Finding
Independent verification after the authorized 0.10.38 release found the same dist-tag state on all 11 published packages:
latest = 0.10.38
next = 0.10.28
That means commands such as npm install relayfile@next resolve to a version ten releases older than stable. The next pointer presents itself as a live channel while directing consumers backward. This state predates 0.10.38; the release did not create it.
Affected packages:
@relayfile/core@relayfile/sdk@relayfile/client@relayfile/agentsrelayfile@relayfile/file-observer@relayfile/local-mount@relayfile/mount-darwin-arm64@relayfile/mount-darwin-x64@relayfile/mount-linux-arm64@relayfile/mount-linux-x64
Decision required
Establish whether next is still an intentional prerelease channel:
- If the channel is active, restore it through the next authorized release so it points to a deliberately published prerelease.
- If the channel was abandoned, remove the tag from all packages. A channel nobody publishes to is worse than no channel because it looks live.
Do not repair this with an ad hoc npm dist-tag add/rm. Moving or removing a dist-tag is a registry mutation on published packages and remains inside the cpo publish gate. Fold the chosen action into an authorized, observed release or a separately approved registry-maintenance procedure.
Acceptance criteria
- The intended lifecycle and owner of
latest, next, and prerelease tags are documented.
next is either absent on all 11 packages or points on all 11 to an intentional prerelease version; it must not point behind stable by accident.- The change is performed under explicit publish/registry authorization, with a preflight snapshot of all 11 current dist-tags.
- Execution is observed to terminal state and followed by independent enumeration of all 11 packages.
- Recovery for a partial dist-tag update is written before execution; no operator improvises a registry mutation after a partial failure.
Evidence
Observed 2026-07-30 immediately after release 0.10.38. Every package above reported { "next": "0.10.28", "latest": "0.10.38" }.
Finding
Independent verification after the authorized 0.10.38 release found the same dist-tag state on all 11 published packages:
That means commands such as
npm install relayfile@nextresolve to a version ten releases older than stable. Thenextpointer presents itself as a live channel while directing consumers backward. This state predates 0.10.38; the release did not create it.Affected packages:
@relayfile/core@relayfile/sdk@relayfile/client@relayfile/agentsrelayfile@relayfile/file-observer@relayfile/local-mount@relayfile/mount-darwin-arm64@relayfile/mount-darwin-x64@relayfile/mount-linux-arm64@relayfile/mount-linux-x64Decision required
Establish whether
nextis still an intentional prerelease channel:Do not repair this with an ad hoc
npm dist-tag add/rm. Moving or removing a dist-tag is a registry mutation on published packages and remains inside the cpo publish gate. Fold the chosen action into an authorized, observed release or a separately approved registry-maintenance procedure.Acceptance criteria
latest,next, and prerelease tags are documented.nextis either absent on all 11 packages or points on all 11 to an intentional prerelease version; it must not point behind stable by accident.Evidence
Observed 2026-07-30 immediately after release 0.10.38. Every package above reported
{ "next": "0.10.28", "latest": "0.10.38" }.