docs: mandatory republish-cascade rule — never publish a package without its exact-pin dependent closure

workspace:* runtime deps publish as EXACT pins (workspace:^ peers as
carets, verified from packuments). The core@12.5.0/ui-components@13.1.1
release skipped the cascade, leaving browser@15.2.0 shipping stale
core@12.4.0 + ui-components@13.1.0 pins (duplicate installs) until the
punch-in-recording sweep cured it. Documents the closure-compute →
topological republish → packument-pin verification procedure.

Author: naomiaro

CLAUDE.md

@@ -55,6 +55,8 @@ pnpm publish --filter @waveform-playlist/NEW-PACKAGE --no-git-checks --access pu
 
 **Pre-publish workspace-dep sweep:** for every `workspace:*`/`workspace:^` dep of the packages being published, verify local version == registry latest (`curl -s https://registry.npmjs.org/...`) — a feature PR that bumps a package version without publishing it (e.g. media-element-playout 12.3.0 in #473) makes dependents' exact pins unresolvable at install time.
 
+**Republish cascade is MANDATORY — never publish a package without its dependents (the outbound direction of the sweep above):** regular `workspace:*` deps publish as **EXACT pins** in the tarball; `workspace:^` peers publish as carets (verified from packuments). Publishing pkg X without republishing every published package that lists X in `dependencies` leaves those dependents pinning the OLD X — consumers silently install duplicate/stale copies. This happened: the core@12.5.0/ui-components@13.1.1 release skipped the cascade, so browser@15.2.0 shipped `core 12.4.0` + `ui-components 13.1.0` pins until the next sweep (2026-07-05) cured it. Procedure: compute the transitive exact-pin dependent closure of every bumped package (grep `"<pkg-name>"` across `packages/*/package.json` `dependencies`), patch-bump + republish ALL of it in topological order, then curl the new packuments and check the `dependencies` pins are the fresh versions. Caret peers force a republish only when the bump escapes the range (any major; ANY bump for zerover `^0.0.x` peers like `@dawcore/*`).
+
 **Build before publishing:** No package defines prepublish hooks — always run `pnpm --filter <pkg> build` before `pnpm publish`, or the tarball ships a stale `dist/`.
 
 **Prerelease Tag:** Use `@next` for prerelease versions when preparing future major releases.