fix(deps): pin hooks to dist-synced tarball

docs/agent-playbooks/known-surprises.md

@@ -38,6 +38,16 @@ If uncertain, ask the developer before adding an entry.
 - **Mitigation:** Before debugging hooks behavior from 5chan, check `package.json` to see whether the app points at a tarball commit or a local path. If you need fresh hooks behavior, update the tarball commit or temporarily switch 5chan to a local path intentionally.
 - **Status:** confirmed
 
+### Hooks source commits can land before the generated tarball payload
+
+- **Date:** 2026-04-18
+- **Observed by:** Codex
+- **Context:** 5chan CI failed after `expandTimeWindow` landed in `bitsocial-react-hooks` because the app was pinned to the feature source commit.
+- **What was surprising:** `bitsocial-react-hooks` uses `dist/` as its published entrypoint, and the repo's CI writes that generated payload in a follow-up `chore(ci): update dist and coverage badge` commit after the source commit lands on `master`.
+- **Impact:** Pinning 5chan to the feature source SHA can install a tarball whose runtime and typings still omit the new API, causing downstream type errors even though the hooks repo's source and CI look green.
+- **Mitigation:** When updating 5chan to a new hooks change, verify whether hooks `master` has a newer follow-up `chore(ci): update dist and coverage badge` commit and pin 5chan to that dist-synced SHA rather than the source-only SHA.
+- **Status:** confirmed
+
 ### Portless breaks Windows installs
 
 - **Date:** 2026-03-04

package.json

@@ -8,7 +8,7 @@
   "license": "GPL-3.0-or-later",
   "private": true,
   "dependencies": {
-    "@bitsocialnet/bitsocial-react-hooks": "https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/e25b593aa05d505a0eb62cbde0505a55523d1998",
+    "@bitsocialnet/bitsocial-react-hooks": "https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/33ec7a773f60ccbd29e72467c09c8e4f5a519ea6",
     "@capacitor/app": "7.0.1",
     "@capacitor/status-bar": "7.0.1",
     "@capawesome/capacitor-android-edge-to-edge-support": "7.2.2",

yarn.lock

@@ -9,7 +9,7 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "5chan@workspace:."
   dependencies:
-    "@bitsocialnet/bitsocial-react-hooks": "https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/e25b593aa05d505a0eb62cbde0505a55523d1998"
+    "@bitsocialnet/bitsocial-react-hooks": "https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/33ec7a773f60ccbd29e72467c09c8e4f5a519ea6"
     "@capacitor/android": "npm:7.4.5"
     "@capacitor/app": "npm:7.0.1"
     "@capacitor/cli": "npm:7.4.5"
@@ -1530,9 +1530,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@bitsocialnet/bitsocial-react-hooks@https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/e25b593aa05d505a0eb62cbde0505a55523d1998":
+"@bitsocialnet/bitsocial-react-hooks@https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/33ec7a773f60ccbd29e72467c09c8e4f5a519ea6":
   version: 0.1.0
-  resolution: "@bitsocialnet/bitsocial-react-hooks@https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/e25b593aa05d505a0eb62cbde0505a55523d1998"
+  resolution: "@bitsocialnet/bitsocial-react-hooks@https://codeload.github.com/bitsocialnet/bitsocial-react-hooks/tar.gz/33ec7a773f60ccbd29e72467c09c8e4f5a519ea6"
   dependencies:
     "@bitsocial/bso-resolver": "npm:0.0.4"
     "@pkc/pkc-logger": "https://github.com/pkcprotocol/pkc-logger.git"
@@ -1551,7 +1551,7 @@ __metadata:
     zustand: "npm:4.0.0"
   peerDependencies:
     react: ">=16.8"
-  checksum: 10c0/27290778536cea4f6b3e9981f092f64ea934f3499c709a4ab7470a27b53451f35cc366ff7c0a3979010ef89fbffe50484593bcf249c0eae4f0cc8bda3e1af458
+  checksum: 10c0/e938f5f698c6a03c3f2c1ddb0ee112e9ca99d3cbdabb8ce31316dc5d7b4cec0a01167492ebe885b69cc250d66ae12f93bbed48a0e57bf7d16f3e5c3e6634e937
   languageName: node
   linkType: hard