fix(release): converge v0.43.1 published truth

Author: DevBot

README.md

@@ -75,13 +75,15 @@ and the
 built on the
 [ADR-0129](./docs/adr/ADR-0129-response-header-channel.md) response-header
 channel. Delivered scope is the 0.43 line together with Universal WC SSR;
-production-runtime recovery and cache semantics remain 0.44 work.
+framework-owned production-runtime recovery and cache semantics remain
+unfrozen and unscheduled under ADR-0140.
 
 ## Current release state
 
-The five-package convergence is published as stable `0.43.0` (Universal WC
-SSR under ADR-0135, on top of the ADR-0122 application loop and untouched
-ADR-0119 static freeze). npm beta.1 through beta.3 remain withdrawn partial artifacts and
+The five-package convergence is published as stable `0.43.1`: the cumulative
+maintenance baseline for Universal WC SSR under ADR-0135, on top of the
+ADR-0122 application loop and untouched ADR-0119 static freeze. npm beta.1
+through beta.3 remain withdrawn partial artifacts and
 are not compatibility baselines. The third audit sweep completed in alpha.19 (see
 [ADR-0118](./docs/adr/ADR-0118-third-audit-round-alpha19-cleanup-sweep.md)),
 and the #390 pilot was retired by maintainer decision after zero recruitment
@@ -99,8 +101,9 @@ cache/ISR, streaming SSR, performance SLOs, the third-party WC SSR corpus
 promise is static-first applications with fullstack output paths—not broad
 fullstack parity.
 
-The `1.0.0` path is a stable five-package product after the application loop, WC SSR,
-production runtime and external-adoption evidence are complete.
+The `1.0.0` path remains unscheduled. It requires a maintainer-approved ADR,
+real-product compatibility evidence and external adoption before the
+five-package surface can receive a long-term compatibility commitment.
 
 ## Start
 

README.zh.md

@@ -60,13 +60,14 @@ Cloudflare 是被组合的服务提供方，不是框架内建功能。
 （绿色运行
 [31925944647](https://github.com/open-element/openelement/actions/runs/31925944647)），
 构建于 [ADR-0129](./docs/adr/ADR-0129-response-header-channel.md)
-响应头通道之上。交付范围是 0.43 线与 Universal WC SSR；生产运行时恢复与
-缓存语义仍是 0.44 的工作。
+响应头通道之上。交付范围是 0.43 线与 Universal WC SSR；框架自有生产运行时
+恢复与缓存语义在 ADR-0140 下仍未冻结，也没有已排期的后续 minor。
 
 ## 当前发布状态
 
-五包收敛已作为 stable `0.41.0` 发布。npm beta.1 至 beta.3 仍是已撤回的
-不完整历史产物，不构成兼容基线。第三轮审计清扫于 alpha.19 完成（ADR-0118），
+五包收敛已作为 stable `0.43.1` 发布：它是 ADR-0135 Universal WC SSR 之上的
+累计维护基线，并进入 ADR-0140 规定的 0.43.x patch-only 维护模式。npm beta.1
+至 beta.3 仍是已撤回的不完整历史产物，不构成兼容基线。第三轮审计清扫于 alpha.19 完成（ADR-0118），
 #390 试点在零招募后由 maintainer 决策退役（ADR-0119）。
 
 `0.42 = WC 轻量全栈（WC light fullstack）`。`0.42.0` 稳定线交付 request-time

docs/release/release-state.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
-  "sourceVersion": "0.43.0",
-  "publishedVersion": "0.43.0",
-  "latestLandedTrain": "v0.43.0",
+  "sourceVersion": "0.43.1",
+  "publishedVersion": "0.43.1",
+  "latestLandedTrain": "v0.43.1",
   "activeTarget": "v0.43.1",
   "nextPlannedTrain": "not scheduled (maintenance mode)",
   "maturity": "stable"

docs/roadmap/ROADMAP.md

@@ -13,7 +13,7 @@ Execution and release state follow the
 > ADR-0135; the #1002 production closure is complete.\
 > Planned line: `0.43.1` cumulative maintenance baseline; no later minor is
 > scheduled. `0.43.0` (Universal WC SSR) shipped 2026-08-20 under ADR-0135.\
-> Maturity stage: stable (0.43.0 — the 0.41.x interface freeze under
+> Maturity stage: stable (0.43.1 cumulative maintenance baseline — the 0.41.x interface freeze under
 > ADR-0119, the request-time loop freeze under ADR-0122, and the Universal
 > WC admission freeze under ADR-0135); the
 > abandoned beta naming is retired.
@@ -134,11 +134,10 @@ making the standard Custom Element contract span both layers. See the official
 
 ## Current release state
 
-`0.43.0` is both the current source package line and the published npm
-line (2026-08-20, dist-tag `latest`), promoted from the `0.43.0-alpha.2`
-train (published 2026-08-15, dist-tag `alpha`) without further changes.
-No later minor is scheduled; `0.43.x` enters maintenance mode after the
-`v0.43.1` cumulative baseline. These are
+`0.43.1` is both the current source package line and the published npm
+line (2026-08-24, dist-tag `latest`). It follows the `0.43.0` Universal WC
+SSR stable line and its `0.43.0-alpha.2` train. No later minor is scheduled;
+`0.43.x` is now in maintenance mode after the `v0.43.1` cumulative baseline. These are
 separate facts by design: landed work is not described as published until the
 registry and immutable release evidence prove it.
 npm beta.1 through beta.3 are immutable partial artifacts and remain withdrawn

docs/status/STATUS.md

@@ -13,7 +13,7 @@
 ## Current position
 
 OpenElement is a Web Components-native application framework, stable at
-`0.43.0` under ADR-0135: the 0.41.x static freeze (ADR-0119 — `defineElement`,
+`0.43.1` as the cumulative maintenance baseline over ADR-0135: the 0.41.x static freeze (ADR-0119 — `defineElement`,
 `definePage`, `buildApp`, the five-package graph, the supported subpaths and
 the static/SPA semantics of `defineApp`) and the request-time Application Loop
 freeze (ADR-0122 — loader/action signatures, the
@@ -27,8 +27,8 @@ unfrozen and are not scheduled. `v0.43.1` is a cumulative maintenance baseline:
 Wave A requalified the 33 earlier closures, Wave B remediated six confirmed
 findings, and Wave C returned `GO` on the schema/runtime candidate after
 exact-SHA CI, authorized 23-migration Supabase application, post-apply
-catalog/RLS qualification, and Advisor review. v0.43.1 is now in the governed
-release workflow. Alpha.19 completed the third audit cleanup sweep (ADR-0118)
+catalog/RLS qualification, and Advisor review. v0.43.1 is published and the
+0.43.x line is now in ADR-0140 maintenance mode. Alpha.19 completed the third audit cleanup sweep (ADR-0118)
 and the #390 pilot requirement was retired by maintainer decision after zero
 recruitment. The `0.41.1` patch carries the third-party audit's fixable
 tooling and hygiene set with no frozen-surface change. On the 0.42 alpha

examples/supabase-cloudflare-starter/deno.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.43.0",
+  "version": "0.43.1",
   "tasks": {
     "build": "deno run --config ../../deno.json --allow-read --allow-write --allow-net --allow-env --allow-ffi --allow-sys --allow-run ../../packages/adapter-vite/src/cli/build.ts",
     "nitro:build": "OPEN_ELEMENT_NITRO_PRESET=cloudflare_module deno run --config ../../deno.json --node-modules-dir=auto -A npm:nitro@3.0.0 build && rm -rf .output-workers/public/server",

tools/autoflow/__tests__/release.test.ts

@@ -32,6 +32,7 @@ import {
   writeReleaseNote,
 } from '../release.ts';
 import {
+  advancePublishedReleaseStateText,
   buildVersionAnchorReplacements,
   bumpProjectConstantsText,
   nextPrereleaseTag,
@@ -248,6 +249,29 @@ Deno.test('bumpProjectConstantsText: re-running a bump is a no-op and keeps the
   assert(once.includes("PREVIOUS_PACKAGE_VERSION = '0.41.0-alpha.16'"));
 });
 
+Deno.test('advancePublishedReleaseStateText: finalize converges source and registry truth', () => {
+  const input = JSON.stringify({
+    schemaVersion: 1,
+    sourceVersion: '0.43.1',
+    publishedVersion: '0.43.0',
+    latestLandedTrain: 'v0.43.0',
+    activeTarget: 'v0.43.1',
+    nextPlannedTrain: 'not scheduled (maintenance mode)',
+    maturity: 'stable',
+  });
+  const stable = JSON.parse(advancePublishedReleaseStateText(input, '0.43.1'));
+  assertEquals(stable.sourceVersion, '0.43.1');
+  assertEquals(stable.publishedVersion, '0.43.1');
+  assertEquals(stable.latestLandedTrain, 'v0.43.1');
+  assertEquals(stable.activeTarget, 'v0.43.1');
+  assertEquals(stable.nextPlannedTrain, 'not scheduled (maintenance mode)');
+  assertEquals(stable.maturity, 'stable');
+
+  const alpha = JSON.parse(advancePublishedReleaseStateText(input, '0.44.0-alpha.1'));
+  assertEquals(alpha.publishedVersion, '0.44.0-alpha.1');
+  assertEquals(alpha.maturity, 'alpha');
+});
+
 Deno.test('two-phase release: prepare never publishes, tags, or pushes main', () => {
   const steps = createPreparePlan('0.41.0-alpha.11', 'docs/current/VERSION_PLAN.md');
   const names = steps.map((step) => step.name);
@@ -260,6 +284,7 @@ Deno.test('two-phase release: prepare never publishes, tags, or pushes main', ()
   assertFalse(commands.some((command) => command.includes('git push')));
   const stage = steps.find((step) => step.name === 'stage release bump');
   assert(stage?.command?.includes('packages/create/src/version.ts'));
+  assert(stage?.command?.includes('examples/supabase-cloudflare-starter/deno.json'));
 });
 
 Deno.test('two-phase release: publish-existing never bumps and verifies main CI first', () => {
@@ -811,7 +836,26 @@ async function initReleaseRepo(): Promise<{ root: string; work: string }> {
   await git(work, ['config', 'user.name', 'Release Test']);
   await git(work, ['checkout', '-b', 'main']);
   await Deno.writeTextFile(`${work}/seed.txt`, 'seed\n');
-  await git(work, ['add', 'seed.txt']);
+  await Deno.mkdir(`${work}/docs/release`, { recursive: true });
+  await Deno.writeTextFile(
+    `${work}/docs/release/release-state.json`,
+    `${
+      JSON.stringify(
+        {
+          schemaVersion: 1,
+          sourceVersion: '9.9.9',
+          publishedVersion: '9.9.8',
+          latestLandedTrain: 'v9.9.8',
+          activeTarget: 'v9.9.9',
+          nextPlannedTrain: 'not scheduled',
+          maturity: 'stable',
+        },
+        null,
+        2,
+      )
+    }\n`,
+  );
+  await git(work, ['add', 'seed.txt', 'docs/release/release-state.json']);
   await git(work, ['commit', '-m', 'seed']);
   await git(work, ['checkout', '-b', 'dev']);
   await git(work, ['remote', 'add', 'origin', origin]);
@@ -896,6 +940,12 @@ Deno.test('local release finalize: evidence and closure land on main, dev is syn
       await git(work, ['show', 'main:docs/release/autoflow3/v9.9.9.json']),
     ) as { status: string };
     assertEquals(mainEvidence.status, 'completed');
+    const releaseState = JSON.parse(
+      await git(work, ['show', 'main:docs/release/release-state.json']),
+    ) as { sourceVersion: string; publishedVersion: string; latestLandedTrain: string };
+    assertEquals(releaseState.sourceVersion, '9.9.9');
+    assertEquals(releaseState.publishedVersion, '9.9.9');
+    assertEquals(releaseState.latestLandedTrain, 'v9.9.9');
     // The release note on main carries the Durable closure section.
     const note = await git(work, ['show', 'main:docs/release/v9.9.9.md']);
     assert(note.includes('## Durable closure'));

tools/autoflow/release.ts

@@ -38,6 +38,7 @@ import {
   releaseTag,
   updateCurrentVersionAnchors,
   updateProjectConstants,
+  updatePublishedReleaseState,
 } from './version-anchors.ts';
 
 // Re-exported for cli.ts (releaseTag) and tools/check-docs-truth.ts
@@ -341,6 +342,7 @@ export function createReleasePlan(
         'packages/*/deno.json',
         'packages/create/src/version.ts',
         'packages/ui/src/generated-manifest.json',
+        'examples/supabase-cloudflare-starter/deno.json',
         'tools/project-constants.ts',
         'README.md',
         'README.zh.md',
@@ -1092,6 +1094,7 @@ async function commitFinalEvidenceAndClosure(
   branch: string,
 ): Promise<void> {
   await writeAndStageReleaseEvidence(evidence);
+  await updatePublishedReleaseState(evidence.targetVersion);
   const tag = releaseTag(evidence.targetVersion);
   const env = (name: string) => Deno.env.get(name);
   const record: ReleaseClosureRecord = {
@@ -1111,6 +1114,7 @@ async function commitFinalEvidenceAndClosure(
     'add',
     closureFile(evidence.targetVersion),
     releaseNoteFile(evidence.targetVersion),
+    'docs/release/release-state.json',
   ]);
   if (await hasStagedChanges()) {
     await runCaptured([

tools/autoflow/version-anchors.ts

@@ -20,6 +20,48 @@ export function releaseTag(version: string): string {
   return `v${version}`;
 }
 
+export interface PublishedReleaseState {
+  schemaVersion: number;
+  sourceVersion: string;
+  publishedVersion: string;
+  latestLandedTrain: string;
+  activeTarget: string;
+  nextPlannedTrain: string;
+  maturity: 'alpha' | 'beta' | 'stable';
+}
+
+/**
+ * Advance the durable source/registry truth only after publication completes.
+ * Prepare intentionally leaves publishedVersion on the prior line; finalize is
+ * the first point where npm, the immutable tag and the GitHub release are all
+ * proven, so it owns this transition.
+ */
+export function advancePublishedReleaseStateText(text: string, version: string): string {
+  const state = JSON.parse(text) as PublishedReleaseState;
+  const prerelease = version.match(/-(alpha|beta)(?:\.|$)/u)?.[1];
+  return `${
+    JSON.stringify(
+      {
+        ...state,
+        schemaVersion: 1,
+        sourceVersion: version,
+        publishedVersion: version,
+        latestLandedTrain: releaseTag(version),
+        activeTarget: releaseTag(version),
+        maturity: prerelease === 'alpha' || prerelease === 'beta' ? prerelease : 'stable',
+      } satisfies PublishedReleaseState,
+      null,
+      2,
+    )
+  }\n`;
+}
+
+export async function updatePublishedReleaseState(version: string): Promise<void> {
+  const path = 'docs/release/release-state.json';
+  const text = await Deno.readTextFile(path);
+  await Deno.writeTextFile(path, advancePublishedReleaseStateText(text, version));
+}
+
 export function nextPrereleaseTag(version: string): string {
   const match = version.match(/^(\d+\.\d+\.\d+)-([a-zA-Z]+)\.(\d+)$/u);
   if (!match) return releaseTag(version);

tools/bump-version.ts

@@ -20,6 +20,9 @@
  */
 
 const PACKAGES_DIR = 'packages';
+const VERSIONED_APP_DENOS = [
+  'examples/supabase-cloudflare-starter/deno.json',
+] as const;
 
 interface PackageJson {
   name?: string;
@@ -133,6 +136,10 @@ function updateVersion(
   const name = data.name ?? path;
   const oldVersion = data.version ?? 'unknown';
 
+  if (data.version === toVersion) {
+    return { updated: false, name, oldVersion };
+  }
+
   if (data.version && data.version === fromVersion) {
     if (!dryRun) {
       const text = Deno.readTextFileSync(path);
@@ -219,6 +226,9 @@ function main(): void {
 
   // Find all package deno.json files
   const packageDenos = findPackageDenos(root);
+  const versionedAppDenos = VERSIONED_APP_DENOS.map((path) => `${root}/${path}`);
+  const versionedAppSet = new Set(versionedAppDenos);
+  const versionedDenos = [...packageDenos, ...versionedAppDenos];
   console.log(`Found ${packageDenos.length} package(s) in ${PACKAGES_DIR}/`);
 
   // Determine "from" version
@@ -231,21 +241,28 @@ function main(): void {
   }
 
   if (resolvedFrom === toVersion) {
-    console.log(`Already at version ${toVersion}. Nothing to do.`);
-    return;
+    console.log(`Package line already at ${toVersion}; checking every governed manifest.`);
+  } else {
+    validateVersionStep(resolvedFrom, toVersion);
   }
 
-  validateVersionStep(resolvedFrom, toVersion);
-
   console.log(`Bumping: ${resolvedFrom} → ${toVersion}${dryRun ? ' (dry-run)' : ''}`);
   console.log('');
 
   // Update package versions
   let updatedCount = 0;
   const mismatched: string[] = [];
 
-  for (const path of packageDenos) {
-    const result = updateVersion(path, resolvedFrom, toVersion, dryRun);
+  for (const path of versionedDenos) {
+    const existing = readJson(path).version;
+    // Versioned application manifests are convergence anchors, not publishable
+    // packages. Heal them on an idempotent resume even when the package line
+    // was already bumped before this manifest joined the governed set.
+    const manifestFrom = versionedAppSet.has(path) && existing ? existing : resolvedFrom;
+    if (versionedAppSet.has(path) && existing && existing !== toVersion) {
+      validateVersionStep(existing, toVersion);
+    }
+    const result = updateVersion(path, manifestFrom, toVersion, dryRun);
     if (result.updated) {
       updatedCount++;
       console.log(`  ✅ ${result.name}: ${result.oldVersion} → ${toVersion}`);
@@ -258,7 +275,7 @@ function main(): void {
   }
 
   console.log('');
-  console.log(`Updated ${updatedCount}/${packageDenos.length} packages.`);
+  console.log(`Updated ${updatedCount}/${versionedDenos.length} versioned manifests.`);
 
   // Update cross-package imports in each package's deno.json. (Root deno.json
   // is deliberately not touched: check-package-graph bans @openelement/*
@@ -289,7 +306,7 @@ function main(): void {
   console.log('Validating alignment...');
 
   let allAligned = true;
-  for (const path of packageDenos) {
+  for (const path of versionedDenos) {
     const data = readJson(path);
     if (data.version !== toVersion) {
       allAligned = false;
@@ -298,7 +315,7 @@ function main(): void {
   }
 
   if (allAligned) {
-    console.log(`  ✅ All ${packageDenos.length} packages aligned to ${toVersion}`);
+    console.log(`  ✅ All ${versionedDenos.length} versioned manifests aligned to ${toVersion}`);
   } else {
     console.log('  ❌ Version alignment check FAILED');
     if (!dryRun) Deno.exit(1);