[ViperJuice]

Release cut for 2.4.0. Version bump only — no source behaviour changes in this PR.

Ships v12 UPDPATH (#179), already merged to main and unreleased. v12 is now complete: TRISTATE and FANOUT shipped in 2.3.0, UPDPATH ships here.

What's in it

• Description freshness is gated on package identity. Cached descriptions were paired with a server config by name and freshness decided on version alone, at three sites — so swapping the configured package at an equal version served the wrong package's tool descriptions indefinitely. An unknown side means "cannot confirm identity", which resolves to refresh, never to "cannot compare, so skip the check".
• Cached entries carry a package_type. A bare name cannot tell npm foo from pypi foo, and both produce orderable release versions so compare_versions never reports them incomparable. A cache written before this release has no type, reads as unknown, and refreshes once. No cache-format bump.
• pmcp refresh --check-versions honours --cache-dir — it computed the path and then dropped it.
• --check-versions splits its report. A server whose package cannot be classified (node /opt/srv.js) is reported as unconfirmable rather than stale, and without the --force remedy that would never settle it.
• The probe-window environment contract is documented and pinned, both halves: a config-driven change (including a rotated manifest credential) is refused; a genuinely ambient variable is live at spawn.

Closes #165 and #162 as part of the phase.

Why minor, not patch

Three user-visible behaviour changes: --check-versions output shape, refresh_all dropping an unclassifiable entry when regeneration fails, and a one-time refresh for pre-2.4 caches. All documented under ### Changed.

Known limitation, shipped knowingly

#180 — detect_package_type collapses distinct packages for registry:port/image and npm exec pkg forms, so the identity gate can falsely confirm for those command shapes. Pre-existing; it only became consequential once package names were compared. The parser backs every version lookup in the codebase, so re-parsing it deserves its own plan rather than being appended to a release cut.

Verification

The release-note extraction was dry-run with the workflow's own awk: 70 lines, two unique ### headings, terminates cleanly before the 2.3.0 section — no duplicate-heading bleed.

Files: pyproject.toml, src/pmcp/__init__.py, uv.lock, and the CHANGELOG.md version header dated 2026-08-25.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbREMUsxgJ8TDBLpJ56PWb

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}