v2026.9.4

@unbrained/pm-cli 2026.9.4

Source range: v2026.9.3...v2026.9.4

Changelog

Added

• Verdict contract: one declared vocabulary of reproducible predicates over recorded state, composable into a score, with reward shaping explicitly refused (pm-e1vkee)

Fixed

• Windows published-release verifier test can preempt its own readiness and cleanup contract (pm-euqm7x)
• Packed npx smoke timeout rejects valid slow dependency reification (pm-8eebb6)
• GH-1186: unrecoverable legacy merge-receipt references block strict health with diagnostic-only remediation (pm-cf4t42)
• GH-1185: hash-only merge receipts make discarded scalar values unreachable to the reviewing agent (pm-mg13iz)
• GH-1184: scalar merge conflict ordering ignores recency and requested preference (pm-7wzb6d)
• Acceptance criteria are documented as merging like tags but are stored as one delimiter-joined scalar, so concurrent criteria additions from different branches are silently discarded (pm-inn5y5)
• GH-1183: Windows nightly event-index lock acquisition and fallback publication are nondeterministic (pm-fqlocp)
• GH-1177: Claude session provenance path is derived from invocation cwd instead of the session-start workspace (pm-l7m7k5)
• GH-1179: legacy merge-receipt shape is misclassified as a gate-failing missing history reference with no remedy (pm-wn3ee5)
• Re-anchoring overwrites the original hash pair, so the immutability proof for every pre-merge entry is destroyed by the operation that repairs the chain (pm-aka8m7)

Security

• GH-1178: history hashes exclude record author and agent provenance, so attribution can be rewritten without detection (pm-javbsq)

Other

• Refresh compatible @types/node 26.4.1 patch (pm-vwtwqj)

PM Tracker Evidence

pm tracker summary skipped: Command failed: /opt/hostedtoolcache/node/24.20.0/x64/bin/node /home/runner/work/pm-cli/pm-cli/dist/cli.js list-all --json
Deprecated command list-all; use pm list --all.