Most of the shelf no longer installs — measured, charted, and tripwired (#5)

* site: most of the shelf no longer installs, measured

This site's promise is the install decision, and until today it only ever
asked whether a plugin declares an install path. It never asked whether that
path still resolves. It usually does not.

## The measurement

`scripts/measure-installability.mjs` reads every npm name in the registry off
registry.npmjs.org and tests each `@deepseek-ai/dsh*` range against every
published dsh version. No GitHub budget, no clone.

Of 1,280 published packages that name a dsh version:

-    79 (6%) accept dsh 0.1.2-rc.1, what `npx @deepseek-ai/dsh` gives you
-   818 accept nothing newer than the 0.1.0 line
-   182 accept no published dsh at all
-   138 use a wildcard: never breaks, never protects

## Why

npm semver never lets a prerelease satisfy a caret with a different version
tuple, and dsh has only ever shipped prereleases. `^0.1.1-rc.1` matches
0.1.1-rc.2 and stops dead; `^0.1.2-alpha.1` matches 0.1.2-rc.1, because the
tuple is the same. The rule is the tuple, not the caret, and it is invisible
in a diff.

The loud failure is ERESOLVE and you would fix that. The quiet one is what
reaches people: install a stale plugin alone and npm hoists the old
`@deepseek-ai/dsh-*` copies to the root, pushing the harness's own into nested
node_modules. The install succeeds and the plugin imports a different harness
than the host runs. Measured on one package: 13 harness packages at two
versions at once, no warning.

Three of our own four plugins were in that column this morning. The section
says so.

## Two tripwires, one of which I got wrong first

- `check-claims` now fails when the installability census names a different
  dsh than the ecosystem census does. A census stale by version is not stale
  by date, and the 14-day rule cannot see it. **It caught one immediately:**
  data/ecosystem.json still said `npx` gives you 0.1.1-rc.2, three days after
  0.1.2-rc.1 took the `latest` tag. Both censuses re-measured.
- The first version of that check sat BELOW the `if (fail.length)` gate, so it
  collected failures nothing ever read — green in both directions. Moved above
  the gate and mutation-checked: it fails on a wrong version now.
- data/installability.json is allowlisted in .gitignore and re-measured in the
  deploy job. A census the deploy does not re-run is the failure this repo
  already had once, for twelve days.

* data: rebuild against the merged registries (13,381 plugins, 486 themes)

941 entries now say they carry no proof, up from 927: the plugins sweep
demoted 84 rows whose only receipt named cordis rather than the harness.

Author: lroolle

.github/workflows/deploy.yml

@@ -89,6 +89,11 @@ jobs:
         run: |
           node scripts/measure-ecosystem.mjs
           node scripts/measure-seams.mjs
+          # Reads registry.npmjs.org only, and its subject moves whenever dsh
+          # publishes: a census against yesterday's `latest` is not stale by
+          # date and is still wrong. check-claims fails the build when this
+          # file and the ecosystem census disagree about what npx installs.
+          node scripts/measure-installability.mjs
 
       # Fetches both registries over the network. DATA_SOURCE is deliberately
       # unset: a `local` build publishes `source: "local checkout"` on

.gitignore

@@ -19,5 +19,8 @@ data/*.json
 !data/ecosystem.json
 !data/directories.json
 !data/seams.json
+# and the installability census, which is the receipt for the one claim on the
+# front page that is about other people's packages rather than our own rows.
+!data/installability.json
 !data/sponsors.json
 .vinext/

data/ecosystem.json

@@ -1,24 +1,17 @@
 {
   "$comment": "Measured from the GitHub search API. total_count is exact even though the result list caps at 1000. Re-derive with scripts/measure-ecosystem.mjs.",
-  "measured": "2026-09-01",
+  "measured": "2026-09-04",
   "topic": "dsh-plugin",
   "launch": "2026-08-13",
   "query": "topic:dsh-plugin created:<DATE",
-  "total": 13007,
-  "withStars": 8388,
+  "total": 13474,
+  "withStars": 8626,
   "release": {
-    "version": "0.1.1-rc.2",
-    "published": "2026-08-21",
-    "ahead": [
-      {
-        "tag": "alpha",
-        "version": "0.1.2-alpha.3",
-        "published": "2026-08-31"
-      }
-    ]
+    "version": "0.1.2-rc.1",
+    "published": "2026-09-03"
   },
-  "beforeFirstDay": 425,
-  "sinceLaunch": 12423,
+  "beforeFirstDay": 439,
+  "sinceLaunch": 12875,
   "series": [
     {
       "date": "2026-08-06",
@@ -42,7 +35,7 @@
     },
     {
       "date": "2026-08-11",
-      "created": 22
+      "created": 23
     },
     {
       "date": "2026-08-12",
@@ -54,79 +47,91 @@
     },
     {
       "date": "2026-08-14",
-      "created": 1891
+      "created": 1882
     },
     {
       "date": "2026-08-15",
-      "created": 1580
+      "created": 1581
     },
     {
       "date": "2026-08-16",
-      "created": 1515
+      "created": 1514
     },
     {
       "date": "2026-08-17",
-      "created": 959
+      "created": 962
     },
     {
       "date": "2026-08-18",
       "created": 683
     },
     {
       "date": "2026-08-19",
-      "created": 739
+      "created": 740
     },
     {
       "date": "2026-08-20",
       "created": 1302
     },
     {
       "date": "2026-08-21",
-      "created": 581
+      "created": 580
     },
     {
       "date": "2026-08-22",
       "created": 304
     },
     {
       "date": "2026-08-23",
-      "created": 304
+      "created": 305
     },
     {
       "date": "2026-08-24",
-      "created": 285
+      "created": 286
     },
     {
       "date": "2026-08-25",
-      "created": 294
+      "created": 298
     },
     {
       "date": "2026-08-26",
-      "created": 267
+      "created": 276
     },
     {
       "date": "2026-08-27",
-      "created": 224
+      "created": 233
     },
     {
       "date": "2026-08-28",
-      "created": 375
+      "created": 383
     },
     {
       "date": "2026-08-29",
-      "created": 187
+      "created": 191
     },
     {
       "date": "2026-08-30",
-      "created": 138
+      "created": 149
     },
     {
       "date": "2026-08-31",
-      "created": 148
+      "created": 166
     },
     {
       "date": "2026-09-01",
-      "created": 11
+      "created": 145
+    },
+    {
+      "date": "2026-09-02",
+      "created": 132
+    },
+    {
+      "date": "2026-09-03",
+      "created": 113
+    },
+    {
+      "date": "2026-09-04",
+      "created": 14
     }
   ]
 }

data/installability.json

@@ -0,0 +1,29 @@
+{
+  "measured": "2026-09-04",
+  "method": "registry.npmjs.org latest manifest per npm name; semver.satisfies over every published @deepseek-ai/dsh version",
+  "dshLatest": "0.1.2-rc.1",
+  "dshVersions": [
+    "0.0.1-rc.1",
+    "0.0.1-rc.2",
+    "0.0.1-rc.5",
+    "0.1.0-rc.2",
+    "0.1.0-rc.3",
+    "0.1.0-rc.6",
+    "0.1.0-rc.7",
+    "0.1.0-rc.8",
+    "0.1.1-rc.1",
+    "0.1.1-rc.2",
+    "0.1.2-alpha.2",
+    "0.1.2-alpha.3",
+    "0.1.2-alpha.4",
+    "0.1.2-alpha.5",
+    "0.1.2-rc.1"
+  ],
+  "npmNames": 2002,
+  "unreadable": 0,
+  "declaring": 1280,
+  "current": 79,
+  "stuckOn010": 818,
+  "neverAny": 182,
+  "wildcard": 138
+}