[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.25 to 2026.10.28

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.28

@​unbrained/pm-cli 2026.10.28

Source range: v2026.10.27...v2026.10.28

Changelog

Fixed

• Preserve explicit tracker scope in lifecycle recovery mutation examples (pm-lifecycle-example-scope)
• Schedule the complete merge-receipt classification keeper after parallel contracts (pm-receipt-serial)
• GH-1607: Provide intent-specific recovery for unsupported block and unblock commands (pm-gh1607)
• GH-1604: Classify missing linked-test executables separately from assertion failures (pm-gh1604)
• GH-1611: render portable tracker scope in generated completion hints (pm-gh1611)
• GH-1612: canonicalize native receipt fault fixtures and guard macOS before merge (pm-receipt-native-fixture)
• GH-1613: preserve typed PmClient validation and lookup refusals (pm-gh1613)
• GH-1605: Preserve recent events when default history output must be bounded (pm-gh1605)
• Capture native lookup evidence and reject interrupted command-absence proof (pm-windows-lookup-proof)
• Review1608: classify absent script interpreters and make negative controls replayable (pm-script-launch-evidence)

Security

• Raise qs floor to 6.16.1 for GHSA-6pq8-jhm2-2vcw (pm-vkckiv)

Other

• Complete October 20 tooling cohort with mature jscpd 5.4.2 (pm-wb25c1)

PM Tracker Evidence

Closed pm items in release window: 8 By type: Issue=7, Chore=1 By status: closed=8

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.27

@​unbrained/pm-cli 2026.10.27

Source range: v2026.10.26...v2026.10.27

Changelog

Fixed

• GH-1593: verify authoritative history integrity in SDK mutation-event reads (pm-gh1593)
• Isolate telemetry setup in the health cursor replay regression (pm-oahhyc)
• Preserve Git-backed merge-receipt evidence in isolated linked-test contexts (pm-ycyymg)
• Let superseded CI aggregators stop when their workflow is canceled (pm-ci-cancel-aggregate)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.28 - 2026-10-28

Fixed

• Preserve explicit tracker scope in lifecycle recovery mutation examples (pm-lifecycle-example-scope)
• Schedule the complete merge-receipt classification keeper after parallel contracts (pm-receipt-serial)
• GH-1607: Provide intent-specific recovery for unsupported block and unblock commands (pm-gh1607)
• GH-1604: Classify missing linked-test executables separately from assertion failures (pm-gh1604)
• GH-1611: render portable tracker scope in generated completion hints (pm-gh1611)
• GH-1612: canonicalize native receipt fault fixtures and guard macOS before merge (pm-receipt-native-fixture)
• GH-1613: preserve typed PmClient validation and lookup refusals (pm-gh1613)
• GH-1605: Preserve recent events when default history output must be bounded (pm-gh1605)
• Capture native lookup evidence and reject interrupted command-absence proof (pm-windows-lookup-proof)
• Review1608: classify absent script interpreters and make negative controls replayable (pm-script-launch-evidence)

Security

• Raise qs floor to 6.16.1 for GHSA-6pq8-jhm2-2vcw (pm-vkckiv)

Other

• Complete October 20 tooling cohort with mature jscpd 5.4.2 (pm-wb25c1)

2026.10.27 - 2026-10-27

Fixed

• GH-1593: verify authoritative history integrity in SDK mutation-event reads (pm-gh1593)
• Isolate telemetry setup in the health cursor replay regression (pm-oahhyc)
• Preserve Git-backed merge-receipt evidence in isolated linked-test contexts (pm-ycyymg)
• Let superseded CI aggregators stop when their workflow is canceled (pm-ci-cancel-aggregate)
• Reserve preparation and runner queue time before serial release acceptance (pm-29bwud)

Other

• Use resilient temporary-root cleanup in the packed-install workflow fixture (pm-p5u6)
• Refresh mature tooling, scanner pins and changelog SDK contracts (pm-8skz5z)

2026.10.26 - 2026-10-26

Added

• Allow safe transaction previews in managed-package workspaces with derived dependency links (pm-jhkzk0)

Changed

• Adopt release-age eligible Greptile 3.7.0 review tooling (pm-greptile370)

Fixed

... (truncated)

Commits

• b5241ce chore(release): cut 2026.10.28
• 7d85bc8 Merge pull request #1608 from unbraind/fix/agent-history-and-recovery
• 9aaa8a2 fix(sdk): preserve cwd tracker authority in copied recovery commands
• 57aced0 docs(pm): close verified SDK and dependency delivery
• 1c534fc fix(pm): complete SDK intake and refresh verified operational results
• c72930a fix(sdk): preserve typed refusals and portable recovery scope
• b76d697 docs(pm): qualify benchmark variance and blocked hosted admission
• ee88e54 docs(pm): track typed PmClient refusal parity report
• fe19918 docs(pm): retain exact local receipts and external admission handoff
• c646aef test(receipts): align fault fixtures with native Git coordinates
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.24 to 2026.10.28

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.28

2026.10.28 - 2026-10-28

Other

• Stop Hound from linting generated dist/ output (pmc-hound-generated-dist)

pm-changelog v2026.10.27

2026.10.27 - 2026-10-27

Other

• Use the pm SDK for whole-tracker completeness validation (pmc-sdk-completeness-1025)

pm-changelog v2026.10.26

2026.10.26 - 2026-10-26

Added

• Compile ordered consumer upgrade obligations across releases (pmc-consumer-upgrades)

pm-changelog v2026.10.25

2026.10.25 - 2026-10-25

Added

• Publish audience-specific change contracts with shared attribution (pmc-audience-contracts)
• Generate release notes from immutable tracker milestones (pmc-tracker-milestones)
• Audit every generated release claim against recorded evidence (pmc-claim-evidence)

Other

• Correct tracker reconciliation review evidence (pmc-review-266)
• Release readiness hardening for pm-changelog (pmc-14cx)
• Bump @​unbrained/pm-cli SDK to >=2026.5.24 (pmc-cfhf)

Changelog

Sourced from pm-changelog's changelog.

2026.10.28 - 2026-10-28

Other

• Stop Hound from linting generated dist/ output (pmc-hound-generated-dist)

2026.10.27 - 2026-10-27

Other

• Use the pm SDK for whole-tracker completeness validation (pmc-sdk-completeness-1025)

2026.10.26 - 2026-10-26

Added

• Compile ordered consumer upgrade obligations across releases (pmc-consumer-upgrades)

Fixed

• Redact every package-scan diagnostic and reject sensitive member names (pmc-scan-redaction)
• Keep internal certification records and local paths out of the npm package (pmc-package-files)
• Document exactly the flags accepted by every standalone command (pmc-help-parser)

Other

• Point the npm homepage at the package catalog and link the author (pmc-mb4e)

2026.10.25 - 2026-10-25

Added

• Publish audience-specific change contracts with shared attribution (pmc-audience-contracts)
• Generate release notes from immutable tracker milestones (pmc-tracker-milestones)
• Audit every generated release claim against recorded evidence (pmc-claim-evidence)

Other

• Correct tracker reconciliation review evidence (pmc-review-266)
• Release readiness hardening for pm-changelog (pmc-14cx)
• Bump @​unbrained/pm-cli SDK to >=2026.5.24 (pmc-cfhf)

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

... (truncated)

Commits

• ad8c171 Release pm-changelog v2026.10.28
• e1c8313 chore(deps-dev): bump the pm-toolchain group with 2 updates (#296)
• c5fba79 Close delivered tracker items with merge evidence (#293)
• c18e666 Release pm-changelog v2026.10.27
• 3a9f5fb chore: stop Hound linting generated dist output (#290)
• 2eb8d9f chore(deps-dev): bump the pm-toolchain group with 2 updates (#292)
• 3a99abc Close items delivered by the 2026-10-25 merges with merge evidence (#286)
• 62833a1 Release pm-changelog v2026.10.26
• 0b43eb3 Redact package-scan diagnostics and reject sensitive member names (#289)
• ce504e1 Point the npm homepage at the package catalog and link the author (#284)
• Additional commits viewable in compare view

Updates pm-ops from 2026.10.24 to 2026.10.29

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.29

Changelog

2026.10.29 - 2026-10-29

No tracked changes.

pm-ops v2026.10.28

Changelog

2026.10.28 - 2026-10-28

No tracked changes.

pm-ops v2026.10.27

Changelog

2026.10.27 - 2026-10-27

No tracked changes.

pm-ops v2026.10.26

Changelog

2026.10.26 - 2026-10-26

Fixed

• Every published release needs exactly one changelog section, including releases with no tracked items (ops-changelog-sections)

pm-ops v2026.10.25

Changelog

2026.10.25 - 2026-10-25

Added

• Run reviewed read-only diagnostic plans within explicit budgets (ops-diagnostic-plans)
• Invalidate only operational claims whose evidence expires or whose scoped versions change (ops-evidence-expiry)
• Report verified backend SDK capabilities without tracker writes (ops-backend-capability)

Fixed

• Honor metrics JSON format and document verified registry activation (ops-install-routes-1022)
• Refuse unsafe diagnostic and artifact inputs before reading (ops-bounded-input)

2026.10.23 - 2026-10-23

Added

... (truncated)

Changelog

Sourced from pm-ops's changelog.

2026.10.29 - 2026-10-29

Added

• Choose the cheapest approved checks to re-verify stale claims (ops-reverification)

Other

• Recover the historical 2026.10.20 GitHub Release with verified release evidence (ops-release-1020-recovery)

2026.10.28 - 2026-10-28

Added

• Explain joint compatibility constraints with minimal reason chains (ops-compatibility-reasons)

Fixed

• Keep release changelog bytes stable when the pending version becomes a tag (ops-release-changelog-stability)

Other

• Stop Hound from linting generated dist/ output (ops-hound-generated-dist)

2026.10.27 - 2026-10-27

Other

• Use SDK corpus reads for backend assurance and diagnostics (ops-sdk-adoption-1025)

2026.10.26 - 2026-10-26

Added

• Reduce diagnostic failures to minimal shared input witnesses (ops-minimal-witnesses)

Fixed

• Every published release needs exactly one changelog section, including releases with no tracked items (ops-changelog-sections)

Other

• Point the npm homepage at the package catalog and link the author (ops-dyh7)

2026.10.25 - 2026-10-25

Added

• Run reviewed read-only diagnostic plans within explicit budgets (ops-diagnostic-plans)
• Invalidate only operational claims whose evidence expires or whose scoped versions change (ops-evidence-expiry)

... (truncated)

Commits

• ee2a78e Release pm-ops v2026.10.29
• 1491ac0 chore(deps-dev): bump the pm-toolchain group with 2 updates (#227)
• 491456c Choose the cheapest approved checks to re-verify expired claims (#226)
• ba05bb8 Release pm-ops v2026.10.28-1
• 0aa3082 Recover v2026.10.20 release notes and guard changelog section completeness (#...
• 983b632 Release pm-ops v2026.10.28
• 6992491 chore(deps-dev): bump the pm-toolchain group across 1 directory with 2 update...
• 3e5156f chore(deps-dev): bump @​types/semver (#222)
• ae66ec5 Explain package, host and extension conflicts with minimal reason chains (#220)
• 6031fee Close items delivered by the 2026-10-26/27 merges with merge evidence (#219)
• Additional commits viewable in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c36d6d5a-bac5-40b8-a44a-47ad619000d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[unbraind]

Updated the group to exact @unbrained/pm-cli@2026.11.4, pm-ops@2026.11.4, and pm-changelog@2026.10.31, after merging main. The declared minimum SDK remains 2026.10.17. This is a partial verified migration; the PR is not green yet.

Root causes and classifications:

• Production — pm-cli 2026.10.30 GH-1614: import comparisons erased literal typed assignee/sprint identities such as none. Preserve those names in import-fidelity.ts, with a real-SDK regression that fails when the production fix is reverted. Commit 065d3f8.
• Test — GH-1614: discussion, label and project fixtures used typed parent: "none". Replace that field with explicit unset: ["parent", ...], retaining real-parent assignments and the model assertions. Commit 5683d6e.
• Coupling/test — issue Isolate minimum-SDK consumer fixture from development-tool peer requirements #199: the minimum-SDK consumer copied every dev dependency into its older host, allowing current toolchain peers to force an npm ERESOLVE before compilation. Isolate current tooling from the real minimum-SDK consumer; retain the packed extension, all authored source checks and actual operational imports. Floor tests now distinguish the exact development pin from the declared peer/manifest minimum. Commit 065d3f8. Resolves Isolate minimum-SDK consumer fixture from development-tool peer requirements #199.
• Test — pm-changelog 2026.10.31, “Fail closed when requested release notes have no matching section”: intentionally empty tagged fixture releases must opt into --include-empty (17e03c0); historical-only workflow fixtures must pair --no-pending-release with --all-release-tags (046a77c). Existing privacy, refusal, zero-close, behavioral-revert and release-placement assertions remain intact; the empty-release fixture also checks its exact section and rendered empty text.
• Pin consistency: test/discussion-packed-acceptance.ts selected SDK 2026.10.28 for current npm/Bun hosts and receipts. Derive all four values from the exact development pin (e1be8be). Historical reproductions and the deliberate minimum-host probe retain their observed/declared versions.
• Production, remaining — GH-1614: the plain import writer still sends --assignee none through legacy CLI flags, which remove that field, while typed SDK assignment stores literal none. The plain repeat-import property still fails at seed 17 because an identical second import changes updated_at (focused rerun 0/1). A separate synthetic CLI-versus-SDK probe confirms the identity mismatch. Recorded in pm-github-quay and docs/daily-sync-recovery.md; 1a6d9b2 documents this blocker, without weakening the no-op assertion.
• Upstream requirement / production integration, remaining — pm-cli 2026.10.26 GH-1591 and pm-cli#1656: the committing observer's raw lifecycle finalizer is outside native transaction ownership. SDK 2026.11.4 still cannot compensate it safely. The focused existing matrix is 1 pass, 2 fail: source-lifecycle rollback and recovered-plan cleanup fail; fresh-plan cleanup passes. An independent public-SDK update/committing-update/throw reproduction retains a compensating journal with transaction_partial_mutation. A supported transaction-owned lifecycle finalizer is still needed from SDK: a transaction-owned finalization step for commitItemMutations, so importers keep rollback under the GH-1591 ownership guard pm-cli#1656. The expected-revision guards added in 2026.11.4 (GH-1576) do not provide that durable step. No observer reordering, forced restore, forged ownership markers or compensation-test weakening was introduced. Issue SDK .26 adoption: lifecycle finalization causes three atomic compensation regressions #197 remains unresolved; evidence is in docs/atomic-finalization-sdk.md and pm-github-quay.

Validation (suites run with nice -n 10; npm uses a null user config):

• node --test test/typed-sentinel-normalization.test.ts test/scheduled-refusals.test.ts: 19/19. Reverting only the production normalization fix makes its new real-SDK regression fail 0/1; restored afterward.
• node --test test/compatibility-floor.test.ts: 4/4; linked PM test runs also passed.
• node --test test/minimum-sdk-consumer.test.ts: 1/1 on the real 2026.10.17 host, including a second run after the explicit-unset fixture change. A disposable 2026.10.15 control installs, then correctly fails authored SDK match typing with TS2353, rather than ERESOLVE.
• Corrected test/changelog-placement.test.ts: 5/5. Five focused corrected test/closeout-workflow.test.ts privacy/zero-close/read-denial/behavioral-revert cases: 5/5. Representative discussion/label fixture checks: 2/2. Complete corrected model/workflow files were not rerun.
• Node 26 npm test was explicitly budget-stopped after about 34 minutes: 648 reported, 577 pass, 21 fail, 50 cancelled, 0 skipped. The 21 assertion failures were two placement and eighteen workflow cases that had already loaded their old fixture definitions, plus the remaining plain-import no-op failure. The corrected focused results above do not certify a complete full-suite rerun.
• npm run build:test, typecheck, lint, docstring, duplication, privacy, audit:prod, changelog:full, changelog:check, and strict PM health passed. Production audit: 0 vulnerabilities. No tracked dist/ exists. The updated five-host packed discussion script compiles and lints, but its runtime matrix was not rerun.
• Full coverage was not run: the suite remains red and the local repository budget expired. Coverage thresholds and ignores are unchanged; no green release/coverage claim is made.

PM evidence is committed with the changes in pm-github-quay and pm-github-gevp; both claims are released and neither item is closed.

[unbraind]

Pushed head: 8907c1441aabc5412d378892076347fe54caf56d.

Follow-up validation for this PR: the plain GH-1614 writer mismatch is fixed. Plain create/update send assignment fields through --stdin-json, preserving literal none/null names; source finalization restores an explicit assignee after native close. The real regression checks existing updates, fresh creates, open/closed sources, exact SDK readback and byte-identical repeated imports. Reverting the production fix fails on undefined !== "none"; restored code passes. Production fix: c59e266; generic SDK list metadata is narrowed in its regression by 8b11727.

The completed npm test run reports 1646 tests: 1644 passed, 0 failed, 0 cancelled, 2 skipped. All 186 workflow decision rows and the existing 500-sequence model assertions remain intact. Typecheck and lint passed afterward. The minimum-SDK consumer also passes with real CLI JSON-input readback at SDK 2026.10.17; its current development tooling remains isolated.

Final classification of the earlier 21 failures and 50 cancellations:

Original entries	Classification	Final result
2	Same root cause: pm-changelog 2026.10.31 empty requested release	Both placement assertions pass; intentionally empty tagged fixtures use --include-empty.
18	Same root cause: pm-changelog historical-only generation contract	All eighteen workflow assertions pass; fixture pairs --no-pending-release with --all-release-tags.
1	Fixed production GH-1614 mismatch	Plain repeat-import passes with literal assignment data preserved.
48	Fixed: previous budget cancellation cleared	Files complete successfully in the full rerun.
1	Upstream pm-cli#1656 in test/import-fidelity.test.ts	File completes; one exact source-lifecycle rollback test is explicitly skipped.
1	Upstream pm-cli#1656 in test/refresh.test.ts	File completes; only recovered=true terminal cleanup is explicitly skipped. Fresh cleanup passes.

The original cancellations came from the deliberate budget SIGINT, not host-load timeouts. The two upstream-labelled file entries were also originally cancelled for that reason; their current label applies only to the one named quarantined body in each file. No test failed or cancelled for a host-load timeout in the completed rerun. All 71 original entries and their individual results are recorded in the 71-entry validation table.

Upstream: pm-cli#1656 remains required for a supported transaction-owned lifecycle finalizer with recovery and compensation. A fresh SDK 2026.11.4 recheck reproduced 1 pass, 2 failures before applying the authorized existing Node skip mechanism. Only these bodies are skipped:

• real SDK atomic compensation restores an imported source lifecycle and removes new items after finalization;
• terminal failures remove replay plans after real SDK compensation (true).

Every compensation assertion remains in its original body. Each skip cites pm-cli#1656 and applies only while the installed SDK is exactly 2026.11.4; another version automatically re-enables both cases. GH-1591 ownership refusal remains protective behavior, and the expected-revision guards added in 2026.11.4 (GH-1576) do not add a durable raw-document step. No forced restore, forged ownership marker, observer reordering or post-commit finalization is used. These two explicit skips do not certify the blocked rollback guarantees.

Coverage passed: exact 100% in all four dimensions across all 29 authored modules, including operational scripts: 14,180/14,180 lines, 14,180/14,180 statements, 445/445 functions, 5,277/5,277 branches. Zero skipped source entries. The instrumented suite again reports 1644 passed, 0 failed, 0 cancelled, 2 explicit upstream skips. The native incremental merge processed all 3883 raw receipts. The coverage gate alone took about three hours, so the follow-up exceeded its approximate time estimate rather than ending another required run early.

Validation commands use Node 26.13.0, nice -n 10 and NPM_CONFIG_USERCONFIG=/dev/null: npm test, npm run typecheck, npm run lint, and npm run coverage. No coverage thresholds or ignores are changed. Docstrings (269 declarations), zero-duplication, changelog generation/check, strict PM health, and privacy (8772 audited objects) also pass. No tracked dist exists. Runtime sources, manifest and dependency files are unchanged from tested source head 8b11727; the final commit adds only documentation and PM evidence.

PM evidence is committed in pm-github-quay and pm-github-gevp. Both claims are released and neither item is closed. Issues #197 and #199 are left open; no merge or release is performed.

[unbraind]

Reviewer follow-up completed in 943e540.

Requested item	Classification / reference	Change and verification
Quarantine predicate regression	Test guard for upstream GH-1591 / pm-cli#1656	test/atomic-finalization-quarantine.test.ts executes the actual predicate and actual skip option from both compensation test files against 12 fixture versions without installing SDKs. Only exact 2026.11.4 is waived; every other fixture version re-enables the assertions. Fresh refresh invocation always runs. All six always-skip, inverted-predicate and skip-bypass mutations were rejected.
Existing-owner close regression	Production GH-1614 fix regression (pm-cli 2026.10.30)	A closed, updated GitHub source updates an existing owner with zero creates and one update. History proves update → close removing the assignee → import restoring literal none; title, closed status and literal sprint also match. Reverting only the existing-owner restore argument from the existing fix makes this new test fail (undefined versus none).
Known limitation documentation	Upstream SDK integration limitation: GH-1591 (2026.10.26), pm-cli#1656	README now explains that on pm-cli ≥ 2026.10.26 without transaction-owned finalization, failure after lifecycle finalization can leave partially applied state, which the recovery journal resumes. It names both exact quarantined tests and their automatic re-enable on any other installed SDK version. The same limitation is recorded on pm-github-quay.

Validation on Node 26.13.0, with npm user config disabled and suites run with nice:

• nice -n 10 node --test test/atomic-finalization-quarantine.test.ts test/typed-sentinel-normalization.test.ts: 5 passed; also recorded through pm test --run.
• Seven deliberate negative controls failed assertions as required; every mutation was restored before the full run.
• NPM_CONFIG_USERCONFIG=/dev/null nice -n 10 npm test: 1,649 total; 1,647 passed, 0 failed, 0 cancelled, 2 skipped (6,167,670.956242 ms). All three new regressions pass in this complete run.
• npm run typecheck, npm run lint, npm run changelog:check: passed, sequentially after the suite. Tags were fetched; changelog is current and unchanged.
• npm run privacy: passed, 8,833 objects audited. The new commit uses the required SteveBot identity. The broader branch author audit also includes pre-existing bot/maintainer commits already on the PR; those were preserved without rewriting history.
• Coverage was not rerun for this test/documentation-only follow-up; previous coverage receipts retain their original source-head scope.

Upstream: pm-cli#1656 remains open and must provide transaction-owned finalization with durable recovery and compensation. The exact lifecycle-restoration test and recovered-refresh compensation test remain quarantined only on SDK 2026.11.4; all compensation assertions are intact. Passing this suite does not certify those blocked rollback guarantees.

PM evidence is committed on pm-github-quay and pm-github-gevp; items remain open and the claim is released. Issues #197 and #199 remain open. Auto-merge remains disabled.