perf: drop zod from settings hot path (~38% faster) + unblock auto daily release

.agents/pm/chores/pm-1nht.toon

@@ -0,0 +1,12 @@
+id: pm-1nht
+title: "pm validate: ok:false on warn-only checks + dumps every item ID per field"
+description: "Dogfood 2026-05-22 HIGH (agent UX + token): on a healthy project, validate returns ok:false purely because warn-level checks fire (closed missing resolution, missing acceptance_criteria/etc under core profile), and lists every affected ID for every field (NxM payload). Agents read ok:false as a hard failure and may abort; the ID lists are very token-heavy. Fix: top-level ok=true when only warn checks fire (separate ok from has_warnings); aggregate/truncate per-field ID lists by default with counts, full lists behind --verbose. Keep the remediation hints."
+type: Chore
+status: open
+priority: 2
+tags[0]:
+created_at: "2026-05-22T15:44:32.363Z"
+updated_at: "2026-05-22T15:44:32.363Z"
+author: maintainer-agent
+parent: pm-rnpb
+body: ""

.agents/pm/chores/pm-uzmf.toon

@@ -0,0 +1,12 @@
+id: pm-uzmf
+title: "Calendar agent ergonomics: equal start/end rejected; schedule-less Event items invisible"
+description: "Dogfood 2026-05-22 (related to pm-fu5d CAL1): (1) start=+Nd,end=+Nd (identical offsets) is rejected as equal start/end - agents naively pass identical offsets; auto-treat equal start/end as an instant event (or interpret bare end as end-of-window). (2) pm create event 'Title' with no --event schedule creates a Type=Event item that never appears on the calendar (no events array) - warn at create time or surface schedule-less events with a 'no time set' note."
+type: Chore
+status: open
+priority: 3
+tags[0]:
+created_at: "2026-05-22T15:44:35.471Z"
+updated_at: "2026-05-22T15:44:35.471Z"
+author: maintainer-agent
+parent: pm-rnpb
+body: ""

.agents/pm/chores/pm-why9.toon

@@ -0,0 +1,12 @@
+id: pm-why9
+title: "Code dedup: extract shared CLI parser blocks and consolidate item-record casts"
+description: "Code-quality audit 2026-05-22 (complements pm-mbdu file splits): (1) byte-identical legacy-none block duplicated in create.ts and update.ts (~250 lines) -> shared/legacy-none.ts. (2) 9 parseLinkedTest* parsers duplicated in create.ts and test.ts -> linked-test-parsers.ts. (3) recurrence/event parsers duplicated create.ts/update.ts -> recurrence-parsers.ts. (4) asRecord defined in loader.ts, mcp/server.ts, main.ts -> shared/primitives.ts. (5) default status/workflow model duplicated runtime-schema.ts vs constants.ts -> single source. (6) update.ts mutate() has 53 near-identical scalar-field blocks + 37 guarded non-null assertions -> declarative field-table (~470 LOC removed). All zero-behavior-change refactors."
+type: Chore
+status: open
+priority: 3
+tags[0]:
+created_at: "2026-05-22T15:44:36.989Z"
+updated_at: "2026-05-22T15:44:36.989Z"
+author: maintainer-agent
+parent: pm-rnpb
+body: ""

.agents/pm/features/pm-e1va.toon

@@ -0,0 +1,12 @@
+id: pm-e1va
+title: "Config-driven custom item types: wire schema/types.json into runtime schema"
+description: "Dogfood 2026-05-22 BLOCKER: pm init scaffolds .agents/pm/schema/types.json with {definitions:[]}, implying custom types register there, but the loader reads type_definitions_from_file and never merges it into the runtime schema (only settings.json item_types.definitions works; custom STATUSES do merge from schema/statuses.json). pm create MyType errors with Allowed: <hardcoded list>. Fix: (a) merge schema/types.json definitions into mergedSchema like statuses/fields, AND/OR (b) add a CLI to register a type (pm config set item-type / pm schema add-type), AND (c) make the invalid-type error hint where to register types. Aligns with project goal: schema defined by config, not hardcoded."
+type: Feature
+status: open
+priority: 1
+tags[0]:
+created_at: "2026-05-22T15:44:26.189Z"
+updated_at: "2026-05-22T15:44:26.189Z"
+author: maintainer-agent
+parent: pm-rnpb
+body: ""

.agents/pm/features/pm-gt82.toon

@@ -6,9 +6,10 @@ status: open
 priority: 0
 tags[2]: performance,startup
 created_at: "2026-05-16T15:07:08.622Z"
-updated_at: "2026-05-17T09:45:19.165Z"
+updated_at: "2026-05-22T16:29:54.345Z"
+assignee: codex-review-followup
 author: claude-code-agent
-comments[11]{created_at,author,text}:
+comments[13]{created_at,author,text}:
   "2026-05-16T16:48:23.232Z",codex-agent,"Audit update 2026-05-16: latest isolated dogfood after init --with-packages passed 44 workflows; slowest normal commands were create 753ms, comments 683ms, package wildcard 634ms, notes/docs/learnings/get brief around 560-600ms. Release gate is green, but sub-200ms startup remains the largest remaining perceived-speed opportunity."
   "2026-05-16T16:59:45.913Z",codex-audit,"Implementation update: adding a build-time bundled dist/cli.js path for the pm binary while keeping SDK/module exports emitted by tsc. Package-root resolution is being made independent of unbundled dist/cli/** module paths so package discovery, guide docs, upgrade version reads, telemetry flush, and Sentry release tagging continue to work from the bundled entrypoint."
   "2026-05-16T17:07:21.271Z",codex-audit,"Benchmark finding: attempted esbuild bundling first, but the safe dependency-external ESM bundle averaged 234.9ms for node dist/cli.js --version versus 201.7ms for the tsc entry, so it was not shipped. Implemented a targeted fast --version/-V path instead; after build, node dist/cli.js --version averages 36.7ms versus 194.6ms for loading dist/cli/main.js, a 5.3x speedup for the standard agent bootstrap probe. Remaining all-command sub-200ms bundling stays open for a deeper CJS/import-meta redesign."
@@ -20,26 +21,33 @@ comments[11]{created_at,author,text}:
   "2026-05-17T09:17:39.943Z",codex-agent,"Token/contract parity verification 2026-05-17: startup bootstrap changes did not alter list/search/help contract surfaces. Confirmed contracts --command list-open --flags-only still exposes --compact/--brief/--full/--fields/--include-body, contracts --command search --flags-only still exposes --mode/--semantic/--hybrid/--include-linked, and top-level plus list help still render rich Intent narratives on help paths."
   "2026-05-17T09:27:50.721Z",codex-agent,"Final evidence 2026-05-17 startup pass: after lazy command-family registration + help-attach gating in src/cli/main.ts, post-change 8-run warm medians improved on key commands versus pre-change baseline (help 183.6ms vs 190ms, list --json --limit 1 382.1ms vs 408.2ms, get --depth brief 311.3ms vs 326.2ms, contracts --flags-only 309.6ms vs 349.4ms). Isolated dogfood passed in temp sandboxes for both default (51 commands) and semantic mode (52 commands, qwen3-embedding:0.6b). Full release gate passed with telemetry+sentry required: build/typecheck/docs/static quality/coverage/version policy/secrets/npx/npm-pack/compatibility all ok; tests 1323/1323 with 100% coverage; sentry critical/high/total 0; telemetry finish_error_rate_pct 2.13 with missing-error-code rows 0."
   "2026-05-17T09:28:29.427Z",codex-agent,"Privacy/observability verification 2026-05-17: node scripts/check-secrets.mjs passed; targeted rg sweeps over .agents/pm for credential tokens/private-key blocks/private IPv4/home-path/user@host patterns found no active secret material. Direct sentry-telemetry gate passed in required mode (sentry critical/high/total=0/0/0, telemetry finish_error_rate_pct=2.13, failures_without_error_code_rows=0)."
-notes[1]{created_at,author,text}:
+  "2026-05-22T16:21:07.143Z",codex-review-followup,"Review follow-up: PR #41 has unresolved CodeRabbit/Gemini threads on vNumber finite/safe-integer parity. Outside-diff .agents/pm warnings are bot false positives for this repo because tracker mutations must go through pm CLI and generate .agents/pm artifacts; no direct manual file edits will be made."
+  "2026-05-22T16:29:54.345Z",codex-review-followup,"Evidence: addressed PR #41 reviewer finite-number feedback. Local verification passed: pnpm build; node scripts/run-tests.mjs test -- tests/unit/settings-validator.spec.ts (19 tests); pnpm quality:static; pm test pm-gt82 --run --progress (6/6 linked tests passed, including release gate 1433/1433 tests with 100% coverage, dogfood 84 workflows, semantic dogfood 86 workflows, sentry critical/high/total 0/0/0, telemetry finish_error_rate_pct 3.24). Secret scan passed after pm evidence updates."
+notes[2]{created_at,author,text}:
   "2026-05-17T09:12:12.755Z",codex-agent,"Benchmark method: spawned fresh node dist/cli.js processes per run from repo root, PM_AUTHOR=codex-agent, no PM_PATH overrides (real tracker), maxBuffer 20-30MiB. Collected both repeated timing arrays and one-shot --profile outputs with and without --no-extensions."
+  "2026-05-22T15:45:00.043Z",maintainer-agent,"Partial progress 2026-05-22: removed zod from settings hot path (settings import 157ms->14ms; --help 227->140ms; list 540->340ms). The remaining startup levers are (a) esbuild bundling (this item) to collapse module-resolution overhead, and (b) item-store full-scan cost for list/context/search (context still ~556ms reading ~786 item files; no read cache - index/ dir is empty). esbuild bundle would mainly help the per-module resolution; an item-store read index would help the scan-bound commands."
 learnings[1]{created_at,author,text}:
   "2026-05-17T09:27:52.419Z",codex-agent,"Durable learning: startup refactors that replace static imports with dynamic imports can trigger orphan-module governance checks; preserving type-only import edges keeps static-quality graph integrity while maintaining runtime lazy-loading."
-files[9]{path,scope,note}:
+files[11]{path,scope,note}:
   src/cli.ts,project,fast --version startup path
   src/cli/commands/extension.ts,project,bundled package discovery root resolution
   src/cli/commands/guide.ts,project,guide docs root resolution
   src/cli/commands/upgrade.ts,project,upgrade version root resolution
   src/cli/main.ts,project,package-root resolution uses shared helper
   src/core/packages/root.ts,project,package-root discovery shared by bundled/future entrypoints
   src/core/sentry/instrument.ts,project,sentry release version root resolution
+  src/core/store/settings-validator.ts,project,"review follow-up: finite and safe-integer settings number validation"
   src/core/telemetry/runtime.ts,project,telemetry flush runner root resolution
   tests/integration/release-readiness-runtime.spec.ts,project,version/root coverage contract
-tests[5]{command,path,scope,timeout_seconds,pm_context_mode,env_set,env_clear,shared_host_safe,assert_stdout_contains,assert_stdout_regex,assert_stderr_contains,assert_stderr_regex,assert_stdout_min_lines,assert_json_field_equals,assert_json_field_gte,note}:
+  tests/unit/settings-validator.spec.ts,project,regression coverage for finite and safe-integer validation
+tests[6]{command,path,scope,timeout_seconds,pm_context_mode,env_set,env_clear,shared_host_safe,assert_stdout_contains,assert_stdout_regex,assert_stderr_contains,assert_stderr_regex,assert_stdout_min_lines,assert_json_field_equals,assert_json_field_gte,note}:
   node scripts/dogfood-package-first.mjs,null,project,300,null,null,null,null,null,null,null,null,null,null,null,isolated temp-project package-first dogfood
   node scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --json,null,project,2400,null,null,null,null,null,null,null,null,null,null,null,full release gate with telemetry and sentry required
   node scripts/run-tests.mjs test -- tests/integration/help-runtime.spec.ts tests/integration/cli.integration.spec.ts tests/unit/contracts-command.spec.ts tests/unit/list-command.spec.ts,null,project,1200,null,null,null,null,null,null,null,null,null,null,null,focused startup regressions
   node scripts/run-tests.mjs test -- tests/integration/release-readiness-runtime.spec.ts,null,project,300,null,null,null,null,null,null,null,null,null,null,null,null
+  node scripts/run-tests.mjs test -- tests/unit/settings-validator.spec.ts,null,project,240,null,null,null,null,null,null,null,null,null,null,null,focused validator regression test
   PM_DOGFOOD_SEMANTIC=1 node scripts/dogfood-package-first.mjs,null,project,600,null,null,null,null,null,null,null,null,null,null,null,isolated semantic hybrid dogfood
-test_runs[1]{run_id,kind,status,started_at,finished_at,recorded_at,attempt,resumed_from,passed,failed,skipped,items,linked_tests,fail_on_skipped_triggered}:
+test_runs[2]{run_id,kind,status,started_at,finished_at,recorded_at,attempt,resumed_from,passed,failed,skipped,items,linked_tests,fail_on_skipped_triggered}:
   test-local-mp8lnyio-0qq3g4,test,passed,"2026-05-16T17:07:21.171Z","2026-05-16T17:08:07.680Z","2026-05-16T17:08:07.680Z",null,null,1,0,0,null,null,null
+  test-local-mph4xiq8-jlp467,test,passed,"2026-05-22T16:22:28.206Z","2026-05-22T16:29:35.889Z","2026-05-22T16:29:35.889Z",null,null,6,0,0,null,null,null
 body: "Current: pm list ~890ms, pm context ~1.5s, pm health ~2.1s even with --skip-*. Root: 126+ unbundled ESM files loaded per invocation. Fix: add esbuild bundle step alongside tsc. Expected improvement: 5-10x."

.agents/pm/features/pm-rnpb.toon

@@ -6,7 +6,7 @@ status: in_progress
 priority: 0
 tags[10]: agent-ux,audit,calendar,ci,dogfood,pm-cli,sdk,search,security,telemetry
 created_at: "2026-05-03T13:20:01.343Z"
-updated_at: "2026-05-21T22:37:12.315Z"
+updated_at: "2026-05-22T15:44:59.210Z"
 deadline: "2026-06-01T00:00:00.000Z"
 assignee: codex-extensive-audit
 author: codex-audit
@@ -15,7 +15,7 @@ acceptance_criteria: Audit findings are actionable and deduplicated; changed fil
 parent: pm-jrjt
 dependencies[1]{id,kind,created_at,author,source_kind}:
   pm-jrjt,parent,"2026-05-03T13:20:01.343Z",codex-audit,null
-comments[180]{created_at,author,text}:
+comments[181]{created_at,author,text}:
   "2026-05-03T13:20:01.343Z",codex-audit,Parent lineage established under pm-jrjt after duplicate checks found only closed prior audit items.
   "2026-05-09T11:12:26.232Z",codex-agent,"Duplicate check before this pass: pm context --limit 10 --depth standard, pm search dogfood audit extensible sdk calendar semantic search telemetry sentry --limit 10, pm list-open --limit 20, and pm list-in-progress --limit 20. Reusing open feature pm-rnpb; prior same-day task pm-m35h is closed, so no duplicate item created."
   "2026-05-09T11:46:59.430Z",codex-agent,"Evidence 2026-05-09: temp dogfood project exercised init/create/claim/update/files/docs/tests/calendar/context/aggregate/dedupe/search/reindex/extension scaffold/install/doctor/contracts/manage. Fixed search gap discovered there: reminder/event metadata is now in keyword and semantic corpus, and short phrase scoring ranks exact calendar event titles first. Verification passed: focused search/reindex/cache tests, release-readiness/search focused tests, linked pm test, full 100% coverage, static quality gate, CI workflow contract tests, pm health, pm validate, npm pack dry-run, secret scan, live telemetry/Sentry checks, and real hybrid reindex of 679 items."
@@ -196,12 +196,14 @@ comments[180]{created_at,author,text}:
   "2026-05-21T21:13:19.585Z",codex-extensive-audit,"PR #39 review feedback addressed: Sourcery/Gemini feedback was valid for get --full precedence, so --full is now mutually exclusive with --depth and --fields, and help text says so. Gemini history schema concern was handled by keeping a root diff array for compact --diff while making it empty to avoid duplicate payloads. CodeRabbit SDK metadata concern was handled by broadening the shared full parameter description beyond search. CodeRabbit .agents/pm concerns were reviewed as false positives because all pm-rnpb file/history changes in this PR were produced through pm CLI mutations, not manual edits. Verification after fixes passed: focused 6-file suite / 172 tests; manual error-output check for --full + --depth shows no bogus suggested retry; release gate with required telemetry passed again (97 files / 1409 tests, 100 percent coverage, Sentry critical=0 high=0 total=0, telemetry finish_error_rate_pct=3.27)."
   "2026-05-21T22:10:31.519Z",claude-code-agent,"PR #40 opened (agent-ux-telemetry-search-audit-2026-05-21): never-block fixes for close-via-update/semantic-hybrid-search/create-positional, calendar --date crash fix, and dead-code removal. 1414 tests at 100% coverage; all local gates green. Required 15-minute AI review window started 2026-05-21T22:10:11Z (CodeRabbit + Sourcery in progress). Children closed: pm-j1v7, pm-l292, pm-b7do. Open follow-ups: pm-7rlp, pm-rjgh, pm-fu5d, pm-mbdu."
   "2026-05-21T22:37:12.289Z",claude-code-agent,"PR #40 squash-merged to main at 2026-05-21T22:36:32Z (commit 0afe2e05). All CI green (build/tests ubuntu+macos/coverage 100%/typecheck/static/compat/smokes); CodeRabbit + Sourcery + Gemini reviewed, feedback addressed (gemini MEDIUM calendar findIndex/slice applied; HIGH atomicity routed to pm-mbdu). Verified on merged main: pm create <type> <title>, pm update --status closed auto-route, pm cal <view> --date, and semantic search all working. Closed: pm-j1v7, pm-l292, pm-b7do. Open follow-ups: pm-7rlp (CI/test perf), pm-rjgh (docs hygiene), pm-fu5d (dogfood polish), pm-mbdu (large-file split + atomic close)."
+  "2026-05-22T15:44:59.210Z",maintainer-agent,"Audit 2026-05-22 (4 parallel sub-agents: code-quality, CI/CD, Sentry+telemetry, dogfood). SHIPPED this PR: (1) Removed zod from settings hot path -> ~38% faster every command, one fewer dep, 100% covered new validator. (2) Populated CHANGELOG [Unreleased] to unblock the auto-release that was silently no-op'ing (reason=changelog_unreleased_empty) and stranding the merged crash fixes (PM-CLI-R/S/T) on 2026.5.18. Telemetry (150k events/2040 installs): top cmds guide/get/update(1148ms,19%err)/search(3176ms); #1 real error update --status closed (fixed by #40, was unreleased). Sentry R/S/T already fixed on main, now in changelog. NEW child items: pm-e1va (config-driven types), pm-ot8r (auto-release empty-changelog robustness), pm-kyd6 (blocked-by deps edge), pm-1nht (validate ok:false on warn), pm-6blp (plan materialize cycle+flags), pm-uzmf (calendar ergonomics), pm-why9 (code dedup). CI/CD: in-process test runner (745 spawns = 0 coverage, ~2/3 CPU) tracked in pm-7rlp. Large-file splits in pm-mbdu. Security: git-tracked tree clean of host/cred/IP leaks."
 notes[2]{created_at,author,text}:
   "2026-05-17T07:36:59.474Z",codex-agent,"Design note 2026-05-17: unfiltered pm contracts default now intentionally omits three heavy sections (schema oneOf union, command_flags, commander_aliases) and emits explicit omitted_reason markers; --full restores complete schema and alias/flag surfaces for tooling that needs maximal detail."
   "2026-05-17T08:33:25.981Z",codex-agent,"Design note 2026-05-17: default brief projection was intentionally scoped to bare 'pm list' instead of all list-* commands to preserve existing automation contracts while still cutting agent token usage on the highest-frequency exploratory list call."
-learnings[2]{created_at,author,text}:
+learnings[3]{created_at,author,text}:
   "2026-05-17T07:37:01.283Z",codex-agent,"Durable learning: strict 100% branch coverage is valuable for agent UX changes because nullable fallback expressions can silently introduce uncovered impossible branches; prefer explicit state predicates over defensive null coalescing in logically constrained paths."
   "2026-05-17T08:33:31.156Z",codex-agent,"Durable learning: when adding default terse projections for agent UX, preserve semantic override paths (include-body, explicit full/compact/fields) so feature-level defaults do not silently drop required payloads in existing workflows."
+  "2026-05-22T15:44:58.334Z",maintainer-agent,"Startup perf: the single biggest CLI startup cost was importing zod (~85ms) eagerly via settings.ts, which is on the hot read path of nearly every command (list/get/search/context/create/update all readSettings). zod was used in exactly ONE file. Replacing it with a dependency-free validator (src/core/store/settings-validator.ts) that mirrors safeParse exactly cut settings import 157ms->14ms and every command ~38% (--help 227->140ms, list 540->340ms). Lesson: profile per-module import cost (node --input-type=module timing each import) before assuming the bottleneck is your own code; a single eager dep on the hot path dominates."
 files[96]{path,scope,note}:
   .github/workflows/ci.yml,project,CI smoke gate runs package-first dogfood
   .github/workflows/docs.yml,project,lightweight-docs-only-ci-gate