Harden SDK context integrity, merge safety, and agent-efficient output

.agents/pm/chores/pm-e9zh.toon

@@ -6,18 +6,18 @@ status: open
 priority: 2
 tags[5]: metadata,normalization,pm-cli,resolution,tracker-governance
 created_at: "2026-06-25T04:57:09.804Z"
-updated_at: "2026-07-26T17:17:15.949Z"
+updated_at: "2026-07-27T23:34:12.968Z"
 author: codex-pm-ecosystem-audit-20260625
 estimated_minutes: 240
 acceptance_criteria: All active item acceptance criteria and estimates remain filled or explicitly waived; terminal items flagged by validate_resolution_missing_fields are reduced or grouped into a residual list with rationale; no placeholder resolution text is added; pm validate --check-resolution --check-history-drift evidence is attached after the pass.
 parent: pm-33cw
 risk: medium
 confidence: medium
-dependencies[3]{id,kind,created_at,author,source_kind}:
-  pm-wrbe,blocked_by,"2026-07-07T07:17:29.062Z",null,null
-  pm-33cw,implements,"2026-07-26T05:56:09.159Z",null,null
-  pm-pcys9n,blocked_by,"2026-07-26T10:52:23.938Z",null,null
-comments[9]{created_at,author,text}:
+dependencies[3]{id,kind,created_at}:
+  pm-wrbe,blocked_by,"2026-07-07T07:17:29.062Z"
+  pm-33cw,implements,"2026-07-26T05:56:09.159Z"
+  pm-pcys9n,blocked_by,"2026-07-26T10:52:23.938Z"
+comments[10]{created_at,author,text}:
   "2026-06-25T04:57:09.804Z",codex-pm-ecosystem-audit-20260625,"Duplicate check: status-all searches for terminal resolution metadata backfill and active planning metadata found closed governance tooling items pm-yq7m, pm-fryg, pm-wbak-class work, and pm-6bz1, but no open execution item for historical backfill."
   "2026-07-04T20:56:40.819Z",codex-agent,"Audit evidence 2026-07-04 continuation: pm validate --check-resolution --check-history-drift --json is ok:true for history_drift across 1506 checked items and warns only validate_resolution_missing_fields:268 across closed historical items. This confirms pm-e9zh remains the canonical open remediation for terminal resolution/expected/actual backfill; no duplicate item created. The earlier list --filter-resolution-missing projection showed 198 closed rows because it counts a narrower filter than validate resolution details. Keep the existing no-placeholder and changelog-drag rules."
   "2026-07-05T05:51:00.468Z",claude-code-agent,"Live validation handoff from pm-lodl/pm-8778 lane: pm validate --check-resolution --check-history-drift --json on 2026-07-05 returned ok:true with history_drift ok across 1536 checked items and the pre-existing validate_resolution_missing_fields:268 warning. This confirms pm-e9zh remains the canonical open remediation for historical terminal resolution metadata; no duplicate item created from this lane."
@@ -27,6 +27,7 @@ comments[9]{created_at,author,text}:
   "2026-07-21T07:57:07.653Z",codex-root-20260721,"2026-07-21 shipping-lane verification: pm validate reports 276 closed items missing one or more structured resolution fields and zero history drift. The count is unchanged from the latest recorded baseline, so this canonical evidence-backed backfill item remains open; no placeholders or duplicate cleanup item were introduced."
   "2026-07-24T12:09:37.095Z",claude-code-agent,"Current validation evidence: pm validate --check-resolution --check-history-drift is ok with zero drift across 1,929 current items and reports 287 historical terminal records missing one or more structured resolution fields. This remains the canonical evidence-preserving backfill owner; no placeholders or duplicate cleanup item were introduced."
   "2026-07-26T17:17:15.948Z","harness:claude-code","Unblocked 2026-07-26. The constraint that held this item was that a metadata write on a long-closed item re-buckets it into the current changelog section, because attribution resolved through closed_at ?? updated_at ?? created_at and 1,488 of 1,795 terminal items carried no closed_at. That is no longer true.\n\nEvery terminal item now carries a release identifier derived from the tag whose window contains its close event, taken from its immutable history stream: 1,782 stamped, 13 deliberately left unstamped because they close after the newest tag and therefore belong to the pending window. The derivation was validated against ground truth before any write — for the 307 items that already had closed_at, the history-derived instant matched on 307 and disagreed on 0.\n\nThe generator honours the release field as the attribution authority under --all-release-tags, which was proved directly rather than assumed: stamping a closed item, which moved its updated_at to now, produced a byte-identical CHANGELOG.md. After the full backfill, regeneration moved 295 items and every one of those moves matched the derivation, with no items added or removed and the Unreleased section unchanged.\n\nThe practical consequence for this item: the backfill work it describes can now proceed as ordinary mutations without changelog churn, and the ordering constraint that deferred it no longer applies. Evidence and method are recorded on pm-3j6it6.\n"
+  "2026-07-27T23:34:12.968Z","harness:codex","2026-07-27 broad SDK/CLI shipping-lane refresh: pm validate --check-resolution --check-history-drift is ok with zero history drift across 2,144 current items and reports 291 historical terminal records missing one or more structured resolution fields. The seven items closed in this lane all carry evidence-backed resolution/expected/actual fields, so this debt did not grow from current work. pm-e9zh remains the canonical dedicated backfill owner; no placeholders, duplicate item, or unrelated bulk mutation was introduced."
 notes[2]{created_at,author,text}:
   "2026-07-04T18:50:14.133Z",maintainer-agent,"Scope addition from 2026-07-04 backlog audit (pm-y904): duplicate issue-code pair GH-209 (pm-1byt canonical, pm-25se follow-up) involves two CLOSED items, so per the changelog updated_at invariant it must be resolved in this careful backfill pass (set duplicate_of on pm-25se or retitle) together with the changelog regen, not in a create-only audit."
   "2026-07-06T13:13:56.245Z",maintainer-agent,"Audit #10 2026-07-06: validate_resolution_missing_fields grew 268 -> 269. The new entry is ADR pm-muhw (accepted+closed 2026-07-05 without resolution/expected_result/actual_result). Do NOT touch it now (changelog drag — it sits in the shipped 2026.7.6 bucket); fold it into this dedicated backfill pass. Real evidence exists: acceptance rationale is in its comments and the SDK-first epic pm-usfg body."

.agents/pm/chores/pm-r31390.toon

@@ -0,0 +1,33 @@
+id: pm-r31390
+title: Evaluate Sentry 10.68.0 compatibility and retain 10.67.0
+description: "Evaluate the latest @sentry/node patch against the Node floor and packed-consumer declaration boundary, retaining the newest version that passes release gates while preserving canonical deferrals for incompatible majors."
+type: Chore
+status: closed
+priority: 3
+tags[3]: dependencies,sentry,telemetry
+created_at: "2026-07-27T22:16:02.821Z"
+updated_at: "2026-07-27T23:35:11.255Z"
+closed_at: "2026-07-27T22:23:25.676Z"
+author: "harness:codex"
+acceptance_criteria: "Evaluate @sentry/node 10.68.0 against build, coverage, security, telemetry, and packed-consumer gates; adopt only if every mandatory boundary passes; retain the prior compatible version and record evidence otherwise; keep incompatible major updates linked to their canonical open deferral items."
+parent: pm-rnpb
+resolution: Deferred as incompatible after mandatory packed-consumer verification; no dependency files changed.
+expected_result: Adopt 10.68.0 only if packed TypeScript consumers compile against the published declaration graph.
+actual_result: 10.68.0 introduces transitive meriyah declaration references rejected by the packed-consumer guard; reverted to 10.67.0.
+dependencies[4]{id,kind,created_at,author,source_kind}:
+  pm-do5b,related,"2026-07-27T22:16:02.821Z","harness:codex","cli:create:dep"
+  pm-ksr40d,related,"2026-07-27T22:16:02.821Z","harness:codex","cli:create:dep"
+  pm-tll8,discovered_from,"2026-07-27T22:16:02.821Z","harness:codex","cli:create:dep"
+  pm-u2tqn6,related,"2026-07-27T22:16:02.821Z","harness:codex","cli:create:dep"
+comments[4]{created_at,author,text}:
+  "2026-07-27T22:16:02.821Z","harness:codex","Duplicate-check evidence: all-status searches for Sentry 10.68.0 and dependency refreshes found historical refresh items and the canonical npm-package-arg 14 / TypeScript 7 deferrals, but no active owner for this compatible Sentry patch."
+  "2026-07-27T22:17:57.447Z","harness:codex","Dependency disposition: @sentry/node 10.68.0 is compatible with the current Node floor and adopted. npm-package-arg 14 remains owned by pm-ksr40d because its engines exclude Node 22.18; TypeScript 7 remains owned by pm-do5b pending typescript-eslint/compiler-API compatibility."
+  "2026-07-27T22:23:19.891Z","harness:codex","Verification finding: full coverage exercised the package-manifest packed-consumer guard, which documents that @sentry/node 10.68.0 exposes transitive meriyah declaration references that fail the supported packed TypeScript consumer. The attempted patch was reverted; 10.67.0 remains the latest compatible release. npm-package-arg 14 and TypeScript 7 remain separately deferred in pm-ksr40d and pm-do5b."
+  "2026-07-27T23:35:11.255Z","harness:codex","Metadata correction: the title, description, and acceptance criteria now describe the verified evaluation outcome rather than the initially attempted upgrade, so the generated changelog does not misstate 10.68.0 as shipped."
+files[2]{path,scope,note}:
+  package.json,project,Sentry runtime version
+  pnpm-lock.yaml,project,Resolved Sentry dependency graph
+tests[1]{command,scope,timeout_seconds}:
+  "pnpm sentry:telemetry:gate -- --telemetry-mode best-effort",project,300
+close_reason: "Compatibility evaluation complete: retained @sentry/node 10.67.0 because the 10.68.0 packed-consumer declaration graph violates the mandatory package boundary; engine-incompatible majors remain on canonical open deferrals."
+body: ""

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-07-27T21:47:15.748Z",
+  "updated_at": "2026-07-28T00:12:43.057Z",
   "entries": [
     {
       "name": "pm-changelog",