Release checklist

Use this checklist for every supported release. Record links or hashes in the release pull request; a checked box without evidence is not a release receipt.

Contract identity

• Cargo version matches the intended tag and changelog heading.
• Document spec, template syntax, renderer API, and local protocol versions are recorded; any version change has a migration.
• node scripts/check_stable_contracts.mjs passes.
• cargo-semver-checks passes against the latest published crate, or the release is a correctly documented major version.
• Every public library item has rustdoc and no broken intra-doc links.
• Rust 1.88.0 compiles all features.

Product evidence

• Full locked tests, clippy, format, site, playground, registry, Action, and integration contracts pass.
• DOCX/PDF semantic parity and exact Linux page baselines pass.
• Compatibility claims link to dated viewer, version, OS, fixture hash, and outcome evidence.
• node scripts/check_accessibility_contract.mjs passes, and accessibility checks pass for every supported semantic.
• Benchmark history is regenerated; no explicit runtime or memory budget is exceeded without a reviewed rationale.
• Load, concurrency, cancellation, and atomic recovery tests pass.
• node scripts/check_security_review.mjs and the RustSec audit pass; every informational maintenance warning has an explicit owner/rationale.
• The compatibility contract covers the exact supported feature set and every spec block variant.
• The release's versioned template registry verifies with its pinned key, and every older immutable default channel remains unchanged.

Supply chain and publication

• The publishable crate contains only the intended files.
• Release archives are produced on all supported targets.
• Every release binary builds twice from a clean, stable target path to identical bytes and each target has a reproducibility receipt; deterministic archives reproduce from one binary. This proves clean-build reproducibility for the pinned runner environment, not path-independent output on toolchains whose linker embeds host paths.
• Native Windows MSVC binaries use the linker's reproducible mode (/Brepro), and any mismatch preserves both binaries as a short-lived CI diagnostic artifact rather than bypassing the gate.
• SHA-256 checksums verify after download.
• SPDX SBOM and GitHub build provenance attestations cover every archive.
• Installers consume the release archive and verify its checksum.
• Installer smoke jobs verify GitHub build provenance before execution.
• The crates.io dry run passes before the OIDC publish job.
• Release notes credit every meaningful contributor from merged history.
• The GitHub release, crates.io version, documentation, Pages site, and installer smoke jobs are independently checked after publication.