v1.0.0 — 1.0.0 closure release

playwright-eir 1.0.0 — closure release

A closure release, not a feature release. 0.3.0's own known-limitations
list named twelve conscious-closure items plus an external verification
step and a completed security review as everything standing between it
and a 1.0.0 stability commitment. Every one reached a final disposition
this session — fixed (with tests), measured (with real data), or
stated as a deliberate, documented stance — nothing silently dropped,
nothing softened. Full detail: FULL_UNDERSTANDING.md
and docs/security-review-1.0.md.

Measured results (seed 42, 8-class mutation benchmark — unchanged since 0.3.0)

Mutation Class	Heal Rate	False-Heal Rate	Suggestion Rate	Miss Rate
id-rename	75.0%	0.0%	25.0%	0.0%
text-change	87.5%	0.0%	12.5%	0.0%
tag-swap	100.0%	0.0%	0.0%	0.0%
class-shuffle	25.0%	0.0%	75.0%	0.0%
sibling-reorder	0.0%	0.0%	0.0%	100.0%
wrapper-inject	100.0%	0.0%	0.0%	0.0%
near-duplicate-sibling-swap	25.0%	0.0%	75.0%	0.0%
compound-release	50.0%	0.0%	25.0%	25.0%

False-heal rate: 0.0% across every class.

Closure-list summary

Fixed:

• EirLocator/EirPage now unwrap themselves at every real
  Locator-argument boundary (.and(), .or(), .dragTo(), .filter(),
  .locator(sel, {has}), addLocatorHandler/removeLocatorHandler — 8
  call sites, centralized in one helper). This was the single largest
  reason 0.3.0 wasn't 1.0.0.
• expect(...).toHaveScreenshot() now works through both wrappers
  (_expectScreenshot/_frame/_selector forwarding).
• ci-action's "has findings" check no longer misses a genuine heal
  whose suggestion generation itself failed.
• Retried-test duplicate rows are collapsed in the rendered PR comment
  (the raw eir-report.json artifact still keeps every attempt).
• One real security finding, fixed: a markdown/table-structure
  injection in the PR-comment renderer, from page-derived content
  (verified with a real hostile fixture before and after the fix).
  Found during a completed 7-area security review — every other area
  (secrets, browser-context code, filesystem writes, network calls, the
  ci-action threat model, supply chain) passed clean.

Verified live, not just unit-tested:

• The GitHub Action's documented adoption path, from a real external
  fork — zero friction, despite the fork's own repo-level permissions
  defaulting to read-only.
• The no-heals "comment updates to a clean state" path, exercised for
  the first time by a real PR losing its findings across two pushes.
• The CI dogfood demo, generalized from a one-time branch name to a
  repeatable eir-dogfood/* prefix.

Measured:

• suggestThreshold's default (0.3) got a real anchoring attempt — 66
  matched attempts across the full benchmark, confidence range
  0.5849–1.0000, nothing near the floor. Stays an honest estimate,
  confirmed rather than assumed.

Documented as deliberate 1.0.0 stances:

• The fingerprint schema's class-token ceiling (measured 25% on
  class-shuffle) — schema v2 is the first Post-1.0 roadmap item.
• Capture-point coverage boundary (6 named methods; everything else,
  including Frame, is an accepted untracked passthrough).
• The small set of undocumented Playwright internals this package
  forwards, with CI-on-peer-range as the ongoing tripwire.
• The Gemini fallback's measured ~23% free-tier reliability — shipped
  disabled by default on that evidence.
• GitHub Marketplace publication of ci-action — intentionally parked.

Semver honesty

The public API surface — the three exports subpaths (.,
./globalTeardown, ./reporter), the EirConfig/EirMode shape, and
the .eir/routes/*.json/*.postconditions.json file formats — is now a
stability commitment. A breaking change to any of these is a major
version bump going forward, not folded into a minor or patch. Fingerprint
schema v2 (the roadmap item above) is explicitly named as the kind of
change that would trigger one.

Links

• FULL_UNDERSTANDING.md — the full audit snapshot this release closes against
• docs/security-review-1.0.md — the completed security review, verdict per area
• packages/eir/CHANGELOG.md — full changelog
• NOTES.md — every decision's reasoning, in full

npm i -D playwright-eir