cross-tab-worker-databus 0.21.51 → 0.21.52

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [0.21.52] - 2026-10-24
+
+`npm publish` has been re-running the entire gate set on every release, and no check in this repository could see it. The finding is an omission rather than a bug — which is why it survived until the question was asked in the inverse direction. No behavior, API shape, export, default, frame or storage key changed; the coverage floors and the zero-count arm ledger are `0.21.51`'s.
+
+### Added
+
+- **Two gates over the release automation's implicit surface.** The `Verify` step's name is now asserted to carry one token per command `pnpm check` actually runs, derived by splitting `package.json` rather than restated, so the gate fails on drift and passes on rewording. And `prepublishOnly` — the package's own lifecycle hook — is asserted to exist and to be explained at the publish step. Neither was catchable before: `tests/workflows.test.ts` already required every `run: pnpm …` command in the workflows to appear in the quick reference, and that case was green throughout, because a lifecycle hook is injected through a manifest field and is not a `run:` line.
+
+### Corrected
+
+- **`release.yml` described `pnpm check` as "typecheck + build + test"** in both its comment and its step name, omitting the perf gates the same step runs — the same class as the `0.21.36` `CONTRIBUTING.md` gloss. The old step name is left alone in the dated `0.21.33` reading in the progress log, kept as written like a published release note.
+- **The manual publish path is now documented as guarded.** The checklist tells a reader without an `NPM_TOKEN` to run `npm publish --access public`; without the hook, that path would ship an unbuildable tree, because the CI `Verify` step belongs to the workflow rather than to `npm publish`. Measured on release run `40111113635`: the workflow's own `Publish to npm` step logs a second `check` with all four sub-steps, ~31 s of that step's 37 s. A publish that takes half a minute before uploading is the hook, not a hang — a fact now written at the step, in `AGENTS.md`'s quick reference, and in both checklists.
+
+### Verification
+
+- `pnpm check` — 40 files and **1037 tests** (+2 cases), plus the 5 perf gates; `pnpm lint`; documentation gate 25 in both languages.
+- Both new gates verified to bite, each by one mutant: the step-name revert (`applied=2`) reddens the name case; deleting the hook comment (`applied=10`) reddens the hook case. The first attempt at the second mutant was a multi-line regex that matched nothing — `applied=0` with a green suite, the recorded failure where an uninserted mutant reports as a survivor — and had to be redone as a literal splice.
+- en/zh `Publishing` section digit multisets compared in **both directions with a non-empty control on each side** (five tokens each), so an empty difference means agreement rather than a failed extraction.
+
 ## [0.21.51] - 2026-10-24
 
 Three shipped sentences were refuted by the two releases before this one, and neither refutation showed up in a green CI check. `0.21.50` recorded its publish at 56.5 s after the ack, which widened the floor that three copies of the docs had quoted as a bound; and the progress log's record of that release's benchmark sample claimed a metric had landed inside its five-report range when the tool's printed column shows it did not. Documentation only; no behavior, API shape, export, default, frame or storage key changed, and the coverage floors and the zero-count arm ledger are `0.21.49`'s.

package/dist/centrifuge.js

@@ -7,7 +7,7 @@ import {
   publicationMetadata,
   selectWorkerBackend,
   serializeError
-} from "./chunk-GPOSJCXD.js";
+} from "./chunk-6ZYMKR6J.js";
 import {
   CENTRIFUGE_INPUT_TYPE,
   CENTRIFUGE_OUTPUT_TYPE,

package/dist/{chunk-GPOSJCXD.js → chunk-6ZYMKR6J.js}

@@ -2548,7 +2548,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.51" : ""
+  true ? "0.21.52" : ""
 );
 
 // src/core/data-bus.ts
@@ -3801,4 +3801,4 @@ export {
   parseDataBusPublication,
   selectWorkerBackend
 };
-//# sourceMappingURL=chunk-GPOSJCXD.js.map
+//# sourceMappingURL=chunk-6ZYMKR6J.js.map

package/dist/cjs/centrifuge.cjs

@@ -2677,7 +2677,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.51" : ""
+  true ? "0.21.52" : ""
 );
 
 // src/core/data-bus.ts

package/dist/cjs/index.cjs

@@ -2643,7 +2643,7 @@ var SDK_VERSION = (
   // declaration's type is `string | undefined` and the export's is `string`
   // (dropping the conditional is TS2322, measured). Recorded here so the leg reads
   // as a shape the harness cannot reach rather than as a case nobody exercised.
-  true ? "0.21.51" : ""
+  true ? "0.21.52" : ""
 );
 
 // src/core/data-bus.ts

package/dist/index.js

@@ -20,7 +20,7 @@ import {
   selectRebalanceTarget,
   selectWorkerBackend,
   topicMatchesPattern
-} from "./chunk-GPOSJCXD.js";
+} from "./chunk-6ZYMKR6J.js";
 import {
   DEFAULT_STORAGE_PREFIX,
   PRUNE_STRATEGY,

package/docs/release-checklist.md

@@ -45,7 +45,7 @@ Skipping the version instead is not available here, and the repository's own gat
 
 ## Publishing
 
-For a manual release (no `NPM_TOKEN` in the workflow), run `npm publish --access public` from the tagged checkout. A version already present on npm cannot be published again. Historical versions missing from npm must be rebuilt from their exact git tags and reviewed individually; never publish the current tree under an old version.
+For a manual release (no `NPM_TOKEN` in the workflow), run `npm publish --access public` from the tagged checkout. **That path is not unguarded:** `package.json` sets `prepublishOnly` to `pnpm check`, and `npm publish` fires it before packing, so the full typecheck → build → test → test:perf sequence runs a second time inside the publish itself. Measured on release run `40111113635`, where the workflow's own `Publish to npm` step logged a second `> cross-tab-worker-databus@0.21.51 check` with all four sub-steps — ~31 s of that step's 37 s. So a manual publish that takes half a minute before uploading anything is the hook, not a hang, and a tree that does not build cannot be published by hand any more than by CI. Nothing in the workflow files shows this, which is why `tests/workflows.test.ts` pins both the hook and the explanation at the publish step. A version already present on npm cannot be published again. Historical versions missing from npm must be rebuilt from their exact git tags and reviewed individually; never publish the current tree under an old version.
 
 ## After publishing
 

package/docs/roadmap.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-0.21.50 was released on October 24, 2026. The project is intentionally continuing through reliability-focused releases before a 1.0.0 stability freeze.
+0.21.51 was released on October 24, 2026. The project is intentionally continuing through reliability-focused releases before a 1.0.0 stability freeze.
 
 ## 0.21.44 delivered scope
 

package/docs/zh/release-checklist.md

@@ -46,7 +46,7 @@
 
 ## 发布（手动场景）
 
-未在工作流配置 `NPM_TOKEN` 时，从对应 tag 的工作树手动运行 `npm publish --access public`。已经存在于 npm 的版本不能重复发布；npm 缺失的历史版本必须从对应 git tag 重建并逐个审阅，不能把当前工作树伪装成旧版本发布。
+未在工作流配置 `NPM_TOKEN` 时，从对应 tag 的工作树手动运行 `npm publish --access public`。**这条路径并非无守门：** `package.json` 把 `prepublishOnly` 设为 `pnpm check`，而 `npm publish` 会在打包前触发它，于是完整的 typecheck → build → test → test:perf 序列会在发布动作自身内部再跑一遍。在发布运行 `40111113635` 上实测：工作流自己的 `Publish to npm` 步骤记录了第二个 `> cross-tab-worker-databus@0.21.51 check`，四个子步骤齐全——该步骤 37 秒里约 31 秒都是它。所以一次手动发布在上传之前先花半分钟，那是钩子而不是卡死；不能构建的工作树，手动也无法发布，正如 CI 不能。这件事在工作流文件里看不到，这就是 `tests/workflows.test.ts` 同时在发布步骤钉住这个钩子与这段解释的原因。已经存在于 npm 的版本不能重复发布；npm 缺失的历史版本必须从对应 git tag 重建并逐个审阅，不能把当前工作树伪装成旧版本发布。
 
 ## 发布后
 

package/docs/zh/roadmap.md

@@ -1,6 +1,6 @@
 # 路线图
 
-0.21.50 已于 2026 年 10 月 24 日发布。项目会先持续完成可靠性发布，再进入 1.0.0 稳定性冻结。
+0.21.51 已于 2026 年 10 月 24 日发布。项目会先持续完成可靠性发布，再进入 1.0.0 稳定性冻结。
 
 ## 0.21.44 已完成范围
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cross-tab-worker-databus",
-  "version": "0.21.51",
+  "version": "0.21.52",
   "description": "Framework-agnostic cross-tab data bus with Dedicated/Shared Worker clustering and Centrifuge support.",
   "type": "module",
   "license": "MIT",