Withdrawn: downstream consumer pilot gate

[woksin]

This gate is withdrawn. Public Components development and verification must use independently authored synthetic fixtures and public repository evidence only. Consumer repositories, product behavior, screenshots, names, data, designs, and implementation details must not be used as Components source material or public release evidence.

[woksin]

RC gate completed against @cratis/components@4.0.0-rc.4, SHA-256 19b46436c36efc6022a966f3a738c4a69779010681dea6ebe14e2f0a063ef901. A third-party design-system consumer and a first-party product consumer were migrated in disposable copies. Compile/test/build matrices and the single-Pixi behavioral delta support the runtime/package conclusions. Visual and accessibility captures remain private exploratory diagnostics and are not published as anonymized certification artifacts. Pilot-discovered Components defects (findOwnReaction, DataPage list-query generics, matcher resolver) and documentation gaps were fixed and reverified. Retained direct-renderer islands are tracked privately by the consumer team. Keep open until #177 merges.

[woksin]

Evidence wording correction after independent re-review: detailed pilot bundles remain private/ephemeral local material and are not publishable anonymized artifacts. Consumer A is third-party; Consumer B is first-party. Compile/test/build matrices and the RC.4 single-Pixi behavioral delta are the strongest retained evidence. Downstream Storybook/axe captures are exploratory diagnostics, not a clean accessibility certification or a claim that all visual pairs passed; several Consumer B pairs contained Storybook error pages, and Consumer A dialog deltas remain for human visual adjudication. PR #177 has been updated to reflect these limits.

[woksin]

Final post-review artifact: @cratis/components@4.0.0-rc.6, source 7cb6547, SHA-256 dd85ccf56f842ad1b9ddfbaa4670163e40432e5a7d95152bf3a4aab079686bc9. Downstream pilots remain RC.4 runtime evidence. RC.6 adds no public/runtime behavior change: explicit deprecation/TSDoc guidance, stronger specs, workflow timeouts/markdown scope, typed Storybook validators, and an internal context/defaults split that removes the Provider↔Toaster Rollup cycle. Full 846-test CI, publish build, strict 21-subpath type matrix, 25 exports, Storybook, package archive, and markdown/link gates were rerun after these changes.

[woksin]

Post-pilot package-boundary hardening is complete in RC.9 (073e1d7, SHA-256 dfe0f3d672f403e15868aef19821cb5dbce894c87db6b5698d44793607ac535b). The package root is setup-only; a packed no-Pixi consumer loads root and all 19 non-spatial subpaths, while the spatial consumer loads Canvas/PivotViewer with one explicit Pixi peer. Known downstream root imports were audited and migrated mechanically on private isolated branches (65 files total, zero unsupported cases); detailed identities remain private. Runtime/visual pilot conclusions remain RC.4 evidence; RC.9 adds import/package-graph tooling and has the full repository/package/type/consumer gate set green.

[woksin]

Final Components 4 root-boundary tranche is now on PR #177 at 654bd47:

• package root is setup-only (provider/config/message APIs and types);
• every component imports through an explicit subpath;
• root/subpath allowlists are checked against source, codemod, ESLint, package exports, and migration documentation;
• @cratis/components-codemods is a publishable, packed-install-tested migration CLI;
• package graph, no-Pixi, Spatial-with-Pixi, provider-context identity, public type, export, package-manager, Arc-version, Storybook, and Markdown gates are blocking CI jobs;
• aggregate CSS has fail-closed raw/gzip/declaration-block budgets.

Exact RC.9 package artifacts are recorded in the PR. Stable release remains blocked on #181 (trusted publishing for the new codemod package), fresh CI, and explicit maintainer API/visual approval.