Final locks before 1.0

This page is the control point before promoting 1.0.0-rc.1, then 1.0.0. It does not replace the scripts: it states what to run, where evidence is kept, and which decisions remain manual. 0.1.33 remains the stable baseline published on latest; candidate 1.0.0-rc.1 remains intended for the next tag.

Development source 0.1.35 adds the visual custom-component designer, safe Quasar/UnoCSS styles and resizable QSplitter panels. It changes the public contract. The green 0.1.33 runs remain historical evidence and do not count toward promotion of the changed source.

GitHub Actions matrix to stabilize

The dedicated workflow is .github/workflows/rc-stability.yml. Run it from GitHub Actions on the real repository, against the same commit that will be used to publish the release candidate.

The matrix runs three passes with bun install --frozen-lockfile:

bun install --frozen-lockfile
bun run release:doctor
bun run e2e:ci:functional
bun run release:browser:check
bun run package:ci:artifact
bun run npm:publish:dry-run -- --skip-gates

The three green passes are recorded in release/rc-ci-stability.json: 29015937386, 29034915381 and 29036138919. The failed run 29014924407 remains excluded from the counter. Do not mix runs from different commits.

Accessibility review to complete

Automated coverage remains required, but it is not enough for the 1.0 promotion. Complete release/manual-accessibility-review.json with these checks:

Check	Expected result
keyboard-only	Complete navigation without a mouse, visible focus, reversible dialog actions.
zoom-200	Interface remains usable at 200 percent without losing critical information.
reflow-320-css-px	Main reading and actions remain possible at 320 CSS px.
nvda-chromium	NVDA pass under Chromium, with coherent announcements for panels, dialogs and fields.
custom-theme-contrast	Contrast checked after theme customization.
artifact-review	Tarball, manifests and public exports reviewed before publication.

Any exception goes into release/accessibility-derogations.json. An exception must be bounded, justified, mitigated and tied to a correction target.

Bundle and components to watch

The CI bundle report is .artifacts/bundle-budget.json. After bun run bundle:budget:inspect, run:

bun run bundle:watchlist:check

The areas to watch before 1.0 are Theme Builder, IconPicker, the custom component CRUD editor and the QSplitter controllers. The 0.1.35 Windows report first measured one chunk at 803,500 bytes, then the embedded-image replay reported kNS-GnIV.js at 802,220 bytes against the unchanged 800,000-byte limit. The graphical designer remains behind an explicit dynamic import, and the Canvas encoder is now separated from the data-URL validation used at runtime. Regenerate the report and mark the bundle review as passed only after both bundle:budget:inspect and bundle:watchlist:check are green.

Distinct business application

Before 1.0.0, integrate 1.0.0-rc.1 into a Nuxt 4 application outside the QForm Builder repository. Fill release/rc-real-app-integration.json with:

• installed package source, npm or verified tarball;
• page rendering FormBuilder and FormViewer;
• import/export of one versioned document;
• reload of a persisted document through the public migration registry;
• no direct import from app/.

After publishing the release candidate, only compatible regression fixes should land before 1.0.0.

Schema and theme migrations

The migration contract is no longer a functional blocker: it already exists. Any future persisted document, schema or theme evolution must go through the public migration registry. The detailed rule is in the Schema migration policy reference.

Active step

After the RC Stability Matrix is validated, the active phase is the manual accessibility review, then bundle inspection and integration in a distinct business Nuxt 4 application. Candidate 1.0.0-rc.1 remains intended for the next tag.