HTTP_SCOPES`          | Space-separated consent scopes                      | `pm:read pm:write` |
-| `PM_MCP_DISCOVERY_CURSOR_KEY` | Shared 32-byte-or-longer secret for discovery pages | process-local key  |
+| Variable | Meaning | Default |
+|---|---|---|
+| `PM_MCP_HTTP_HOST` | Bind host | `127.0.0.1` |
+| `PM_MCP_HTTP_PORT` | Bind port, including `0` for an ephemeral test port | `3000` |
+| `PM_MCP_HTTP_ALLOWED_ORIGINS` | Comma-separated exact browser origins | none |
+| `PM_MCP_HTTP_BEARER_TOKEN` | Opaque deployment token for the bundled verifier | none |
+| `PM_MCP_HTTP_AUTH_ISSUER` | Exact HTTPS authorization-server issuer | none |
+| `PM_MCP_HTTP_RESOURCE` | Canonical MCP resource/audience URI | none |
+| `PM_MCP_HTTP_SCOPES` | Space-separated consent scopes | `pm:read pm:write` |
+| `PM_MCP_DISCOVERY_CURSOR_KEY` | Shared 32-byte-or-longer secret for discovery pages | process-local key |
 A non-loopback bind fails closed unless token, issuer, and resource are all
 present. Production deployments should normally call
@@ -151,18 +151,18 @@ inherit one another's trace context. Raw bearer tokens are hashed for
 constant-time comparison by the bundled verifier and are never included in
 claims, errors, traces, or JSON-RPC result data.
-| Threat                         | Enforced boundary                                                               |
-| ------------------------------ | ------------------------------------------------------------------------------- |
-| DNS rebinding/browser drive-by | Loopback default plus exact `Origin` allowlist                                  |
-| Token passthrough              | Bearer is verified at pm and never forwarded to another service                 |
-| Issuer mix-up                  | Exact discovery/response issuer checks and issuer-keyed credentials             |
-| Confused audience              | Exact protected-resource audience check                                         |
-| Excess authority               | Required-scope intersection before dispatch                                     |
-| Query/log credential leak      | Query tokens rejected; challenges and errors omit token material                |
-| Header injection               | Schema-derived allowlist, reserved-name checks, control-byte rejection          |
-| Trace privacy leak             | Syntax/size validation, baggage-key allowlist, request-local storage            |
-| Proxy cache disclosure         | MCP and metadata errors use explicit content types; MCP results use `no-store`  |
-| Replay after disconnect        | No session, event id, resume cursor, or redelivery; retry uses a new request id |
+| Threat | Enforced boundary |
+|---|---|
+| DNS rebinding/browser drive-by | Loopback default plus exact `Origin` allowlist |
+| Token passthrough | Bearer is verified at pm and never forwarded to another service |
+| Issuer mix-up | Exact discovery/response issuer checks and issuer-keyed credentials |
+| Confused audience | Exact protected-resource audience check |
+| Excess authority | Required-scope intersection before dispatch |
+| Query/log credential leak | Query tokens rejected; challenges and errors omit token material |
+| Header injection | Schema-derived allowlist, reserved-name checks, control-byte rejection |
+| Trace privacy leak | Syntax/size validation, baggage-key allowlist, request-local storage |
+| Proxy cache disclosure | MCP and metadata errors use explicit content types; MCP results use `no-store` |
+| Replay after disconnect | No session, event id, resume cursor, or redelivery; retry uses a new request id |
 ## Deprecated-feature inventory and sunset

package/docs/MCP_SKILLS_AND_APPS.md CHANGED Viewed

@@ -75,7 +75,7 @@ SDK-backed tools. `resources/list` and `resources/read` expose the corresponding
 `ui://` documents:
 | View | Authoritative tool | Purpose |
-| --- | --- | --- |
+|---|---|---|
 | Context explorer | `pm_context` | Context, provenance, omissions, and token cost |
 | Relationship graph | `pm_graph` | Typed edges, explaining paths, and governance |
 | Plan and milestone | `pm_plan` | Steps, dependencies, decisions, and validation |

package/docs/MERGE_SAFETY.md CHANGED Viewed

@@ -136,12 +136,12 @@ History scalar rebasing and ignored settlement artifacts are tracked by
 [pm-gh1553](../.agents/pm/issues/pm-gh1553.toon) and
 [pm-gh1556](../.agents/pm/issues/pm-gh1556.toon).
-| Artifact                                                         | Driver                              | Merge behavior                                                                                                                                                                                                                                                                      |
-| ---------------------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Item `.toon` / `.md`                                             | `pm-item-toon` / `pm-item-markdown` | Three-way field merge; append-like collections use set union, `updated_at` uses the latest timestamp, scalar conflicts select the value from the later document update with stable value order as an equal-timestamp tie-break, and canonical serialization recomputes TOON counts. |
-| `history/*.jsonl`                                                | `pm-history`                        | Preserves the common prefix and both divergent suffixes, orders deterministically, then re-anchors the resulting hash chain.                                                                                                                                                        |
-| tracker `**/*.jsonl` except the later `history/*.jsonl` override | `pm-relationship`                   | Covers default and package-owned custom relationship event paths, unions divergent suffixes by `eventId` (timestamp-ordered, ours-first on ties), and renumbers `sequence` consecutively so the strict-sequence store loader accepts the merged stream.                             |
-| root `settings.json` and nested `**/*.json`                      | `pm-json`                           | Recursively merges objects per key. Arrays compose when both branches preserve the base and add distinct entries, so independent extension installs and evaluation additions merge without weakening edit/removal conflict detection.                                               |
+| Artifact | Driver | Merge behavior |
+|---|---|---|
+| Item `.toon` / `.md` | `pm-item-toon` / `pm-item-markdown` | Three-way field merge; append-like collections use set union, `updated_at` uses the latest timestamp, scalar conflicts select the value from the later document update with stable value order as an equal-timestamp tie-break, and canonical serialization recomputes TOON counts. |
+| `history/*.jsonl` | `pm-history` | Preserves the common prefix and both divergent suffixes, orders deterministically, then re-anchors the resulting hash chain. |
+| tracker `**/*.jsonl` except the later `history/*.jsonl` override | `pm-relationship` | Covers default and package-owned custom relationship event paths, unions divergent suffixes by `eventId` (timestamp-ordered, ours-first on ties), and renumbers `sequence` consecutively so the strict-sequence store loader accepts the merged stream. |
+| root `settings.json` and nested `**/*.json` | `pm-json` | Recursively merges objects per key. Arrays compose when both branches preserve the base and add distinct entries, so independent extension installs and evaluation additions merge without weakening edit/removal conflict detection. |
 History union validates each event in its original branch before rebasing its
 effects. A whole metadata-field replacement still assigns its exact value when

package/docs/MUTATION_INTEGRITY.md CHANGED Viewed

@@ -32,11 +32,11 @@ pm config project set mutation_guard_stale_in_progress_hours 48
 Defaults preserve author compatibility while providing secret advice:
-| Setting                                    | Default  | Behavior                                                 |
-| ------------------------------------------ | -------- | -------------------------------------------------------- |
-| `mutation_guard.require_attributed_author` | `false`  | When enabled, reject an effective author of `unknown`.   |
-| `mutation_guard.secret_guard`              | `advise` | `off`, stderr/structured `advise`, or pre-write `block`. |
-| `mutation_guard.stale_in_progress_hours`   | `72`     | Age threshold for unclaimed active work in `pm health`.  |
+| Setting | Default | Behavior |
+|---|---|---|
+| `mutation_guard.require_attributed_author` | `false` | When enabled, reject an effective author of `unknown`. |
+| `mutation_guard.secret_guard` | `advise` | `off`, stderr/structured `advise`, or pre-write `block`. |
+| `mutation_guard.stale_in_progress_hours` | `72` | Age threshold for unclaimed active work in `pm health`. |
 A blocking secret policy may be bypassed only by an explicit `--force` on a
 force-capable mutation. The warning records that an override occurred while

package/docs/OUTPUT_PROJECTION_CONTRACTS.md CHANGED Viewed

@@ -64,13 +64,13 @@ explicit receipt with `has_omissions: false`,
 Mutually exclusive output modes emit only their active row collection:
-| Command mode                | Active row key        | Withheld group | Restore          |
-| --------------------------- | --------------------- | -------------- | ---------------- |
-| `activity` (digest default) | `activity_digest`     | `event_rows`   | `--raw`          |
-| `activity --raw/--compact`  | `compact_activity`    | `provenance`   | `--full`         |
-| `activity --full`           | `activity`            | none           | already complete |
-| `history` (compact default) | `compact_history`     | `raw_history`  | `--full`         |
-| `history --full`            | `history`             | none           | already complete |
+| Command mode | Active row key | Withheld group | Restore |
+|---|---|---|---|
+| `activity` (digest default) | `activity_digest` | `event_rows` | `--raw` |
+| `activity --raw/--compact` | `compact_activity` | `provenance` | `--full` |
+| `activity --full` | `activity` | none | already complete |
+| `history` (compact default) | `compact_history` | `raw_history` | `--full` |
+| `history --full` | `history` | none | already complete |
 Inactive row keys are omitted, not zero-filled. This makes a wrong parser loud:
 reading `.activity` from compact activity now yields a missing key instead of a
@@ -177,11 +177,11 @@ for their domain without adding package-specific logic to the CLI renderer.
 The following bounded built-ins now use this shared declaration:
-| Command mode        | Withheld group                                           | Restore  |
-| ------------------- | -------------------------------------------------------- | -------- |
-| `deps --summary`    | selected dependency tree, graph, or relationship context | `--full` |
-| `graph --summary`   | `result_rows`                                            | `--full` |
-| `validate --counts` | `diagnostic_rows`                                        | `--full` |
+| Command mode | Withheld group | Restore |
+|---|---|---|
+| `deps --summary` | selected dependency tree, graph, or relationship context | `--full` |
+| `graph --summary` | `result_rows` | `--full` |
+| `validate --counts` | `diagnostic_rows` | `--full` |
 Passing `--full` with the corresponding compact flag is a usage error. An
 explicit full request and the default full request produce the same payload
@@ -337,7 +337,7 @@ metadata as a continuation negative control. The checked-in report is
 [`scripts/release/context-intent-calibration.json`](../scripts/release/context-intent-calibration.json).
 | Intent | 2-item tokens / budget | 2,243-item tokens / budget | Current-scale rows | Degradation |
-| ------ | ---------------------- | -------------------------- | ------------------ | ----------- |
+|---|---|---|---|---|
 | `context:orient` | 735 / 2,400 | 1,028 / 2,400 | 3 | bounded sections |
 | `get:inspect` | 401 / 3,200 | 415 / 3,200 | item envelope | standard item |
 | `list:triage` | 443 / 3,200 | 3,189 / 3,200 | 69 | budget-derived rows |
@@ -348,7 +348,7 @@ Whole-answer cursor cost is measured against the unprojected single call for
 the identical ordered row set:
 | Family | Rows | Pages | Optimized bytes/row | Optimized walk | Repeated-metadata control | Unbounded call | Walk / unbounded |
-| ------ | ---- | ----- | ------------------- | -------------- | ------------------------- | -------------- | ---------------- |
+|---|---|---|---|---|---|---|---|
 | `list:triage` | 1,998 | 31 | 172.93 | 345,519 B | 387,489 B | 1,558,741 B | 0.2217 |
 | `search:discover` | 1,998 | 66 | 202.50 | 404,591 B | 470,046 B | 1,681,847 B | 0.2406 |

package/docs/PACKED_FIRST_RUN.md CHANGED Viewed

@@ -14,7 +14,7 @@ node scripts/release/packed-first-run.mjs /path/to/installed/@unbrained/pm-cli
 ```
 | Journey | Required observation |
-| --- | --- |
+|---|---|
 | Installed README | Ordered init/create/list from `60 Second Example`; missing/reordered commands, unsupported expressions or unbalanced quotes fail. No shell execution. |
 | Persistence | Each command returns nonempty output below 4,096 characters; the created item exists. |
 | Branch merge | Independent comments survive a real Git merge; reconciliation and strict history verification succeed. |

package/docs/QUICKSTART.md CHANGED Viewed

@@ -94,16 +94,16 @@ pm create \
 Useful item types:
-| Type                                        | Use                                                         |
-| ------------------------------------------- | ----------------------------------------------------------- |
-| `Epic`                                      | broad outcome or initiative                                 |
-| `Feature`                                   | user-facing capability or major slice                       |
-| `Task`                                      | implementation work                                         |
-| `Chore`                                     | maintenance, refactoring, or housekeeping work              |
-| `Issue`                                     | bug or defect                                               |
-| `Decision`                                  | recorded choice and rationale                               |
-| `Plan`                                      | agent-optimized living plan with ordered steps and evidence |
-| `Event`, `Reminder`, `Milestone`, `Meeting` | calendar-aware planning                                     |
+| Type | Use |
+|---|---|
+| `Epic` | broad outcome or initiative |
+| `Feature` | user-facing capability or major slice |
+| `Task` | implementation work |
+| `Chore` | maintenance, refactoring, or housekeeping work |
+| `Issue` | bug or defect |
+| `Decision` | recorded choice and rationale |
+| `Plan` | agent-optimized living plan with ordered steps and evidence |
+| `Event`, `Reminder`, `Milestone`, `Meeting` | calendar-aware planning |
 ## Find and Claim Work

package/docs/README.md CHANGED Viewed

@@ -17,17 +17,17 @@ pm guide release --json
 ## Read Path
-| Reader                              | First page                                  | Then read                                                                                                                                                      |
-| ----------------------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| New user                            | [Quickstart](QUICKSTART.md)                 | [Command Reference](COMMANDS.md)                                                                                                                               |
-| New maintainer                      | [Onboarding](ONBOARDING.md)                 | [Agent Guide](AGENT_GUIDE.md), [Testing](TESTING.md), [Releasing](RELEASING.md)                                                                                |
-| Coding agent                        | [Agent Guide](AGENT_GUIDE.md)               | [Configuration](CONFIGURATION.md), then command help                                                                                                           |
-| Maintainer                          | [Contributing](../CONTRIBUTING.md)          | [Testing](TESTING.md), [Releasing](RELEASING.md), [Architecture](ARCHITECTURE.md)                                                                              |
-| Package author                      | [Packages and Extensions](EXTENSIONS.md)    | [SDK](SDK.md), [starter extension](examples/starter-extension/README.md)                                                                                       |
-| Codex or ChatGPT plugin implementer | [Codex Plugin](CODEX_PLUGIN.md)             | [Native ChatGPT and Codex Plugin Implementation Plan](CHATGPT_CODEX_PLUGIN_IMPLEMENTATION.md)                                                                  |
-| Codex user                          | [Codex Plugin](CODEX_PLUGIN.md)             | [Agent Guide](AGENT_GUIDE.md), then [Command Reference](COMMANDS.md)                                                                                           |
-| Claude Code user                    | [Claude Code Plugin](CLAUDE_CODE_PLUGIN.md) | [Agent Guide](AGENT_GUIDE.md), then [Command Reference](COMMANDS.md)                                                                                           |
-| Machine client                      | `pm contracts --json`                       | [CLI Scripting Contract](SCRIPTING.md), [Command Reference](COMMANDS.md#machine-contracts), optionally `pm install guide-shell --project && pm guide commands` |
+| Reader | First page | Then read |
+|---|---|---|
+| New user | [Quickstart](QUICKSTART.md) | [Command Reference](COMMANDS.md) |
+| New maintainer | [Onboarding](ONBOARDING.md) | [Agent Guide](AGENT_GUIDE.md), [Testing](TESTING.md), [Releasing](RELEASING.md) |
+| Coding agent | [Agent Guide](AGENT_GUIDE.md) | [Configuration](CONFIGURATION.md), then command help |
+| Maintainer | [Contributing](../CONTRIBUTING.md) | [Testing](TESTING.md), [Releasing](RELEASING.md), [Architecture](ARCHITECTURE.md) |
+| Package author | [Packages and Extensions](EXTENSIONS.md) | [SDK](SDK.md), [starter extension](examples/starter-extension/README.md) |
+| Codex or ChatGPT plugin implementer | [Codex Plugin](CODEX_PLUGIN.md) | [Native ChatGPT and Codex Plugin Implementation Plan](CHATGPT_CODEX_PLUGIN_IMPLEMENTATION.md) |
+| Codex user | [Codex Plugin](CODEX_PLUGIN.md) | [Agent Guide](AGENT_GUIDE.md), then [Command Reference](COMMANDS.md) |
+| Claude Code user | [Claude Code Plugin](CLAUDE_CODE_PLUGIN.md) | [Agent Guide](AGENT_GUIDE.md), then [Command Reference](COMMANDS.md) |
+| Machine client | `pm contracts --json` | [CLI Scripting Contract](SCRIPTING.md), [Command Reference](COMMANDS.md#machine-contracts), optionally `pm install guide-shell --project && pm guide commands` |
 ## Documentation Map
@@ -127,16 +127,16 @@ Additional SDK, operations, and generated contracts:
 ## Guide Topic Map
-| Optional `pm guide` topic | Primary docs                                                                                        |
-| ------------------------- | --------------------------------------------------------------------------------------------------- |
-| `quickstart`              | [Quickstart](QUICKSTART.md), [Command Reference](COMMANDS.md)                                       |
-| `commands`                | [Command Reference](COMMANDS.md), [Configuration](CONFIGURATION.md)                                 |
-| `workflows`               | [Agent Guide](AGENT_GUIDE.md), [Testing](TESTING.md)                                                |
-| `sdk`                     | [SDK](SDK.md), [SDK context contracts](SDK_CONTEXT.md), [Architecture](ARCHITECTURE.md)             |
-| `extensions`, `packages`  | [Packages and Extensions](EXTENSIONS.md), [starter extension](examples/starter-extension/README.md) |
-| `skills`                  | [Agent Guide](AGENT_GUIDE.md) plus `.agents/skills/*`                                               |
-| `harnesses`               | [Agent Guide](AGENT_GUIDE.md) plus `.agents/skills/HARNESS_COMPATIBILITY.md`                        |
-| `release`                 | [Releasing](RELEASING.md), [CHANGELOG](../CHANGELOG.md)                                             |
+| Optional `pm guide` topic | Primary docs |
+|---|---|
+| `quickstart` | [Quickstart](QUICKSTART.md), [Command Reference](COMMANDS.md) |
+| `commands` | [Command Reference](COMMANDS.md), [Configuration](CONFIGURATION.md) |
+| `workflows` | [Agent Guide](AGENT_GUIDE.md), [Testing](TESTING.md) |
+| `sdk` | [SDK](SDK.md), [SDK context contracts](SDK_CONTEXT.md), [Architecture](ARCHITECTURE.md) |
+| `extensions`, `packages` | [Packages and Extensions](EXTENSIONS.md), [starter extension](examples/starter-extension/README.md) |
+| `skills` | [Agent Guide](AGENT_GUIDE.md) plus `.agents/skills/*` |
+| `harnesses` | [Agent Guide](AGENT_GUIDE.md) plus `.agents/skills/HARNESS_COMPATIBILITY.md` |
+| `release` | [Releasing](RELEASING.md), [CHANGELOG](../CHANGELOG.md) |
 Community files:

package/docs/READ_OUTPUT_CONTRACTS.md CHANGED Viewed

@@ -10,12 +10,12 @@ Complete package-envelope fitting and session-reference recovery are tracked by
 Every built-in read surface uses four output dimensions: what to include, how much to return, how much the result may cost, and how to encode it. The same canonical controls work through the CLI, SDK, MCP, generated schemas, runtime contracts, and shell completions.
-| Dimension | CLI                              | SDK and MCP     | Meaning                                                                |
-| --------- | -------------------------------- | --------------- | ---------------------------------------------------------------------- |
-| Include   | `--output-include <csv>`         | `outputInclude` | Retain named fields or sections, or select a declared projection mode. |
-| Amount    | `--output-limit <n\|unbounded>`  | `outputLimit`   | Bound shared row collections.                                          |
-| Cost      | `--output-budget <n\|unbounded>` | `outputBudget`  | Fail closed when even the compact result cannot fit.                   |
-| Encoding  | `--output-format <toon\|json>`   | `outputFormat`  | Select the CLI renderer and record the requested encoding.             |
+| Dimension | CLI | SDK and MCP | Meaning |
+|---|---|---|---|
+| Include | `--output-include <csv>` | `outputInclude` | Retain named fields or sections, or select a declared projection mode. |
+| Amount | `--output-limit <n\|unbounded>` | `outputLimit` | Bound shared row collections. |
+| Cost | `--output-budget <n\|unbounded>` | `outputBudget` | Fail closed when even the compact result cannot fit. |
+| Encoding | `--output-format <toon\|json>` | `outputFormat` | Select the CLI renderer and record the requested encoding. |
 The contract covers `list`, `context`, `search`, `get`, `next`, `health`, `deps`, `graph`, `history`, `activity`, `validate`, `events`, `contracts`, `comments`, `notes`, `files`, `docs`, `stats`, and `aggregate`, including list aliases and `ctx`.
@@ -295,9 +295,9 @@ may only shrink, while repeat suppression may only hold or improve. The gate
 also fixes the expected unique-fact shape:
 | Tracker tier | Group spend / budget | Seen items | Suppressed repeats | Delivered bytes |
-| ------------ | -------------------- | ---------- | ------------------ | --------------- |
-| 2 items      | 3,820 / 20,000       | 2          | 3                  | 15,274          |
-| 2,243 items  | 10,156 / 20,000      | 106        | 7                  | 40,614          |
+|---|---|---|---|---|
+| 2 items | 3,820 / 20,000 | 2 | 3 | 15,274 |
+| 2,243 items | 10,156 / 20,000 | 106 | 7 | 40,614 |
 These are deterministic synthetic-corpus measurements from
 `scripts/release/context-intent-calibration.json`; they contain no hosted

package/docs/RECURRENCE_RECOVERY_CONTRACTS.md CHANGED Viewed

@@ -99,7 +99,7 @@ The refusal contract distinguishes four states before any command-specific
 read or mutation begins:
 | Selected root state | Code | Exit | Recovery |
-| --- | --- | ---: | --- |
+|---|---|---:|---|
 | Path does not exist | `tracker_root_missing` | 3 | Tokenized, non-interactive `pm --pm-path <path> init --defaults --agent-guidance skip` |
 | Directory exists but `settings.json` does not | `tracker_not_initialized` | 3 | The same initialization retry |
 | Path or ancestor is a regular file | `tracker_root_not_directory` | 2 | Select a directory; never suggest `pm init` against the file |

package/docs/RELEASING.md CHANGED Viewed

@@ -220,15 +220,15 @@ Signal tiers:
 Category precedence (first matching bucket wins):
-| Priority | Category     | Trigger terms (from strong + weak signals unless noted)                                                                                 |
-| -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
-| 1        | `Security`   | `security`, `cve`, `vulnerability`                                                                                                      |
-| 2        | `Deprecated` | `deprecated`, `deprecation`                                                                                                             |
-| 3        | `Removed`    | `removed`, `remove`, `deleted`, `delete`                                                                                                |
-| 4        | `Fixed`      | `fix`, `fixed`, `bug`, `bugfix`, `hotfix`, `regression`                                                                                 |
-| 5        | `Added`      | `feature`, `feat`, `added`, `add`, `new`                                                                                                |
-| 6        | `Changed`    | strong-signal `change`, `changed`, `refactor`, `update`, `updated`, `improve`; for non-bug-like types only, title fallback is also used |
-| 7        | `Other`      | no classifier match                                                                                                                     |
+| Priority | Category | Trigger terms (from strong + weak signals unless noted) |
+|---|---|---|
+| 1 | `Security` | `security`, `cve`, `vulnerability` |
+| 2 | `Deprecated` | `deprecated`, `deprecation` |
+| 3 | `Removed` | `removed`, `remove`, `deleted`, `delete` |
+| 4 | `Fixed` | `fix`, `fixed`, `bug`, `bugfix`, `hotfix`, `regression` |
+| 5 | `Added` | `feature`, `feat`, `added`, `add`, `new` |
+| 6 | `Changed` | strong-signal `change`, `changed`, `refactor`, `update`, `updated`, `improve`; for non-bug-like types only, title fallback is also used |
+| 7 | `Other` | no classifier match |
 Bug-like default:
@@ -284,7 +284,16 @@ semantic class is `usage`, `not_found`, or `conflict`. Message and title prose
 never participate. Unknown codes, missing or mismatched exits, unhandled
 events, and every `generic_failure` or `dependency_failed` remain blocking.
 This keeps rewording independent from release policy and makes stale or broad
-message allowlists impossible.
+message allowlists impossible. The gate skips issues seen only in
+`environment=test` (opted-in CI tests); an issue with any other event counts
+whenever any of its events falls inside the activity window. Activity and
+environment are separate Sentry queries, because Sentry applies `lastSeen` after
+an environment filter: a combined query would also skip an issue whose
+production event predates the window while a test event falls inside it. When
+the listing of issues with non-test events may be truncated, nothing is skipped,
+and a failed listing fails the gate. Both listings follow Sentry's next-page links
+up to `--sentry-limit` (default `200`); when active issues remain beyond it, the
+gate fails, because it cannot judge issues it never read.
 Sentry API requests use a 120-second deadline by default. Operators can set
 `--sentry-request-timeout-ms` between `1` and `300000` when reproducing