dsh-mini-utility-dock 0.1.3 → 0.1.4

package/CHANGELOG.en.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.4 - 2026-09-16
+
+- Add a cross-repo consistency section to the READMEs, separating two different properties: **local** -- a consumer's `npm test` runs `loopback:check` / `guard:check` to compare both fragments byte-for-byte against the version of this package it pins, covering both "edited a block by hand" and "forgot to re-`sync`"; and **cross-repo** -- this package's published versions are immutable and consumers pin an exact version, so "all three pin the same version" already implies "all three hold byte-identical blocks".
+- That section also records that a consumer's `scripts/guard-parity.mjs` is a **manual diagnostic, not a CI gate**, because the property it asserts cannot hold while a peer checkout resolves to a different branch, which would make it report false failures.
+- The LICENSE copyright holder is now `xswt442-cmd`.
+
 ## 0.1.3 - 2026-09-14
 
 - Add two host-side fragments. `dist/loopback.js` (`dsh-loopback-helpers`) exports `LOOPBACK_HOSTNAMES`, `normalizeHostValue`, `hostHostname`, `isLoopbackName` and `isLoopbackAddress`. `dist/guard.js` (`dsh-host-guard`) exports `portOf`, `GUARD_REASONS`, `DEFAULT_GUARD_POLICY` and an internal `bindGuard()` factory; a consumer passes its own error codes and wording as `policy`, so the enforcement does not fork per plugin.

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.4 - 2026-09-16
+
+- README 新增「跨仓一致性」一节，区分两类性质：**本地**——消费仓 `npm test` 的 `loopback:check` / `guard:check` 把本仓两个片段与它们所 pin 的本仓版本逐字节比对，覆盖「私自改块」与「忘了重新 `sync`」；**跨仓**——本仓版本发布后不可变、消费仓 pin 的是精确版本，故「三仓 pin 同一版本」已经蕴含「三仓的块逐字节相同」。
+- 该节同时记录：消费仓的 `scripts/guard-parity.mjs` 是**人工诊断工具而非 CI 门禁**，理由是它断言的性质在 peer 检出解析到不同分支时不成立，门禁化会误报。
+- LICENSE 的版权署名统一为 `xswt442-cmd`。
+
 ## 0.1.3 - 2026-09-14
 
 - 新增两个 host 侧片段：`dist/loopback.js`（`dsh-loopback-helpers`）导出 `LOOPBACK_HOSTNAMES`、`normalizeHostValue`、`hostHostname`、`isLoopbackName`、`isLoopbackAddress`；`dist/guard.js`（`dsh-host-guard`）导出 `portOf`、`GUARD_REASONS`、`DEFAULT_GUARD_POLICY` 与内部的 `bindGuard()` 工厂。调用方以 `policy` 传入自己的错误码与文案，判定逻辑不随之分叉。

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 PracticalIssue
+Copyright (c) 2026 xswt442-cmd
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.en.md

@@ -38,10 +38,21 @@ Consumers invoke the same CLI as `loopback:sync` / `guard:sync`, with the target
 
 The two fragments in `lib/shared.js` have a fixed order, `dsh-loopback-helpers` first.
 
-The order is a functional requirement, not a style choice. Both fragments occupy one file, and `dsh-host-guard` uses the module-scope names the preceding fragment exports. It therefore neither redeclares those predicates nor imports a sibling module: redeclaring collides with the declaration in the same file, and importing would break the standalone-publication constraint. The `guard-parity` check fails when the order is reversed.
+The order is a functional requirement, not a style choice. Both fragments occupy one file, and `dsh-host-guard` uses the module-scope names the preceding fragment exports. It therefore neither redeclares those predicates nor imports a sibling module: redeclaring collides with the declaration in the same file, and importing would break the standalone-publication constraint. `guard-parity` and every consumer's `check` fail when the order is reversed.
 
 `bindGuard` is not exported from the fragment. A consumer declares its own guard export in the same file (typically reusing an existing name such as `createGuard`), and exporting the same identifier would collide. Each plugin calls `bindGuard()` and passes its own error codes and wording through `policy`: the enforcement is shared, the error vocabulary stays with each plugin.
 
+## Cross-repo consistency
+
+The three hand-maintained copies drifted three times: all three rejected IPv6 loopback; the three disagreed on which Host spellings count as loopback; and an unbracketed IPv6 Host silently skipped the allowlist in one plugin while the others denied it. Two checks of different kinds now cover this.
+
+- **Local.** Each consumer's `npm test` runs `loopback:check` / `guard:check`, comparing its two blocks byte for byte against the `dist/` of **the dock version it pins**. This covers a hand edit to a block and a missing re-`sync`.
+- **Cross-repo.** A published dock version is immutable, and consumers pin an exact version, so "all three pin one version" is equivalent to "all three hold byte-identical blocks". The cross-repo property follows from pin agreement, without comparing three source trees. The one real risk is omitting a peer from a synchronized bump.
+
+A consumer's `scripts/guard-parity.mjs` checks that cross-repo property directly, including pin agreement, and asserts that all three reach the same answer for every decision.
+
+It is a **manual diagnostic, not a CI gate**: the property it asserts cannot hold while peers sit on a different branch — on a `dev` push the peer checkouts resolve to their default branch. Run it when all three checkouts share a branch (before or after a release), where a failure is a real signal.
+
 ## Development
 
 `dist/` is the single source for each fragment. Run `npm test` after a change; consumers that have already embedded a fragment must re-run the matching `sync` command.

package/README.md

@@ -38,10 +38,21 @@ npm run dock:embed -- sync path/to/client.js   # 写入标记之间
 
 `lib/shared.js` 中的两个片段顺序固定，`dsh-loopback-helpers` 在前。
 
-顺序是功能要求，不是风格约定。两者位于同一文件，`dsh-host-guard` 直接使用前一片段导出的模块级名字，因此它既不重新声明这些判据，也不 import 兄弟模块：重新声明与 import 都会与同文件内的声明冲突，且 import 会破坏插件独立发布的约束。`guard-parity` 检查在该顺序被颠倒时失败。
+顺序是功能要求，不是风格约定。两者位于同一文件，`dsh-host-guard` 直接使用前一片段导出的模块级名字，因此它既不重新声明这些判据，也不 import 兄弟模块：重新声明与 import 都会与同文件内的声明冲突，且 import 会破坏插件独立发布的约束。`guard-parity` 与消费仓的 `check` 都会在该顺序被颠倒时失败。
 
 `bindGuard` 不从片段导出。消费插件在同一文件中声明自己的 guard 导出（通常沿用 `createGuard` 等既有名字），导出同名标识符会冲突。每个插件调用 `bindGuard()`，通过 `policy` 传入自身的错误码与文案；判定逻辑共用，错误词汇由各插件持有。
 
+## 跨仓一致性
+
+三份手写副本曾漂移三次：三家都拒绝 IPv6 loopback；三家对 Host 拼写各执一词；未加方括号的 IPv6 Host 在一家静默跳过校验、另两家拒绝。现在由两条性质不同的检查覆盖：
+
+- **本地**。每个消费仓的 `npm test` 运行 `loopback:check` / `guard:check`，把本仓的两个块与**它所 pin 的该 dock 版本**的 `dist/` 逐字节比对。这覆盖「私自改块」与「忘了重新 `sync`」。
+- **跨仓**。dock 版本发布后不可变，且消费仓 pin 的是精确版本，因此「三仓 pin 同一版本」等价于「三仓的块逐字节相同」。跨仓性质由 pin 的一致性推出，不需要比对三份源码树。唯一现实风险是遗漏对某个 peer 的同步 bump。
+
+消费仓的 `scripts/guard-parity.mjs` 把上述跨仓性质直接检出来，含三仓 pin 一致性断言，也断言三仓在每一道判定上结论相同。
+
+它是**人工诊断工具，不是 CI 门禁**：它断言的性质在 peer 处于不同分支时不成立 —— `dev` 推送时 peer 检出会解析到默认分支。请在三个检出处于同一分支时运行它（发版前或发版后），此时报错才是真信号。
+
 ## 开发
 
 片段的唯一来源是 `dist/`。修改后运行 `npm test`；已嵌入片段的消费插件需重新运行对应的 `sync` 命令。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mini-utility-dock",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Canonical fragments and a build-time embedding CLI shared by DSH plugins: the Mini Utility Dock bootstrap for client halves, and the loopback predicates plus the host request guard for host halves.",
   "type": "module",
   "bin": {