chore(deps-dev): bump @unbrained/pm-cli from 2026.8.28 to 2026.9.2

[dependabot]

Bumps @unbrained/pm-cli from 2026.8.28 to 2026.9.2.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.9.2

@​unbrained/pm-cli 2026.9.2

Source range: v2026.9.1...v2026.9.2

Changelog

Fixed

• GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably (pm-r97901)

Security

• GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable (pm-dn8rwl)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.

v2026.9.1

@​unbrained/pm-cli 2026.9.1

Source range: v2026.8.31...v2026.9.1

Changelog

Added

• GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item (pm-83cz0o)
• Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract (pm-3g3f8z)

Fixed

• The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either (pm-jjqyzd)
• GH-1166: root help hides the --all discovery option that reveals the full command surface (pm-7f9zkh)
• GH-1104: health must not certify pending lossless merge receipts as reconciled (pm-baksix)
• GH-1135: item_hash_version 2 still masks writer hash divergence as corruption (pm-2qahia)

Other

• Document the measured canonical agent cold-start across docs and generated guidance (pm-ka6d)
• Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require (pm-wenq)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.

v2026.8.31

@​unbrained/pm-cli 2026.8.31

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.9.2 - 2026-09-02

Fixed

• A read whose result was omitted for budget still records those items as served and included, so the usage-affinity signal learns from context the agent never received (pm-wv47pf)
• Shape-qualified scale baselines drifted from current CLI/SDK output contracts and supported runtime (pm-r8yytk)
• GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably (pm-r97901)

Security

• GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable (pm-dn8rwl)

Other

• Refresh compatible 2026-09-01 jscpd 5.1.1 tooling (pm-ur4swu)
• Refresh Sentry 10.73 and TypeScript-ESLint 8.69 with exact coverage (pm-92tp12)

2026.9.1 - 2026-09-01

Added

• GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item (pm-83cz0o)
• Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract (pm-3g3f8z)

Fixed

• The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either (pm-jjqyzd)
• GH-1166: root help hides the --all discovery option that reveals the full command surface (pm-7f9zkh)
• GH-1104: health must not certify pending lossless merge receipts as reconciled (pm-baksix)
• GH-1135: item_hash_version 2 still masks writer hash divergence as corruption (pm-2qahia)

Other

• Document the measured canonical agent cold-start across docs and generated guidance (pm-ka6d)
• Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require (pm-wenq)

2026.8.31 - 2026-08-31

Added

• Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember (pm-bq0ii8)

Fixed

• Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface (pm-0mhspz)
• GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path (pm-46hpx8)
• GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented (pm-s8cth5)
• The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment (pm-4o7tlx)
• The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet (pm-edywqn)

... (truncated)

Commits

• f34fce1 chore(release): cut 2026.9.2
• ba96802 feat: actionable merge evidence diagnostics across SDK and CLI (#1175)
• dd505d4 chore(release): cut 2026.9.1
• fb2aae4 Merge pull request #1167 from unbraind/feat/progressive-capability-discovery
• bb627cd fix(pm): preserve recurrence closure evidence
• c0d07a7 fix(mcp): preserve discovery for custom profiles
• cd65969 Reject malformed discovery authorization inputs
• d4d6eaa Align review evidence with canonical PM owners
• fea1aad Clear terminal evidence on every reopen path
• 8c2546f Validate public discovery candidate catalogs
• Additional commits viewable in compare view

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Looks like @unbrained/pm-cli is up-to-date now, so this is no longer needed.