Running tcm on the fake network: identities looked up on it, sign-ins kept in a directory of the test's own, and a browser that follows the sign-in page's redirect back to tcm, as if the person had said yes. Each run is alongside this process (a spawnSync would stop the fake network answering): `run` says how it ended, `ok` insists it worked.
A package carries what it uses of a sibling package that the sibling keeps to itself (doesn't export): two packages of one codebase share code without either publishing it. What the sibling does export still comes from its release.
`tcm release --announce`: signed in once in the browser (the loopback OAuth client, against a fake network), the release's record is written to the author's repository, naming the namespace hash `tcm lib add` mounts; the sign-in is kept (and refreshed) for next time, as are the sources; a version is one record.