…try (#66)

Both local copies of the name grammar accepted a dash inside a label,
which the registry is dropping (moshcoder/moshpit-name#6,
moshcoder/moshcode#193). A name accepted here and rejected there forwards
the tab to a page saying it does not exist, which is a worse failure than
refusing it up front.

Neither drift test would have caught this. moshpit.test.js compares the
extension port against the TypeScript reference over a shared hostname
list, and moshpit-drift.test.js compares both against the published
package — and neither list contained a dash inside a label. Leading and
trailing dashes were covered from the start; the case the rule actually
turns on was covered nowhere, so all three implementations could disagree
and every assertion still passed.

Both lists now carry it, and the anchor consequently fails against
@moshcoder/moshpit-resolve 0.1.1 with a real behavioural difference:
blue.lazy-loaded decides 'park' against the package and 'clearnet' here.
That is the guard working. It goes green once moshcoder/moshpit-resolve#3
publishes and the devDependency is bumped.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

The last copy of this rule, and right now the one breaking main in
moshcode: with moshcoder/moshcode#193 and #194 merged, its drift test
compares the vendored bridge against this package and fails on
blue.lazy-loaded — vendored says null, this says { blue, lazy-loaded }.

That is the guard working. It was predicted in #194 and is why the
publish has to lead the consumer, not follow it.

Matches moshcoder/moshpit-name#6 and moshcoder/moshpit-resolve#3. Of 4593
endings claimed, exactly one contains a dash.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

A dash is the cheapest way to mint a near-miss of an ending someone else
holds. `.crypto` and `.cryp-to` read as the same thing at a glance, and
this namespace is one level deep and first come first served, so there is
no second level to retreat to and nothing to appeal into.

Matches moshcoder/moshpit-name#6 and moshcoder/moshcode#193. This copy
came to light because tronbrowser.dev anchors both of its local copies to
this package: with the rule changed there and not here, the anchor test
fails with a real behavioural difference — `blue.lazy-loaded` decides
'park' against this package and 'clearnet' against the new rule, which is
a tab sent somewhere else.

Blast radius, measured against the live registry: of 4593 endings claimed,
exactly one contains a dash.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Unblocks main, which has been red since #193 merged.

The dash rule landed here (#193) and in the drift guard covering it
(#194) before the package carried it, so dns-drift correctly failed on
blue.lazy-loaded: vendored null, published { blue, lazy-loaded }. That
is the guard working.

0.2.2 carries the rule. The lockfile is the part that matters — CI runs
`pnpm install --frozen-lockfile`, so the ^0.2.1 range in package.json
never picked the new version up on its own; it installed 0.2.1 and kept
failing after the publish.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>