fix(scripts): measure a version bump against the last published version, not the base branch

[drewstone]

Ports agent-runtime#1074 verbatim. scripts/check-version-bump.mjs and
tests/version-bump-check.test.ts are byte-identical with agent-runtime main
after this change, as the script's own header requires.

The defect

The gate asked that a consumer-visible change ship under a version strictly
higher than the base branch's. That reads an unreleased version as if it were
released. main routinely carries a bump that has not shipped, and under the old
rule the first consumer-visible change claimed that open slot while every later
change in the same train was told to open another.

Measured 2026-09-01 on agent-runtime, which carries the same file. main
declared 0.190.0 while the registry's newest version was 0.189.0. Two
export-adding PRs were open against it and both were refused, each for adding
exports to a version no consumer could yet resolve. Both had to be merged with
admin over a red gate, and nothing was wrong with either change.

A version that is on the registry still demands its own bump. That is the
defect this file exists for and it is untouched.

What changed

Only the version the bump is measured against. The surface comparison still runs
against the merge base — what a branch changes is a different question from
what a consumer can already resolve.

"Published" resolves in three steps: the highest v* tag reachable from the base
(ordered semantically, never lexically, with each package's version read from
its own manifest at that tag); else the npm registry's latest, best effort
with a five-second timeout and skippable via PACKAGE_VERSION_BUMP_REGISTRY=0;
else the base branch's version, exactly as before, because unknown publication
state must never weaken the check.

This repository is unaffected today

package.json declares 13.0.0, npm's latest is 13.0.0, and the newest
reachable tag v13.0.0 carries 13.0.0. The baseline is the same number the check
already used, so no verdict here moves. The fix applies the first time a release
train carries an unshipped bump — the case that cost agent-runtime two
admin-merges.

Tests

The same seven cases. Four fail without this change, verified by stashing the
script: an addition absorbed by an unshipped bump, a second addition absorbed by
the same one (the release-train case), the refusal naming its published baseline,
and semantic tag ordering (v0.100.0 outranks v0.99.0).

Three pass before and after on purpose, pinning what must not move: an
addition under a published version still fails, a change with no consumer surface
still passes, and a workspace package is still measured on its own released
version rather than the root's.

The existing 29 are unchanged and now run hermetically:
PACKAGE_VERSION_BUMP_REGISTRY=0 keeps a tagless fixture off the real registry,
where these package names are published and would otherwise have measured every
fixture version against a stranger's release. 36 pass.

Gates

• pnpm run lint — clean
• pnpm run typecheck — clean
• pnpm run check:version-bump — passes (this PR changes no consumer surface)
• npx vitest run tests/version-bump-check.test.ts — 36 passed

[tangletools]

✅ Auto-approved drewstone PR — 202d9ac0

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-01T23:50:06Z}