[viztor]

What broke

On 2026-11-04 the harness started its 0.2.2 release candidate. It published @deepseek-ai/cordis 4.1.0 and loader 1.1.0 as latest, the @deepseek-ai/* cluster at 0.2.2-rc.1, and @deepseek-ai/dsh 0.2.2-rc.1 under next. The cluster's @deepseek-ai/dsh-typert-protocol@0.2.2-rc.1 peers @deepseek-ai/cordis ~4.1.0.

npm resolves the plugin's typert peer to the newest build the range admits, because typert's latest tag (0.1.0-rc.6) is outside it. It then needs that build's cordis, and the plugin's optional cordis peer (~4.0.4 || >=4.0.5-0 <4.1.0 || >=4.0.6-0 <4.1.0) stopped short of 4.1. So:

• a fresh npm install dsh-opencode-patch@1.8.0 fails with ERESOLVE. This was measured with npm 11.20. Installing it alongside explicitly installed rc 0.2.1-rc.5 or alpha 0.2.2-alpha.3 host packages still resolves;
• scripts/check.ts's consumer install fails the same way. So the check · test · build · gate job is red on main and on every open pull request from its next run on.

The fix

• package.json: the cordis peer also admits ~4.1.0. Nothing else in the manifest changes: the typert peer already admits 0.2.2-rc.1, and the peer stays optional.

• test/harness-channel.test.ts: a new case records two things from the registry:

  • every published typert build on the 0.2.1 and 0.2.2 lines with its cordis range;
  • the published cordis releases.

  It requires every cordis an admitted build can install to satisfy the plugin's cordis peer. It checks concrete published versions, not range overlap, because semver.intersects ignores the prerelease-tuple rule npm resolves under. Two known answers show it bites: the peer shipped before 0.2.2-rc.1 refuses typert@0.2.2-rc.1 -> cordis@4.1.0, and a peer missing the 4.0.6 clause refuses the alpha line's prereleases. The range still stops at the next tuple: 4.1.1-alpha.1, 4.2.0 and 5.0.0 stay out. The typert case's list gains 0.2.2-alpha.3.

• README pair, in step: the compatibility section names the 0.2.2 builds on both channels. It explains why the cordis peer follows the typert range: a fresh install takes the newest build's cordis, and a host-first install takes its own line's. It also adds a Host core row matching the range.

The plugin imports nothing from @deepseek-ai/cordis at runtime, so this changes a declaration only. It does not claim the plugin is verified on 0.2.2-rc.1: the stacked real-host work (#109 and up) adds the host tiers that measure each channel.

Verification

Step	Result
New case on main's range	red: expected [ 'typert@0.2.2-rc.1 -> cordis@4.1.0' ] to deeply equal []
New case with a peer missing the 4.0.6 clause	red
New case with the fix	green
pnpm run check	0 errors, 23 warnings (main: 23)
vp test run, shuffle seeds 1 and 42	85 files, 1324 tests passed
mock suite	passed
pnpm run build + scripts/check.ts	check passed (on main without the fix: FAIL a consumer install or load failed: npm error code ERESOLVE)
npm 11.20 dry-run, packed tarball	fresh install resolves typert 0.2.2-rc.1 + cordis 4.1.0; beside each channel's host set in both orders it resolves
coverage	ratchet met
Node 24: shuffle seed 7 + mock	passed
local-path grep over the diff	clean

An independent review found that the first version of the case compared ranges by overlap and fixed it in the second commit. It also found two README wording errors, now corrected: 0.2.1 called the rc channel's latest, and an over-broad ERESOLVE sentence.

🤖 Generated with Claude Code

https://claude.ai/code/session_0141fKp5k6hiaJcP5ovhGtSD