diff --git a/TODO.md b/TODO.md
index 1431c2c..0ed2cbc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,11 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `package.json` has no `version` field and is marked
+  `"private": true` ([#158](https://git.eeqj.de/sneak/netwatch/issues/158)). It
+  said `1.0.0`, a release that has not been made, and nothing read it; the git
+  tag is the one version, which the image and `make build` take from
+  `git describe --tags`. The package is never published
 - 2026-10-19: `main()` in `cmd/netwatch-server/main.go` is one call into a new
   package, `internal/cli`, as the Go style guide asks
   ([#160](https://git.eeqj.de/sneak/netwatch/issues/160)). `internal/cli` runs
diff --git a/package.json b/package.json
index 6acde58..be9e3fa 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "version": "1.0.0",
+    "private": true,
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {