36b - review: no stale private flag, no undefined freeze

docs/decisions.md

@@ -210,8 +210,7 @@ switches on `code` with no `default`.
   `unsupported-node-shape` — since a code no input reaches is one no consumer can switch on
   (2026-09-20).
 - A refusal no spelling recovers from is a gap in the flavour rather than a code: give the flavour
-  the spelling and the code goes, which the freeze is the last moment for (`unspellable-link`,
-  2026-09-13). A cause the carry answers gets no code: a mark no spelling writes rides the carry
+  the spelling and the code goes (`unspellable-link`, 2026-09-13). A cause the carry answers gets no code: a mark no spelling writes rides the carry
   with its node.
 
 ## Which code a cause takes
@@ -268,8 +267,7 @@ token.
 
 `package.json` version on `main` is the source of truth. CI on `main`: tests green and version
 differs from npm → publish and tag `vX.Y.Z`. No bump, no deploy; the bump is each shipping PR's
-deliberate semver judgment. `publish.sh` is that job, and `private: true` stops it before it reads
-the token, so the pipeline is live and silent until the maintainer's first bump drops the field.
+deliberate semver judgment. `publish.sh` is that job.
 
 The publish and the tag each observe their own end state — the version on npm, the tag on the
 remote — and neither gates the other, so a run that dies between them converges on the next push

src/result.test.ts

@@ -25,7 +25,7 @@ function calledCodes(): string[] {
   return [...called].sort()
 }
 
-// The list is frozen at 0.1.0 (docs/decisions.md §The code list), so a code outliving its cause is a removal that costs a MAJOR.
+// Removing a code is breaking (docs/decisions.md §The code list), so a code must not outlive its cause.
 test('every ConvertErrorCode is the code of a production call site, and every call site names a declared one', () => {
   assert.deepEqual(calledCodes(), declaredCodes())
 })