Record 1.4.0 as released: tagged on a2dff15, five packages on nuget.org

The gate table for 1.4.0 is filled with the run that answered each gate rather than the intention: ci.yml on
a2dff15 (41842529851) and its quality-gate wait, the dry run with publish: false (41843140247) whose login and
push steps were skipped as they should be, and the tag's own publish run (41843545643), which pushed all five
packages and got a 201 Created for each. The gate that needed a new answer is G1: this is the first release
since 1.1.0 whose surface grows, and the growth is two enum members moved from Domain's
PublicAPI.Unshipped.txt into PublicAPI.Shipped.txt in the commit that was tagged, so the file is in the
release diff on purpose and names exactly what changed.

G8 is recorded with what it printed: an empty net10.0 console app against the published 1.4.0 packages, three
inputs written with the builder, 4 pages and 2,096 bytes in merged.pdf, primary source cover.pdf, read back as
PDF 1.7 with producer "SharpCorePDF 1.4.0", and ReadPageDetailAsync — the member whose await foreach this
release hardened — answering page 1 at 595.28 x 841.89 pt. nuget.org needed about ten minutes to index the
versions, so the first flatcontainer read answered 1.0.0 to 1.3.0 and the check was repeated rather than
concluded from a 404. qpdf is not installed on this machine, so that part of the 1.2.0 check is named as not
repeated instead of being assumed.

The changelog now says 1.4.0 is on the feed where it used to say this tree will be tagged as it, and the
manual beside the release is the 1.4.0 edition: 26 chapters, 119 pages, 222 bookmarks.

Author: MPCoreDeveloper

CHANGELOG.md

@@ -20,7 +20,8 @@ against an empty feed.
 
 ## [Unreleased]
 
-Nothing yet. `1.3.0` is on the feed; the entry below it is `1.4.0`, the version this tree will be tagged as.
+Nothing yet. `1.4.0` is on the feed: the five packages were pushed by `publish.yml` from tag `v1.4.0` on
+2026-11-04, and the entry below it is the version that was released.
 
 ## [1.4.0] - 2026-11-04
 

docs/release-checklist.md

@@ -488,5 +488,30 @@ tag `v1.3.0` on `71907b0`. The manual beside it is the `1.3.0` edition, 26 chapt
 bookmarks, and it is the first edition the library generated itself: `docs/SharpCorePDF-Manual-1.2.0.pdf` and
 `docs/SharpCorePDF-Manual-1.1.0.pdf` stay as those releases shipped them.
 
+## G1–G9 at `1.4.0` (2026-11-04)
+
+`1.4.0` is the first release since `1.1.0` whose surface grows, so the surface question is answered by what
+did change rather than by what did not: two enum members left `PublicAPI.Unshipped.txt` for
+`PublicAPI.Shipped.txt` in the release commit, and nothing shipped was removed or retyped.
+
+| Gate | State at `1.4.0` | Evidence |
+| --- | --- | --- |
+| G0 — the id | **Closed** | the five ids are unchanged since `1.0.0`; `1.4.0` adds a version to ids the project already owns |
+| G1 — the surface has stopped moving | **Yes — the growth is two enum members, both declared** | `a2dff15` moves `PdfWarningKind.FormFieldDepthExceeded = 65` and `PdfSignatureProblemKind.FormFieldTreeTooDeep = 13` from `SharpCorePDF.Domain/PublicAPI.Unshipped.txt` into `PublicAPI.Shipped.txt`, and all five `PublicAPI.Unshipped.txt` files hold 0 entries again; no shipped entry was removed or retyped, so the surface `1.3.0` shipped is a subset of this one; RS0016 and RS0017 are build errors, and the Release build that packed the release was clean |
+| G2 — the shipped leg | **Unchanged: both legs ship** | `dotnet pack` of the release tree produced five `1.4.0` packages before the push, and `publish.yml` read `lib/net10.0` and `lib/net11.0` out of all four layer `.nupkg` files it built |
+| G3 — notes a consumer can read | **Yes** | `CHANGELOG.md` holds `## [1.4.0] - 2026-11-04`, written in the same commit as the bump, and `PackageReleaseNotes` in `src/Directory.Build.props` carries the same summary onto all five package pages |
+| G4 — symbols and reproducible binaries | **Still partly** | no `.snupkg` is packed and nothing is code-signed, exactly as at `1.1.0`, `1.2.0` and `1.3.0` |
+| G5 — trusted publishing and `NUGET_USERNAME` | **Unchanged, outside the tree** | neither the policy nor the secret was touched and `publish.yml` is unchanged in this release; the same subject list published all five ids, each answer a `201 Created` rather than a `403` |
+| G6 — a dry run on the commit to be tagged | **Yes, 2026-11-04 — `publish: false`, run `41843140247`** | dispatched on `main` after `ci.yml` (`41842529851`) finished on `a2dff15`; sonar-gate, build, both test legs, pack, the package checks and the local-feed handshake `success`, `NuGet login` and `Push to nuget.org` correctly `skipped` |
+| G7 — the tag equals `<Version>` | **Yes — `v1.4.0` on `a2dff15`, `<Version>` 1.4.0** | an annotated tag whose message is `SharpCorePDF 1.4.0`, cut on the commit the dry run answered for; `publish.yml` re-checked the equality itself before it packed anything |
+| G8 — the packages install and open a document | **Yes, 2026-11-04** | all five ids serve `1.4.0` from `api.nuget.org/v3-flatcontainer/<id>/index.json`, read after the index caught up; an empty `net10.0` console app referencing `SharpCorePDF` `1.4.0` and `Microsoft.Extensions.DependencyInjection` built it — three inputs written with the builder, merged into `merged.pdf` — and printed **4 pages, 2,096 bytes, 0 warnings**, `Primary source: cover.pdf`; the inspector read it back as **4 pages, PDF 1.7, not encrypted**, producer `SharpCorePDF 1.4.0`, and the hardened `ReadPageDetailAsync` returned page 1 at 595.28 × 841.89 pt with 0 images and 0 warnings. `qpdf` is not installed on this machine, so the `qpdf check` of the `1.2.0` run is not repeated |
+| G9 — the quality gate on the tagged commit | **Green on `a2dff15`, the tagged commit** | `ci.yml` (`41842529851`) passed the gate for `a2dff15`; the dry run's sonar-gate job read it again for the same commit; the tag's own run (`41843545643`) read it once more before it exchanged the OIDC token |
+
+The release went out on that evidence: run `41843545643` pushed all five packages — five `201 Created` — from
+tag `v1.4.0` on `a2dff15`. The manual beside it is the `1.4.0` edition, 26 chapters, 119 pages and 222
+bookmarks, built from the tagged sources with `tools/SharpCorePDF.Manual`; the `1.3.0`, `1.2.0` and `1.1.0`
+editions stay as those releases shipped them.
+
+