docs(changelog): resolve 0.9.2 merge conflict, dedupe sections, add missing post-0.9.2 entries

[danielmeppiel]

TL;DR

CHANGELOG.md is structurally broken on main (unresolved git merge-conflict markers in [0.9.2], two pairs of duplicate ### Fixed headers) and missing entries for ~10 PRs that landed since v0.9.2. This PR is a pure docs cleanup -- no code changes.

Problem

Audit pass against gh pr list --state merged --search "merged:>=2026-04-23T10:06:53Z" (the v0.9.2 cut) surfaced four structural defects:

1. Unresolved merge-conflict markers at lines 63 / 72 / 132 of CHANGELOG.md in the [0.9.2] ### Fixed block. The <<<<<<< fix-copilot-transport-validation-791 side duplicated entries that were already published in [0.9.0] (Install silently drops skills/agents/commands when package also ships hooks/*.json #780, [BUG] Ignores ssh://, tries https (Bitbucket Datacenter) #661, Using dependencies within non-default ports #731, [BUG] SCP shorthand with numeric port silently misparsed as repo path #784, Fix apm install --global skipping MCP server installation #638, [FEATURE] Thread dep_ref.port into credential resolution (git credential fill) #785) and one entry that actually belongs in [Unreleased] (fix: Copilot adapter validates remote transport_type (#791) #812 transport_type validation, merged 2026-04-24).
2. Duplicate ### Fixed subsections in [Unreleased] -- Keep a Changelog requires one ### Fixed per release block.
3. Duplicate ### Fixed subsections in [0.9.1] -- same issue.
4. Misplaced apm experimental entry in [0.9.1] referencing PR feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset #845, which was actually closed unmerged. The feature landed via feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset #849 on 2026-04-23T19:51, after the 0.9.2 cut, so it belongs in [Unreleased]/Added.

Plus [Unreleased] was missing entries for these merged PRs:

PR	Section	Why it matters to readers
#849	Added	New apm experimental flag registry
#904	Changed	shared/apm.md now uses apm-action@v1.4.2 (fixes restore-mode workspace pollution)
#874	Changed	CI docs branch-protection clarification (PR ref was missing on existing entry)
#812	Fixed	Copilot adapter rejects unknown MCP transport_type instead of writing garbage config
#895	Fixed	Policy cache path-traversal false-positive on Windows when cache dir does not yet exist
#860	Fixed	load_policy() no longer trips macOS OSError [Errno 63] on YAML strings >1023 bytes
#921	Fixed	merge-gate.yml reports gate inside the merge queue (PRs no longer hang in queue)
#899	Fixed	apm update env-sanitisation entry was missing its PR ref
#875	Removed	ci-integration-pr-stub.yml deletion entry was missing its PR ref
#905, #907, #908	folded	Sequel hardening fixes for apm-review-panel, folded into existing #882 entry

Approach

Minimal, surgical edits to the [Unreleased], [0.9.2], and [0.9.1] sections only. Pre-existing entries kept verbatim where they already met the convention. New entries written tight, answering "so what" for readers per .github/instructions/changelog.instructions.md.

Skipped (not user-facing per the convention):

• chore: bump shared/apm.md to microsoft/apm-action@v1.4.2 #904 was actually included as a Changed entry because it transitively fixes Bump shared/apm.md to microsoft/apm-action@v1.4.2 (restore-mode workspace pollution fix) #902 in caller workspaces.

Validation

$ grep -nE ^(<<<<<<<|=======|>>>>>>>) CHANGELOG.md
(none)

$ awk /^## \[/{s=$0;a=0;next} /^### Fixed/{print s,$0;a++} CHANGELOG.md | sort | uniq -c | awk $1>1
(none -- no section has duplicate ### Fixed)

Modified region (lines 1-90) is ASCII-clean (the 213 non-ASCII bytes that remain are em dashes / curly quotes in pre-0.9.x history -- out of scope for this PR).

Net diff: +10 / -22 lines.

How to test

Read the new [Unreleased] block end-to-end: every PR ref appears exactly once, every entry answers "so what".

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Cleans up CHANGELOG.md to restore Keep a Changelog structure by removing accidental merge-conflict artifacts, deduplicating repeated subsections, and adding missing post-0.9.2 entries so the Unreleased section accurately reflects recent merged work.

Changes:

• Removed unresolved git merge-conflict markers from the 0.9.2 section.
• Deduplicated duplicate ### Fixed subsections (notably in Unreleased and 0.9.1).
• Added missing Unreleased entries for recently merged PRs (e.g., apm experimental, merge-queue gate, policy/cache fixes).

Show a summary per file

File	Description
CHANGELOG.md	Fixes structural breakage (conflict markers + duplicate headers) and updates Unreleased entries to include missing PR references since 0.9.2.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 0

[github-actions]

APM Review Panel Verdict

Disposition: APPROVE (no required actions before merge)

---

Per-persona findings

Python Architect: PR is purely a markdown document edit -- no Python classes, modules, or functions modified. Per the review contract, I substitute a classDiagram of the problem space (CHANGELOG as a structured document) and an execution-flow diagram tracing the reader's path through the resolved file.

OO / class diagram (CHANGELOG problem space)

classDiagram
    direction LR
    class CHANGELOG {
        <<IOBoundary>>
        +unreleased: Section
        +versioned_sections: List[Section]
        +resolve_conflict() void
        +dedupe_sections() void
    }
    class Section {
        <<ValueObject>>
        +heading: str
        +subsections: List[Subsection]
    }
    class Subsection {
        <<ValueObject>>
        +kind: str
        +entries: List[Entry]
    }
    class Entry {
        <<ValueObject>>
        +description: str
        +pr_refs: List[str]
    }
    CHANGELOG *-- Section : contains
    Section *-- Subsection : contains
    Subsection *-- Entry : contains
    note for CHANGELOG "This PR: removes conflict markers,\nmerges two Fixed subsections into one,\nmoves apm-experimental to Unreleased"
    class CHANGELOG:::touched
    classDef touched fill:#fff3b0,stroke:#d47600

Loading

Execution-flow diagram (post-PR reader path through CHANGELOG.md)

flowchart TD
    A["[I/O] Open CHANGELOG.md"] --> B["Unreleased Added\n(pr-description-skill, apm-experimental, includes,\naudit-ci, apm-triage-panel)"]
    B --> C["Unreleased Changed\n(find_primitive_files, lockfile shape, apm-review-panel,\nCI smoke gate #878, CI docs #874, shared/apm.md #904)"]
    C --> D["Unreleased Fixed -- single consolidated subsection\n(user-scope init_link_resolver #850, audit-blindness #887,\npacker-leak #887, apm-update env-sanitize #899,\nCopilot transport #812, _get_cache_dir #895,\nload_policy #860, merge-gate merge_group #921)"]
    D --> E["Unreleased Removed\n(ci-integration-pr-stub.yml #875)"]
    E --> F["[FS] 0.9.2 -- no conflict markers, clean section"]
    F --> G{"Conflict-block entries\nalready in 0.9.0?"}
    G -->|Verified YES| H["VS Code adapter http #654 in 0.9.0\nPreserve git ports #665 in 0.9.0\nDetect port-SCP #787 in 0.9.0\napm install global MCP #638 in 0.9.0\nToken resolution by port #788 in 0.9.0\napm install drops skills #780 in 0.9.0"]
    H --> I["[FS] 0.9.1 -- apm-experimental removed\n(correctly moved to Unreleased)"]
    I --> J["[I/O] Done -- no data loss confirmed"]

Loading

Design patterns

• Used in this PR: none -- straight-line document editing, appropriate for the scope.
• Pragmatic suggestion: none -- the current shape is the simplest correct design at this scope.

Structural findings:

1. All three conflict markers (<<<<<<< fix-copilot-transport-validation-791, =======, >>>>>>> main) are removed.
2. The two ### Fixed subsections under [Unreleased] are correctly merged into one.
3. Every entry dropped from the [0.9.2] conflict block is verified to already exist in [0.9.0] -- no data loss.
4. apm experimental (feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset #849) correctly moves from [0.9.1] to [Unreleased] -- it was never shipped in 0.9.1.
5. Missing PR numbers backfilled: #874, #875, #904, and others.
6. New entries in [Unreleased] Fixed are legitimate post-0.9.2 unreleased fixes.

---

CLI Logging Expert: No CLI output code, CommandLogger, DiagnosticCollector, or _rich_* helper is touched. All inline references to CLI symbols in new entries ([!], [+]) correctly use ASCII bracket notation per STATUS_SYMBOLS convention. All new entry text is ASCII-clean -- no emojis, no Unicode dashes, no box-drawing characters. Clean pass.

---

DevX UX Expert: No CLI command surface, flags, help text, or first-run flow is changed. Three observations: (1) Moving apm experimental to [Unreleased] correctly sets user expectations -- it was never actually in 0.9.1 and this correction avoids confusion. (2) PR number backfilling gives contributors a clear link between entries and diffs, improving traceability. (3) The shared/apm.md bump entry (v1.4.2 workspace-pollution fix) is actionable and clearly described for gh-aw contributors. No concerns.

---

Supply Chain Security Expert: No changes to dependency resolution, lockfile integrity, path security, token handling, or auth. Security entries in [0.9.0] Security (MCP registry validation, apm install --mcp defense-in-depth, SimpleRegistryClient timeouts) remain intact and undisturbed. The Copilot adapter validates transport_type entry (#812) is correctly placed in [Unreleased] Fixed -- unreleased security-adjacent hardening in the right section. No threat surface touched, no entries suppressed. Clean pass.

---

Auth Expert: Not activated -- PR only modifies CHANGELOG.md; no auth, token management, credential resolution, host classification, or AuthResolver-related files are touched.

---

OSS Growth Hacker: CHANGELOG.md is a direct conversion surface -- raw material for release narratives and the upgrade-decision artifact for existing users. Three growth observations: (1) apm experimental moving to [Unreleased] is a trust-builder -- correcting the miscategorization means users who searched for it and couldn't find it will now see it in the upcoming release. (2) The apm update LD_LIBRARY_PATH fix entry (#899) is exceptionally story-shaped (names specific distros, root cause, solution with <VAR>_ORIG protocol) -- this should headline the next release note; it converts frustrated Fedora/Debian-arm64 users into re-engaged users. (3) PR number completeness signals diligent maintainership -- external contributors can trace every entry, which builds repo credibility.

Side-channel to CEO: no WIP/growth-strategy.md update required for routine housekeeping. Flag the apm experimental feature for a dedicated social beat on next release: "Try new APM features before they graduate to default" is a contributor-acquisition angle worth a short post.

---

CEO arbitration

All five mandatory specialists agree: this is a well-scoped, factually correct CHANGELOG cleanup with no regressions and no dropped entries. The three structural changes -- deduplication of [Unreleased] Fixed sections, conflict-marker removal with verification that all conflict-side entries already exist in [0.9.0], and the apm experimental repositioning to [Unreleased] -- are all independently verified correct. PR number backfilling is pure improvement. The Growth Hacker's apm update release-note angle is worth using. No disagreements to arbitrate; the change is uncontroversial and ready to merge.

---

Required actions before merge

None.

---

Optional follow-ups

• When cutting the next release, consider leading the release note with the apm update LD_LIBRARY_PATH fix (fix(update): sanitise env before spawning installer #899) -- it is the most user-pain-reducing entry and names specific affected distros, making it repostable.
• Consider a short social beat for apm experimental when the next version ships: the "try before it graduates to default" angle is a low-cost contributor-acquisition hook.

Generated by PR Review Panel for issue #932 · ● 528.4K · ◷