fix(release): survive the version-bump race that wedged publishing

.github/workflows/release.yml

@@ -62,12 +62,33 @@ jobs:
         run: |
           set -euo pipefail
           bump="${{ github.event.inputs.bump || 'minor' }}"
-          current="$(node -p "require('./package.json').version")"
+          # If a prior run published but lost the race to commit the bump back
+          # (see #99/#114), package.json trails the registry — bump from
+          # whichever is ahead so a stale manifest can't wedge publishing.
+          manifest="$(node -p "require('./package.json').version")"
+          set +e
+          view_out="$(npm view "$(node -p "require('./package.json').name")" version 2>&1)"
+          view_rc=$?
+          set -e
+          if [ "$view_rc" -eq 0 ]; then
+            published="$view_out"
+          elif grep -q E404 <<< "$view_out"; then
+            # Never published: the manifest is the only source of truth.
+            published="0.0.0"
+          else
+            # A transient registry error must not silently fall back to a
+            # possibly-stale manifest base; fail here and let a re-run heal.
+            echo "$view_out"
+            echo "::error::npm registry lookup failed; refusing to derive a version base"
+            exit 1
+          fi
+          current="$(printf '%s\n%s\n' "$manifest" "$published" | sort -V | tail -n1)"
+          npm version "$current" --no-git-tag-version --allow-same-version
           npm version "$bump" --no-git-tag-version
           next="$(node -p "require('./package.json').version")"
           echo "current=$current" >> "$GITHUB_OUTPUT"
           echo "next=$next" >> "$GITHUB_OUTPUT"
-          echo "Bump: $bump | $current → $next"
+          echo "Bump: $bump | manifest=$manifest published=$published | $current → $next"
 
       - name: Build policy module
         run: npm run build:policy
@@ -95,13 +116,25 @@ jobs:
           git add package.json package-lock.json
           git diff --cached --quiet && exit 0
           git commit -m "chore: release v${{ steps.version.outputs.next }}"
+          # A merge landing on main mid-run rejects this push as
+          # non-fast-forward (see #99/#114); the bump commit only touches
+          # package files, so rebasing onto the new tip is safe.
+          for attempt in 1 2 3; do
+            if git push origin main; then
+              exit 0
+            fi
+            git pull --rebase origin main
+          done
           git push origin main
 
       - name: Tag release
         run: |
           set -euo pipefail
           tag="v${{ steps.version.outputs.next }}"
-          git tag -a "$tag" -m "Release $tag"
+          # Tag the commit the artifact was built from, not post-rebase HEAD —
+          # a merge landing mid-run would otherwise put newer spec content
+          # under the tag than what npm serves for this version.
+          git tag -a "$tag" -m "Release $tag" "$GITHUB_SHA"
           git push origin "$tag"
 
       - name: Create GitHub Release