# Release and Publication Procedure

Use this procedure only after the user explicitly authorizes publishing.
Publishing is a separate state-changing phase. Local implementation and tests
do not imply release authority.

## Preconditions

Confirm:

- supported Node, package-manager, and npm versions are available;
- npm credentials have permission to publish the package;
- the user has authorized publication now;
- current source changes are built and verified;
- no unrelated dirty change will be included accidentally.

## Package publication contract

Publish only from the repository's dedicated publish artifact directory. Do
not publish a raw workspace root.

Before bundling:

1. clean workspace build artifacts as prescribed by the repository;
2. remove stale TypeScript build-info records when repository procedure calls
   for it;
3. rebuild every workspace package;
4. run the publish bundler that injects/copies required package files.

Before publish:

1. create/use a local npm cache if the repository procedure requires it;
2. pack the publish directory;
3. inspect tarball contents;
4. verify README is shipped and wired into package metadata;
5. verify compiled entrypoints are present;
6. verify tests, coverage, caches, stale source, source maps, and build-info
   artifacts are absent when excluded by policy;
7. set a version greater than the registry's current version.

Publish with the repository-prescribed command and cache configuration. Then
verify the registry version and README. Allow for normal registry/UI delay,
but distinguish that delay from a failed publication.

## Release truth table

| Observation | Correct statement |
| --- | --- |
| Workspace build passes | Source is buildable locally |
| Tarball inspection passes | Packaged artifact has inspected contents |
| Publish command succeeds | Registry accepted publish request |
| Registry reports new version | Release is published |
| Daemon still reports old boot identity | Release exists; runtime has not upgraded |

## Hotfix/rollback

Do not delete a published version. Use the ecosystem's deprecation/superseding
mechanism, then publish a corrected patch following the same complete process.

## Update versus release

An update command is not complete until both are true:

```text
installed package identity == intended version
booted shared daemon identity == intended version
```

If the package is new but the daemon is old, preserve the truthful failure
state and perform an attested, authorized handoff. Do not kill an arbitrary
listener just to make the status look healthy.