pm files/docs --add silently ignore unknown CSV/markdown keys (no validation), unlike test --add which rejects them — consistency defect #258

Summary

pm files <id> --add and pm docs <id> --add silently ignore unknown CSV/markdown keys (typos are dropped with no error or warning), while the sibling pm test <id> --add strictly rejects unknown keys with a clear "Allowed keys" error. This is a cross-command consistency defect: a user who typos a metadata key (e.g. lable= instead of label=, or scoep= instead of scope=) in files/docs --add gets silently wrong data, whereas the same typo in test --add is caught immediately.

Note: known-key values ARE validated in all three (e.g. scope=TOTALLYBOGUS is rejected). Only unknown key names are treated inconsistently.

Environment

• pm version: 2026.6.16 (latest published; @unbrained/pm-cli)
• Found via extension-free testing (--no-extensions)

Repro (extension-free clean tracker)

pm init repro --pm-path /tmp/repro --no-extensions
P="--pm-path /tmp/repro --no-extensions"
F=$(pm create $P --type Task --title "X" --author t --json | jq -r .item.id)

# files --add: UNKNOWN keys 'label'/'boguskey' silently dropped — no error/warning
pm files $F $P --add "path=README.md,label=main,boguskey=v" --author t
# => adds file with only path+scope; 'label' and 'boguskey' vanish silently
#     (changed: true, count: 1, no warning)

# docs --add: same silent drop
pm docs $F $P --add "path=README.md,boguskey=v,anotherfake=x" --author t
# => adds doc; unknown keys silently ignored

# markdown-pair form via stdin: ALSO silently drops unknown keys
printf 'path: CHANGELOG.md\nlabeltypo: hello\nweirdkey: 1\n' | pm files $F $P --add - --author t

# CONTROL — test --add correctly REJECTS unknown keys:
pm test $F $P --add "command=echo hi,boguskey=zzz" --author t
# => Error: --add does not recognize key "boguskey". Allowed keys: command, cmd, path, scope, ...

Expected

files/docs (and any other link --add commands) should reject unknown CSV/markdown keys with an "Allowed keys" error, matching test --add — OR all commands should document a single consistent policy. Silent dropping of typoed keys risks data-integrity surprises (metadata the user believes they set is never stored).

Actual

files/docs --add accept and silently discard any unrecognized key in both CSV (k=v,...) and markdown-pair (k: v lines, stdin -) forms. test --add rejects the same with an explicit allowed-key list.

Suggested fix

Run the unknown-key validation already implemented for test --add across files --add, docs --add, --add-glob, and any sibling link adders (and ideally the --dep/--note/--field seed parsers for consistency).