diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5679018..b9107f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,8 +11,16 @@ and this project adheres to [Conventional Commits](https://www.conventionalcommi
 
 - `New-PveNetwork` and `Set-PveNetwork` gained `-BridgeVlanAware`, so a VLAN-aware Linux bridge can be created and toggled from the module instead of only being read back. The model already surfaced `bridge_vlan_aware` as `BridgeVlanAware`, so this closed a write-path gap. On `Set-PveNetwork` the switch is only sent when explicitly bound, so an update that omits it leaves the flag alone. Clearing it goes through the endpoint's `delete` list rather than `bridge_vlan_aware=0`: PVE merges supplied keys onto the stored stanza and accepts the `0` without acting on it, so the obvious form is a silent no-op — confirmed against a live PVE 9 cluster, where the bridge stayed VLAN-aware. `bridge_vids` is not covered; it is an independent parameter and PVE defaults to 2-4094. (#92)
 
+### Changed
+
+- `Newtonsoft.Json` is now 13.0.4 in both shipped assemblies, with every package version managed centrally in `Directory.Packages.props` so the two can no longer drift; the SDK is pinned by `global.json` (10.0, latest feature band) and the net48 test build no longer emits the `System.Memory` MSB3277 conflict. (#156)
+
 ### Fixed
 
+- `Copy-PveVm` and `Copy-PveContainer` now allocate a valid guest ID through `cluster/nextid` when `-NewVmId` is omitted, instead of sending `newid=0`, which PVE rejects. Both cmdlets now forward `-Storage` to the clone request; it was declared and silently dropped, so a full clone always landed on the source storage. `New-PveVm` and `Import-PveOva` use the same service call for their ID allocation, so a response without `data` is a clear error rather than a `NullReferenceException`. (#135)
+- `Import-PveOva` no longer throws an unhandled `InvalidOperationException` when the created VM is not yet listed on the node (the disk import still running without `-Wait`); it returns the basic VM record instead, as the cmdlet always intended. Its upload no longer runs under the session's 100-second timeout, so an OVA that takes longer to transfer completes; `-TimeoutSeconds` was added (default 30 minutes, `0` for none), mirroring `Send-PveFile`. (#139)
+- `Wait-PveTask` polls through `TaskService.WaitForTask` like every other `-Wait` path, so it clamps the poll interval to one second, checks the task before sleeping, and no longer overflows on intervals over 24 days. An omitted `-Timeout` still waits indefinitely. (#140)
+- `Get-PveVm` and `Get-PveContainer` warn for each node skipped because it was unreachable or returned a server error, instead of silently returning a partial or empty list, and a permission error on any node now surfaces instead of reading as "no guests". Lifecycle cmdlets with `-Wait` surface an expired session, a permission error or a missing guest during the status poll immediately, instead of failing with a generic timeout after the full `-Timeout` window. (#142)
 - `Remove-PveStorage`, `Remove-PveSdnVnet` and `Remove-PveSdnZone` now percent-encode the name before building the API path and reject names outside `A-Z a-z 0-9 . _ -`, so a name containing `../` can no longer be turned into a request against a different endpoint. The three cmdlets now call the existing service methods instead of building their own request. (#145)
 - `Invoke-PveVmGuestExec` now recognises a boolean `exited` from the guest agent, instead of polling until `-Timeout` on PVE builds that return `true` rather than `1`. (#141)
 - `Disconnect-PveServer` no longer issues a `DELETE` to `/access/ticket`, an endpoint PVE does not have; the call always failed and was hidden. It now discards the local session only and gained `-Session` so an explicitly created session can be disconnected. The warning for a session that is not the module-level one names the credential's real lifecycle: tickets expire on their own, API tokens do not and can be revoked with `Remove-PveApiToken`. (#144)