@unbrained/pm-cli 2026.8.31 → 2026.9.2

package/docs/MCP_REMOTE_TRANSPORT_SECURITY.md

@@ -1,6 +1,7 @@
 # MCP Remote Transport, Authorization, and Migration
 
-Tracker references: [pm-v7e337](../.agents/pm/features/pm-v7e337.toon),
+Tracker references: [pm-3g3f8z](../.agents/pm/features/pm-3g3f8z.toon),
+[pm-v7e337](../.agents/pm/features/pm-v7e337.toon),
 [pm-3zh9s4](../.agents/pm/features/pm-3zh9s4.toon), and
 [pm-vzcisw](../.agents/pm/chores/pm-vzcisw.toon).
 
@@ -36,6 +37,7 @@ Configuration is explicit and environment-only:
 | `PM_MCP_HTTP_AUTH_ISSUER`     | Exact HTTPS authorization-server issuer             | none               |
 | `PM_MCP_HTTP_RESOURCE`        | Canonical MCP resource/audience URI                 | none               |
 | `PM_MCP_HTTP_SCOPES`          | Space-separated consent scopes                      | `pm:read pm:write` |
+| `PM_MCP_DISCOVERY_CURSOR_KEY` | Shared 32-byte-or-longer secret for discovery pages | process-local key  |
 
 A non-loopback bind fails closed unless token, issuer, and resource are all
 present. Production deployments should normally call
@@ -50,9 +52,17 @@ placing a real credential in documentation:
 PM_MCP_HTTP_BEARER_TOKEN='<deployment-secret>' \
 PM_MCP_HTTP_AUTH_ISSUER='https://auth.example.test' \
 PM_MCP_HTTP_RESOURCE='http://127.0.0.1:3000/mcp' \
+PM_MCP_DISCOVERY_CURSOR_KEY='<32-byte-or-longer-random-secret>' \
 pm-mcp-http
 ```
 
+Single-process deployments may omit the discovery cursor key. That selects a
+random process-local HMAC key and deliberately makes pagination process-affine:
+a restart or another worker rejects the cursor as stale. Multi-worker or
+restart-continuous deployments must provide the same high-entropy value to
+every worker. Rotating it invalidates outstanding discovery cursors without
+exposing the key in MCP input, output, errors, traces, or cache identities.
+
 The adapter serves RFC 9728 protected-resource metadata at both
 `/.well-known/oauth-protected-resource` and the path-qualified
 `/.well-known/oauth-protected-resource/mcp` location.

package/docs/MERGE_SAFETY.md

@@ -97,7 +97,34 @@ pm merge report
 pm merge report --include-reconciled
 ```
 
-The underlying public SDK exports are `mergeItemDocuments`, `mergeHistoryStreams`, `mergeRelationshipEventStreams`, `mergeJsonDocuments`, `runMergeDriver`, `runMergeInstall`, `installMergeFence`, `findGitWorkspaceRoot`, `runMergeReconcile`, `runMergeReceiptReport`, `listMergeReceipts`, `auditMergeDriverConfiguration`, `refreshMergeAttributeFenceIfInstalled`, `buildMergeAttributePatterns`, and `auditMergeAttributeFence` from `@unbrained/pm-cli/sdk`. `installMergeFence` accepts explicit tracker and workspace roots, so custom init hosts do not depend on process cwd or CLI globals.
+The underlying public SDK exports are `mergeItemDocuments`, `mergeHistoryStreams`, `mergeRelationshipEventStreams`, `mergeJsonDocuments`, `runMergeDriver`, `runMergeInstall`, `installMergeFence`, `findGitWorkspaceRoot`, `runMergeReconcile`, `runMergeReceiptReport`, `runMergeReceiptEvidenceReport`, `inspectMergeReceiptEvidence`, `listMergeReceipts`, `auditMergeDriverConfiguration`, `refreshMergeAttributeFenceIfInstalled`, `buildMergeAttributePatterns`, and `auditMergeAttributeFence` from `@unbrained/pm-cli/sdk`. `installMergeFence` accepts explicit tracker and workspace roots, so custom init hosts do not depend on process cwd or CLI globals.
+
+`listMergeReceipts` is the compatibility projection for callers that only need
+validated receipts. It cannot distinguish an empty evidence store from a store
+whose candidates were all rejected. Gates and diagnostic integrations should
+use `inspectMergeReceiptEvidence`, whose `invalid_evidence_count` preserves
+that distinction without returning malformed contents.
+`runMergeReceiptEvidenceReport` and `pm merge report --json` expose the same
+loss-aware contract through `complete`, `invalid_evidence_count`, bounded
+`invalid_evidence[]`, `invalid_evidence_truncated`, and
+`clone_local_evidence_resolved`. Each rejected candidate reports a stable
+reason plus its `clone_local`, `durable`, or copy-consistency source. A safe
+receipt filename is returned as `receipt_id`; unsafe candidate names are
+represented only by `candidate_name_hash`, and malformed contents are never
+returned. The detail list is capped at 100 rows while the count remains exact,
+so automated gates stay token-bounded. Directory traversal distinguishes a
+truly absent store from a non-directory or unreadable ancestor on Windows and
+POSIX instead of treating platform-specific `ENOENT`/`ENOTDIR` spellings as
+equivalent. Full health also cross-checks the privacy-safe receipt summaries in
+append-only history against valid pending and reconciled evidence. Missing
+evidence emits `merge_receipt_history_reference_missing:<n>` with bounded item,
+history-line, and receipt-id-or-hash coordinates. Its remediation enumerates
+the exact references and directs recovery from an authoritative clone or
+backup; it never recommends deleting receipts or rewriting history. The CLI
+exits nonzero when evidence is incomplete, even when the valid-receipt count is
+zero. Current SDK implementations always emit the new field, while its optional
+type preserves structural compatibility for existing typed adapters and test
+fixtures. `runMergeReceiptReport` remains the compatible valid-only report.
 
 ## Cross-branch id collision safety
 
@@ -189,7 +216,22 @@ pm merge reconcile --dry-run --json
 
 `history-repair` records the reconciliation patch and classifies its changed fields against the final item. Append-only collection unions and deterministic reordering are reported as preserved context without a data-loss warning. Fields whose replayed values are actually removed or replaced remain loud with discarded event authors/operations and recovery guidance. Re-apply any intended losing mutation as a normal `pm update` so it remains explicit and auditable.
 
-History events now declare an item-hash epoch. The current epoch preserves linked-test insertion order; unversioned streams are verified against both the legacy sorted-test canonicalization and the order-preserving canonicalization. An unknown explicit epoch is reported as `unsupported_item_hash_version` and repair refuses to guess. This keeps version incompatibility distinct from item corruption and is tracked by [pm-2htk4p](../.agents/pm/issues/pm-2htk4p.toon).
+History events now declare an item-hash epoch. Epochs are immutable writer
+contracts, not aliases for the current item serializer: epoch 1 sorts linked
+tests; epoch 2 preserves their insertion order and has both an earlier
+field-frozen form and a later expanded form because the writer surface grew
+before the marker advanced; epoch 3 is the current form. Verification accepts
+both recorded epoch-2 forms without allowing one entry to mix them, and repair
+preserves the form evidenced by each event. Unversioned streams are verified
+against the supported legacy canonicalizations. Current-document comparison
+selects the resolved epoch candidate that matches the chain head. A union merge
+may consume suffixes written by both epoch-2 forms, but its synthesized output
+uses one form for the complete re-anchored stream so every stored `after_hash`
+is exactly the next stored `before_hash`. An unknown explicit epoch is
+reported as `unsupported_item_hash_version` and repair refuses to guess. This
+keeps version incompatibility distinct from item corruption and is tracked by
+[pm-2htk4p](../.agents/pm/issues/pm-2htk4p.toon) and
+[pm-2qahia](../.agents/pm/issues/pm-2qahia.toon).
 
 ## Delete versus modify policy
 

package/docs/OUTPUT_TOKEN_ACCOUNTING.md

@@ -1,6 +1,6 @@
 # Output Token Accounting
 
-Tracker references: [pm-t5dt4z](../.agents/pm/tasks/pm-t5dt4z.toon), [pm-g3n00m](../.agents/pm/stories/pm-g3n00m.toon), [pm-8pnj](../.agents/pm/features/pm-8pnj.toon), [pm-f05lsg](../.agents/pm/features/pm-f05lsg.toon), and [pm-srns](../.agents/pm/issues/pm-srns.toon).
+Tracker references: [pm-t5dt4z](../.agents/pm/tasks/pm-t5dt4z.toon), [pm-g3n00m](../.agents/pm/stories/pm-g3n00m.toon), [pm-8pnj](../.agents/pm/features/pm-8pnj.toon), [pm-f05lsg](../.agents/pm/features/pm-f05lsg.toon), [pm-srns](../.agents/pm/issues/pm-srns.toon), and [pm-jjqyzd](../.agents/pm/issues/pm-jjqyzd.toon).
 
 ## Agent Quick Context
 
@@ -39,7 +39,9 @@ The command still exits with its normal non-zero status; the receipt is additive
 
 ## Release-Level Task Entitlement
 
-[`agent-task-transcripts.json`](agent-task-transcripts.json) is the SDK-validated, versioned golden corpus. [`agent-task-token-baseline.json`](agent-task-token-baseline.json) is its externally shipped release ratchet. The gate executes the built CLI against independent, identically seeded accounting-on and accounting-off workspaces. Its five complete workflows cover:
+[`agent-task-transcripts.json`](agent-task-transcripts.json) is the SDK-validated, versioned golden corpus. [`agent-task-token-baseline.json`](agent-task-token-baseline.json) is its externally shipped release ratchet. The gate executes the built CLI against independent, identically seeded accounting-on and accounting-off workspaces. Its eight complete workflows cover:
+
+- three equivalent cold-start protocols and a fail-closed rule that the documented canonical protocol must remain the measured winner: `context --for orient` at 1,055 estimated tokens, the historical four-read sequence at 2,293, and `contracts --summary` plus `next` at 4,798 on the fixed 101-item corpus;
 
 - bounded triage, scaled-workspace orientation, and returning-agent inspection;
 - a closed-domain refusal followed by the exact advertised shell-free retry;
@@ -49,7 +51,7 @@ The command still exits with its normal non-zero status; the receipt is additive
 
 Every step verifies its public SDK output family, canonical successful or refusal exit status, required own-property paths, declared `expected_field_values`, and refusal identity where applicable. Recovery steps must declare a successful output family instead of chaining one refusal to another, every refusal in a completed task must have a later successful `recovery_for` step, and every completed task must terminate with successful output. Successful steps cannot carry refusal-only metadata. Dot-separated `required_fields` and `expected_field_values` paths are traversed structurally from the output root, so incidental prose or nested key names cannot satisfy completeness or terminal-state assertions. The report publishes bytes and estimated tokens for each step and completed task, retry counts, corpus digest, and composite cost. Accounting-on application payloads must be byte-equivalent to their independently captured accounting-off payloads after removing only the receipt. Receipt byte and token fields are independently measured rather than trusted. Runtime refusals verify that their self-reported `total_bytes` matches the independent transport and that `total_estimated_tokens` equals `ceil(total_bytes / 4)`; Commander usage refusals that happen before accounting attachment are measured directly from the captured transport and labeled `independent_transport`.
 
-The baseline fails closed on corpus digest, task identity, step identity, missing or non-finite per-step and per-task ceilings, and missing or non-finite composite cost ceilings. A seeded million-token completed-task regression proves the ratchet fails. Run it with:
+The baseline fails closed on corpus digest, task identity, step identity, the canonical orientation winner and its ceiling, missing or non-finite per-step and per-task ceilings, and missing or non-finite composite cost ceilings. A seeded million-token completed-task regression proves the ratchet fails. Run it with:
 
 ```bash
 pnpm quality:agent-task-token

package/docs/PROGRESSIVE_TOOL_DISCOVERY.md

@@ -0,0 +1,42 @@
+# Progressive Tool Discovery
+
+Tracker: [pm-3g3f8z](../.agents/pm/features/pm-3g3f8z.toon).
+
+`pm` exposes a public SDK discovery engine and an opt-in MCP extension for large tool catalogs. The design keeps the full legacy-compatible catalog available while allowing capable clients to attach only a small entry surface and expand it by intent.
+
+## Negotiation and entry catalog
+
+`server/discover` advertises the namespaced `dev.unbrained.pm/progressive-tool-discovery` extension. A client opts in by returning that extension in the request-local MCP capabilities on every modern request. Negotiated `tools/list` responses contain the stable entry catalog:
+
+- `pm_discover` for bounded capability expansion;
+- `pm_next` and `pm_context` for action and workspace orientation;
+- `pm_search` and `pm_get` for targeted retrieval.
+
+Clients that do not negotiate the extension receive the complete profile-selected tool list. Legacy initialize-era clients are unchanged.
+
+## Public SDK contract
+
+`discoverPmTools()` accepts an authorization-filtered candidate catalog plus query, family, tier, limit, cursor, schema projection, profile, output-budget, and optional host-owned cursor-integrity-key options. It returns:
+
+- deterministic score-then-name ordering;
+- lexical, semantic, graph, permission, freshness, and usage scores with public weights and source provenance;
+- a tamper-evident cursor bound to query, filters, schemas, authorization-filtered catalog, ranking inputs, and either the private discovery process or an explicit shared host key;
+- exact estimated token cost and a fail-closed `within_budget` verdict;
+- explicit schema, row-limit, and token-budget omission receipts with recovery;
+- a private cache key, 30-second TTL, and named invalidation events.
+
+Hosts may supply normalized semantic, graph, freshness, and usage signals. Missing host values use documented deterministic fallbacks, and the result identifies every signal source; the formula never changes implicitly.
+
+SDK hosts that route pages across processes or restarts must pass the same random, secret `cursorIntegrityKey` of at least 32 bytes on every call. Omitting it deliberately selects a random process-local key: that securely enforces process affinity, and a cursor reaching another process fails closed as stale. The bundled MCP adapter reads the shared key from `PM_MCP_DISCOVERY_CURSOR_KEY`; local stdio needs no override, while multi-worker or restart-continuous HTTP deployments must configure one shared high-entropy value.
+
+## Canonical tool results
+
+Negotiated clients treat `structuredContent.result` as the single canonical model-facing application result. The text content becomes a stable pointer instead of a second JSON serialization. Errors use the same rule through `structuredContent`.
+
+Unnegotiated and legacy clients retain the prior duplicated JSON text plus structured result. That compatibility behavior is isolated at the MCP adapter boundary; domain operations and SDK results do not branch on transport generation.
+
+## Scale and change safety
+
+The discovery quality gate exercises selection, deterministic pagination, stale-cursor refusal, permission filtering, schema recovery, and token ceilings at 100, 1,000, and 10,000 candidate tools. Contract snapshots cover the tool schema, and modern MCP integration tests prove both negotiated and compatibility modes.
+
+Any tool-definition, workspace-extension, profile, authorization, ranking-signal, or cursor-key change invalidates prior cursors and cache entries. Process-local cursors also expire when that process exits. Clients restart discovery without a cursor after an explicit stale-cursor refusal.

package/docs/README.md

@@ -45,6 +45,7 @@ pm guide release --json
 - [Package SDK Contract Conformance](PACKAGE_SDK_CONTRACT_CONFORMANCE.md) - authoritative public types, `typeof` module derivation, and the first-party parity gate.
 - [SDK Action and Boundary Conformance](SDK_ACTION_CONFORMANCE.md) - derived CLI/SDK/MCP action vocabulary, public-import ratchets, intent budget diagnostics, and package-runner proof.
 - [MCP 2026-07-28 Protocol Decision](MCP_2026_07_28.md) - stateless request metadata, discovery, result envelopes, explicit legacy boundary, and migration policy.
+- [Progressive Tool Discovery](PROGRESSIVE_TOOL_DISCOVERY.md) - opt-in bounded MCP catalogs, public SDK ranking and pagination, canonical results, and compatibility isolation.
 - [MCP 2026-07-28 Conformance Matrix](MCP_2026_07_28_CONFORMANCE.md) - official revision changes mapped to canonical owners and executable evidence.
 - [MCP Interaction and Task SDK](SDK_MCP_INTERACTIONS.md) - public MRTR continuation, cache/schema validation, and durable task-store contracts.
 - [MCP Skills and Apps](MCP_SKILLS_AND_APPS.md) - negotiated draft workflow discovery, stable interactive views, digests, provenance, accessibility, and trust boundaries.

package/docs/agent-task-token-baseline.json

@@ -1,11 +1,165 @@
 {
-  "version": 3,
+  "version": 4,
   "transcript_version": 2,
-  "transcript_digest": "sha256:2bf91406426d2a9e5de1da10ba67f7b8e9d4a4baa09eb488fe89ae3925c78f3f",
+  "transcript_digest": "sha256:4f9e96bb6ce12bbbeb2514e4bd5958d201c4e62e95083bcbebd749d1e48cc82d",
   "estimator": "ceil(utf8_bytes / 4)",
   "measurement_scope": "output_before_token_accounting",
   "published_with_release": true,
+  "orientation": {
+    "canonical_task_id": "orientation-context-intent",
+    "required_capabilities": [
+      "actionable_work",
+      "active_ownership",
+      "workspace_state"
+    ],
+    "measured_winner_tokens": 1055,
+    "protocols": [
+      {
+        "task_id": "orientation-context-intent",
+        "command_count": 1,
+        "estimated_tokens": 1055,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "context",
+              "field_path": "hierarchy"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "context",
+              "field_path": "activity"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "context",
+              "field_path": "summary.active_items"
+            }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-operating-rules",
+        "command_count": 4,
+        "estimated_tokens": 2293,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "open",
+              "field_path": "items"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "in-progress",
+              "field_path": "items"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "context",
+              "field_path": "summary.active_items"
+            }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-contracts-next",
+        "command_count": 2,
+        "estimated_tokens": 4798,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "next",
+              "field_path": "recommended.id"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "next",
+              "field_path": "held_by_others"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "next",
+              "field_path": "summary.in_progress"
+            }
+          ]
+        }
+      }
+    ]
+  },
   "tasks": [
+    {
+      "id": "orientation-context-intent",
+      "max_estimated_tokens": 1055,
+      "steps": [
+        {
+          "id": "context",
+          "max_estimated_tokens": 1055,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
+    {
+      "id": "orientation-contracts-next",
+      "max_estimated_tokens": 4798,
+      "steps": [
+        {
+          "id": "contracts",
+          "max_estimated_tokens": 4111,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "next",
+          "max_estimated_tokens": 687,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
+    {
+      "id": "orientation-operating-rules",
+      "max_estimated_tokens": 2293,
+      "steps": [
+        {
+          "id": "context",
+          "max_estimated_tokens": 1055,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "search",
+          "max_estimated_tokens": 164,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "open",
+          "max_estimated_tokens": 878,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "in-progress",
+          "max_estimated_tokens": 196,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
     {
       "id": "context-bootstrap",
       "max_estimated_tokens": 1978,
@@ -107,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 4331
+  "composite_max_estimated_tokens": 12477
 }

package/docs/agent-task-transcripts.json

@@ -1,6 +1,149 @@
 {
   "version": 2,
+  "orientation": {
+    "canonical_task_id": "orientation-context-intent",
+    "required_capabilities": [
+      "workspace_state",
+      "active_ownership",
+      "actionable_work"
+    ],
+    "protocols": [
+      {
+        "task_id": "orientation-context-intent",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "context", "field_path": "summary.active_items" }
+          ],
+          "active_ownership": [
+            { "step_id": "context", "field_path": "activity" }
+          ],
+          "actionable_work": [
+            { "step_id": "context", "field_path": "hierarchy" }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-contracts-next",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "next", "field_path": "summary.in_progress" }
+          ],
+          "active_ownership": [
+            { "step_id": "next", "field_path": "held_by_others" }
+          ],
+          "actionable_work": [
+            { "step_id": "next", "field_path": "recommended.id" }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-operating-rules",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "context", "field_path": "summary.active_items" }
+          ],
+          "active_ownership": [
+            { "step_id": "in-progress", "field_path": "items" }
+          ],
+          "actionable_work": [{ "step_id": "open", "field_path": "items" }]
+        }
+      }
+    ]
+  },
   "tasks": [
+    {
+      "id": "orientation-context-intent",
+      "description": "Build sufficient cold-start workspace, ownership, and actionable-work context with the bounded orientation intent.",
+      "steps": [
+        {
+          "id": "context",
+          "args": ["context", "--for", "orient", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["summary.active_items", "hierarchy", "activity"]
+        }
+      ]
+    },
+    {
+      "id": "orientation-contracts-next",
+      "description": "Compare the proposed contracts-summary plus next cold-start protocol on the same fixed workspace.",
+      "steps": [
+        {
+          "id": "contracts",
+          "args": ["contracts", "--summary"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["commands"]
+        },
+        {
+          "id": "next",
+          "args": ["next", "--for", "execute", "--ready-only", "--limit", "3"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": [
+            "summary.in_progress",
+            "held_by_others",
+            "recommended.id"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "orientation-operating-rules",
+      "description": "Compare the historical context, search, open-list, and in-progress-list orientation sequence.",
+      "steps": [
+        {
+          "id": "context",
+          "args": ["context", "--for", "orient", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["summary.active_items", "hierarchy", "activity"]
+        },
+        {
+          "id": "search",
+          "args": ["search", "agent task", "--status", "all", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        },
+        {
+          "id": "open",
+          "args": ["list", "--status", "open", "--limit", "20"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        },
+        {
+          "id": "in-progress",
+          "args": ["list", "--status", "in_progress", "--limit", "20"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        }
+      ]
+    },
     {
       "id": "context-bootstrap",
       "description": "Orient in a scaled workspace and inspect the canonical focus item.",

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 354
+- Catalog error codes: 355
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 335
-- Coverage fraction: 0.053672
+- Uncovered error codes: 336
+- Coverage fraction: 0.053521
 - Closed-domain probes: 19
 - Grammar probes: 94
 
@@ -186,6 +186,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `merge_decisions_unreviewed` | `merge_decisions_unreviewed` | uncovered | none | 0 |
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
+| `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
 | `merge_receipts_pending` | `merge_receipts_pending` | uncovered | none | 0 |
 | `merge_reconcile_receipt_evidence_untrusted` | `merge_reconcile_receipt_evidence_untrusted` | uncovered | none | 0 |
 | `merge_root_not_found` | `merge_root_not_found` | uncovered | none | 0 |

package/docs/performance/cli-transport-overhead.md

@@ -7,12 +7,14 @@ admission reliability owned by
 Each result starts from a fresh isolated workspace containing exactly one item.
 The command runs in a fresh Node v26.5.0 process on
 linux/x64; setup and fixture generation are
-outside the timed interval. Short local gates use the best observed latency,
-while the report retains p50 and p95 evidence. RSS admission uses the measured
-median so one page-level outlier cannot false-fail the gate; the maximum remains
-in the report as diagnostic evidence. Every post-warmup RSS sample must be a
-finite measurement; an unavailable sample makes the admission median unavailable
-and fails closed when a budget exists. Admission adds a fixed 512 KiB noise margin
+outside the timed interval. The default gate measures ten post-warmup fresh
+processes per command and uses the best observed latency, which keeps the
+immutable ratchets meaningful under transient host contention; the report
+retains p50 and p95 evidence. RSS admission uses the measured median so one
+page-level outlier cannot false-fail the gate; the maximum remains in the report
+as diagnostic evidence. Every post-warmup RSS sample must be a finite
+measurement; an unavailable sample makes the admission median unavailable and
+fails closed when a budget exists. Admission adds a fixed 512 KiB noise margin
 without changing the committed budget; a majority persistent increase beyond
 that bounded margin still fails.
 

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.31"
+    "version": "2026.9.2"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.31",
+      "version": "2026.9.2",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -231,7 +231,7 @@
     "fast-check": "^4.9.0",
     "greptile": "^3.4.2",
     "jscpd": "^5.0.16",
-    "tsx": "^4.23.12",
+    "tsx": "^4.23.13",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.68.0",
     "vitest": "^4.1.11"

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.8.31",
+  "version": "2026.9.2",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",