🔖 fix: sync package-lock, and stamp the version fallbacks from the build

Junie's review on #16 caught the lock, and it was worse than reported:
package-lock.json said 0.3.0, so it had already missed the 0.4.0 release. It
does not ship (npm excludes it from tarballs, and `files` lists only dist, src,
FRAMEWORKS.md and CHANGELOG.md) and `npm ci` never complained because it only
diffs dependencies, not the project's own version — which is exactly why it
drifted two releases without anyone noticing. Regenerated with
`npm install --package-lock-only`.

The other half was the two version strings in docs/index.html: the brand badge
and the "It is still 0.x" line. Both are no-JavaScript fallbacks — page.js
overwrites them from meta.js — so they are right in a browser and stale in a
text reader or a scraper. Bumping them by hand is what failed on 0.4.0 and
again here, and it is the "release facts hand-bumped beside their generator"
finding from the code review.

So build-docs.mjs now stamps them, next to the meta.js it already writes. The
docs-sync gate turns a forgotten bump into a CI failure instead of a review
comment. Both regexes are asserted: renaming the markup fails the build with
the pattern that stopped matching, rather than silently stamping nothing —
verified by renaming the id and watching it exit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SAcqrz3FcadkYr3xG32CjK

docs/index.html

@@ -410,7 +410,7 @@ footer { border-top: 1px solid var(--border); padding-block: 2.5rem; color: var(
 
 <header class="nav">
   <div class="wrap nav-inner">
-    <a class="brand" href="#top"><svg class="mark" width="10" height="18" viewBox="0 0 10 18" aria-hidden="true" focusable="false"><rect x="4" y="0" width="2" height="18" fill="currentColor" opacity=".3"/><rect x="0" y="2" width="10" height="2" fill="currentColor"/><rect x="0" y="6" width="10" height="2" fill="currentColor"/><rect x="0" y="10" width="10" height="2" fill="currentColor"/><rect x="0" y="14" width="10" height="2" fill="currentColor"/></svg>cereale <span class="badge" id="version-badge">v0.4.0</span></a>
+    <a class="brand" href="#top"><svg class="mark" width="10" height="18" viewBox="0 0 10 18" aria-hidden="true" focusable="false"><rect x="4" y="0" width="2" height="18" fill="currentColor" opacity=".3"/><rect x="0" y="2" width="10" height="2" fill="currentColor"/><rect x="0" y="6" width="10" height="2" fill="currentColor"/><rect x="0" y="10" width="10" height="2" fill="currentColor"/><rect x="0" y="14" width="10" height="2" fill="currentColor"/></svg>cereale <span class="badge" id="version-badge">v0.4.1</span></a>
     <nav class="nav-links" aria-label="Primary">
       <a class="nav-hide" href="#guarantee">Guarantee</a>
       <a class="nav-hide" href="#playground">Playground</a>
@@ -992,7 +992,7 @@ export default defineConfig({
         </div>
         <div class="note-item">
           <h3>It is still 0.x</h3>
-          <p><span class="js-version">0.4.0</span> is published, and under semver a 0.x minor bump
+          <p><span class="js-version">0.4.1</span> is published, and under semver a 0.x minor bump
             is allowed to break you. Pin the version until 1.0; the
             <a href="https://github.com/avalon-vanguard/cereale/blob/main/CHANGELOG.md">changelog</a>
             says what moved and why.</p>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "cereale",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cereale",
-      "version": "0.3.0",
+      "version": "0.4.1",
       "license": "MIT",
       "devDependencies": {
         "@babel/standalone": "^8.0.4",

scripts/build-docs.mjs

@@ -49,6 +49,27 @@ await writeFile(
   `window.CEREALE_META = ${JSON.stringify({ version: pkg.version, node: pkg.engines.node }, null, 2)};\n`
 );
 
+// 2b. The same version, stamped into the two spots in index.html that page.js later
+//     overwrites from meta.js. Those are the no-JavaScript fallbacks: correct in a browser,
+//     stale in a text reader or a scraper, and hand-bumped until now — they went stale on
+//     0.4.0 and again on 0.4.1. Stamping them here means the docs-sync gate catches the
+//     drift instead of a reviewer. The regexes are asserted, so if the markup is renamed
+//     the build fails loudly rather than silently stamping nothing.
+const indexPath = path.join(docs, 'index.html');
+let index = await readFile(indexPath, 'utf8');
+const stamps = [
+  [/(<span class="badge" id="version-badge">)v[\d.]+(<\/span>)/, `$1v${pkg.version}$2`],
+  [/(<span class="js-version">)[\d.]+(<\/span>)/g, `$1${pkg.version}$2`],
+];
+for (const [re, replacement] of stamps) {
+  if (!re.test(index)) {
+    console.error(`build-docs: nothing in docs/index.html matched ${re} — the version fallback markup moved.`);
+    process.exit(1);
+  }
+  index = index.replace(re, replacement);
+}
+await writeFile(indexPath, index);
+
 // 3. The compiler errors the page quotes, produced by actually running the compiler. If a
 //    snippet the page calls a compile error ever compiles, this fails the build.
 const { byCase, problems } = await collectDiagnostics(root);