Forma 3.1.0-rc.2 (rc, M4)

[3.1.0-rc.2] - Prepared; publication pending

• Preserve seed rejection tests across the final version transition and verify
  native error reporting without Chromium-specific assumptions in other engines.
  Product behavior and the recorded performance tradeoffs are unchanged.
• RC1 was stopped before publication; its tag and failed/cancelled evidence are
  retained. RC2 requires its own review and release qualification.

Milestone: rc (M4), pre-release on npm next. Every gate of rc and its predecessors is done.

Pending before later milestones:

• before final (M5): FORMA-144 slice 3: final template and release cleanup; FORMA-191: the per-release measurements in P17; FORMA-145 soak: L-62: at least 3600 seconds of continuous fault-free CI burn-in on the exact packed RC set, including stress, fuzzers and skew/upgrade drills, after RC P17 and the independent whole-release audit

Commit: 226f0d8d56e0d6e68517d53f52bcc7149ee7e869 · run: 40214937298 · CI: 40213870466

Package	Version	SHA-256
forma-ir	3.1.0-rc.2	eb1ec83e863992b5482ce3d7e812fbc0a67a42bedaa20cadea093916990c078c
forma-ir-derive	3.1.0-rc.2	359061282da8b4ff4d93491ff54b246e8cc400b37e667f36f6a0663e194a4f7e
forma-server	3.1.0-rc.2	559969a33767b2671a66f423bf28bf739cb3c1fa6ae6891dd5bd1955ec79b4b1
@getforma/core	3.1.0-rc.2	d30fa799e48be3ee35ce1b9f623db6e8f123be1bc7b99bd0da6ae4532c83eebc
@getforma/compiler	3.1.0-rc.2	4094cfef0dd24d8810b71029107bcbd8e0186d9294a846e6fa1bb2aad5177054
@getforma/build	3.1.0-rc.2	9c2f9ade4690df89622dd066273456dfb0a5818470764e7bc41bb13ee21ad0d6
@getforma/create-app	3.1.0-rc.2	3365228c8d9951873abf22d592be09f4f1690dfbd6be90359b93decd1ac2f17d

Contract versions: {"stage":"v3-development","fmir":3,"manifest":2,"props":"declared-v1","stateBlock":"declared-v1","staticHtml":"plain-v1","versionWindow":"same major; writer minor at most reader minor; patch independent; package suffix omitted","version":"3.1.0","milestones":{"alpha":{"plan":"M2","tags":"v3.1.0-alpha.N: npm next, Cargo -alpha.N","gates":{"FORMA-110":{"status":"done","scope":"server functions, the WASM walker and Node rendering removed"},"FORMA-185":{"status":"done","scope":"FMIR v3 writer and reader on main, seeded-fault replay, the nightly fuzz observed"},"FORMA-112":{"status":"done","scope":"one version, the compatibility window checked at install, build and start"},"FORMA-102":{"status":"done","scope":"declared page data, the derived Rust type and the start-time bind"},"FORMA-107":{"status":"done","scope":"render returns the result, strict loading only, declared route modes, per-page limits"},"FORMA-109":{"status":"done","scope":"PageResponse only, Trusted Types enforced"},"FORMA-111":{"status":"done","scope":"the worker's digest checks, integrity on every tag, precache mode removed"},"FORMA-144 slice 1":{"status":"done","scope":"both templates on the coordinated 3.1 API, packed and verified by P17"}}},"beta":{"plan":"M3","tags":"v3.1.0-beta.N: npm next, Cargo -beta.N","gates":{"FORMA-103":{"status":"done","scope":"island props in one JSON block, compiler-bound seeding"},"FORMA-104":{"status":"done","scope":"adoption writes nothing on its first run, coded mismatch errors"},"FORMA-105":{"status":"done","scope":"islands only, literal registry, identity digest"},"FORMA-181":{"status":"done","scope":"keyed rows"},"FORMA-182":{"status":"done","scope":"the marker vocabulary and the seven value rules with shared vectors"},"FORMA-183":{"status":"done","scope":"the parity harness and its corpus, blocking in CI"},"FORMA-184":{"status":"done","scope":"renderBoth(component, state) in Forma's own suite"},"FORMA-144 slice 2":{"status":"done","scope":"island state adoption in the templates: the integrated packed adoption and static-route acceptance"},"FORMA-188 fixture applications":{"status":"done","scope":"the three fixture applications in P17"},"FORMA-021 ratchet":{"status":"done","scope":"the safe cuts landed and the size gate green at the restated ceiling"}}},"rc":{"plan":"M4","tags":"v3.1.0-rc.N: npm next, Cargo -rc.N","gates":{"FORMA-101":{"status":"done","scope":"the published server-renderable subset and coded build errors"},"FORMA-139":{"status":"done","scope":"the conformance corpus, a fixture and a near miss per code"},"FORMA-108":{"status":"done","scope":"the hostile corpus with zero executions"},"FORMA-186":{"status":"done","scope":"the deployment identity and inert-or-reload on a skew"},"FORMA-188 skew drill":{"status":"done","scope":"the skew drill green in P17"},"FORMA-190":{"status":"done","scope":"the size report green on both templates at the recorded ceiling"},"FORMA-141":{"status":"done","scope":"formaAlias warns once per build for every bare formajs importer and preserves the 3.x mapping; reviewed implementation 76df14bf in PR78"},"FORMA-145 documentation":{"status":"done","scope":"the 3.1 upgrade and stability documentation matches the final public surface; the complete 3.0 upgrade guide remains available"},"FORMA-116":{"status":"done","scope":"reviewed governance source controls and actual SR14 security mutation probes; live rollout deferred by L-60"},"FORMA-189":{"status":"done","scope":"the recall script and SECURITY.md generated from the release record"},"FORMA-145 audit":{"status":"done","scope":"the whole-release audit on another model or a separate fresh-context reviewer under L-65, with an empty blocking list (D14)"},"FORMA-257":{"status":"done","scope":"no-JavaScript routes emit plain HTML without markers, row keys or island state while island adoption bytes remain compatible; shared visible 10/100/1000-row checks pass and the 100-row HTML is at most 17,500 bytes; rerace HTTP events 1-4 and 7 with bytes, throughput, render cost and RenderCounts retained"},"FORMA-258":{"status":"done","scope":"profile and reduce per-byte walker cost and allocations without changing adoptable bytes, limits or fault behavior; record 100/1000-row ns/byte and allocations against the 10 ns/byte target, then rerace HTTP events 1-4 with Endurance p99/p50 at most 1.5"},"FORMA-259":{"status":"done","scope":"Qualify the selected simpler supplied-node effects and initial-failure cleanup repair under docs/release/3.1-PERFORMANCE-TRADEOFFS.md: preserve adoption/ownership/cleanup/error semantics; retain fresh exact-source Linux results against published Forma and pristine alien-signals 3.1.2, all nine workloads and original 80%/85% target outcomes; explicitly accept the documented fan-out shortfall and delivery tradeoff with core 49,414 B and route 28,420 B gzip ceilings, leaving other budgets unchanged"},"FORMA-260":{"status":"done","scope":"Complete source-bound row profiling and preserve stable row/event/ownership/teardown behavior under docs/release/3.1-PERFORMANCE-TRADEOFFS.md; retain all nine fresh exact-source DOM operations and three-engine correctness; accept and disclose the existing create-1,000 gap above 1.10 times same-session vanilla for 3.1, exclude incompatible compiler/listener experiments, and investigate any material new regression before release"},"FORMA-261":{"status":"done","scope":"opt-in br/gzip/identity rendered-response compression has correct negotiation, Vary and length behavior, unchanged decoded bytes/no-store/CSP/HEAD semantics, and an explicit reviewed BREACH policy; rerace event 7 and HTTP events 1 and 3 with throughput, CPU, memory and tail latency"},"FORMA-262":{"status":"done","scope":"both generated-template CI/release workflows cache locked Cargo builds and retain cold/warm page-only build evidence; evaluate disk-loaded release FMIR and record the decision without changing the existing development reload contract"},"FORMA-263":{"status":"done","scope":"retain the bundle component breakdown, remove only proven unused/adoption-specific bytes, publish exact raw/gzip/Brotli deltas with all correctness and existing size budgets passing, and preserve runtime export/activation/disposal behavior"},"FORMA-264":{"status":"done","scope":"freeze the round2 protocol before implementation, run native island correctness for all 11 entrants, rerace and report each fix, establish the qualified native Linux baseline, and enforce memory ≤ 8 MiB, boot ≤ 50 ms and image ≤ 150 MB with source/browser/image identity, scoped cleanup and retained failures; the user-approved 2026-10-24 gha-4-v1 baseline is a separate profile with Class A 1 CPU/1 GiB, Class B 2 CPU/2 GiB and disjoint 2-CPU load generation, preserving the original native-8-v1 profile and prohibiting cross-profile performance-gain claims"}}},"final":{"plan":"M5","tags":"v3.1.0: npm latest, Cargo 3.1.0","gates":{"FORMA-144 slice 3":{"status":"pending","scope":"final template and release cleanup"},"FORMA-191":{"status":"pending","scope":"the per-release measurements in P17"},"FORMA-146":{"status":"done","scope":"Q10 to Q13 and Q14 to Q18 defaults confirmed by the founder in L-57 on 2026-10-15; see docs/release/3.0-GATE-DISPOSITIONS.md"},"FORMA-145 soak":{"status":"pending","scope":"L-62: at least 3600 seconds of continuous fault-free CI burn-in on the exact packed RC set, including stress, fuzzers and skew/upgrade drills, after RC P17 and the independent whole-release audit"}}}},"informational":{"decision":"L-57 (2026-10-15): application runs do not gate 3.0.0; no application repository is touched","FORMA-192":{"status":"not-run","scope":"optional external application builds; excluded from this release task"},"FORMA-147":{"status":"not-run","scope":"optional external login spike; excluded from this release task"},"FORMA-116 live rollout":{"status":"deferred","decision":"L-60 (2026-10-16)","owner":"Victor","scope":"beyond 3.0: separate agent GitHub identity and scoped credentials; new founder-only protection enforcement and distinct-identity denial drills; external alert receiver, scheduler and real delivery acceptance","risk":"agents continue using the founder identity, so GitHub does not independently separate their administrator/release authority; external alert delivery remains unavailable; these criteria are deferred, not passed"},"currentScope":"The current framework/benchmark programme does not make old external applications a release constraint or modify their repositories. Historical L-57/L-60 evidence below remains historical; no live-rollout criterion is newly marked passed."},"trustedTypes":"enforced-v1","boundRender":"finalized-v1","assetIntegrity":"sha384-v1","sourceTemplates":"islands-v1","fixtureApps":"declared-v1","deploymentSkew":"native-v1","performance":"measured-v1"}

Tag-event run to acknowledged release write: 2136.5 seconds; target 1800 seconds. Full measurements and DS11 hashes are in the attached JSON.

P17 ran 1332 s of 1,800 s; the most Forma code on any fixture route is 28,137 B of 28,420 B gzip -9 (ksx /check); measured on Linux X64, 4 CPUs, Node v24.22.0. N1 slowest p99: 3,421,669 nodes/s; N5 median paired ratio 23.17; mobile worst p95 TBT 0.0 ms. Public decoder worst sample 30.60 ms at four-times CPU slowdown. All three client comparison engines and both public budget refusals are recorded; packed npm and crates; ordinary cargo release; N1 prepared typed inputs; Lighthouse13.5.0 applied mobile; serial Chromium/Firefox/WebKit comparison.