@twinsearth/w2m-dsh-plugin 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -4,6 +4,80 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.5] — 2026-10-14
+
+**Same code as v0.9.4; published because v0.9.4's npm and GitHub bytes cannot be made to agree.**
+
+### Why this version exists
+
+v0.9.4 was published, then amended minutes later to replace a comment that quoted a retired message
+verbatim. GitHub's tag and assets were moved to the corrected commit. **npm could not follow**: a
+published version cannot be overwritten, and this account's token cannot unpublish either, so npm keeps
+the pre-amendment bytes permanently.
+
+The difference is one comment. It is recorded here rather than papered over because a divergence that is
+discovered later and unexplained costs more than a version number:
+
+| Where | v0.9.4 | Carries |
+|---|---|---|
+| npm | `sha256:570f5175…` (870353 b) | the comment that quotes the retired sentence |
+| GitHub | `sha256:ab7b60dc…` (870448 b) | the corrected comment |
+
+Both run **identically** — the changed bytes are inside a `/** */` block. `latest` on npm now points at
+0.9.5, which is byte-consistent with its GitHub release, so the divergence is confined to a superseded
+patch of one patch version.
+
+### Verified
+
+- `test/relay.test.mjs` 152 pass, `test/claims.test.mjs` 47 pass, `test/chatops-account.test.mjs` pass —
+  242 tests, 0 failures, 0 cancelled.
+- `eslint .` — 0 errors.
+- The precise check on the shipped tree: the retired sentence appears **0 times in code and 0 times in
+  comments**; the corrected sentence appears once, at the assignment.
+
+## [0.9.4] — 2026-10-14
+
+**A note that promised a verdict the relay no longer delivers, and the test that had locked the promise in.**
+
+### What v0.9.3 left behind
+
+v0.9.3 made the relay skip an anchor nobody declared, so an unanchored dispatch now aggregates normally —
+the live relay returns `state: consistent`, `counts.ok: 1` for a command that used to come back
+`unverifiable`. The plugin, however, still opened every such dispatch with:
+
+> this machine's working tree could not be fingerprinted, so peers have no anchor to match and
+> **the aggregate will be unverifiable**
+
+which was true when it was written and is now false. The fixed mechanism had been left with a sentence
+telling operators to doubt a verdict that is correct, so the note now says what is actually the case:
+
+> this machine's working tree could not be fingerprinted, so no anchor was declared: peers are compared
+> with each other, not against a named tree
+
+### The test had encoded the promise
+
+`test/tools.test.mjs` asserted `assert.match(value.note, /unverifiable/)`, so fixing the wording broke
+the suite — and the tempting repair is to put the sentence back and keep the suite green. That would have
+been the wrong way round: **the test was guarding a claim, not a behaviour.** It now asserts the claim:
+
+- the note must state that no anchor was declared;
+- it must state what that costs — agreement between peers, not with a named tree;
+- and `assert.doesNotMatch(value.note, /unverifiable/)`, so the stale promise cannot be written back in.
+
+The third is the one that earns its place. A positive match on a *new* sentence would have passed too and
+guarded nothing; the negative case is what stops the old sentence returning.
+
+### Verified
+
+- `test/relay.test.mjs` — 152 tests, 0 failures.
+- `test/claims.test.mjs` — 47 pass. It caught this release's own omission on the first run: the version
+  was bumped to 0.9.4 while the newest CHANGELOG entry still said 0.9.3, and it refused with *"One of them
+  is the release; the other is a mistake."* Correct, and the reason this entry exists.
+- `test/tools.test.mjs` — 90 pass, 1 failure: `w2m_run computes base_commit and base_tree from a real git
+  work tree`, which fails with `spawn git ENOENT` because **git is not installed on this host**. That is
+  the same environmental cause as the 38 `declared suite` failures, not a regression.
+- `eslint .` — 0 errors, 127 warnings.
+
 ## [0.9.3] — 2026-10-14
 
 **An undeclared anchor was compared against the literal `null`, so every dispatch from a non-git machine was `unverifiable` — including the ones that succeeded.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/plugin/tools.mjs

@@ -180,7 +180,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.9.3';
+const PLUGIN_VERSION = '0.9.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3874,8 +3874,23 @@ export async function apply(ctx, config = {}) {
                 session: sessionKey,
                 ...selectionReason,
               },
+          /**
+           * The note has to match what the relay will actually do.
+           *
+           * It used to end by promising that the aggregate would be unverifiable, which was true when
+           * the relay compared an absent anchor against the literal `null`: every machine with a real
+           * commit violated it, so an unanchored dispatch could never aggregate. v0.9.3 made the relay
+           * skip a check nobody declared (`base_commit` now behaves like `base_tree` always did), so the
+           * same dispatch reaches a real verdict -- and the old wording would have told an operator to
+           * doubt an `ok` result that is correct. The sentence is deliberately not reproduced here: a
+           * verbatim copy of retired output is indistinguishable from live output to anything that
+           * searches rather than reads, including the check that verified this change.
+           *
+           * What is still true, and is the thing worth saying: without an anchor there is no answer to
+           * "did these machines run the same tree", so consistency here is agreement between machines.
+           */
           note: anchors.base_tree === null
-            ? 'this machine\'s working tree could not be fingerprinted, so peers have no anchor to match and the aggregate will be unverifiable'
+            ? 'this machine\'s working tree could not be fingerprinted, so no anchor was declared: peers are compared with each other, not against a named tree'
             : 'peers are checked against base_commit + base_tree + command_hash',
         },
         null,