@twinsearth/w2m-dsh-plugin 0.9.4 → 0.9.5

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.5] — 2026-10-14
+
+**Same code as v0.9.4; published because v0.9.4's npm and GitHub bytes cannot be made to agree.**
+
+### Why this version exists
+
+v0.9.4 was published, then amended minutes later to replace a comment that quoted a retired message
+verbatim. GitHub's tag and assets were moved to the corrected commit. **npm could not follow**: a
+published version cannot be overwritten, and this account's token cannot unpublish either, so npm keeps
+the pre-amendment bytes permanently.
+
+The difference is one comment. It is recorded here rather than papered over because a divergence that is
+discovered later and unexplained costs more than a version number:
+
+| Where | v0.9.4 | Carries |
+|---|---|---|
+| npm | `sha256:570f5175…` (870353 b) | the comment that quotes the retired sentence |
+| GitHub | `sha256:ab7b60dc…` (870448 b) | the corrected comment |
+
+Both run **identically** — the changed bytes are inside a `/** */` block. `latest` on npm now points at
+0.9.5, which is byte-consistent with its GitHub release, so the divergence is confined to a superseded
+patch of one patch version.
+
+### Verified
+
+- `test/relay.test.mjs` 152 pass, `test/claims.test.mjs` 47 pass, `test/chatops-account.test.mjs` pass —
+  242 tests, 0 failures, 0 cancelled.
+- `eslint .` — 0 errors.
+- The precise check on the shipped tree: the retired sentence appears **0 times in code and 0 times in
+  comments**; the corrected sentence appears once, at the assignment.
+
 ## [0.9.4] — 2026-10-14
 
 **A note that promised a verdict the relay no longer delivers, and the test that had locked the promise in.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/plugin/tools.mjs

@@ -180,7 +180,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.9.4';
+const PLUGIN_VERSION = '0.9.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3877,12 +3877,14 @@ export async function apply(ctx, config = {}) {
           /**
            * The note has to match what the relay will actually do.
            *
-           * It used to read "...and the aggregate will be unverifiable", which was true when the relay
-           * compared an absent anchor against the literal `null`: every machine with a real commit
-           * violated it, so an unanchored dispatch could never aggregate. v0.9.3 made the relay skip a
-           * check nobody declared (`base_commit` now behaves like `base_tree` always did), so the same
-           * dispatch reaches a real verdict -- and the old wording would have told an operator to doubt
-           * an `ok` result that is correct.
+           * It used to end by promising that the aggregate would be unverifiable, which was true when
+           * the relay compared an absent anchor against the literal `null`: every machine with a real
+           * commit violated it, so an unanchored dispatch could never aggregate. v0.9.3 made the relay
+           * skip a check nobody declared (`base_commit` now behaves like `base_tree` always did), so the
+           * same dispatch reaches a real verdict -- and the old wording would have told an operator to
+           * doubt an `ok` result that is correct. The sentence is deliberately not reproduced here: a
+           * verbatim copy of retired output is indistinguishable from live output to anything that
+           * searches rather than reads, including the check that verified this change.
            *
            * What is still true, and is the thing worth saying: without an anchor there is no answer to
            * "did these machines run the same tree", so consistency here is agreement between machines.