Fix SDK graph census and Bun receipts; ship tested runtime bundles

.agents/pm/chores/pm-3rgp.toon

@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[4]: audit,backlog,governance,pm-cli
 created_at: "2026-07-06T21:10:23.139Z"
-updated_at: "2026-09-19T08:39:23.117Z"
+updated_at: "2026-10-06T16:42:07.922Z"
 closed_at: "2026-07-06T21:11:35.442Z"
 author: maintainer-agent
 estimated_minutes: 90
@@ -18,7 +18,7 @@ release: v2026.7.7
 resolution: "Audit complete: 8 GH-issue items created (pm-6abs pm-25d0 pm-sqf7 pm-bfma pm-h85e pm-4bzq pm-yjim pm-alnj), security capability epic pm-qwoy + agent story pm-6ixn created, pm-oz8u/pm-2czc reparented; validate/health green, zero open orphans, branch commits fully mapped to closed items"
 expected_result: Every open GitHub issue and all branch work tracked in well-defined pm items; no orphaned open items
 actual_result: GH-467..474 untracked and pm-oz8u/pm-2czc orphaned pre-audit; all gaps closed during audit
-dependencies[17]:
+dependencies[27]:
   - id: pm-1k57
     kind: related
     created_at: "2026-07-26T17:03:22.077Z"
@@ -73,6 +73,66 @@ dependencies[17]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
+  - id: pm-hj9h
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-j8z6
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-jqd2
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-n7rr
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-oz0k
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-oz8u
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-pivf
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-tu71
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-usfg
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-vcu7
+    kind: verifies
+    created_at: "2026-10-06T16:42:07.641Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
 learnings[3]{created_at,author,text}:
   "2026-07-06T21:10:35.285Z",maintainer-agent,"pm search accepts --format json|toon ONLY (not table, unlike pm list): with stderr suppressed, an invalid-format error looks identical to zero search hits — always validate search plumbing with a known-hit query (e.g. GH-457 -> pm-tu71) before trusting empty dedupe results."
   "2026-07-06T21:10:35.651Z",maintainer-agent,pm update does not accept -m (that shorthand is pm close only); update history messages need the full --message flag.

.agents/pm/chores/pm-o043.toon

@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[3]: context-management,metadata,tracker-governance
 created_at: "2026-07-04T19:09:41.942Z"
-updated_at: "2026-09-19T08:40:51.268Z"
+updated_at: "2026-10-06T16:43:23.069Z"
 closed_at: "2026-07-04T19:20:52.951Z"
 author: maintainer-agent
 estimated_minutes: 300
@@ -18,7 +18,7 @@ release: v2026.7.5
 resolution: "All 41 active items (1 milestone, 11 epics, 29 leaves incl. new pm-114v) now carry body + risk + confidence on top of the pre-existing 100% AC/estimate/parent coverage; epic bodies are charters with scope, invariants, and child inventories; deps and one promoted idea (pm-114v) round out the graph."
 expected_result: "Every active item rebuildable from pm CLI alone: body, risk, confidence, AC, estimate, parent, deps populated with real content (no placeholders)."
 actual_result: "Verified by scripted sweep post-pass: 0 items missing any of body/risk/confidence/AC/estimate/priority; parents 100% on non-container items; remaining metadata debt is scoped to pm-j8z6 (linked files) and pm-e9zh (terminal resolution evidence), both open with full bodies."
-dependencies[17]:
+dependencies[38]:
   - id: pm-114v
     kind: related
     created_at: "2026-07-26T17:21:32.422Z"
@@ -73,6 +73,132 @@ dependencies[17]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
+  - id: pm-e9zh
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-esbt
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-f4yn
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-gdi7
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ghf1
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ixoa
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-j8z6
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-jqd2
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-jt3b
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-l98s
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-llrp
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-lt6n
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-mpbb
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-o2kc
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-qt5d
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-rj3w
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-u9d0
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ueuq
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ugqx
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ydp6
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-z5nb
+    kind: verifies
+    created_at: "2026-10-06T16:43:22.778Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
 notes[1]{created_at,author,text}:
   "2026-07-04T19:20:51.932Z",maintainer-agent,"2026-07-04 metadata backfill pass (this audit) completed the full scope: (1) charter bodies + risk/confidence on the milestone pm-doxj and all 11 open epics — each charter records scope in/out, standing invariants, closed-children count, and the live open-children inventory; (2) full-context bodies (Context / Approach or Design / Definition of done) + risk/confidence on all 24 open leaf items; (3) dep edges wired: pm-114v blocked_by pm-8t5x + related pm-2muu, pm-bgcu related pm-2muu (singleton locks reuse the lock machinery); (4) idea promotion: pm claim --next extracted from pm-8t5x prose into tracked Feature pm-114v under pm-dj98. Verification sweep after the pass: 41/41 active items have AC + estimate + priority + body + risk + confidence; every non-container item has a parent. Comments/linked-artifact reconciliation intentionally NOT duplicated here: the 146 missing / 134 orphaned linked-file rows remain owned by pm-j8z6, terminal-item resolution backfill by pm-e9zh."
 close_reason: "Backfill complete: full-context bodies, risk and confidence now cover every active item; context is rebuildable from the pm CLI alone (verified by sweep, 2026-07-04)."

.agents/pm/chores/pm-osea.toon

@@ -6,7 +6,7 @@ status: closed
 priority: 1
 tags[4]: audit,backlog,governance,pm-cli
 created_at: "2026-07-04T19:46:48.898Z"
-updated_at: "2026-09-19T08:40:53.818Z"
+updated_at: "2026-10-06T17:36:24.925Z"
 closed_at: "2026-07-04T20:02:29.795Z"
 author: maintainer-agent
 estimated_minutes: 180
@@ -20,7 +20,7 @@ release: v2026.7.5
 resolution: "Audit #4 complete. Verified the backlog fully + non-redundantly reflects the pm-cli ecosystem (12-epic coverage matrix recorded). Structural fixes: created governance epic pm-33cw + re-parented pm-j8z6/e9zh/pivf; modeled pm-khdq<->pm-bgcu concurrency edge; milestone pm-doxj now indexes all 12 epics. Per user direction, added a 12-story capability agent-story layer (one per epic, tag=agent-story+capability, closed=delivered) complementing the existing feature-level stories. 14 new items total; only open/new items touched (zero changelog drag); no duplicates; not committed."
 expected_result: The pm backlog fully reflects the entire ecosystem per best-practice PM with an agent-story layer and no duplicates.
 actual_result: "12 living capability epics cover 100% of subsystems; governance gap closed; agent-story layer added; all 5 validate warnings map to open items; pm health ok:true."
-dependencies[17]:
+dependencies[29]:
   - id: pm-0zuv
     kind: related
     created_at: "2026-07-26T17:22:16.160Z"
@@ -75,6 +75,78 @@ dependencies[17]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
+  - id: pm-dj98
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-fhsg
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-i25f
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-j8z6
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-kj4
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-kp1d
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-m2u1
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-o2kc
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-u9d0
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ugqx
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-wtsp
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
+  - id: pm-ydp6
+    kind: verifies
+    created_at: "2026-10-06T16:42:47.908Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
 notes[3]{created_at,author,text}:
   "2026-07-04T19:47:53.189Z",maintainer-agent,"COVERAGE MATRIX (audit #4, 2026-07-04) — every codebase subsystem maps to exactly one living capability epic under milestone pm-doxj. Built from Explore codebase inventory (28 CLI commands, ~20 core subsystems, SDK, 28 MCP tools, 11 first-party packages, 263 specs, 14 docs).\n\nCLI command surface (lifecycle/query/bulk/scheduling/logs/links/help, plan family, focus/session) -> pm-mpbb\nStorage + item model + io/fs/output + checkpoint rollback GC -> pm-o2kc\nHistory (append/replay) + compact/redact/repair + drift-scan -> pm-o2kc\nSearch (bm25/vector/hybrid) + eval harness + background-refresh -> pm-ydp6\nExtensions runtime + loader + 11 packages + SDK (define/compose/runtime/testing) + plugins (pm-claude/pm-codex) -> pm-ugqx\nGovernance + validate + diagnostics/remediation registry + metadata-coverage/issue-codes/content-fields -> pm-33cw (NEW this audit)\nConcurrency: lock ownership/gc, claim/release atomicity, singleton-file races -> pm-dj98\nTelemetry + observability + sentry instrumentation -> pm-5oj5\nConfig (nested-settings) + schema (types/statuses/fields/workflows) + profiles (archetype presets) -> pm-8jdc\nMCP server + machine-readable contracts (cli-contracts) -> pm-5k4v\nSource-code quality gates: CodeFactor/ESLint/jscpd/LOC/CC ratchets -> pm-92if\nDocs + onboarding + release + CI + build harness (scripts/ *.mjs) -> pm-u9d0\nArchitecture Decision Records (living decision log, 50 Decisions) -> pm-m2u1\nPost-v0.1 roadmap container / milestone -> pm-doxj (Milestone)\n\nRESULT: 12 living capability epics + ADR log + milestone cover 100% of shipped subsystems. No subsystem is orphaned; no two epics overlap (scope In/Out boundaries stated in each charter). No duplicate epics created — pm-33cw continues closed governance epics pm-5rjn/pm-wtsp rather than duplicating them."
   "2026-07-04T19:51:51.180Z",maintainer-agent,"VERIFICATION COMPLETE. (1) In-flight uncommitted code (lock.ts +80, claim.ts +17, constants/errors/types) maps to in_progress pm-2muu (lock retry) + pm-8t5x (claim atomicity) — no untracked code. (2) Zero TODO/FIXME/HACK/XXX markers in src/ — no untracked work hidden in comments. (3) PRD post-v0.1 roadmap items (cross-encoder rerank pm-7tsx, embedding batch pm-i25f, vector adapters pm-kj4) are all CLOSED/implemented — no untracked forward work. (4) pm next surfaces sensible actionable work; pm aggregate confirms clean epic distribution. (5) All 5 pm validate warnings map to open items under pm-33cw. No duplicate items created. Only 2 new items: pm-33cw (governance epic, fills real gap) + pm-osea (this tracker)."

.agents/pm/chores/pm-othr.toon

@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[4]: "area:docs","area:tests",contributor-experience,coverage
 created_at: "2026-06-07T10:05:19.369Z"
-updated_at: "2026-09-19T08:40:54.557Z"
+updated_at: "2026-10-06T16:42:11.301Z"
 closed_at: "2026-06-19T13:37:19.572Z"
 author: audit-docs-tests-agent
 acceptance_criteria: "- ARCHITECTURE.md or TESTING.md has a 'Coverage governance' section explaining:\n- pure-logic modules: add to include only (must be 100%)\n- complex command files: add to BOTH include and exclude (coverage tracked but not gated)\n- static-gate 120-file cap for tests/unit/ enforced via scripts/release/static-quality-gate.mjs --max-files-per-dir 120\n- new spawn entries need static-gate orphan allowlist + coverage include-alignment list updates"
@@ -16,10 +16,22 @@ confidence: high
 release: v2026.6.20
 resolution: "ARCHITECTURE.md documents how coverage include/exclude works (literal all-source globs, single d.ts exclude, 100% aggregate, SDK alias) so contributors don't skip gates."
 expected_result: "- ARCHITECTURE.md or TESTING.md has a 'Coverage governance' section explaining:\n- pure-logic modules: add to include only (must be 100%)\n- complex command files: add to BOTH include and exclude (coverage tracked but not gated)\n- static-gate 120-file cap for tests/unit/ enforced via scripts/release/static-quality-gate.mjs --max-files-per-dir 120\n- new spawn entries need static-gate orphan allowlist + coverage include-alignment list updates"
-dependencies[3]{id,kind,created_at}:
-  pm-p37b,related,"2026-06-19T13:38:31.395Z"
-  pm-zyse,related,"2026-06-19T13:38:31.395Z"
-  pm-u9d0,implements,"2026-07-26T17:22:21.555Z"
+dependencies[4]:
+  - id: pm-p37b
+    kind: related
+    created_at: "2026-06-19T13:38:31.395Z"
+  - id: pm-zyse
+    kind: related
+    created_at: "2026-06-19T13:38:31.395Z"
+  - id: pm-u9d0
+    kind: implements
+    created_at: "2026-07-26T17:22:21.555Z"
+  - id: pm-5dbn
+    kind: discovered_from
+    created_at: "2026-10-06T16:42:11.067Z"
+    author: "harness:codex"
+    source_kind: "cli:update:evidence-backfill:pm-jprn58"
+    author_source: detected
 comments[1]{created_at,author,text}:
   "2026-06-19T13:37:17.502Z",claude-code-agent,"Enhanced the Testing Architecture coverage-governance guidance to document the current literal all-source model: the full coverage.include glob set (src, packages, scripts, plugins, docs/examples), the single src/**/*.d.ts exclude, the 100/100/100/100 aggregate thresholds (no per-file ratchet/allowlist), the bare-SDK-specifier vitest alias for example specs, and the extract-pure-helpers guidance with the local coverage command. Implemented in PR (docs accuracy & contributor-reference hardening). Verified: docs-skills-gate passed, doc unit specs (66) passed, quality:static passed, manual temp-dir smoke passed."
 files[1]{path,scope,note}: