fix(sdk): make continuation and union read result types truthful

.agents/pm/chores/pm-wb25c1.toon

@@ -6,7 +6,7 @@ status: open
 priority: 3
 tags[2]: dependencies,maintenance
 created_at: "2026-10-20T07:06:03.433Z"
-updated_at: "2026-10-20T11:37:09.804Z"
+updated_at: "2026-10-21T04:30:46.643Z"
 author: "harness:codex"
 estimated_minutes: 60
 acceptance_criteria: "Adopt eligible eslint, gpt-tokenizer, greptile and knip after seven-day cooldown; existing strict static, token, review-tool and coverage gates pass"
@@ -20,8 +20,9 @@ dependencies[5]{id,kind,created_at,author,source_kind,author_source}:
   pm-fokyhh,related,"2026-10-20T07:49:32.939Z","harness:codex","cli:update:dep",detected
   pm-ksr40d,related,"2026-10-20T07:49:32.939Z","harness:codex","cli:update:dep",detected
   pm-t3jxjj,related,"2026-10-20T07:49:32.939Z","harness:codex","cli:update:dep",detected
-comments[3]{created_at,author,text}:
+comments[4]{created_at,author,text}:
   "2026-10-20T07:06:03.433Z","harness:codex","Duplicate check: complete3021-item strict all-status/full-body read plus dependency/cooldown search and open/in-progress inventories found completed pm-ul0ow4 and broad owners, with no active minor-refresh leaf. Major migration owners are preserved. Open/unclaimed until eligible implementation."
   "2026-10-20T07:08:29.386Z","harness:codex",Current live GitHub inventories have zero open dependency PRs or Dependabot/code-scanning/secret-scanning alerts. npm-package-arg14 remains assigned to pm-ksr40d (engines require22.22.2 vs supported22.18.0); TypeScript7 to pm-do5b; Sentry11 compile/privacy/distribution migration to pm-t3jxjj; Vitest5/CodSpeed6 to pm-fokyhh. No dependency update is called accepted solely because the security inventory is empty.
   "2026-10-20T11:37:09.803Z","harness:codex","Live October20 continuation check: zero open GitHub dependency PRs, zero open Dependabot/code-scanning/secret-scanning alerts, and pnpm audit reports zero advisories at all severities. Registry confirms eslint10.13.0 was published October16 14:24UTC and knip6.42.1 October19 18:24UTC; both remain below seven-day cooldown, as do the previously documented October18 token/review minor updates. Existing major-migration owners are unchanged. This item remains open and unclaimed; no unsafe or premature upgrade was applied."
+  "2026-10-21T04:30:46.642Z","harness:codex","October21 live registry refresh: eslint10.13.0 published2026-10-16T14:24:10Z, gpt-tokenizer4.1.0 October18T05:43:37Z, greptile3.7.0 October18T00:02:04Z, knip6.42.1 October19T18:24:59Z and typescript-eslint8.72.0 October19T17:08:09Z. All remain below the configured seven-day cooldown. The pnpm outdated census also retains the already-owned Sentry11, Vitest5/CodSpeed6, npm-package-arg14 and TypeScript7 migrations. GitHub has0 open dependency PRs and0 open dependency or security alerts. Keep this existing owner open/unclaimed; no cooldown or compatibility floor is bypassed."
 body: ""

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-10-20T22:18:08.272Z",
+  "updated_at": "2026-10-21T06:24:41.413Z",
   "entries": [
     {
       "name": "builtin-calendar",

.agents/pm/history/pm-bj7rq0.jsonl

@@ -113,3 +113,7 @@
 {"hash_algorithm":"sha256","ts":"2026-10-20T16:26:26.595Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"244d33e51b5f1223152c8358","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-02z97f","claim:pm-htiwmd","lineage:pm-htiwmd","lineage:pm-lvyd","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]},"topic":{"value":"workset:pm-02z97f+pm-htiwmd","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-02z97f","claim:pm-htiwmd","lineage:pm-htiwmd","lineage:pm-lvyd","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/5","value":{"id":"pm-2zjs0g","kind":"related","created_at":"2026-10-20T16:26:25.937Z","author":"harness:codex","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-20T16:26:26.595Z"}],"before_hash":"dc71486ba9e6875f81c553643fb716f1a287c35fa2f3bdc7cf3b81a2539f1989","after_hash":"cfa16c3b8ddfdc607e95298e1f0972451b89720acbd6b78c02dbc85642ce4bc5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b63cc5079e88c42d2422ca05d179192473197330656f8f2daed34d7b5a470fa4"}
 {"hash_algorithm":"sha256","ts":"2026-10-20T19:22:28.989Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"244d33e51b5f1223152c8358","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/61","value":{"created_at":"2026-10-20T19:22:28.989Z","author":"harness:codex","text":"New CodSpeed report on PR1524 source86edbdc versus main849dbf0 reports createQueryFingerprint -2.17% (displayed1ms to1.1ms), with9 untouched and1 improved benchmark. Chrome computer-use inspection of the report confirms different runtimes: Node24.21.0/V813.6.233.17-node.53 versus Node24.22.0/V813.6.233.17-node.57. It also identifies14 system calls totaling149.9us excluded from the CPU Simulation measure. Source and benchmark algorithms are unchanged in this dependency/CI patch. Retain this as a comparability gap requiring matched-runtime and syscall-aware Walltime evidence under the existing performance scope; no acknowledgement or benchmark threshold change was made. Report: https://app.codspeed.io/unbraind/pm-cli/branches/fix%2Ffollow-redirects-security"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-20T19:22:28.989Z"}],"before_hash":"cfa16c3b8ddfdc607e95298e1f0972451b89720acbd6b78c02dbc85642ce4bc5","after_hash":"7ab49baf7b126a5b906995a0da6543af47b67eb4258225cecef486c0b23798be","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b35a8f00bd8189b1a27679f8d6ce33cfc7705615168f866dfad3f8bbfc3f7284"}
 {"hash_algorithm":"sha256","ts":"2026-10-20T20:46:31.181Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"244d33e51b5f1223152c8358","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-5sgx37","claim:pm-eg5u1n","claim:pm-eqxjzl","lineage:pm-eg5u1n","lineage:pm-1jzupz","lineage:pm-33cw","lineage:pm-doxj"]},"topic":{"value":"workset:pm-5sgx37+pm-eg5u1n+pm-eqxjzl","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-5sgx37","claim:pm-eg5u1n","claim:pm-eqxjzl","lineage:pm-eg5u1n","lineage:pm-1jzupz","lineage:pm-33cw","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/62","value":{"created_at":"2026-10-20T20:46:31.179Z","author":"harness:codex","text":"PR #1526 local static evidence on the qualified Node 26.9.0 runner: control medians 75/79ms against 106ms maximum; SDK entrypoint gate reported product_admission=failed. Governance 506>327ms, graph 290>172ms, merge 383>226ms, query 270>241ms, runtime 464>452ms, testing 482>461ms. Observed load ~22 on 8 available CPUs does not override the configured qualified result. Hosted source static job 118869982878 passed in 12m13s. Retain this as broader performance/runner evidence, without weakening budgets or claiming the local gate passed. No new performance implementation or parent claim in the advisory scope."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-20T20:46:31.181Z"}],"before_hash":"7ab49baf7b126a5b906995a0da6543af47b67eb4258225cecef486c0b23798be","after_hash":"7e3efe47e88b93bff133320a151c621e8dd6a0045db3d139d490852ae40fae9a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5272d65825664ccf890dab4488022b0a719fc099d794a189920ceab1f0b8153a"}
+{"hash_algorithm":"sha256","ts":"2026-10-21T05:05:20.995Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"84c7455f2d19eb009b089d3a","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-j2vwbh","claim:pm-jqgkis","claim:pm-oybmsd","lineage:pm-j2vwbh","lineage:pm-bj7rq0","lineage:pm-o87av6","lineage:pm-doxj"]},"topic":{"value":"workset:pm-j2vwbh+pm-jqgkis+pm-oybmsd","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-j2vwbh","claim:pm-jqgkis","claim:pm-oybmsd","lineage:pm-j2vwbh","lineage:pm-bj7rq0","lineage:pm-o87av6","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/63","value":{"created_at":"2026-10-21T05:05:20.994Z","author":"harness:codex","text":"October21 final-source observations: an isolated SDK entrypoint-cost run now passes all10 entrypoints, independently of the earlier failed concurrent receipt. The subsequent CLI transport-floor run still returns benchmark_product_budget_exceeded on a qualified Node26.9.0 runner: get best370>362ms, next475>440, create440>398 and claim461>415. Control medians50/65ms are within106ms. Keep this qualified failure distinct from load observations and hosted Node24 acceptance; no baseline, threshold or retry was changed. The new child pm-j2vwbh owns only the independently proven missing context corpus allocation."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-21T05:05:20.995Z"}],"before_hash":"7e3efe47e88b93bff133320a151c621e8dd6a0045db3d139d490852ae40fae9a","after_hash":"9f0cb91d0b55b8f61fc4d88f9300053ed5c937a1e26d4cda526b1690223bc351","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f0d7b69fcbaa121c1196e9805b8fdc05892598807fcb5c92dd68b0344c162daf"}
+{"hash_algorithm":"sha256","ts":"2026-10-21T05:28:15.577Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"84c7455f2d19eb009b089d3a","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-j2vwbh","claim:pm-jqgkis","claim:pm-oybmsd","lineage:pm-j2vwbh","lineage:pm-bj7rq0","lineage:pm-o87av6","lineage:pm-doxj"]},"topic":{"value":"workset:pm-j2vwbh+pm-jqgkis+pm-oybmsd","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-j2vwbh","claim:pm-jqgkis","claim:pm-oybmsd","lineage:pm-j2vwbh","lineage:pm-bj7rq0","lineage:pm-o87av6","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/64","value":{"created_at":"2026-10-21T05:28:15.576Z","author":"harness:codex","text":"A second independent local qualification observation from the complete four-shard replay: shard 4 timed out the existing tests/unit/scripts/cli-transport-floor.spec.ts case runs the default measurement with isolated permissive test budgets at its unchanged 30000ms deadline. This is separate from the earlier context corpus timeout, which now has serial allocation proof under its scoped child. All other shards are allowed to finish; the failed full shard will be rerun once in isolation against the same frozen source and limits before any code change is considered. No coverage merge is accepted from the failed attempt."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-21T05:28:15.577Z"}],"before_hash":"9f0cb91d0b55b8f61fc4d88f9300053ed5c937a1e26d4cda526b1690223bc351","after_hash":"45b52793f3f617221f8710fe5327a8e7935ed1c017eca117f696ae9566f186b5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"61e7644f74911d47592e1a59e981568c5c33df03c2b3802d2110c056e191bc2f"}
+{"hash_algorithm":"sha256","ts":"2026-10-21T06:23:52.866Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"84c7455f2d19eb009b089d3a","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-qal1uw","lineage:pm-qal1uw","lineage:pm-srns","lineage:pm-mpbb","lineage:pm-doxj"]},"topic":{"value":"pm-qal1uw","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-qal1uw","lineage:pm-qal1uw","lineage:pm-srns","lineage:pm-mpbb","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/65","value":{"created_at":"2026-10-21T06:23:52.866Z","author":"harness:codex","text":"Separate hosted measurement retained for PR1529 f480367: CodSpeed reports jaccardSimilarity 332us to349.8us (-5.1%) and explicitly warns that significant changes compare different runtime environments; createQueryFingerprint also carries the system-call instrumentation warning. The measured text-normalization code and benchmark are unchanged by this declaration-focused PR. This is an unresolved comparison qualification report, not proof of a source regression or of its absence, and is separate from the local CLI admission failure. The requested Chrome Computer Use fallback opened the exact CodSpeed branch page, but subsequent tab access failed Debugger unattached twice; no benchmark was acknowledged or hidden. Report: https://github.com/unbraind/pm-cli/pull/1529#issuecomment-6309167940 . Require the final revision report and retain the qualification limitation if it persists."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-21T06:23:52.866Z"}],"before_hash":"45b52793f3f617221f8710fe5327a8e7935ed1c017eca117f696ae9566f186b5","after_hash":"091eca16d64413303dac0dc93588c683de53a3f108a429662735673324844ef3","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"24bd44439cd932dc264d0985ecf1a9f1f9a84f20886c4b49b2f131666e9246bb"}
+{"hash_algorithm":"sha256","ts":"2026-10-21T06:25:30.293Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"84c7455f2d19eb009b089d3a","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":null,"topic":null},"op":"comment_edit","patch":[{"op":"replace","path":"/metadata/comments/65/text","value":"Separate hosted measurement retained for PR1529 f480367: CodSpeed reports jaccardSimilarity 332us to349.8us (-5.1%) and explicitly warns that significant changes compare different runtime environments; createQueryFingerprint also carries the system-call instrumentation warning. The measured text-normalization code and benchmark are unchanged by this declaration-focused PR. This is an unresolved comparison qualification report, not proof of a source regression or of its absence, and is separate from the local CLI admission failure. The requested Chrome Computer Use fallback opened the exact CodSpeed branch page, but subsequent tab access failed Debugger unattached twice; no benchmark was acknowledged or hidden. Report: https://github.com/unbraind/pm-cli/pull/1529#issuecomment-6309096531 . Require the final revision report and retain the qualification limitation if it persists."},{"op":"add","path":"/metadata/comments/65/edited_at","value":"2026-10-21T06:25:30.293Z"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-21T06:25:30.293Z"}],"before_hash":"091eca16d64413303dac0dc93588c683de53a3f108a429662735673324844ef3","after_hash":"8c5e7c84eeb3ceea152b30f566cb8dbde7c2fdf62e23fadbe6288f6ba717340c","item_hash_version":3,"message":"Correct the report anchor using the live GitHub comment database ID.","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"53609d3f5285d69b208b4c81d683c5fa9527408abfdef83ec4d56882dd54e26c"}