@@ -8,6 +8,13 @@ _Add entries here, never under a stamped version_ — a release commit renames t
 heading, and a branch that wrote beneath it merges without conflict straight into a
 published section (it happened to #170).
 
+## [0.47.3] - 2026-10-13
+
+PATCH by content: fixes VS Code JSONC configuration preservation and adds
+native-client validation tooling. No new CLI command, signature or protocol
+claim. Tagged during the 2026-09-15 → 10-15 release freeze on the maintainer's
+explicit "merge #261, release" instruction.
+
 ### Fixed
 
 - VS Code user-global `mcp.json` accepts comments and trailing commas. Install,
 
@@ -12,29 +12,20 @@ An open-source, CLI-first MCP package manager — **"npm for MCP servers"**.
 A registry where developers can search, install, audit, publish, and update MCP servers
 across all major clients (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI) from a single tool.
 
-**Current release:** `@getmcpm/cli@0.47.2` (2026-10-12), tag commit `aaf358f`.
-PATCH: repository native-client validation tooling/docs only; production source
-and dependencies are unchanged from v0.47.1. PR #257 merged as `9e96bfd`,
-byte-identical to Astra-reviewed `89fad08`, after all nine checks passed.
-Documentation-only release PR #258 merged as `aaf358f` after all nine checks.
-Exact release-main CI/CodeQL/Scorecard passed before tagging. The maintainer
-explicitly requested "merge #257, release" during the recorded release freeze.
-
-Publish run `38162631692` passed all five jobs, including Node 22/24/26 package
-gates and official registry listing. GitHub release is published/immutable;
-npm and MCP registry exact/latest are 0.47.2. Downloaded tarball integrity and
-verified npm provenance bind to release commit `aaf358f` and the exact tagged
-GitHub Actions workflow identity. The SBOM signature verifies; altered bytes
-are rejected. These verify build identity, not code safety.
-
-The actual published 0.47.2 tarball passes clean-install release smoke, all
-97 public fixtures and 11 modern guarded-process cases, with legacy
-initialization and pin/event persistence. A throwaway reference-peer harness
-repinned to actual 0.47.2 passes 40 comparisons, with zero failures, two expected
-unsupported combinations and seven self-checks; its locked integrity matches
-the verified npm tarball. The committed harness baselines remain unchanged.
-
-**Unreleased Phase 2B:** VS Code user-global configuration reads JSONC and edits
+**Release prepared:** `@getmcpm/cli@0.47.3` (2026-10-13).
+PATCH: VS Code user-global JSONC preservation from PR #260 plus the native
+consent suite from PR #261. Microsoft `jsonc-parser` 3.3.1 is the sole new
+production dependency since 0.47.2. No new CLI command, guard signature, SDK
+upgrade or protocol-conformance claim. PR #261 merged as `e69ea0e`, with its
+tree byte-identical to reviewed `3466e03` after all nine checks passed.
+
+The maintainer explicitly requested "merge #261, release" during the recorded
+release freeze. This documentation-only preparation retains the reviewed
+production source, dependencies, harness and workflow. Published version is
+still 0.47.2 until the tag workflow completes; npm/registry publication,
+provenance/SBOM and actual published-binary verification remain pending.
+
+**Phase 2B (included in v0.47.3):** VS Code user-global configuration reads JSONC and edits
 only the selected server while preserving unrelated bytes/comments and the raw
 backup. Invalid/duplicate server paths fail before writes; other clients remain
 strict JSON. Microsoft `jsonc-parser` 3.3.1 is the sole new production dependency.
@@ -49,7 +40,7 @@ User-global paths are unchanged; portable/Agent Host routes and
 provider/model/usage-skill behavior remain unverified. Normal tool consent is
 measured separately in Phase 2C below.
 
-**Unreleased Phase 2C:** Native default-mode consent passes 4/4 cases in each of
+**Phase 2C (included in v0.47.3):** Native default-mode consent passes 4/4 cases in each of
 VS Code 1.141.0 and Claude Code 2.1.296: one-shot re-prompting in one session,
 deny/Escape before dispatch, exact echo grants surviving restart while warn
 still prompts, and guard blocking after client approval with echo recovery.
 
@@ -396,6 +396,12 @@ mcpm baseline remains 0.47.1. It exercises
 actual global configurations and MCP calls with synthetic inputs; live models,
 interactive chat and other client/platform combinations require separate tests.
 
+v0.47.3 fixes VS Code user-global JSONC configuration edits so unrelated
+comments/settings and the raw backup survive the MCP lifecycle. It also adds
+separate native approval/denial tests: four cases each in the pinned VS Code
+and Claude Code builds, with synthetic model responses. Native macOS dialogs,
+workspace/server trust, inline chat/Agent Host and live providers remain unverified.
+
 Install-time trust scoring catches most poisoned servers before they ship. But what about **rug-pulls** — a server that changes its tool definitions after you've already approved them? Or **prompt-injection in tool responses** — adversarial text embedded in a Slack message, web page, or calendar invite that the agent reads through your trusted MCP server?
 
 `mcpm guard` adds a runtime inspection layer. It wraps every installed MCP server with a stdio relay, scans tool descriptions / responses / arguments for OWASP MCP Top 10 attack patterns, pins each tool's schema at install time, and blocks calls when the live response drifts from the pin (rug-pull defense).
 
@@ -2,6 +2,8 @@
 
 Repository tooling added in v0.47.2. Its reproducible published mcpm baseline
 remains 0.47.1; a release does not silently repin the native measurements.
+The v0.47.3 additions include explicit candidate/configuration validation and
+separate default-consent cases; the reference-peer baseline also stays 0.47.0.
 
 This repository harness exercises installed VS Code and Claude Code inside
 separate disposable macOS VM clones. It uses the actual user-global configuration