cross-tab-worker-databus 0.21.48 → 0.21.50

package/CHANGELOG.md

@@ -1,3 +1,38 @@
+## [0.21.50] - 2026-10-24
+
+The benchmark trend the last release shipped was built from one release-sample, because its second run was deferred under the loaded-host rule. That second sample is now taken, and the shipped trend reflects an archive two reports deep rather than one. Documentation only; no behavior, API shape, export, default, frame or storage key changed, and the coverage floors and the zero-count arm ledger are `0.21.49`'s.
+
+### Documentation
+
+- **The browser benchmark trend is regenerated from the 94-report archive** (both languages). The added report is the release-sample `0.21.49` deferred when its host read load average 16–21 on 8 cores; the retake landed on a quiet host and the comparison gate passed with the worst mover at +46.2% against the 50% ceiling. One metric the deferred run had flagged — the batch-publish figure at +54.5% — reads +25.0% here and sits inside its own five-report range, which is the fast/slow alternation the release checklist documents rather than a regression.
+
+### Verification
+
+- `pnpm bench:browser` (archived), `pnpm bench:compare --fail-above-pct 50` and `pnpm bench:trend` all clean; the documentation gate at 25 in both languages.
+- `pnpm check`, `pnpm lint`, `pnpm test:coverage` (99.03 / 97.65 / 99.27 / 99.69, `0.21.49`'s aggregate), `verify:pack` / `verify:compat` / `verify:types`, and `pnpm audit` on the public registry.
+
+## [0.21.49] - 2026-10-24
+
+A release the advisory database forced and the benchmark archive was owed: five October advisories made the blocking `pnpm audit` step fail on every pull request (dev toolchain only — no shipped code path changed), and the browser benchmark trend doc carried numbers 24 days and twenty-one releases old. The one source change is behavior-identical by construction and measured; the coverage floors are unchanged and the zero-count arm ledger lost its last unadjudicated member.
+
+### Changed
+
+- **`holdLastFinite`'s `primed` flag is deleted.** The flag was set exactly when the held value was assigned a finite reading, and the held value is initialized to the same `0` the flag's other arm returned — so the conditional it gated was equal to the plain held value for every input, and no test could have distinguished the arm from its deletion. The wrapper's output is byte-identical; what is new is the pin beneath the seed: a clock that has never produced a finite reading stamps `0` (the value the cluster's TTL comparisons read as "very old") and survives `JSON.stringify` where `NaN` would have become `null`.
+
+### Fixed
+
+- **The blocking audit step is green again.** Four dev-toolchain dependencies are pinned at their patched versions for advisories published after `0.21.48`'s release run: `source-map-js` <1.2.2 (high, event-loop DoS, reached through the coverage adapter's magicast dependency), `vite` <=7.3.6 (five advisories), the Vitest mocker <5.0.3, and `undici` <8.12.2 (through jsdom). Three are pinned by `pnpm-workspace.yaml` overrides inside their declared ranges; `vite` is pinned as a direct devDependency because an override does not reach an auto-installed peer resolution, which was measured with the override in place and the lockfile still resolving the vulnerable version.
+
+### Documentation
+
+- **The browser benchmark trend is refreshed in both languages** from the 93rd archived report (2026-10-24), 24 days after its predecessor; the comparison gate is clean with the worst mover at +19.4% against a 50% ceiling. A second release-sample run was deferred under the standing loaded-host rule (load average 16–21 on 8 cores; the sample was moved out of the archive rather than allowed to become the next baseline's median).
+
+### Verification
+
+- `pnpm check` — **1035 tests** (+1: the clock-seed pin) plus the 5 perf gates; `pnpm lint`; the documentation gate at 25 in both languages.
+- `pnpm test:e2e` **38 passed**; `pnpm verify:pack`; `pnpm test:coverage` with the branch aggregate up 0.05 because an arm that could never light no longer exists.
+- `pnpm audit` on the public registry, clean.
+
 ## [0.21.48] - 2026-10-02
 
 An option added in `0.21.47` was documented accurately and not at all: it appeared in a prose paragraph, while the surface a reader actually scans — a table — said nothing. Documentation only; no behavior, API shape, export, default, frame or storage key changed, and the coverage floors and the zero-count arm ledger are `0.21.47`'s.

package/dist/centrifuge.js

@@ -7,7 +7,7 @@ import {
   publicationMetadata,
   selectWorkerBackend,
   serializeError
-} from "./chunk-A3AYPDMW.js";
+} from "./chunk-5TMCDBQC.js";
 import {
   CENTRIFUGE_INPUT_TYPE,
   CENTRIFUGE_OUTPUT_TYPE,

package/dist/{chunk-A3AYPDMW.js → chunk-5TMCDBQC.js}

@@ -2548,7 +2548,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.48" : ""
+  true ? "0.21.50" : ""
 );
 
 // src/core/data-bus.ts
@@ -3801,4 +3801,4 @@ export {
   parseDataBusPublication,
   selectWorkerBackend
 };
-//# sourceMappingURL=chunk-A3AYPDMW.js.map
+//# sourceMappingURL=chunk-5TMCDBQC.js.map

package/dist/cjs/centrifuge.cjs

@@ -2677,7 +2677,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.48" : ""
+  true ? "0.21.50" : ""
 );
 
 // src/core/data-bus.ts

package/dist/cjs/index.cjs

@@ -2643,7 +2643,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.48" : ""
+  true ? "0.21.50" : ""
 );
 
 // src/core/data-bus.ts

package/dist/index.js

@@ -20,7 +20,7 @@ import {
   selectRebalanceTarget,
   selectWorkerBackend,
   topicMatchesPattern
-} from "./chunk-A3AYPDMW.js";
+} from "./chunk-5TMCDBQC.js";
 import {
   DEFAULT_STORAGE_PREFIX,
   PRUNE_STRATEGY,

package/docs/benchmarks.md

@@ -2,19 +2,19 @@
 
 # Browser Benchmark Trend
 
-> Data through 2026-09-30, from the 92 archived `bench-results/browser-*.json` reports (run `pnpm bench:browser` to add one; regenerate this doc with `node scripts/bench-trend.mjs`).
+> Data through 2026-10-24, from the 94 archived `bench-results/browser-*.json` reports (run `pnpm bench:browser` to add one; regenerate this doc with `node scripts/bench-trend.mjs`).
 
 The comparison baseline for release gating is `pnpm bench:compare --fail-above-pct 50`, which compares the newest report against the median of the same metric in the preceding reports *and* requires the new value to exceed the highest of those samples (50% ceiling absorbs shared-runner noise; a single previous report was a fragile baseline because the in-page hot-path metrics alternate between a fast and a slow mode on identical code — and a median over an alternating sample is only stable while the modes are mixed, so a percentage alone can still fail on nothing but a mode shift. Metrics excused by that second leg are listed as "within-baseline, not gated" rather than passing silently). This doc records the long-run picture: values are per-metric latencies where lower is better, and the last column is the best run inside the most recent 5 reports — not an all-time record, because the in-page matrix changed measurement semantics in early September 2026 and older reports are not comparable.
 
 <!-- BENCH-TREND:BEGIN (machine-generated table) -->
 | Metric | Previous (ms) | Latest (ms) | Δ | Best of last 5 runs (ms) |
 |---|---|---|---|---|
-| publish per-message (ms, lower is better) — dedicated | 41.3311 | 44.6795 | +3.35 | 37.1566 |
-| publish per-message (ms, lower is better) — shared | 34.1115 | 37.8574 | +3.75 | 33.8184 |
-| wildcard dispatch ×1000 (ms, lower is better) | 6.7 | 7.4 | +0.70 | 6.3 |
-| publishBatch ×1000 (ms, lower is better) | 4.4 | 5 | +0.60 | 3.7 |
-| dedup ×1000 (ms, lower is better) | 19 | 18.3 | -0.70 | 15.6 |
-| trace + publish ×1000 (ms, lower is better) | 6.6 | 5.7 | -0.90 | 4.6 |
+| publish per-message (ms, lower is better) — dedicated | 42.4834 | 40.396 | -2.09 | 40.1172 |
+| publish per-message (ms, lower is better) — shared | 33.8229 | 36.1461 | +2.32 | 33.8229 |
+| wildcard dispatch ×1000 (ms, lower is better) | 6 | 9.5 | +3.50 | 6 |
+| publishBatch ×1000 (ms, lower is better) | 3.9 | 5.5 | +1.60 | 3.9 |
+| dedup ×1000 (ms, lower is better) | 17.9 | 14.6 | -3.30 | 14.6 |
+| trace + publish ×1000 (ms, lower is better) | 7.4 | 5.2 | -2.20 | 4.6 |
 | first-packet cold dispatch (ms, lower is better) | 0 | 0 | +0.00 | 0 |
 <!-- BENCH-TREND:END -->
 

package/docs/roadmap.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-0.21.47 was released on September 30, 2026. The project is intentionally continuing through reliability-focused releases before a 1.0.0 stability freeze.
+0.21.49 was released on October 24, 2026. The project is intentionally continuing through reliability-focused releases before a 1.0.0 stability freeze.
 
 ## 0.21.44 delivered scope
 

package/docs/zh/benchmarks.md

@@ -2,19 +2,19 @@
 
 # 浏览器基准趋势
 
-> 数据截至 2026-09-30，基于 92 份归档的 `bench-results/browser-*.json` 报告（运行 `pnpm bench:browser` 追加一份；用 `node scripts/bench-trend.mjs` 重新生成本文档）。
+> 数据截至 2026-10-24，基于 94 份归档的 `bench-results/browser-*.json` 报告（运行 `pnpm bench:browser` 追加一份；用 `node scripts/bench-trend.mjs` 重新生成本文档）。
 
 发布门禁的对比基线是 `pnpm bench:compare --fail-above-pct 50`：将最新报告与其之前若干报告中同一指标的中位数比较，*并且*要求新值超过这些样本中的最大值（50% 上限用于吸收共享 runner 的噪声；此前只看"上一份报告"并不稳定，因为页内热路径指标在同一份代码上会在快/慢两档之间来回跳；而在两档交替的样本上，中位数只有在这两档混合分布时才稳定，因此单看百分比仍可能纯粹因为档位切换而失败）。被第二个条件放过的指标会显式列在 “within-baseline, not gated” 里，而不是悄悄算作通过。本文记录长期趋势：数值为逐指标延迟，越低越好；最后一列是最近 5 份报告内的最优值，而不是历史纪录——页内基准矩阵在 2026 年 9 月初变更过测量语义，更早的报告不可比。
 
 <!-- BENCH-TREND:BEGIN (machine-generated table) -->
 | 指标 | 上次 (ms) | 本次 (ms) | Δ | 近 5 次最优 (ms) |
 |---|---|---|---|---|
-| publish per-message (ms, lower is better) — dedicated | 41.3311 | 44.6795 | +3.35 | 37.1566 |
-| publish per-message (ms, lower is better) — shared | 34.1115 | 37.8574 | +3.75 | 33.8184 |
-| wildcard dispatch ×1000 (ms, lower is better) | 6.7 | 7.4 | +0.70 | 6.3 |
-| publishBatch ×1000 (ms, lower is better) | 4.4 | 5 | +0.60 | 3.7 |
-| dedup ×1000 (ms, lower is better) | 19 | 18.3 | -0.70 | 15.6 |
-| trace + publish ×1000 (ms, lower is better) | 6.6 | 5.7 | -0.90 | 4.6 |
+| publish per-message (ms, lower is better) — dedicated | 42.4834 | 40.396 | -2.09 | 40.1172 |
+| publish per-message (ms, lower is better) — shared | 33.8229 | 36.1461 | +2.32 | 33.8229 |
+| wildcard dispatch ×1000 (ms, lower is better) | 6 | 9.5 | +3.50 | 6 |
+| publishBatch ×1000 (ms, lower is better) | 3.9 | 5.5 | +1.60 | 3.9 |
+| dedup ×1000 (ms, lower is better) | 17.9 | 14.6 | -3.30 | 14.6 |
+| trace + publish ×1000 (ms, lower is better) | 7.4 | 5.2 | -2.20 | 4.6 |
 | first-packet cold dispatch (ms, lower is better) | 0 | 0 | +0.00 | 0 |
 <!-- BENCH-TREND:END -->
 

package/docs/zh/roadmap.md

@@ -1,6 +1,6 @@
 # 路线图
 
-0.21.47 已于 2026 年 9 月 30 日发布。项目会先持续完成可靠性发布，再进入 1.0.0 稳定性冻结。
+0.21.49 已于 2026 年 10 月 24 日发布。项目会先持续完成可靠性发布，再进入 1.0.0 稳定性冻结。
 
 ## 0.21.44 已完成范围
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cross-tab-worker-databus",
-  "version": "0.21.48",
+  "version": "0.21.50",
   "description": "Framework-agnostic cross-tab data bus with Dedicated/Shared Worker clustering and Centrifuge support.",
   "type": "module",
   "license": "MIT",
@@ -129,19 +129,20 @@
     "@eslint/js": "^10.0.1",
     "@playwright/test": "^1.63.0",
     "@testing-library/react": "^16.3.3",
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.5",
     "@types/react": "^19.3.0",
     "@vitest/coverage-v8": "^5.0.1",
     "centrifuge": "^5.7.4",
     "esbuild": "^0.28.2",
-    "eslint": "^10.11.0",
+    "eslint": "^10.13.0",
     "fake-indexeddb": "^6.2.5",
-    "globals": "^17.12.0",
-    "jsdom": "^30.1.1",
+    "globals": "^17.13.0",
+    "jsdom": "^30.1.3",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.0",
+    "typescript-eslint": "^8.72.0",
+    "vite": "^7.3.7",
     "vitest": "^5.0.1",
     "vue": "^3.5.43"
   },