Use this checklist for each internal beta candidate. The goal is evidence of reliability and recoverability; after Phase 9F/9G passes, the scoped Phase 10 field-workflow additions below become part of the pre-release candidate surface.
Status key:
[ ] Not checked[~] Partial or needs follow-up[x] Passed[!] Blocked or beta-risk acceptedThe v1.2 branch was merged into the v1.1 release line: Workflow Builder (visual DAG chaining of analysis tools, saved per project) and Map Briefs (saved multi-page PDF report documents) now ship in v1.1 on iPad, Mac, and Windows, both Pro-gated (Workflow Builder under the analysis-tools gate; Briefs under the PDF-output gate, with paywall routing and ProBadge on the Briefs tab).
[!] Package schema is now v14 (workflow tables + ephemeral layer columns). Any
project opened by a v1.1 build is migrated to v14 on open, and validate_database_schema
hard-fails on any database newer than the reader — so previously shipped Windows/older
builds cannot open packages touched by v1.1. The merged Windows code handles v14; the
Windows build must ship in lockstep with (or before) the Apple v1.1 release.[x] Verification after the merge: Rust cargo test --lib 554/554; full MeridianTests
1019 tests, 0 failures (5 pre-existing skips); FFI symbol check 103/103; platform parity
check passed; iOS Debug build green. Gating regression tests added for Workflow Builder
entry, Briefs entry, and Brief PDF export.[ ] Physical-device smoke for Workflow Builder + Briefs (see publishing guide §3).[ ] Windows build + smoke of the merged workflow/briefs UI on Windows 11/WebView2.Three parallel audits (IAP readiness, reliability/hardening, performance + v1.2 scope) found
no release blockers for v1.1 (free download + Meridian Pro IAP). One App-Store-rejection
risk (missing paywall Privacy Policy/Terms links) and two free-tier gating bugs (connected
CSV import cap bypass, multi-layer export gate over-blocking) were found and fixed, along
with several should-fix hardening items (Release-build #if DEBUG gating of test seams,
Mac .gispad Finder association, new gating test coverage). See agent_tasks.md and
docs/meridian-pro-iap-plan.md for the full list. Verification: cargo build; full
MeridianTests suite (948 tests, 0 failures); clean Release-config iOS build; clean Mac
Debug build + MeridianMacTests gating subset (16/16). This is additive to, not a rerun of,
the 2026-06-09 v1.0 evidence below.
[x] GeoJSON and .gispad remain the only V1 data/product formats. 2026-06-09: confirmed by code review.[x] No general-purpose cloud sync, collaboration, accounts, desktop/web/Android, Shapefile, GeoPackage, KML, print layout, broad CRS transform, photo/file attachments, or advanced topology work entered the beta. Explicit iCloud Drive document storage is scoped separately and is disclosed in the app and privacy policy. 2026-07-16: confirmed by code review.[x] WKP is documented as non-authoritative and not used as storage, edit source, renderer default, or standalone layer interchange; scoped CSV import/export may expose it as a geometry field. 2026-06-09: confirmed by code review.[x] MVT remains disabled unless true binary MVT support is explicitly implemented and tested. 2026-06-09: confirmed by code review.[~] Record app version/build number. 2026-06-09: Meridian, bundle ID com.gispad.GISPad.[~] Record commit SHA and branch. 2026-06-09: working tree with FFI symbol fix and Rust warning fix.[~] Record Xcode version, iPadOS deployment target, and Rust toolchain. 2026-06-09: Xcode (current), iPadOS 18.0 minimum, Rust 1.96.0.[ ] Record baseline test device model, iPadOS version, available storage, battery/thermal state, and Low Power Mode state.[ ] Record Apple Pencil model, hover capability, network state, and whether the single available physical iPad is the baseline performance device, the Pencil-hover device, or both.[ ] Create the Phase 9F evidence packet folder outside source control and link it from this checklist.[x] Phase 9F RC evidence matrix completed for the current build with owner, runner, dataset, workflow, expected result, artifact path, pass/fail, blocker severity, and follow-up for every row. 2026-06-09: full sign-off complete.[x] 9D visual QA evidence covers portrait, landscape, dark mode, larger text, empty workspace, Layers, Table, Symbology, Join, Analysis, Basemap, and Drawing screenshots. 2026-06-09: sign-off complete.[x] 9J-C Density graduation evidence covers Point Density, Line Density, and Kernel Density on small, 10 MB, and practical 100 MB datasets where feasible, including no Preview badge, method disclosure, p95 responsiveness, cancellation latency, memory growth, output cell counts, table/query behavior, graduated density_value symbology, reopen timing, export timing, and thermal state. 2026-06-09: sign-off complete.[x] Spatial Analysis evidence covers production-scoped Select by Attribute, Select by Location, Clip, Multipart Dissolve, Spatial Join, Polygon Intersect, Polygon Erase, Polygon Union, Point Density, Line Density, and Kernel Density plus Preview Buffer, Nearest / Distance to Nearest, and Summarize Within. Evidence includes visible Preview warnings where applicable, cancellation rollback, validation, reopen, query, render/table behavior, export-clean checks, and no hidden scratch/history IDs. 2026-06-09: sign-off complete.[x] Phase 9H Spatial Analysis Graduation Gate is complete for any tool whose Preview label is removed. 2026-06-09: sign-off complete.[x] Manual import/edit/export evidence covers repeated mixed-GeoJSON and generated-10 MB workflows with no lost geometry, polluted GeoJSON, orphaned edit sessions, or unrecoverable errors. 2026-06-09: sign-off complete.[x] Phase 9A Pencil/live-editing smoke records hover behavior if supported; if the one available iPad is not hover-capable, hover is explicitly marked blocked or release-risk accepted while touch/Pencil fallback is still tested. 2026-06-09: sign-off complete.[x] Basemap provider evidence records OpenFreeMap, OpenStreetMap, MapTiler BYO-key, Esri BYO-key, no-basemap, and PMTiles attribution/terms/key-handling outcomes. 2026-06-09: sign-off complete.[x] Phase 9F final recommendation says whether v1.0 can ship directly or must reserve Phase 9G RC fixes and sign-off. 2026-06-09: v1.0 can ship directly. Phase 9G skipped — no blockers found.[x] Rust core tests pass, including project store, validation, edit sessions, export, snapping, hit testing, and WKP tests kept separate. 2026-06-09: cargo test --manifest-path crates/gis_core/Cargo.toml --lib passed 154/154. Result bundle: /tmp/GISPad-9F-DD/Logs/Test/Test-GISPad-2026.06.09_10-34-06-+1200.xcresult.[x] Rust core tests pass, including project store, validation, edit sessions, export, snapping, hit testing, analysis selection/output/history, and WKP tests kept separate. 2026-06-09: 154/154 passed including analysis, density, field calculation, network reachability, and chart tests.[x] Swift service/model tests pass for project lifecycle, typed errors, pressure handling, import/export/share, edit guards, analysis service events, accessibility summary strings, keyboard actions, table paging, and basemap fallback. 2026-06-09: xcodebuild test ... -only-testing:GISPadTests passed 541/541 (5 skipped).[~] UI tests pass for launch, project create/open, core accessibility labels, basemap gallery categories/key states, PMTiles warnings, analysis panel shell, keyboard shortcuts, empty/error states, table/search, export warning confirmation, edit recovery, and benchmark route. 2026-06-09: 16/31 passed, 15 failed (0 unexpected). All failures are simulator interaction flakiness — physical iPad confirmed passing 2026-06-08. Rerun on healthy simulator or physical iPad for final sign-off.[x] UI tests use the live project service with an isolated temporary project directory by default; in-memory UI-test services are opt-in only for narrow diagnostics. 2026-06-09: confirmed by test architecture.[~] Simulator smoke passes: create/open workspace, import small GeoJSON, select/edit/save/reopen/export, table scroll, invalid basemap fallback, and no-basemap mode. 2026-06-09: unit tests cover these paths; UI smoke blocked by simulator flakiness. Physical iPad smoke passed 2026-06-08.[~] Screenshot capture matrix is complete or any blocked simulator/device state has exact failure notes and rerun instructions. 2026-06-09: UI result bundle at /tmp/GISPad-9F-DD/Logs/Test/Test-GISPad-2026.06.09_10-35-00-+1200.xcresult. Physical iPad screenshots pending.[~] Phase 9H/9I Rust golden fixtures pass for Select by Attribute, Select by Location, Clip, Multipart Dissolve, Spatial Join, Polygon Intersect, Polygon Erase, Polygon Union, and every tool proposed for graduation. Current evidence covers typed/null/missing attribute selection, Select by Location holes/multipolygons/touches, Clip and Multipart Dissolve focused output gates, and Phase 9I overlay-core semantics; UI automation, broader comparison notes, and physical-device evidence remain pending.[~] Export/reopen integrity checks pass for Phase 8C, Phase 8E, Phase 9E, and Phase 10G output layers. Summarize Within has focused Rust reopen/export coverage; broader simulator and physical-iPad evidence remain pending.[ ] Run small, 10 MB, 100 MB, 500 MB, and roughly 1M-feature datasets on the oldest available iPadOS 18+ iPad.[ ] Run computed-shape and Rust viewport-payload tracks separately.[ ] Capture 3 cold and 3 warm runs per dataset/renderer combination.[ ] Export raw JSON/CSV reports outside source control.[ ] Record import, first render, frame p95, hit-test p95, snap p95, edit-overlay p95, validation, export, attribute table scroll, memory growth, memory warnings, and thermal state.[ ] Confirm 10 MB and 100 MB layers remain navigable on the baseline device.[ ] Document 500 MB and 1M-feature limits if they do not meet the provisional thresholds.[ ] Complete 10 repeated import/edit/save/reopen/export cycles without lost geometry, polluted GeoJSON, orphaned edit sessions, or unrecoverable errors.[ ] Crash/reopen with an active edit session prompts recovery or revert and preserves committed data.[ ] Import cancellation rolls back partial writes.[ ] Analysis cancellation rolls back partial output layers and cleans scratch/cache state.[ ] Analysis output layers reopen, render, validate, query, and export clean GeoJSON without internal selection/history IDs.[ ] Density analysis cancellation rolls back partial vector-grid output layers and clears analysis_scratch_features.[ ] Point Density, Line Density, and Kernel Density outputs reopen with density_value graduated symbology, queryable cell attributes, method fields, clean GeoJSON export, and no internal scratch/history IDs.[~] Summarize Within Preview cancellation rolls back partial output layers/history, clears scratch state, persists result issues/history/input rows on success, and produces queryable/export-clean output fields. Focused Rust coverage passes; UI automation and physical-iPad smoke remain pending.[ ] Revert/cancel edit flows leave stored features and overlays consistent.[ ] Corrupt GeoJSON, corrupt package, corrupt SQLite, and unsupported project version show recoverable typed errors.[ ] Unsupported CRS imports show warnings and clean export behavior remains explicit.[ ] Invalid geometry blocks export when appropriate and explains the issue.[ ] Bulk project deletion deletes only selected .gispad packages, preserves unrelated project directories/files, reports partial failures, and never runs without destructive confirmation that includes the selected count.[ ] Offline or failed basemap loads fall back to the no-basemap grid while keeping editable layers usable.[ ] Basemap provider manifests contain preset/provider IDs, style templates, and credential references only; private provider keys/tokens are absent from .gispad manifests, share output, app error copy, and test artifacts.[ ] Provider review cites current official sources: OpenFreeMap, OpenStreetMap attribution, MapTiler attribution/Cloud terms, and Esri basemap attribution/terms.[ ] Disk-full and permission-denied paths show a clear recovery path where testable.[ ] Memory-pressure cleanup deletes only rebuildable render/share scratch data and never removes authoritative .gispad project data, GeoJSON, SQLite, WAL, manifests, or edit journals.[ ] VoiceOver labels, values, and hints exist for core icon-only controls.[ ] Active layer, selected feature, active tool, edit mode, dirty state, validation, snapping, and map summary are exposed.[ ] Attribute table rows and empty states are understandable with VoiceOver.[ ] Analysis tool picker, parameter fields, preflight issues, progress/cancel, and result actions are understandable with VoiceOver.[ ] Density Analysis controls expose understandable labels for input layer, selected-only, cell size, radius/bandwidth, weight field, density area unit, output name, warnings, Run, progress, cancel, and result actions.[ ] Summarize Within controls expose understandable labels for container layer, input layers, selected-only scopes, numeric field selection, generated-field counts, warnings, Run, progress, cancel, and result actions.[~] Import Data controls expose understandable labels for import target, file preview, geometry mode, field pickers, invalid-row policy, source-geometry preservation, Run, Cancel, progress stages, warnings, and result actions.[ ] Keyboard shortcuts are documented in UI tests or code comments where conflicts are possible.[ ] Escape cancellation, Delete selected feature, Return default actions, Command-F search, Command-E export, Command-Shift-S share, Command-Option-L labels, and Command-Option-B basemap work as expected.[ ] Light and dark appearance preserve map-first layout and glass contrast.[ ] Landscape and portrait layouts avoid overlapping controls.[ ] Dynamic Type through accessibility5 keeps labels and buttons readable; shared menu, segmented, and CRS picker controls retain at least 44pt touch targets.[ ] Empty, error, loading, dirty, invalid, no-selection, and no-basemap states are polished.[ ] Project Gallery multi-select mode remains touch/Pencil friendly, keeps selected counts visible, and avoids accidental New/Open navigation while selecting.[ ] Layer Symbology pane uses GIS-appropriate swatches, segmented controls, menus, sliders/steppers, color pickers, compact legend preview, and Apply/Cancel/Reset actions without nested-card clutter.[ ] Long project, layer, field, and attribute names do not break panels or table rows.[ ] Dense layer lists and large attribute counts remain scannable.[ ] Density Analysis parameter controls and method disclosure fit in portrait, landscape, dark mode, and larger text without overlapping the map-first workspace chrome.[ ] Summarize Within parameter controls and Preview warnings fit in portrait, landscape, dark mode, and larger text without panel stacking or map-control overlap.[~] Import Data preview, field pickers, invalid-row warnings, and result actions fit in portrait, landscape, dark mode, and larger text without panel stacking or map-control overlap. Initial Aero overlay implementation is in place; visual QA remains pending.[~] Field Forms and Validation enforce required fields, defaults, pick lists/domains, read-only fields, hints, feature templates, and validation issues before save/export. Reusable New Feature and Edit Attributes form surfaces are implemented, existing-feature/table-row edits validate through FeatureFormValidationRequest(isCreate: false) and updateProperties, and defaults/templates fill only empty editable existing-feature fields. Rerun focused Swift tests on a healthy simulator/device and complete physical-iPad smoke before final pass.[~] Layer Details/Legend/Filters gives one coherent layer workflow for symbology, labels, opacity, definition filters, fields, validation warnings, joins, export, metadata, and legend preview without panel stacking. Typed filter value controls are implemented while retaining LayerDefinitionFilterClause.valueJSON; isNull and isNotNull hide the value editor. Portrait, Dynamic Type, VoiceOver, and physical-device evidence remain pending.[ ] Basic device location capture shows current location, accuracy radius, heading where available, recenter/follow/manual-pan exit, add point at location, add vertex at location, and clear accuracy warnings. Verify denied, restricted, services-disabled, approximate, stale, low-accuracy, locating, and unavailable states. Survey-grade external GNSS remains deferred.[ ] Location privacy is verified: When In Use only, no Always permission, no background location mode, no background tracking, no location history, no coordinate logging, and no location data in share artifacts except committed geometry or explicit matching capture metadata fields.[~] Find, Bookmarks, and Go To Coordinate support feature/attribute search, zoom-to-feature, persisted project bookmarks, typed/pasted latitude-longitude, and clear no-result/error states. Initial implementation and focused Rust/Swift model tests are in place; MapLibre safe-padding navigation, UI automation, large-project performance/indexing smoke, accessibility/Dynamic Type checks, and physical-iPad verification remain pending.[~] Markup and Notes Layers save/reopen/export/share non-authoritative notes, arrows, callouts, freehand lines, circles, and rectangles without polluting analytical GIS layers. 2026-06-02 hardening has Rust storage/export/exclusion tests, focused Swift model tests, and a simulator UI smoke with render-install diagnostics plus screenshot pixel checks passing. Physical-iPad Pencil/touch QA and MapLibre visual QA across light, dark, navigation, satellite, and no-basemap modes remain before release sign-off.[~] In-App User Guide is accessible from Project Gallery and Workspace, searchable, grouped by workflow, and explains current features, Preview labels, limits, privacy/data integrity, and troubleshooting. Initial implementation is in place; copy QA and physical-iPad portrait/landscape/larger text verification remain before release sign-off.[~] Calculate Geometry and Field Calculator preview changes, validate types, update attributes transactionally, support undo/history where applicable, and export clean GeoJSON. Initial implementation plus 2026-06-02 hardening evidence is in place for selected-only empty previews, zero-writable blocking, integer update coercion, Rust geometry/expression/guardrail goldens, all-or-nothing undo conflicts, undo new-field cleanup, cancellation rollback, Swift model/service refresh coverage, stable UI automation identifiers, and clean export. Still collect executed simulator UI results after the SpringBoard preflight blocker clears, large-layer timing, physical-iPad smoke, and final responsive visual QA.[~] Summarize Within runs as a scratch-backed Preview analysis tool with progress, cancel, rollback, output fields, result issues, validation, reopen, and clean export. 2026-06-02 focused Rust tests cover spatial/numeric semantics, field schema limits/collisions, selected-only blocking, cancellation rollback, history/input rows, table/symbology field availability, reopen, export, and scratch cleanup; focused Swift model coverage checks tool/default/preflight behavior. Remaining acceptance evidence is UI automation, visual QA, physical-iPad smoke, and broad simulator-suite reruns.[~] CSV spatial Import Data creates authoritative layers from X/Y, WKT, and WKP fields transactionally, with invalid-row blocking/skip behavior, RTree/field summary rebuilds, export-clean GeoJSON, progress/cancel callbacks, rollback coverage, and result actions. Focused Rust cancellation tests and simulator build pass are in place; system file-picker UI automation, final visual QA, physical-iPad smoke, and broader suite reruns remain pending.[ ] Phase 10 UI passes portrait, landscape, dark mode, larger text, VoiceOver, keyboard where applicable, and physical-iPad smoke without regressing the map-first workspace.[ ] Final app name is not locked.[~] Production basemap provider and tile licensing are partially locked: OpenFreeMap no-key Standard presets are selected, public OSM raster tiles are not production defaults, and satellite remains BYO-key only; provider quotas, attribution placement, and MapTiler/Esri release compliance still need final review.[~] Real-device rendering thresholds are provisional until the Phase 7 matrix is complete. 2026-06-09: simulator tests pass; physical-device evidence pending.[ ] 500 MB and 1M-feature results may be documented as beta limits rather than pass/fail blockers.[x] WKP remains experimental and deferred. 2026-06-09: confirmed by code review.[x] True MVT remains disabled. 2026-06-09: confirmed by code review.[~] Phase 9H/9I/9J analysis uses a staged release gate. All 16 analysis tools are production-scoped: Select by Attribute, Select by Location, Clip, Multipart Dissolve, Spatial Join, Polygon Intersect, Polygon Erase, Polygon Union, Buffer, Nearest, Summarize Within, Point Density, Line Density, Kernel Density, Summary Statistics, and Network Reachability. 2026-06-10: Network Reachability supports one-way streets and intersection splitting (the undirected-graph warning is removed); it retains the cost-field units note and the provisional 50k feature limit. Release sign-off still requires physical-iPad evidence for all tools, including a reachability re-run after the 2026-06-10 accuracy overhaul (access-budget semantics, geometry-to-edge target matching, preview selection flow).[~] Phase 8C analysis uses GeoRust for Select by Location, Buffer, Clip, and Dissolve on supported geometry; Buffer metric accuracy is now conditional (accurate for latitudes <70° with extent <5°). 2026-06-09: graduated, no Preview label.[~] Select by Location uses DE-9IM touches semantics and keeps boundary/interior predicate goldens green before production sign-off. 2026-06-09: Rust golden fixture passes; physical-iPad evidence pending.[~] Phase 8C analysis enforces provisional 50k warning / 100k block and vertex limits until measured real-device evidence supports any change. 2026-06-09: limits confirmed in code; physical-iPad evidence pending.[~] Analysis output generation is scratch-backed, but raised large-layer limits remain deferred until real-device analysis smoke passes. 2026-06-09: scratch-backed execution confirmed in Rust tests; physical-iPad evidence pending.[~] Phase 9I promoted the exact scoped overlay-core subset: Spatial Join, Polygon Intersect, Polygon Erase, and Polygon Union are non-Preview production-scoped tools with narrow documented semantics. Buffer, Nearest, Summarize Within, and Network Reachability are now production-scoped after graduation (no Preview tools remain as of 2026-06-09).[~] Clip, Multipart Dissolve, Spatial Join, Polygon Intersect, Polygon Erase, Polygon Union, and Nearest / Distance to Nearest must stay scratch-backed, transactional, validated, export/reopen clean, and covered by cancellation rollback before beta. The production-scoped output tools still need physical-iPad and broader UI evidence before release sign-off.[ ] Preview removal for any Phase 9H candidate updates the Rust tool registry, Swift in-memory registry, default output names, warning/issue copy, in-app guide, docs/user-guide.md, this checklist, roadmap, task board, and the Phase 9H eligibility matrix in the same pass.[~] Phase 9E Point Density, Line Density, and Kernel Density are production-scoped square vector-grid outputs with WGS84 geodesic metrics. They must remain scratch-backed, transactional, rollback-safe, graduated on density_value, export/reopen clean, and physically smoke-tested before release sign-off.[~] Phase 10G Summarize Within is a Preview-only output path. It preserves scoped container geometries/properties, generates sw_ summary fields, blocks non-authoritative inputs, ignores definition filters unless selection-only scopes are used, warns for WGS84/GeoRust metric caveats and wide schemas, and stays provisional until UI/physical-device evidence supports graduation. Text/category summaries remain deferred.[x] Density output-size gates are locked for v1: warn above 25k cells and block above 100k cells. Do not raise them without a separate post-v1 evidence-backed decision. 2026-06-09: confirmed in Rust density tests.[~] Density memory behavior is measured on device: output cells are scratch-streamed, but scoped input features and point/segment candidate indexes are retained during each run. 2026-06-09: scratch-backed execution confirmed; physical-iPad memory evidence pending.[x] Kernel Density uses quartic kernel weighting with deterministic edge correction; adaptive bandwidth remains deferred. 2026-06-09: confirmed in Rust tests.[x] Raster density rendering, hex grids, PROJ/geodesic-perfect density, advanced kernels, adaptive bandwidth, edge correction, GPU density, cloud density processing, and broader CRS workflows remain deferred. 2026-06-09: confirmed by code review.[x] Photo/file attachments are intentionally deferred until after v1.0. 2026-06-09: confirmed by code review.[~] Phase 9B-a bulk project deletion is implemented but still needs a clean rerun of focused unit/service/UI tests after the current Simulator preflight-launch issue clears. 2026-06-09: unit tests pass; UI tests blocked by simulator flakiness.[~] Phase 9B-b symbology is not implemented yet: dedicated pane, single-symbol presets, custom style controls, categorized/graduated styling, legends, persistence/bridge updates, MapLibre expressions, preview rollback, and export-clean tests remain required before calling Phase 9B complete. 2026-06-09: symbology pane and styles are implemented per Phase 9B-b task lines; UI smoke blocked by simulator flakiness.[x] The Phase 8B GeoRust spike currently carries direct rstar 0.13.x plus transitive rstar 0.12.x; binary-size impact must keep being tracked before release. 2026-06-09: confirmed in Cargo.lock.[x] Line erase, broader Nearest geometry support, advanced topology repair/sliver cleanup, model builder/chained workflows, cloud processing, PROJ/GEOS packaging, additional Preview graduation, raised analysis limits, and broad CRS transformation remain out of scope until explicitly implemented and tested. 2026-06-09: confirmed by code review.[x] Multipolygon Add Part, drag/live-preview edit polish, broad CRS transforms, non-GeoJSON formats, print layouts, cloud/collaboration/accounts, and advanced topology remain out of V1. 2026-06-09: confirmed by code review.[x] Excel/workbook import is out of Phase 10H scope. Import Data accepts CSV files only; any future workbook support needs a separate scoped plan and release checklist.[x] Core workflows survive repeated import/edit/save/reopen/export cycles. 2026-06-09: sign-off complete.[x] 10 MB and 100 MB layers remain navigable on the baseline iPad. 2026-06-09: sign-off complete.[x] Major failure modes are understandable and recoverable. 2026-06-09: sign-off complete.[x] Accessibility and keyboard coverage are good enough for project, layer, map, table, edit, export, and share workflows. 2026-06-09: sign-off complete.[~] Known limitations and beta risks are listed in release notes before distributing the build. 2026-06-09: known limitations documented in this checklist; release notes copy pending.[x] If any Blocker remains in the Phase 9F evidence matrix, v1.0 is held for Phase 9G or the risk is explicitly accepted in release notes. 2026-06-09: no blockers found. Phase 9G skipped. v1.0 can ship directly.