Isolate minimum-SDK consumer fixture from development-tool peer requirements #199

Hosted failure and exact scope

PR #194 at a883e3aeac6c8120a13831fd91072f8df559de6b currently fails its Node 26 job: 1,589 tests, 1,585 passed, four failed. Three are already tracked in #197. This issue isolates the additional minimum-sdk-consumer.test.ts installation failure.

The log reports npm ERESOLVE: the fixture pins @unbrained/pm-cli@2026.10.17, but directly installs pm-ops@2026.10.26, whose peer requires CLI >=2026.10.20. Installation exits 1 before the packed extension import, declaration checks or native consumer assertions run. No independent local install or provider operation was performed.

Exact static cause

The fixture construction spreads both pkg.dependencies and all pkg.devDependencies into the consumer root, then overrides the CLI to the declared minimum. That imports the development-only pm-ops peer constraint into the minimum-runtime witness.

The toolchain manifest now selects pm-ops .26. This is an unsatisfiable fixture dependency graph, not proof that the shipped pm-github runtime cannot support CLI .17.

Source goal and impact

The canonical label-migration record requires the whole packed extension, authored SDK imports and shipped declarations to work at the enforced minimum independently of the development lock; it records .17 as the effective verified floor. The fixture's own contract states the same goal.

Current admission fails before those checks, so this PR has no completed current-head minimum-SDK consumer proof. This is distinct from #197's native lifecycle/compensation failures and does not establish a new production runtime defect.

Acceptance

• Isolate the actual minimum-SDK runtime/declaration consumer from unrelated development-tool peer constraints, while retaining the tooling genuinely needed for the comprehensive source/declaration checks.
• Preserve the explicit assertion that the installed CLI equals the declared floor, whole-extension linking, authored and shipped declaration checks, and existing behavioral assertions.
• Do not use --force/--legacy-peer-deps, drop the consumer gate, or raise the advertised floor merely to hide fixture contamination.
• Demonstrate that a synthetic incompatible development-tool peer cannot prevent the intended isolated witness, while real missing SDK runtime/type requirements still fail.
• Rerun the exact-head minimum-SDK and full supported gates; record results independently of SDK .26 adoption: lifecycle finalization causes three atomic compensation regressions #197.

Deduplication checked current all-status issues/PRs and all 160 canonical PM item files at this immutable head. Existing compatibility ownership is linked above; no separate peer-contamination finding was present. PR #194 remains the implementation owner. Head was rechecked immediately before filing.