unified-ble-manager 4.0.1 → 4.0.2

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `unified-ble-manager` are documented here.
 
 ## [Unreleased]
 
+## [4.0.2] - 2026-08-24
+
+Public coalesced scans no longer lose duplicate suppression after lost-peer or presence-cap churn: fingerprint deletions now decrement the retained-byte counter. IPC pre-registration buffering is globally bounded (ID/item/byte/age) with fail-visible tombstones. Connection release attempts `connection.disconnect` even when lifecycle unsubscribe rejects or returns `release-failed`, and preserves both cleanup failures. Does not retag `v4.0.1`.
+
+### Fixes
+
+- Coalesced public scans keep exact fingerprint byte accounting across `reportLost` and presence eviction (#53).
+- IPC pending streams for unknown IDs are aggregate-bounded; quota/TTL loss is visible when the ID later registers (#54).
+- IPC connection release no longer skips physical `connection.disconnect` after a lifecycle unsubscribe failure (#56).
+
+### Release integrity
+
+- Cut from the exact post-PR #57 `main` merge commit through the tag-driven trusted-publishing workflow.
+- Intended for publication as `latest`; this does not promote backend support labels or claim physical-radio evidence.
+
 ## [4.0.1] - 2026-08-24
 
 Tauri JS transport now accepts the adapter-state snapshot the Rust plugin emits (`heard: null` on unsampled bootstrap, non-negative integer on live `adapter.state`). Extra or missing adapter-state keys stay fail-closed and are named in the decode error. Teaching docs describe the current stable 4.x install instead of RC-as-current. Does not retag `v4.0.0`.

package/MIGRATION_4.0.md

@@ -2,7 +2,7 @@
 
 # Migrating from react-native-ble-plx
 
-The current package is `4.0.1`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
+The current package is `4.0.2`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
 
 This page is for a React Native app that already uses `react-native-ble-plx`. Web, Electron, Node, and Tauri are new hosts — use those pages after you understand the RN rewrite.
 

package/README.md

@@ -6,7 +6,7 @@
 
 It is an evolution of `react-native-ble-plx`, rewritten as a **cross-platform unified product**. One bytes-first BLE model and lifecycle semantics across hosts, with host-specific construction and ownership. The root package never picks a radio for you, and it will not quietly fall back to a simulator or a different backend.
 
-Install `unified-ble-manager` from npm (`4.0.1` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
+Install `unified-ble-manager` from npm (`4.0.2` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
 
 > Sponsored by [Imagi Explain](https://imagiexplain.com) — researched, narrated whiteboard explainers from a prompt, a PDF, or your notes.
 

package/RELEASE.md

@@ -81,7 +81,7 @@ Active `4.0.0-rc.*` release-train candidates publish to npm `latest` so a bare `
 
 On release day, set `release_candidate` to the exact candidate required by the
 release plan. RC2, RC3, RC4, `4.0.0-rc.4.1`, and RC5 are already immutable
-once tagged. Stable `4.0.0` is immutable. `4.0.1` is the current train head.
+once tagged. Stable `4.0.0` and `4.0.1` are immutable. `4.0.2` is the current train head.
 
 ```sh
 release_candidate=4.0.0-rc.N
@@ -111,7 +111,15 @@ git tag -a v4.0.0 -m "v4.0.0"
 
 ## Releasing 4.0.1
 
-The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0`.
+The `v4.0.1` tag is immutable published history. Do not recreate or move it.
+
+```sh
+git tag -a v4.0.1 -m "v4.0.1"
+```
+
+## Releasing 4.0.2
+
+The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0` or `v4.0.1`.
 
 On release day:
 
@@ -121,12 +129,12 @@ git checkout main
 git pull --ff-only origin main
 
 test "$(git branch --show-current)" = "main"
-test "$(node -p "require('./package.json').version")" = "4.0.1"
+test "$(node -p "require('./package.json').version")" = "4.0.2"
 git diff --exit-code
 git diff --cached --exit-code
 
-git tag -a v4.0.1 -m "v4.0.1"
-git push origin v4.0.1
+git tag -a v4.0.2 -m "v4.0.2"
+git push origin v4.0.2
 ```
 
 Do not push another commit to `main` between the final verification and the tag push.
@@ -181,7 +189,7 @@ Never move or recreate a published version tag to hide a failed release.
 
 - If the workflow fails **before npm publication**, fix the source on `main`, increment/version as appropriate, and create the correct new tag.
 - If npm publication succeeds but a later GitHub-release step fails, preserve the immutable npm version and rerun the workflow. The recovery path skips the current-`main` admission check and attaches the exact npm registry tarball rather than newly linked native binaries.
-- If a defect is discovered after `4.0.0` is published, fix it and release `4.0.1`; do not replace `4.0.0`.
+- If a defect is discovered after a stable tag is published, fix it and release a new patch; do not replace the published tag.
 
 ## Prereleases after 4.0.0
 

package/SBOM.cdx.json

@@ -6,15 +6,15 @@
   "metadata": {
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/unified-ble-manager@4.0.1",
+      "bom-ref": "pkg:npm/unified-ble-manager@4.0.2",
       "name": "unified-ble-manager",
-      "version": "4.0.1",
+      "version": "4.0.2",
       "licenses": [
         {
           "expression": "Apache-2.0"
         }
       ],
-      "purl": "pkg:npm/unified-ble-manager@4.0.1"
+      "purl": "pkg:npm/unified-ble-manager@4.0.2"
     },
     "properties": [
       {
@@ -537,7 +537,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/unified-ble-manager@4.0.1",
+      "ref": "pkg:npm/unified-ble-manager@4.0.2",
       "dependsOn": [
         "pkg:npm/%40tauri-apps/api@2.11.1",
         "pkg:npm/node-addon-api@8.9.0",

package/THIRD_PARTY_LICENSES.json

@@ -4,7 +4,7 @@
   "schemaVersion": "1.0.0",
   "package": {
     "name": "unified-ble-manager",
-    "version": "4.0.1"
+    "version": "4.0.2"
   },
   "source": {
     "method": "pnpm-lock production graph with installed-manifest license audit",

package/docs/ELECTRON.md

@@ -4,7 +4,7 @@
 
 Main owns the radio. The renderer uses a versioned IPC client and never loads a native addon.
 
-The current package is `4.0.1`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
+The current package is `4.0.2`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
 
 `unified-ble-manager/electron/main` and
 `unified-ble-manager/electron/renderer` are the only Electron entrypoints.

package/docs/EXPO_PLUGIN.md

@@ -7,7 +7,7 @@ start a radio, request runtime permissions during prebuild, or prove physical
 radio/restoration reliability. Expo Go is not a supported BLE execution
 environment because it cannot contain this native module.
 
-Use the v2 plugin options in the published `4.0.1` package. Those options match
+Use the v2 plugin options in the published `4.0.2` package. Those options match
 the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 
 ## Installation and development build
@@ -15,7 +15,7 @@ the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 Pin the package so a later `latest` bump does not change native plugin options
 without a rebuild:
 
-    pnpm add unified-ble-manager@4.0.1
+    pnpm add unified-ble-manager@4.0.2
     pnpm add expo@^57.0.0 expo-dev-client
     npx expo prebuild --clean
     npx expo run:ios

package/docs/GAPS.4.0.md

@@ -14,7 +14,7 @@ This file tracks platform code, CI, package, lab, and live-radio evidence. It do
 
 The clean-baseline contract, unified core, public manager, deterministic backend, TCK, native protocol, first-party backend implementations, host-isolated package exports, SDK/CLI, and legacy-absence gates exist in the 4.0 source. Passing deterministic, compile, ABI, or package tests are implementation proof; they do not become physical-radio support evidence unless a retained record proves the corresponding live scenario.
 
-`unified-ble-manager@4.0.1` is the published, immutable stable package/API. Immutable `4.0.0` remains published history. Backend support labels remain
+`unified-ble-manager@4.0.2` is the published, immutable stable package/API. Immutable `4.0.0` and `4.0.1` remain published history. Backend support labels remain
 evidence-derived. This package does not rewrite the evidence inventory: a backend remains at the support level
 justified by its records. The alpha train, including `v4.0.0-alpha.40`, remains historical implementation/release
 evidence and must not be used to claim a higher current support label than it actually proved.

package/docs/GETTING_STARTED.md

@@ -4,7 +4,7 @@
 
 This page gets you to a first scan, connect, read, notify, and teardown on React Native. Other hosts are linked at the bottom. The root import does not turn Bluetooth on.
 
-The current package is `4.0.1`.
+The current package is `4.0.2`.
 
 ## Pick a host
 
@@ -27,7 +27,7 @@ The current package is `4.0.1`.
 Pin the current package for a known native rebuild:
 
 ```sh
-pnpm add unified-ble-manager@4.0.1
+pnpm add unified-ble-manager@4.0.2
 ```
 
 Declare Android Bluetooth permissions and the BLE hardware feature yourself,
@@ -37,10 +37,10 @@ request runtime permissions on Android 12+, add
 #### Expo / CNG v2
 
 The Expo v2 schema and `unified-ble-manager/expo` factory are in the published
-`4.0.1` package. Pin that exact version:
+`4.0.2` package. Pin that exact version:
 
 ```sh
-pnpm add unified-ble-manager@4.0.1
+pnpm add unified-ble-manager@4.0.2
 ```
 
 The package does not run in Expo Go.

package/docs/NODE.md

@@ -10,7 +10,7 @@ The root import does not open an adapter. Pick one backend:
 | `unified-ble-manager/node/winrt`         | Windows                                      |
 | `unified-ble-manager/node/bluez`         | Linux (needs `dbus-next@^0.10.2` in the app) |
 
-The current package is `4.0.1`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
+The current package is `4.0.2`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
 
 ## One-call factories
 

package/docs/PLATFORMS.md

@@ -8,7 +8,7 @@ This page is an evidence index, not a static compatibility matrix. An applicatio
 
 ## Package stability and backend support are separate
 
-`unified-ble-manager@4.0.1` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0` remains published history.
+`unified-ble-manager@4.0.2` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0` and `4.0.1` remain published history.
 
 This package is the portable API/semantics freeze; it does **not** mean every first-party backend is
 automatically Preview, Supported, or Reliability-qualified.

package/docs/WEB.md

@@ -4,7 +4,7 @@
 
 Use `unified-ble-manager/web` in a secure context (HTTPS or localhost) from a user gesture. There is no background scan and no process-level restoration.
 
-The current package is `4.0.1`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
+The current package is `4.0.2`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
 
 ## Create the manager
 

package/docs/generated/PLATFORM_SUPPORT.md

@@ -6,7 +6,7 @@ This page is generated by `scripts/docs/generate-platform-support.js` from valid
 
 ## Current package
 
-`unified-ble-manager@4.0.1`
+`unified-ble-manager@4.0.2`
 
 No evidence record is bound to this exact package version and artifact. Consequently, this generated page makes no Preview, Live Preview, Supported, or Reliability-qualified platform claim for the current package.
 

package/lib/commonjs/implementation-version.js

@@ -7,5 +7,5 @@ exports.UNIFIED_BLE_IMPLEMENTATION_VERSION = void 0;
 // src/implementation-version.ts
 
 /** The one production version stamped into every first-party backend identity. */
-const UNIFIED_BLE_IMPLEMENTATION_VERSION = exports.UNIFIED_BLE_IMPLEMENTATION_VERSION = '4.0.1';
+const UNIFIED_BLE_IMPLEMENTATION_VERSION = exports.UNIFIED_BLE_IMPLEMENTATION_VERSION = '4.0.2';
 //# sourceMappingURL=implementation-version.js.map