# Milestone 5 closeout

## Outcome

DocForge `1.4.0` completes the first DocForge2 successor release. Compatibility, migration,
determinism, concurrency, recovery, policy, projection isolation, accessibility, performance,
adoption, artifact reproducibility, and representative real-task evidence are maintained and
passing.

The documentation-bearing candidate passed its complete local release gate. Its final
documentation-only descendant passes the anonymous exact-commit clone gate and is identified by
the annotated `v1.4.0` tag and public Forgejo release.

## Candidate lineage

- Merged Milestone 4 baseline:
  `6d06195950d33bcd2d712f8819bbfb3d6652ad03`.
- Frozen executable implementation:
  `d2bb95fe6190e659cf66ba57c78be53b63b53240`.
- Fresh-clone legacy-tag verification:
  `97f3b6b1ae303c972387508557a3d54ea621a702`.
- Maintained aggregate recovery proof:
  `2b98059b44f4d46b4d4cce776f163e893c647c76`.
- Release version and tag: `1.4.0` and `v1.4.0`.
- Publication channel: public Forgejo release only.

The tag resolves to the final documentation-bearing descendant of this lineage, never to the
earlier executable-only commit.

## Closed release evidence

The clean executable release gate passed:

- Formatting, Python and web lint, strict types, compilation, lock, dependency, package-build,
  generated-reference, and documentation checks.
- 142 contract tests plus 272 subtests.
- 378 complete tests plus 422 subtests.
- Three interactive accessibility flows.
- 116 compatibility tests plus 263 subtests.
- 29 concurrency tests plus 2 subtests.
- Offline fresh-wheel adoption.
- Reproducible wheel and source-distribution builds with exact version and MIT license identity.
- Gitleaks scans of reachable history and the candidate directory with no findings.
- Full maintained Milestone 0, 1, 2, 3, and 4 benchmarks.

The proof-only recovery commit adds four maintained tests. The aggregate recovery gate passes 72
tests plus 62 subtests.

Detailed migration identities, artifact evidence, recovery boundaries, and task measurements are
in the [Milestone 5 baseline](MILESTONE_5_BASELINE.md).

## Compatibility and migration result

Version `1.4.0` preserves the established distribution, imports, CLI, MCP, schema-1 descriptor,
generic-project, one-method adapter, exact-hash changeset, rendering, result-envelope, and no-AST
surfaces. New adapter, retrieval, projection, and release capabilities are additive.

The real annotated `v1.0.0` archive migrates without canonical or proposal changes. Its schema-1
index rebuilds as schema 3, and its graph identity remains exact. The current CLI and MCP
registrations are supersets of the version-1 surfaces. The proof reports the inherited version-1
metadata/runtime mismatch instead of hiding it.

## Representative task result

The pinned real-package comparison uses `markdown-it-py 4.2.0`, 66 Python files, and 225,945 bytes.
Graph-assisted and source-only workflows both return exact reviewed answers for direct
dependencies, bounded reverse impact, and a dependency path.

Graph-assisted medians were 0.008, 0.009, and 0.013 ms after one-time preparation, versus 1.341,
32.108, and 32.142 ms for source-only inspection. Graph-assisted work also reduced inspected bytes
from 10,628 to 349, from 225,945 to 419, and from 225,945 to 212. Source-only final responses were
smaller, so no universal response-size advantage is claimed.

## Preserved boundaries

- Canonical project files remain authoritative. Indexes, caches, receipts, render output, graph
  output, client fragments, and viewer state remain disposable.
- Full rebuild remains the recovery and equivalence oracle.
- Derived publication is durable and atomic. Multi-file canonical application does not claim
  process-death atomicity.
- `--no-ast` remains a restrictive binding policy, not a parser detector or filesystem sandbox.
- Reference adapters publish narrow static evidence and do not claim resolved calls, types,
  inheritance, runtime behavior, compiler semantics, or semantic ownership.
- Reference MCP remains read-only.
- No WorldForge, ScrapeStation, legacy repository, production binding, storage, or self-hosting
  change belongs to this release.
- No PyPI publication belongs to this release.

## Publication

`main`, `dev`, `origin/main`, and `origin/dev` resolve to the exact documentation-bearing release
commit. An anonymous HTTPS clone of that commit verifies the frozen annotated `v1.0.0` migration
tag and repeats the complete release gate before `v1.4.0` is created.

The public Forgejo release attaches the reproducible wheel, source distribution, and
machine-readable release-identity evidence containing their exact SHA-256 checksums. No PyPI
publication, production binding change, or legacy-repository mutation is part of this release.