fix(publish): poll npm registry for verification instead of republishing

[konard]

Fixes #105

Problem

scripts/publish-to-npm.mjs treated "publish succeeded" and "verification succeeded" as one retryable unit. When the publish worked but the single check 2s later missed because npm's registry had not propagated, the retry loop re-ran the whole changeset publish, which then failed with "cannot publish over the previously published versions" — turning a successful release into a reported failure.

Solution

New module scripts/publish-retry.mjs splits the two failure domains:

• waitForVersionOnRegistry() — bounded polling with exponential backoff (7 attempts, 2s → 30s cap). A thrown E404/network error is treated as a miss and polling continues.
• publishWithRetry() — retries changeset publish only when the publish command itself failed. Once a publish reports success, the flow moves to verification and never re-enters the publish path; an exhausted poll fails the release without republishing.
• isAlreadyPublishedError() — EPUBLISHCONFLICT / "cannot publish over the previously published versions" is treated as a cue to verify, not to fail.

Verification is still mandatory: a publish that falsely claims success still fails the release.

publish-to-npm.mjs now delegates to publishWithRetry; attemptPublish became runPublishCommand (publish only, no verification). Non-retryable auth guidance from #77 is preserved.

Reproduction / tests

tests/publish-retry.test.js encodes the scenario from the issue — a runner whose publish succeeds once and whose verification misses twice:

• one publish, verification eventually succeeds, success ✅ (previously: a second publish attempt and a conflict)
• exhausted verification polling fails without republishing
• publish-command failures still retry
• non-retryable auth errors still fail fast
• backoff sequence is capped at maxDelay

All 169 tests pass; npm run lint, format:check and check:duplication are clean.

[konard]

Working session summary

Done — all CI checks pass, working tree clean.

PR: #109 (ready for review)

Root cause: attemptPublish() bundled publish + a single 2s-later verification into one retryable unit, so a registry propagation miss re-ran changeset publish, which then failed with a publish conflict.

Fix: new scripts/publish-retry.mjs splitting the domains — waitForVersionOnRegistry() (7 attempts, 2s→30s exponential backoff, treats E404/network throws as misses), publishWithRetry() (retries the publish command only when the publish itself failed; after a success it verifies and never re-enters the publish path), and isAlreadyPublishedError() (conflict → verify, not fail). publish-to-npm.mjs delegates to it; attemptPublish became publish-only runPublishCommand. Verification is still mandatory, and the #77 non-retryable auth fast-fail is preserved.

Tests: tests/publish-retry.test.js reproduces the issue's scenario (publish succeeds once, verify misses twice → 1 publish, exit success) plus exhausted-polling, publish-retry, fast-fail and backoff cases. 169/169 tests pass.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $1.679828

📊 Context and tokens usage:

• 63.7K / 1M (6%) input tokens, 15.4K / 128K (12%) output tokens

Total: (68 new + 50.1K cache writes + 1.6M cache reads) input tokens, 15.4K output tokens, $1.679828 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-4-8)
• Thinking level: off (disabled)
• Model: Claude Opus 4.8 (claude-opus-4-8)

📎 Log file uploaded as Gist (1079KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🔄 Auto-restart triggered (iteration 1)

Reason: Merge conflicts detected

Starting new session to address the issues.

---

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

[konard]

Working session summary

Conflict resolved (only .gitkeep, kept both marker lines), merged main, all 175 tests pass, pushed to PR #109.

---

This summary was automatically extracted from the AI working session output.

[konard]

🔄 Auto-restart-until-mergeable Log (iteration 1)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $0.188740

📊 Context and tokens usage:

• 25.3K / 1M (3%) input tokens, 647 / 128K (1%) output tokens

Total: (10 new + 11.8K cache writes + 109.6K cache reads) input tokens, 647 output tokens, $0.188740 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-4-8)
• Model: Claude Opus 4.8 (claude-opus-4-8)

📎 Log file uploaded as Gist (1304KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag