SDK .26 adoption: lifecycle finalization causes three atomic compensation regressions #197

Observed compatibility failure

At PR #194 head 58af1d3e8ffb926270a573d298249a9bc5b2c1e5, the dependency update resolves @unbrained/pm-cli 2026.10.26 (previous lock .25). Three completed CI lanes fail the same three real-SDK compensation tests:

• npm / Node22: 1586 passed /1589, 3 failed.
• Bun release / Node22: 1586 passed /1589, 3 failed.
• Bun release / Node26: the same three failing cases.
  Node26 npm was queued at the 11:36UTC snapshot; not claimed passing or failing.

Failures:

1. test/import-fidelity.test.ts:459–475: real SDK atomic compensation restores imported source lifecycle and removes newly created items after finalization.
2. test/refresh.test.ts:657–673: terminal failures remove replay plans after real SDK compensation, fresh and recovery variants.

The tests inject an ordinary error at committing. Instead of completed compensation, they receive compensation was incomplete … cannot safely compensate incomplete step. The later item restoration/plan-cleanup assertions are not reached. This is not evidence that data was lost, nor that state was restored.

Static explanation to investigate, not an independent native reproduction

Commit hook invokes source-lifecycle finalization before the injected transition callback.
Finalizer appends an SDK mutateItem import event with Preserve GitHub source lifecycle…, outside the bulk mutation's step ownership marker.
SDK .26 ownership check rejects non-owned history suffixes unless verified sibling compensation restores the exact state. These paths support a finalization/compensation ownership mismatch; they do not establish that the SDK's protective refusal is wrong.

Intended contract and existing owners

• Atomic-import pm-github-1jez: ordinary failures compensate applied mutations; incomplete compensation is reported as potentially partial.
• SDK lifecycle adoption pm-github-d26g and source fidelity pm-github-c093 require source lifetimes, durable history, hooks and native governance.
  Those records are closed historical deliveries. Current adoption PR chore(deps-dev): bump the pm-toolchain group across 1 directory with 3 updates #194 is blocked by these fresh receipts. All-status issue/PR and canonical-record review found no exact existing issue for this mismatch; Gated repeat import on 2026.10.19 appends closed-item history and fails the no-diff gate #175 / PR fix: make scheduled closeout actionable and repeat imports idempotent #190 concern identical-repeat history churn, a different trigger.

Reproduction and acceptance

In an isolated synthetic tracker with the PR lockfile, run the existing two test files, selecting the three names above after the normal inspected build/test preparation. No provider account or live mutation is needed. These are existing CI reproductions; this review did not run native/concurrency/lock tests locally.

1. Integrate lifecycle finalization with supported shared SDK transaction/compensation semantics; preserve exact source dates, close evidence, complete history and hooks.
2. On the injected ordinary failure, restore/remove only transaction-owned effects and retain unrelated replay plans; verify actual item/history/journal outcomes, not just error text.
3. If a foreign write makes compensation unsafe, retain the truthful incomplete state and resumable plan. Do not weaken ownership guards, discard history, broaden rollback ownership, or merely relax these assertions.
4. Cover fresh and recovery paths, minimum supported SDK and adopted .26+ artifact, and all current npm/Bun lanes. If a reusable SDK primitive is missing, coordinate that upstream rather than duplicate PM semantics here.

Impact: dependency adoption/full release gates are blocked and the intended ordinary-failure recovery guarantee is not verified for this supported-host combination. Exact residual state and exclusive .25→.26 causality remain to be established. No whole-package certification or publication/deployment claim.