Publish order exists to make a partial publication self-consistent: an
interrupted run should leave a prefix whose packages never point at a version
absent from the registry. It read only dependencies and optionalDependencies, so
peer declarations — how sibling harness packages reference each other, 1088 edges
in the dsh family — constrained nothing.
Peer edges now order the publication too. devDependencies still do not: a dev
dependency is absent from the published package.
Peers cannot constrain it absolutely. Sibling packages declare each other as
peers, which is what closes the two cycles here, and npm treats an unmet peer as
a warning rather than a resolution failure. Install edges therefore win: a peer
edge is dropped where the peer installs the member declaring it, or where
following it would revisit a member already being visited. One peer edge is
dropped in the dsh family and two in the vendored family; every install edge is
honoured.
A cycle among install edges stays a defect rather than something to order
around, and release:verify now reports it before the build instead of letting it
surface once pack is already writing tarballs. Install-edge acyclicity is checked
on its own graph, because a peer edge leading into an install edge otherwise
reads as a cycle where the install edges are perfectly orderable.
The assertion compared a rebuilt object that carried only reason.kind,
so a failing turn reported "expected { kind: 'error' }" with no payload.
TurnEndReasonMap is merge-extensible and several variants carry the only
record of why the turn ended: error holds LlmFailure (message, code) and
aborted holds its TurnEndCancelCause.
Compare the reason itself. completed declares kind as its only field, so
the passing path is unchanged, and any failure prints the full variant
payload without a per-variant branch.
The jobs list and the Cordis panel carried identical outside-pointerdown
close effects, which the duplication gate rejects; both now use
useDismissOnOutsidePointer from ui-primitives.
Refs #2526
The Cordis popup now uses the standard menu surface (layer-3 fill,
inverted border, lv3 shadow) so it stays visible in dark mode, closes on
outside pointerdown, and anchors to its trigger through a measured fixed
position that escapes the sidebar overflow clip. The Cordis and Settings
footer triggers share the same 42px row, icon size, padding, and hover
fill, and the panel's header, heading, and card spacing is rebalanced.
Refs #2526
Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.
check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.
Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.
