Problem:
An interrupted Stable or Preview event could publish some or all npm packages before another surface failed. Rerunning the documented orchestrator then failed on immutable versions that already existed, so postflight could not create the release marker.
Root cause:
npm/build.mjs always published every package directly under the public dist-tag and required that tag to equal the recovering version.
Fix:
Record the approved candidate SHA in every package, reuse only matching immutable versions, fill missing packages under a temporary tag, and advance public dist-tags monotonically after the full package set exists. Conflicting provenance fails closed and stale recovery cannot roll a newer channel backward.
Verification:
- node --test npm/publish.test.mjs
- bash scripts/release-workflows.test.sh
- actionlint release workflows
- npm six-platform dry build
- ./scripts/cache-guard.sh
SivanCola
249ffd7936