v2026.9.18

@unbrained/pm-cli 2026.9.18

Source range: v2026.9.17...v2026.9.18

Changelog

Fixed

• Allow canonical JSON/TOON encoding on mutations (pm-1rta7z)
• Omit redundant read receipts when canonical output flags do not compact results (pm-g8oh0f)
• Keep the largest list prefix that fits the output budget (pm-15yuly)
• Reject ambiguous event durations with explicit minute and month units (pm-jkjt)
• Packed telemetry acceptance must await completion across delivery batches (pm-07m41m)
• GH-1264: enforce next ready-queue token budgets and disclose omitted recommendations (pm-v53h9j)
• Reject malformed linked-test JSON paths instead of silently normalizing assertions (pm-czr31p)

Security

• Reject inherited array elements in linked-test assertions (pm-1skc)
• Read linked-test JSON assertions without invoking accessors (pm-xxrq)
• Prevent prototype traversal in nested settings reads and writes (pm-3kk6)
• Share secret and private-context detection between mutation preflight and repository scanning (pm-wwooxx)

Other

• Serialize the complete build pipeline so overlapping validation cannot consume partially rewritten dist artifacts (pm-cxc4jc)
• Released-artifact acceptance: the exact published tarball is installed clean and driven through a scripted agent session before the release is advertised (pm-ygli86)
• Verify explicit calendar duration in package-first dogfood (pm-d9bg0i)
• Move meet/event/remind calendar shortcuts from core surface into the builtin-calendar package as create sugar (pm-o3fh)
• ADR: Require explicit minute and month units for event durations (pm-j1vw3a)
• Context judgment corpus: small, real-shaped, scale, and returning-agent continuity scenarios for pm context/next (pm-lixy)
• Refresh Sentry 10.75 and CLI 3.8 with Unicorn 75 compatibility proof (pm-1wypwu)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.