Recover same-day npm releases with an explicit stable dist-tag

Merged
UN
3mo ago
+61-3

Summary

  • publish every supported calendar release with an explicit latest npm dist-tag so same-day ordinal versions are not rejected as implicit prereleases
  • lock the hosted workflow contract against regression and document why the explicit channel is required
  • record the exact failed hosted run and TDD evidence in the canonical pm lineage

PM items

Verification

  • focused workflow contract: 10/10 passed after an intentional red test
  • static quality: passed, including 100% source/exported/member docstrings
  • full coverage: 354 files, 6,213 tests, 100% statements/branches/functions/lines
  • docs links and build: passed

Recovery context

Release run 30077790348 passed build, typecheck, coverage, compatibility, packed smoke, and dogfood, then npm rejected 2026.7.24-2 because the publish command omitted --tag. This PR fixes that production contract before a new same-day ordinal is cut; no manual npm publish is used.

Summary by cubic

Fixes same‑day calendar releases by publishing on the stable npm dist‑tag. The release workflow now passes --tag latest so hyphenated versions (e.g., 2026.7.24-2) are not rejected as prereleases.

  • Bug Fixes
    • Add --tag latest to npm publish in .github/workflows/release.yml.
    • Harden the workflow contract to fail any untagged npm publish, including trailing-flag, duplicate-command, inline if/then, brace‑group { ... }, and negated ! npm publish paths.
    • Update docs/RELEASING.md to explain why the explicit stable tag is required.