pm-github 2026.10.19 → 2026.10.24

package/CHANGELOG.md

@@ -1,18 +1,55 @@
 # Changelog
 
-## 2026.10.19 - 2026-10-19
+## 2026.10.24 - 2026-10-24
+
+### Fixed
+
+- Publish tracker sync after restoring workflow-owned setup artifacts ([pm-github-sync-setup-artifacts](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-sync-setup-artifacts.toon))
+
+## 2026.10.23 - 2026-10-23
 
 ### Added
 
+- Require opt-in before adopting cited GitHub issue items ([pm-github-cited-issue-adoption](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-cited-issue-adoption.toon))
+- Explore provider identity collisions and approve scoped provenance repairs ([pm-github-identity-collisions](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-identity-collisions.toon))
+- Reconcile authenticated GitHub webhooks through a durable deduplicating inbox ([pm-github-webhook-inbox](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-webhook-inbox.toon))
+- Let reusable workflows carry their own release version ([pm-github-znig](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-znig.toon))
 - Preserve imported GitHub lifetimes, closure evidence and release attribution while linking cross-provider items ([pm-github-c093](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-c093.toon))
+- Refresh only already-linked GitHub items without importing new ones ([pm-github-ullj](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-ullj.toon))
 
 ### Fixed
 
-- Require explicit delivery attribution before merged-PR closeout ([pm-github-uqjf](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-uqjf.toon))
-- The daily release regenerates the changelog with a different status filter than release:check, so an open changelog-unreleased item delivered since the last tag fails the release ([pm-github-l1ot](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-l1ot.toon))
-- Release timeout must report current workflow approval state ([pm-github-b145](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-b145.toon))
-- Preserve legacy GitHub ownership across copied provider examples ([pm-github-b143](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-b143.toon))
+- Derive release merge wait from CI duration and refresh a safe main advance once ([pm-github-release-merge-wait](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-release-merge-wait.toon))
+- A publish spelled through a package runner was invisible to the attestation gate, so an unattested one read as clean ([pm-github-5igz](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-5igz.toon))
+- PM CLI filtered native Bun tests falsely report an empty run ([pm-github-2ao1](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-2ao1.toon))
+- Track pm-changelog rendering closed historical incidents as Fixed ([pm-github-n0mm](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-n0mm.toon))
+- Stabilize the watchdog startup probe under concurrent coverage ([pm-github-sah1](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-sah1.toon))
+- Explain privacy matches and distinguish bare-root regex literals during gated sync ([pm-github-xhtp](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-xhtp.toon))
+- The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit ([pm-github-m8vj](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-m8vj.toon))
+- Closeout workflow tests race the detached telemetry flush when removing their temporary global root ([pm-github-aplb](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-aplb.toon))
+- Keep reusable workflow operands out of executable positions in attestation scans ([pm-github-7c95](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-7c95.toon))
+- Keep automated sync and closeout PRs current and dispatch caller checks ([pm-github-8r7c](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-8r7c.toon))
 - Reject malformed effective-rule discriminators before closeout ([pm-github-b141](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-b141.toon))
+- Preserve legacy GitHub ownership across copied provider examples ([pm-github-b143](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-b143.toon))
+- Release timeout must report current workflow approval state ([pm-github-b145](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-b145.toon))
+- The daily release regenerates the changelog with a different status filter than release:check, so an open changelog-unreleased item delivered since the last tag fails the release ([pm-github-l1ot](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-l1ot.toon))
+- Require explicit delivery attribution before merged-PR closeout ([pm-github-uqjf](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-uqjf.toon))
+- Closeout changelog generation attributes new deliveries to an old package release ([pm-github-lfcf](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-lfcf.toon))
+- The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green ([pm-github-m8u2](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-m8u2.toon))
+- A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last ([pm-github-yq1d](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-yq1d.toon))
+- The daily release cannot build a changelog once the tracker outgrows the default output budget ([pm-github-ypi5](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-ypi5.toon))
+
+### Security
+
+- Gate historical identities and host-path privacy across every Git object ([pm-github-zqad](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-zqad.toon))
+
+### Other
+
+- Enable GitHub CodeQL code scanning ([pm-github-sx18](https://github.com/unbraind/pm-github/blob/main/.agents/pm/chores/pm-github-sx18.toon))
+- Certify pm-github with PM CLI SDK 2026.9.26 ([pm-github-6vcq](https://github.com/unbraind/pm-github/blob/main/.agents/pm/chores/pm-github-6vcq.toon))
+- Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates ([pm-github-julo](https://github.com/unbraind/pm-github/blob/main/.agents/pm/chores/pm-github-julo.toon))
+- Audit copied fleet release workflows for canonical generation and one daily publication ([pm-github-sagl](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-sagl.toon))
+- Adopt the released gated sync caller in fleet repositories ([pm-github-aiok](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-aiok.toon))
 
 ## 2026.10.16 - 2026-10-16
 

package/README.md

@@ -39,11 +39,20 @@ Only `https://github.com/owner/repo/blob/main/.agents/pm/<folder>/<id>.toon`
 links in PR bodies are recognized. Percent-encoded names and nested SDK tracker
 folders are supported; malformed encodings and traversal segments are ignored. Repository comparisons ignore case. Links to
 other repositories, unknown ids, closed/canceled items and `--skip` ids produce
-explicit skip rows. Bare mentions and `pm:` trailers are not delivery evidence. Use a whole-line
-`Closes <item-id>` or `pm-github: <item-id>` declaration, a closing keyword before
-the canonical item link, or an item field `github_pr`, `pr_url` or
-`pull_request_url` containing the exact PR URL. Multiple merged PRs explicitly
-claiming one item are reported as `ambiguous_delivery`; none closes it.
+explicit skip rows. A whole-line `Closes <item-id>` or `pm-github: <item-id>`
+declaration, a closing keyword before the canonical item link, or a structured
+`PM item: <item-id-or-canonical-link>` line declares delivery. Spaces and tabs
+are allowed; declarations cannot span lines. Matching uses the complete item ID,
+so `Closes pm-x-extra` cannot deliver `pm-x`. Undeclared canonical links in the
+PR body, including links in follow-up lists (`PM:`), can produce `not_delivery`
+rows for otherwise eligible items with the reason "Mentioned, not delivered".
+Tracker PR URL metadata with no body reference or declaration produces no row.
+
+When several merged PRs declare delivery, closeout selects the latest merge with
+complete merge facts and passing head checks. Equal merge times use the higher
+PR number. Other qualifying claims receive `duplicate_selection`; mention-only
+PRs retain `not_delivery`. All completion fields and the appended close event use
+the selected PR's merge time, merge SHA, head SHA and check evidence.
 
 **A mention is not delivery.** PR bodies routinely link follow-ups, epics and
 related work for context, so a link alone never closes an item. An item is
@@ -134,6 +143,39 @@ only the tracker; commit it with its history and regenerate the caller's
 changelog in a closeout PR. The [automated closeout workflow](#automated-closeout-workflow)
 performs that daily review-PR preparation for fleet repositories.
 
+## Authenticated webhook reconciliation
+
+`pm github webhook receive <owner/repo> --payload delivery.json --delivery <id>
+--event issues --signature <sha256=...>` accepts explicitly supplied deliveries.
+Set `PM_GITHUB_WEBHOOK_SECRET` through your secret manager. Exact payload bytes
+are authenticated before any write; a durable inbox deduplicates delivery IDs.
+
+`pm github webhook reconcile <owner/repo> --limit 20` reads current GitHub state
+for already-linked issues and returns compact proposals with lifecycle deltas.
+It never applies the event's lifecycle or changes items. Out-of-order events
+therefore cannot reopen a closed item. Output defaults to TOON; add `--json`
+for JSON. Signature and storage refusals include typed codes and remedies.
+
+Use `pm github refresh <owner/repo> --dry-run` to review full changes and
+`--atomic` to apply a fresh polling read. Polling remains the recovery route
+for missed deliveries or unavailable webhooks. Back up the ignored durable
+`github-webhooks` directory inside your tracker. See the
+[CLI and typed SDK example](docs/webhook-inbox.md) for deployment, crash recovery,
+retention and supported-event details.
+
+## Without git
+
+With an explicit repository, GitHub import, export, refresh, sync, project commands,
+blocker checks, closeout and webhook receive/reconcile work in a plain pm tracker
+without a git executable.
+`pm github identity` also works there, entirely offline and without credentials.
+The provider commands still require their normal GitHub access and credentials. Privacy scanning
+with `github gate --diff <file>` also works there. Reading a proposed tracker diff
+with `github gate` requires a git repository; otherwise pass an explicit diff.
+Gated imports (`github import --gate`, including the scheduled sync workflow)
+also require a git repository so the proposed publication can be checked. They
+refuse before writing when the tracker is outside one; plain imports still work.
+
 ## Revalidate GitHub blockers
 
 **Compatibility:** pm-github now requires PM CLI 2026.10.5 or newer for complete
@@ -186,7 +228,7 @@ containing this command before adopting the updated workflow.
 |---|---|
 | `importers` | `pm github import <owner/repo>` — idempotent native import pipeline |
 | `importers` (exporter) | `pm github export` — pm items → GitHub issues (dry-run by default; upsert) |
-| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github closeout` (verified merged-PR delivery), `pm github project list\|fields\|import\|sync` (Projects v2) |
+| `commands` | `pm github refresh <owner/repo>` (refresh linked items only), `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github closeout` (verified merged-PR delivery), `pm github project list\|fields\|import\|sync` (Projects v2) |
 | `schema` | declares `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, `github_updated_at` item fields |
 | `hooks` | `afterCommand` — opt-in sync reminder (`PM_GITHUB_SYNC`) for linked items |
 | `preflight` | early warning when a mutating github command lacks a token |
@@ -223,6 +265,67 @@ checks.
 
 ## Import
 
+### Keeping a mirror current
+
+Use `refresh` when your tracker deliberately mirrors only a few issues from a busy
+repository. It selects existing `gh:owner/repo#N` tags or explicit `github_url`
+links (also `github_repo` with `github_number`), fetches those numbers in GraphQL
+batches of at most 100, and **never creates items**. Only `/issues/N` URLs are
+refreshable links: the batch query reads issue nodes, so a `/pull/N` URL is not
+selected. Ordinary references in text
+are not links. Conflicting identities or multiple owners fail before any write.
+
+```sh
+pm github refresh owner/repo --dry-run --json
+pm github refresh owner/repo --atomic
+pm github refresh owner/repo --since 7d --limit 50 --dry-run
+```
+
+`--limit` bounds the selected issue numbers, in ascending order, before fetching.
+`--since` filters by the fetched upstream update time, including closed issues;
+filtered items are counted separately. Omit it for a complete refresh. A GitHub
+token is required for GraphQL (`GITHUB_TOKEN`, `GH_TOKEN`, or `gh auth login`).
+Closure evidence uses the importer's timeline reader; label pages are fetched in
+full. API retries and rate limits use the shared transport.
+
+Refresh reuses import's title, labels and source lifecycle mapping, including
+real closure/completion dates and reopening. Body, local item type, assignee and
+milestone are preserved. A `release` already present on the item is only replaced
+when GitHub supplies calendar-tag attribution for a closure; open issues and
+closures without a matching tag keep the existing release, so user- or tool-set
+attribution survives. Existing cross-provider link-only owners retain their
+native lifecycle and content, as on import. TOON (default) or `--json` returns a
+`plan` of `{id, number, changes: [{field, old, new}]}` plus `updated`, `unchanged`,
+`missing`, `filtered`, `selected`, `resumed` and `created: 0`. On dry-run, `updated` means
+would update; nothing is written. Missing rows carry a typed `reason` and remain
+unchanged: `not_found_or_inaccessible` (GitHub cannot distinguish deleted/hidden),
+`inaccessible`, `transferred`, `api_error`, `incomplete_response`, or `invalid_issue`.
+A request-wide failure aborts before new refresh writes. Recovery of unfinished
+transactions happens first and may already have committed earlier writes when
+a subsequent request fails.
+
+Each changed item receives an audit comment. `--atomic` applies the batch in one
+SDK workspace writer transaction with rollback; otherwise each changed item gets
+its own transaction. Every update transaction persists its exact plan beside the
+SDK journal before writing. If a run dies mid-transaction, the next refresh
+detects unfinished journals for the selected items, validates every saved plan
+before any replay, and refuses recovery from another repository. It replays the original
+plan — committing the journal without duplicating the audit comment — before
+unchanged items are skipped, and reports it in `resumed`. A preview
+(`--dry-run`) refuses while such a journal is open; a missing plan fails closed
+naming the transaction id instead of silently reporting a no-op. Review the preview before publishing tracker changes and
+apply the existing privacy gate to any proposed commit.
+
+For a weekly refresh, run this in a checkout with the extension installed, token
+available and `PM_PATH` set to the intended tracker. For example, a cron entry:
+
+```cron
+0 6 * * 1 cd "$MIRROR_CHECKOUT" && pm github refresh owner/repo --atomic --json >> "$MIRROR_LOG" 2>&1
+```
+
+Configure those environment variables in the crontab. The command updates the
+tracker locally; review and commit changes using your normal workflow.
+
 ### `pm github import <owner/repo>` (or `pm gh-issues import`)
 
 ```bash
@@ -258,6 +361,7 @@ pm github import owner/repo --dry-run
 | `--with-comments` | boolean | Fetch issue comments and append them to the item body |
 | `--comments-mode <mode>` | `body`\|`annotations`\|`both` | How fetched GitHub comments are persisted (default `body`). `annotations` syncs comments into the pm item's native comments collection via the SDK; `both` writes the body section AND native comments. `annotations`/`both` are idempotent on re-import (dedupe by GitHub comment id) |
 | `--atomic` | boolean | Commit every create, update, close, and reopen in one workspace-writer-locked, crash-resumable transaction (requires pm CLI/SDK >=2026.7.20). Normal failure compensation restores updated/closed items and deletes newly created items; an incomplete compensation is reported explicitly for retry or repair. |
+| `--adopt-cited` | boolean | Explicitly opt in to conservative citation adoption (default: off). Tag new items `gh:owner/repo#N` instead. Default imports only report citation candidates. |
 | `--link-deps` | boolean | After import, map dependency references in issue **bodies** (`Blocked by #N`, `Depends on owner/repo#N`, `Blocks #N`) to pm dependency edges between the linked items. Idempotent, best-effort, and re-runnable; see [Dependency linking](#dependency-linking---link-deps) below. |
 | `--gate` | boolean | Fail-closed privacy gate: verify plan completeness (every fetched issue accounted for exactly once) and provenance idempotency (every re-import lands on exactly one `gh:owner/repo#N`-tagged item) BEFORE the write, then scan the proposed tracker change with [`pm github gate`](#pm-github-gate) AFTER it. Any finding — or any unreadable scan input — exits non-zero so an automated pipeline can never commit or push the change. Embeds `gate` receipts in the result. |
 | `--dry-run` | boolean | Preview without writing |
@@ -265,6 +369,74 @@ pm github import owner/repo --dry-run
 
 Each imported item records GitHub provenance: the `gh:owner/repo#N` idempotency tag, a `github_author:<login>` tag, and an enriched description (`author @<login> · state reason <reason> · created <iso> · updated <iso>`). GitHub issues closed as `not_planned` import as pm `canceled` instead of `closed`, preserving the difference between completed work and deliberately dropped work. The integration declares the `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, and `github_updated_at` schema fields.
 
+The primary way to prevent duplicate imports is to tag an item
+`gh:owner/repo#N` **when it is created**, for example
+`pm create issue "Fix widget behavior" --tags "gh:acme/widgets#30"`.
+For an existing item, use `pm update <id> --add-tags "gh:acme/widgets#30"`. A prose URL is context, not an
+ownership declaration. Existing tag/structured URL/provider matching takes
+precedence and is unchanged.
+
+**Citation adoption is off by default.** Manual imports, the legacy alias and
+scheduled gated syncs retain normal create behavior when explicit ownership is
+absent. They report read-only `citation_candidates` so an agent can tag the
+correct item, including when several candidates exist. No candidate is adopted
+or ambiguity-blocked by default.
+
+Use `--adopt-cited` on the CLI, `adoptCited: true` in SDK import options, or
+`adopt-cited: true` on the reusable sync workflow to enable the fallback. The
+fallback deliberately favors refusal over overwriting an unrelated item:
+
+1. **Normalize before checking.** Decode complete named/numeric HTML entities and
+   percent-encoded bytes repeatedly until stable, bounded to eight passes.
+   Apply NFKC and remove zero-width/bidi control characters. Unwrap Markdown
+   link destinations and reference definitions and join soft line breaks for
+   intent matching. Retain normalized source as well as the unwrapped view for
+   exclusion, so a link label cannot hide a second reference. Joined-line views
+   also expose split references. A normalization bound exhaustion is a refusal.
+2. **Allowlisted ownership.** A qualified target issue reference must appear in
+   the title, directly follow `Fix`, `Fixes`, `Fixed`, `Close`, `Closes`, `Closed`,
+   `Resolve`, `Resolves` or `Resolved` at the start of the description, or be a
+   URL on a whole body line `Issue: <url>` or `Tracks: <url>`. Matching ignores
+   case. Body fix phrases, `Related:` mentions, unanchored phrases and bare
+   numbers cannot authorize adoption.
+3. **Exclude every other reference.** Across all normalized fields, any other
+   `github.com` URL, foreign repository, different `#<digits>` or
+   `issues`/`pull` token followed by another number vetoes adoption. Unattributed
+   paths/bare hashes also refuse adoption: this item projection has no verified
+   owning-repository context. PR URLs, including a same-number PR URL, are other
+   URLs. The scan over-counts code and incidental text deliberately. These
+   checks reduce risk; they do not make arbitrary prose an ownership contract.
+
+| Existing prose | Default | With `--adopt-cited` |
+| --- | --- | --- |
+| Description: `Fixes acme/widgets#30` | Create + `adoption_disabled` hint | Eligible if no other reference |
+| Body line: `Issue: https://github.com/acme/widgets/issues/30` | Create + hint | Eligible if no other reference |
+| Title: `Handle acme/widgets#30` | Create + hint | Eligible if no other reference |
+| Body: `Fixes acme/widgets#30` | Create + `missing_intent` hint | Create + hint |
+| Body: `Related: acme/widgets#30` | Create + `missing_intent` hint | Create + hint |
+| Title cites issues 30 and 31 | Create + `multiple_issues` hint | Create + hint |
+| Description fixes issue 30; body has `**https://github.com/other/widgets/issues/30**` | Create + hint | Create + `multiple_issues` hint |
+| Description fixes issue 30; body has `[other](https://github.com/other/widgets/issues&sol;31)` or `issues%2F31` | Create + hint | Create + `multiple_issues` hint |
+
+Plans include `citation_candidates: [{id, reason}]`; aggregate dry-run and write
+receipts include `citation_candidates: [{issue, id, reason}]`. Reasons are
+`adoption_disabled`, `missing_intent`, `multiple_issues`, `normalization_limit` or `structured_owner` (the item already carries a `github_*` field, a core `external_ref` or `source_owner`, a `linear_*`/`jira_*`/`ado_*` identity field, provider provenance, a GitHub issue URL in its links or a native declaration, so prose citing another issue never re-owns it).
+Candidate reporting never changes the referenced item's status, content or
+fields, including a closed item's completion state.
+
+With explicit opt-in, one eligible untagged candidate produces an `adopt` plan:
+its ID receives the provenance tag and `github_*` fields through normal upsert.
+Closed/canceled owners remain eligible. Two or more eligible owners refuse the
+batch with typed `ambiguous_citation`, IDs and a remedy to tag the correct item.
+The default path never applies that fallback ambiguity refusal. Existing
+structured-identity collision checks still apply in both modes.
+
+Dry runs show `adopt` and `wouldAdopt`; write receipts report `adopted` separately
+from `imported`/`updated`. Gated idempotency counts an opt-in adopt as one landing
+item. Status push, export and Projects matching retain their scope. Citation
+reporting and opt-in adoption work in non-git trackers; actual `--gate` writes
+still require a Git worktree for the proposed-change privacy scan.
+
 `--issue` deduplicates references and fetches each selected issue directly, including closed issues, without listing the repository. Every selected number is fetched and checked before any tracker write. A missing number fails the whole import; `--dry-run` instead reports `missingIssues` and previews the available selection. Pull request numbers require `--include-prs`. Selection combines with comment modes, dependency linking, atomic imports, gates, dry runs, and custom item types, preserving provenance-based re-import idempotency.
 
 `--limit` bounds the matching list after PR, draft, and milestone filters. Pagination stops once one extra matching issue establishes truncation, so at most `n + 1` eligible issues are retained; GitHub pages may also contain excluded entries. Without a limit, existing list ordering is unchanged.
@@ -462,7 +634,9 @@ Unreadable input, malformed or truncated diffs, binary input, invalid UTF-8, Git
 
 Rendered values are also scanned in memory before mutation, so a known finding cannot be written to disk. After mutation, the importer verifies that every planned provenance tag exists exactly once, then scans the tracker diff. A completed SDK journal cannot substitute for missing item files.
 
-The `gate` receipt reports the verdict, scanned file count, findings, and allowlisted count. With `--json`, successful reports go to stdout; failures use the host CLI's JSON error envelope on stderr, with the redacted gate report serialized in `detail` (`jq ' .detail | fromjson ' gate-error.json`). Unreadable inputs produce a nonzero JSON refusal.
+The `gate` receipt reports the verdict, scanned file count, findings, and allowlisted count. Each finding includes `match_offset` (the starting character offset of the hashed match within the scanned field value, or the serialized added line for tracker text) and `excerpt`. Host-path excerpts show only the root initial, such as `/h***/…`; other matches use `[redacted]`. Human-readable workflow diagnostics include the same evidence. Full paths and secrets never appear. Recognizable bare-root JavaScript regex literals immediately used with `.test()` or `.exec()` are distinguished from paths; quoted host paths and slash-separated host paths remain refused, including inside code and regex source. Ambiguous quote contexts remain refused. Whole JSON-serialized fields retain the same distinction after decoding; TOON wrappers are recognized only in tracker text.
+
+With `--json`, successful reports go to stdout; failures use the host CLI's JSON error envelope on stderr, with the redacted gate report serialized in `detail` (`jq ' .detail | fromjson ' gate-error.json`). Unreadable inputs produce a nonzero JSON refusal.
 
 ## Self-versioned workflows and Dependabot
 
@@ -665,6 +839,8 @@ Fleet repos sync their issues into pm through ONE audited implementation: the re
 
 When the tracker has no changes, regenerated `CHANGELOG.md` drift is discarded and the run emits a notice that the caller's own `changelog:check` owns that drift. The sync closes any owned open review PR and exits successfully without pushing or dispatching CI. Changelog changes are published only together with tracker changes.
 
+Before extension and attributes setup, both reusable maintenance workflows require `.gitattributes` and the tracker’s `extensions/.managed-extensions.json` to match the checkout, including the index and ignored untracked files. Immediately after setup they save the runtime artifacts outside the checkout, then restore original tracked bytes or remove setup-created files before any privacy or publication scan. Strict health temporarily uses the saved runtime files after checking that both paths still match the baseline; an exit trap restores the baseline even when health fails. No caller script runs inside either setup window. Preexisting edits and later caller edits to either artifact fail closed and remain untouched, including ignored files. The publication allowlist stays unchanged. Callers receive the fix through their Dependabot workflow pins.
+
 The explicit allowed scope for changed paths is:
 
 - Files beneath the SDK-resolved repository-local pm tracker, excluding its `extensions/`, `locks/`, and `checkpoints/` runtime directories. The extension setup files `settings.json` and `history/_workspace.jsonl` are permitted during setup, then restored before publication and excluded from both the scan and commit.
@@ -676,6 +852,7 @@ Optional inputs:
 
 | Input | Default | Behavior |
 | --- | --- | --- |
+| `adopt-cited` | `false` | Explicitly enable conservative normalized citation adoption for preview, import and repeat verification. Primary prevention is creating items with `gh:owner/repo#N` tags. Leave false to retain normal creates with read-only candidate hints. |
 | `npm-project-dir` | `.` | Relative npm project directory for `npm ci --ignore-scripts`, the CLI `node_modules/.bin` PATH entry, and `post-import-script`. Must have `package.json`, contain no `..` segments, and resolve inside the workspace (including symlinks); invalid paths fail before caching/install. The tracker and publication scope stay at the repository root. |
 | `post-import-script` | `changelog:full` | Caller npm script name invoked with `npm run --if-present` after import and before the final scan. Override for a different package script, or set `""` to disable. Missing scripts are skipped. Raw shell commands are not accepted. Generated `CHANGELOG.md` is staged with the tracker. Changing any file outside the documented scope fails the run, whether staged, unstaged, or untracked. |
 | `automation-app-client-id` | `""` | Optional GitHub App client ID, paired with the `automation_app_private_key` workflow-call secret. Enables eligible native PR runs through a fresh repo-scoped token; absent credentials retain GITHUB_TOKEN with a notice. |
@@ -701,6 +878,7 @@ jobs:
     uses: unbraind/pm-github/.github/workflows/pm-github-sync.yml@RELEASE_COMMIT_SHA # vRELEASE_VERSION
     with:
       automation-app-client-id: ${{ vars.PM_GITHUB_APP_CLIENT_ID }}
+      adopt-cited: false # Tag new items gh:owner/repo#N; opt in only for deliberate adoption.
     secrets:
       automation_app_private_key: ${{ secrets.PM_GITHUB_APP_PRIVATE_KEY }}
 ```
@@ -765,6 +943,10 @@ Release checks require type checking, docstrings, ESLint, zero source duplicatio
 
 `npm run changelog:full` reads the complete tracker through the SDK and feeds pm-changelog. Closed work supplies release history; the explicit `changelog-unreleased` tag includes a pending candidate without closing its PM item. Other open work stays excluded.
 
+Daily Release measures the successful `test (22)` and `test (26)` jobs from the last 20 successful main push CI runs. Its merge wait is the nearest-rank p95 duration plus the larger of 15 minutes or 25%, bounded to 60–120 minutes. Missing history uses the 60-minute floor. The log and job summary record the samples, p95, margin and bounds; the job timeout is 360 minutes.
+
+A main advance during preparation or waiting can update the release branch once. Every intervening commit must preserve `package.json` and lockfile release versions, `CHANGELOG.md`, `manifest.json`, and release notes, including changes later reverted. Dependency-only changes are eligible. A conflict, metadata change, non-ancestor main, or second advance aborts. A successful update uses a head-specific push lease, restarts the full measured wait, and requires protected checks on the new head. Publication still verifies the merged commit and runs the release gate again.
+
 ## Multi-agent merge safety
 
 This repo tracks its project management in `.agents/pm/` and ships a committed `.gitattributes`
@@ -814,3 +996,17 @@ Before creating an item, import checks the complete tracker for its provenance t
 With `--gate` and a nonempty filtered issue list, both preview and apply results include a `plan` with source dates, closure reason, release, target identity, link/create/update action and state-conflict decision. An empty filtered issue list returns without a `plan`, including with `--gate --dry-run`. GitHub wins lifecycle conflicts for GitHub-owned imports. A canceled item that GitHub later reports as completed uses the SDK's explicit repeat-closure transition with the source reason. A linked external owner keeps its local status, and the plan records `preserve-provider-owner`; `github_state` still records the source state. Atomic transaction identity includes the latest external edit or different lifecycle generation in history. Local state edits and repeated state cycles force reconciliation, while staging and compensation keep crash retries on the same journal. Finalization runs before the SDK commits and is compensated with the batch on failure. It is idempotent and runs again after a recovered atomic journal, so an interrupted finalization can be repaired by retrying the same import before the gate permits a push.
 
 SDK limitation: native `updated_at` remains the local mutation clock because the bulk SDK uses it to address rollback history. The GitHub update date is retained exactly in `github_updated_at`, and the gated plan discloses this policy. Backdating native `updated_at` safely requires an SDK import mutation whose version identity is independent of source time. Native creation, closure and completion dates still preserve GitHub lifetimes for momentum and cycle-time readers.
+
+## Provider identity collisions
+
+Use `pm github identity --json` for a bounded offline graph of conflicting
+`external_ref`, GitHub provenance tags and native/provider ownership. Copied
+prose appears as a weaker mention; genuine provider links retain distinct
+ownership evidence. Inspect one group with
+`pm github identity --identity 'gh:example/project#7'`.
+
+Preview a narrowly scoped repair with `--identity`, `--owner` and `--detach`;
+apply only after reviewing its exact `--approve` digest. Ambiguous identities
+refuse with typed remedies. The SDK supplies complete reads, semantic preview,
+writer transactions, immutable audit history and idempotent replay. See the
+[worked example and SDK contracts](docs/identity-collisions.md).

package/dist/closeout.d.ts

@@ -16,7 +16,7 @@ export interface CloseoutRow {
     code: CloseoutCode;
 }
 /** Stable decisions used by automation and compact skip counts. */
-export type CloseoutCode = "already_terminal" | "other_repository" | "duplicate_selection" | "explicit_skip" | "unknown_item" | "epic" | "active_children" | "not_delivery" | "close_failed" | "ambiguous_delivery" | "head_checks_passed" | "head_checks_failed" | "head_evidence_unavailable" | "required_checks_unverified" | "incomplete_merge";
+export type CloseoutCode = "already_terminal" | "other_repository" | "duplicate_selection" | "explicit_skip" | "unknown_item" | "epic" | "active_children" | "not_delivery" | "close_failed" | "head_checks_passed" | "head_checks_failed" | "head_evidence_unavailable" | "required_checks_unverified" | "incomplete_merge";
 /** Which head-check policy was evaluated for one selected pull request. */
 interface CheckGate {
     pr: number;
@@ -47,13 +47,15 @@ interface PullRequest {
 /** Verify metadata-backed or caller-declared requirements before considering observed head runs. */
 export declare function checkCloseoutHead(api: CloseoutApi, repo: string, pr: PullRequest, declared?: string[]): Promise<CheckGate>;
 /**
- * Whether a closing keyword directly precedes a link, given the line text before the link.
+ * Whether a closing keyword or standalone structured item declaration identifies a link.
+ * @param prefix - Same-line text preceding the canonical link.
+ * @param suffix - Same-line text after the link, including a possible markdown closing parenthesis.
  *
  * Only earlier links (markdown or bare), commas and "and" may sit between the keyword and the link, so
  * `Delivers [a](…) and [b](…)` declares both while `Not fixed here; see <link>` declares nothing.
  * Scans backwards with plain string operations; no backtracking pattern touches PR text.
  */
-export declare function declaresDelivery(prefix: string): boolean;
+export declare function declaresDelivery(prefix: string, suffix?: string): boolean;
 /** Extract only canonical tracker links, retaining foreign references solely for skip rows. */
 export declare function extractCloseoutItems(body: string): {
     item: string;

package/dist/closeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"closeout.d.ts","sourceRoot":"","sources":["../closeout.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,eAAe,GACxG,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,cAAc,GAAG,cAAc,GAC7E,oBAAoB,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,kBAAkB,CAAC;AAEzJ,2EAA2E;AAC3E,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD;AAuJD,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA0DpI;AAoBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAuBxD;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,EAAE,CAuBtG;AAQD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED,sHAAsH;AACtH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAMrD;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW;;;;;;;;GA8H7H;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;;;;;;;cA1e7E,MAAM;YACR,MAAM;gBAEF,MAAM;cACR,YAAY;;;;;EAifnB"}
+{"version":3,"file":"closeout.d.ts","sourceRoot":"","sources":["../closeout.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,eAAe,GACxG,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,cAAc,GAAG,cAAc,GAC7E,oBAAoB,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,kBAAkB,CAAC;AAElI,2EAA2E;AAC3E,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD;AAuJD,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA0DpI;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,OAAO,CAwBrE;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,EAAE,CAyBtG;AAQD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED,sHAAsH;AACtH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAMrD;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW;;;;;;;;GA2H7H;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;;;;;;;cA5e7E,MAAM;YACR,MAAM;gBAEF,MAAM;cACR,YAAY;;;;;EAmfnB"}

package/dist/closeout.js

@@ -236,17 +236,21 @@ function declarationKey(id) {
     });
 }
 /**
- * Whether a closing keyword directly precedes a link, given the line text before the link.
+ * Whether a closing keyword or standalone structured item declaration identifies a link.
+ * @param prefix - Same-line text preceding the canonical link.
+ * @param suffix - Same-line text after the link, including a possible markdown closing parenthesis.
  *
  * Only earlier links (markdown or bare), commas and "and" may sit between the keyword and the link, so
  * `Delivers [a](…) and [b](…)` declares both while `Not fixed here; see <link>` declares nothing.
  * Scans backwards with plain string operations; no backtracking pattern touches PR text.
  */
-export function declaresDelivery(prefix) {
+export function declaresDelivery(prefix, suffix = "") {
     let rest = prefix;
     // The link may be the target of a markdown label: `Closes [pm-x](`.
     if (rest.endsWith("]("))
         rest = rest.slice(0, Math.max(0, rest.lastIndexOf("[")));
+    if (/^(?:[-*][ \t]+)?PM item:[ \t]*$/i.test(rest.trimStart()))
+        return /^\)?$/.test(suffix.trim());
     for (;;) {
         rest = rest.trimEnd();
         if (rest.endsWith(",")) {
@@ -293,7 +297,8 @@ export function extractCloseoutItems(body) {
             return [];
         const item = components.at(-1);
         const key = `${match[1].toLowerCase()}/${item}`;
-        const declared = declaresDelivery(body.slice(body.lastIndexOf("\n", match.index) + 1, match.index));
+        const lineEnd = body.indexOf("\n", match.index);
+        const declared = declaresDelivery(body.slice(body.lastIndexOf("\n", match.index) + 1, match.index), body.slice(match.index + match[0].length, lineEnd < 0 ? body.length : lineEnd));
         if (seen.has(key)) {
             // A later "Closes <link>" line still declares an item an earlier line only mentioned.
             if (declared)
@@ -390,8 +395,6 @@ export async function runCloseout(pmRoot, repo, options, api) {
         if (typeof parent === "string" && !TERMINAL_STATUSES.includes(item.status))
             activeChildren.set(parent, (activeChildren.get(parent) ?? 0) + 1);
     }
-    const selected = new Set();
-    const candidates = new Map();
     const plan = [];
     const checks = [];
     const closures = [];
@@ -404,9 +407,9 @@ export async function runCloseout(pmRoot, repo, options, api) {
         const refs = extractCloseoutItems(pr.body ?? "");
         // Scan declarations once per PR, retaining case-insensitive IDs and optional punctuation.
         const declarations = new Set();
-        for (const match of (pr.body ?? "").matchAll(/^(?:[-*][ \t]+)?([a-z]+|pm-github:)[ \t]+(\S+)[ \t]*$/gim)) {
+        for (const match of (pr.body ?? "").matchAll(/^(?:[-*][ \t]+)?([a-z]+|pm-github:|PM item:)[ \t]+(\S+)[ \t]*$/gim)) {
             const keyword = match[1].toLowerCase();
-            if (!CLOSING_KEYWORDS.has(keyword) && keyword !== "pm-github:")
+            if (!CLOSING_KEYWORDS.has(keyword) && keyword !== "pm-github:" && keyword !== "pm item:")
                 continue;
             const id = declarationKey(match[2]);
             declarations.add(id);
@@ -414,9 +417,8 @@ export async function runCloseout(pmRoot, repo, options, api) {
                 declarations.add(id.slice(0, -1));
         }
         for (const item of items.values()) {
-            // Only canonical delivery metadata or a whole-line trailer/closing declaration is authoritative.
-            const linked = [item.github_pr, item.pr_url, item.pull_request_url].includes(pr.html_url);
-            if (linked || declarations.has(declarationKey(item.id))) {
+            // Delivery must be declared in this PR body, never inferred from tracker metadata.
+            if (declarations.has(declarationKey(item.id))) {
                 const ref = refs.find(ref => ref.item === item.id && ref.repo.toLowerCase() === repo.toLowerCase());
                 if (ref)
                     ref.declared = true;
@@ -425,11 +427,6 @@ export async function runCloseout(pmRoot, repo, options, api) {
             }
         }
         for (const ref of refs) {
-            if (ref.declared && pr.merged && ref.repo.toLowerCase() === repo.toLowerCase()) {
-                const choices = candidates.get(ref.item) ?? new Set();
-                choices.add(number);
-                candidates.set(ref.item, choices);
-            }
             let reason;
             let code;
             if (ref.repo.toLowerCase() !== repo.toLowerCase()) {
@@ -462,15 +459,10 @@ export async function runCloseout(pmRoot, repo, options, api) {
             }
             else if (!ref.declared) {
                 code = "not_delivery";
-                reason = "A mention is not delivery, regardless of item status. Declare Closes, Fixes, Resolves or Delivers, link the item to this PR, or use a pm-github trailer.";
-            }
-            else if (selected.has(ref.item)) {
-                code = "duplicate_selection";
-                reason = "Item already selected by another pull request.";
+                reason = "Mentioned, not delivered. A mention is not delivery. Declare Closes, Fixes, Resolves or Delivers, or use a structured PM item: or pm-github: declaration.";
             }
             else {
                 reason = gate.reason;
-                selected.add(ref.item);
                 const row = { item: ref.item, pr: number, action: "close", code: gate.code, reason };
                 const criteria = items.get(ref.item).acceptance_criteria;
                 closures.push({ row, reason: closeReason(pr, gate.passed), at: pr.merged_at,
@@ -485,13 +477,20 @@ export async function runCloseout(pmRoot, repo, options, api) {
             plan.push({ item: ref.item, pr: number, action: "skip", code, reason });
         }
     }
-    // Resolve attribution across the complete selection before the first SDK write.
-    for (const row of plan) {
-        const claimants = candidates.get(row.item);
-        if (claimants && claimants.size > 1 && claimants.has(row.pr) && !["already_terminal", "other_repository", "unknown_item", "explicit_skip"].includes(row.code)) {
-            row.action = "skip";
-            row.code = "ambiguous_delivery";
-            row.reason = "Multiple merged PRs explicitly claim delivery; select the intended PR before closing.";
+    // Choose one complete, passing delivery before any SDK write. Merge chronology, not PR number,
+    // determines the winner; an equal timestamp uses the higher PR number for stable selection.
+    const deliveries = new Map();
+    for (const entry of closures) {
+        const previous = deliveries.get(entry.row.item);
+        if (!previous || Date.parse(entry.at) >= Date.parse(previous.at)) {
+            deliveries.set(entry.row.item, entry);
+        }
+    }
+    for (const entry of closures) {
+        if (deliveries.get(entry.row.item) !== entry) {
+            entry.row.action = "skip";
+            entry.row.code = "duplicate_selection";
+            entry.row.reason = "A later qualifying merged PR declares delivery for this item.";
         }
     }
     let closed = 0;