chore(deps-dev): bump the pm-toolchain group across 1 directory with 3 updates

.agents/pm/issues/pm-github-gevp.toon

@@ -2,10 +2,37 @@ id: pm-github-gevp
 title: Minimum-SDK consumer fixture installs development-tool peers it cannot satisfy
 description: "Tracks gh:unbraind/pm-github#199 (filed 2026-10-29, missed by the blind issue watch; the three failures already covered by gh:unbraind/pm-github#197 are tracked separately). test/minimum-sdk-consumer.test.ts spreads all devDependencies into the consumer root and then overrides the CLI to the declared minimum (2026.10.17), while the manifest now installs pm-ops 2026.10.26 whose peer requires CLI >=2026.10.20 — an unsatisfiable graph, npm ERESOLVE before any packed import or declaration check runs. The PR #194 checks still fail as of run 41330041504. Fix the fixture to install only runtime dependencies plus the enforced minimum CLI (isolating the witness from development-tool peer requirements) so the packed extension, authored SDK imports and shipped declarations are verified at the floor independently of the development lock."
 type: Issue
-status: open
+status: in_progress
 priority: 2
-tags[3]: ci,fixtures,"gh:unbraind/pm-github#199"
+tags[7]: ci,dependencies,fixtures,"gh:unbraind/pm-github#194","gh:unbraind/pm-github#199",migration,sdk
 created_at: "2026-11-02T09:17:16.438Z"
-updated_at: "2026-11-02T09:17:16.438Z"
+updated_at: "2026-11-05T06:15:39.732Z"
 author: pi-glm
+comments[14]{created_at,author,text}:
+  "2026-11-04T19:20:31.399Z",codex-toolchain-1104,"Root cause (coupling): two compatibility assertions required the development SDK to equal the peer minimum range. The brief requires an exact development pin independently of the declared runtime minimum. Baseline compatibility-floor.test.ts fails on exact 2026.11.4 versus >=2026.10.17. Retain the declared minimum and enforce exact development pin/lock identity plus numerical compatibility; the packed consumer still verifies the exact minimum artifact."
+  "2026-11-04T19:23:04.630Z",codex-toolchain-1104,"Root cause (test fixture, issue 199): reproduced npm ERESOLVE on the adopted pins before packed import/type checks. The full devDependency spread now first conflicts on pm-changelog 2026.10.31 requiring CLI >=2026.10.23 versus the 2026.10.17 consumer; pm-ops has the same class of contamination. Install production dependencies plus compiler/Node types in the consumer, and place real operational pm-ops types in a separate fixture tooling graph. A synthetic dev tool requires exact SDK 2026.11.4 there while the consumer must retain exact SDK 2026.10.17. No force/legacy-peer-deps flags or minimum increase."
+  "2026-11-04T19:29:04.511Z",codex-toolchain-1104,"The isolated minimum consumer passed 1/1: exact SDK 2026.10.17 installed, entire packed extension linked, all production/operational source and shipped declarations compiled, and native label/tag behavior passed without git. Real pm-ops tooling and a synthetic peer resolved exact SDK 2026.11.4 independently. Exact development pin/floor tests pass 4/4. Full gate remains separate from the atomic-finalization blocker."
+  "2026-11-04T19:31:19.726Z",codex-toolchain-1104,"Negative control after isolation: in a disposable source copy, changing only the manifest/peer minimum to real SDK 2026.10.15 fails the complete witness on a missing SDK type/runtime contract, not ERESOLVE. This preserves the comprehensive minimum gate rather than masking it with a stub or peer override. The synthetic incompatible tooling peer still resolves separately. Linked pin/floor tests pass 4/4."
+  "2026-11-04T19:32:51.536Z",codex-toolchain-1104,Updated current minimum-SDK documentation and README to separate the declared minimum from the exact development pin; removed the stale current-lock version from prose. Historical dated validation reports retain their original artifact versions. docs/atomic-finalization-sdk.md identifies current 2026.11.4 and remaining #1656 requirement; daily-sync recovery now identifies GH-1628 as fixed in 2026.10.31 while preserving historical reproductions.
+  "2026-11-04T19:46:00.242Z",codex-toolchain-1104,The missing-contract negative control reaches source/identity.ts compilation on real SDK 2026.10.15 and fails TS2353 because BulkItemUpdateMutation.match is absent. The 2026.10.17 positive witness passes unchanged native assertions. This directly verifies that tooling isolation removes peer contamination while preserving the genuine minimum requirement.
+  "2026-11-04T20:54:37.841Z",codex-toolchain-1104,"Issue #199 verification remains green after typed parent fixture migration: the real minimum-SDK packed consumer passes 1/1 on 2026.10.17 with isolated current tooling. A disposable 2026.10.15 floor control installs successfully and fails authored SDK match typing (TS2353), proving compilation still detects unsupported SDK APIs rather than failing dependency resolution. Latest typecheck and lint pass. This consumer fix is independent of the unresolved finalization and plain-writer issues tracked in pm-github-quay."
+  "2026-11-04T21:00:35.063Z",codex-toolchain-1104,Resumed PR 194 validation only. Existing minimum-SDK isolation remains unchanged and will be rechecked with the previously cancelled consumer test. No issue closure is authorized.
+  "2026-11-04T21:08:31.996Z",codex-toolchain-1104,"Minimum consumer recheck passes 1/1 on real SDK 2026.10.17. Added a real installed CLI --stdin-json assignment update/readback to prove the new plain-writer transport works at the declared floor, alongside existing complete source/declaration checks and packed operational import probes. Current tooling remains isolated from the minimum host."
+  "2026-11-04T22:44:26.254Z",codex-toolchain-1104,"The complete npm test run passes 1644 cases with zero failures/cancellations and two unrelated explicit pm-cli#1656 skips. The minimum-SDK consumer executes in that full run and passes, including its real 2026.10.17 CLI JSON-input assignment probe, all authored source/declaration compilation and packed operational imports. Typecheck and lint also pass afterward. Issue 199 remains open; no closure action is taken. Coverage is now running separately after the green full suite."
+  "2026-11-05T01:43:07.926Z",codex-toolchain-1104,Final source coverage also passes at exact 100 percent in all four dimensions across the complete authored scope. The minimum-SDK consumer isolation and real 2026.10.17 CLI JSON-input witness pass in both complete test runs. The 71-entry classification and exact test/coverage receipts are in docs/toolchain-1104-validation.md. No issue or item is closed.
+  "2026-11-05T01:45:53.435Z",codex-toolchain-1104,"Validation closeout: minimum consumer remains a real installed SDK 2026.10.17 witness; full tests, typecheck/lint and complete four-dimensional source coverage pass with only the two separately documented SDK finalization skips. Documentation, duplication and changelog checks also pass. Release the claim for orchestrator review; leave the item and issues open."
+  "2026-11-05T04:28:03.353Z",codex-toolchain-1104,"Reviewer follow-up is limited to quarantine predicate verification, the missing existing-owner close regression, and import atomicity documentation. Minimum-SDK isolation and pins remain unchanged. The requested complete suite will recheck the consumer without changing or closing this item."
+  "2026-11-05T06:15:39.732Z",codex-toolchain-1104,"Reviewer follow-up complete suite passes on Node 26.13.0: 1647 pass, 0 fail, 0 cancelled, 2 explicit unrelated pm-cli#1656 skips; typecheck, lint and changelog check pass. Minimum-SDK isolation source and declarations remain unchanged. This follow-up adds only quarantine regression checks, existing-owner GH-1614 close coverage and README limitation documentation. Item and GitHub issues remain open."
+files[5]{path,scope}:
+  docs/sdk-minimum.md,project
+  package-lock.json,project
+  package.json,project
+  test/compatibility-floor.test.ts,project
+  test/minimum-sdk-consumer.test.ts,project
+tests[1]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}:
+  nice -n 10 node --test test/compatibility-floor.test.ts,project,120,codex-toolchain-1104,"2026-11-04T19:29:07.418Z",local_mutation,dependabot/npm_and_yarn/pm-toolchain-838740a1aa
+docs[3]{path,scope}:
+  docs/sdk-minimum.md,project
+  docs/toolchain-1104-validation.md,project
+  README.md,project
 body: ""