Prepare 0.1.1 release without reusing withdrawn versions

.github/workflows/native.yml

@@ -16,7 +16,7 @@ jobs:
         run: |
           docker compose -f tests/integration/docker/compose.yaml exec -T -w /module php sh tests/integration/build-artifact.sh
           docker compose -f tests/integration/docker/compose.yaml exec -T php sh /module/tests/integration/docker/install-artifact.sh
-          docker compose -f tests/integration/docker/compose.yaml exec -T -w /module -e BASICRUM_RELEASE_TAG=0.1.0 php sh tests/integration/release-gate.sh
+          docker compose -f tests/integration/docker/compose.yaml exec -T -w /module -e BASICRUM_RELEASE_TAG=0.1.1 php sh tests/integration/release-gate.sh
       - name: Stop only this disposable stack
         if: always()
         run: docker compose -f tests/integration/docker/compose.yaml down

CHANGELOG.md

@@ -2,12 +2,34 @@
 
 Notable changes to Basicrum Analytics are recorded here.
 
-## [0.1.0] - 2026-09-24
+## [0.1.1] - 2026-09-24
 
 ### Added
 
 - Illustrated setup instructions for collector details, Magento configuration,
   consent integration, and query-string privacy controls.
+
+### Changed
+
+- Prepare `0.1.1` as the next release after withdrawing `0.1.0`. Published
+  Packagist versions are immutable and must not be replaced by moved tags.
+- Update the native release gate, CI, and regression tests for `0.1.1`, rejecting
+  withdrawn and other unsupported release identities before native work.
+- Require `^0.1.1` in the installation instructions, keeping Composer versions
+  derived from VCS tags rather than a hardcoded package version.
+
+### Fixed
+
+- Remove obsolete consent-cookie cleanup from the readable and minified
+  loaders. Browser tests verify no cookies before consent and only the `RT`
+  measurement cookie after initialization.
+- Clarify automatic Beacon Endpoint origin registration in storefront CSP and
+  the cache refresh required after configuration changes.
+
+## [0.1.0] - 2026-09-23 (withdrawn)
+
+### Added
+
 - The owner-approved root MIT license, matching the existing Composer license
   declaration and preserving bundled third-party notices.
 - Magento-aware PHPStan level 8, Magento coding standards, precise runtime
@@ -71,11 +93,6 @@ Notable changes to Basicrum Analytics are recorded here.
 
 ### Fixed
 
-- Remove obsolete consent-cookie cleanup from the readable and minified
-  loaders. Browser tests verify no cookies before consent and only the `RT`
-  measurement cookie after initialization.
-- Clarify automatic Beacon Endpoint origin registration in storefront CSP and
-  the cache refresh required after configuration changes.
 - The Admin integration test opens Magento's native Basicrum navigation group
   before selecting the exact settings link, which is hidden when collapsed.
 - Validate package metadata through Composer's validating VCS importer in CI,

README.md

@@ -16,10 +16,10 @@ Install Basicrum Analytics from the
 Composer package:
 
 ```sh
-composer require 'basicrum/basicrum-magento-2:^0.1'
+composer require 'basicrum/basicrum-magento-2:^0.1.1'
 ```
 
-The version constraint selects the `0.1.x` release line.
+The constraint selects `0.1.1` or a newer `0.1.x` release.
 
 Alternatively, for a manual source installation, place this module at the exact
 path below. The casing is required on case-sensitive filesystems:

docs/PHASE-1-PARITY-COMPLETION.md

@@ -4,6 +4,11 @@ These notes are for incorporation into the central Basicrum parity task. The
 shared parity ledger and both reference plugins were intentionally left
 unchanged.
 
+This is the original Phase 1 completion snapshot. The current release target
+is `0.1.1`; `0.1.0` was withdrawn and cannot be reused on Packagist. Follow the
+[current release gate](../tests/integration/README.md#required-pre-release-native-gate)
+instead of the historical release references below.
+
 ## Review mapping
 
 - **R-001:** connected immediate and consent-controlled settings to loader

package.json

@@ -1,6 +1,6 @@
 {
   "name": "basicrum-magento-2-tests",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "description": "Automated verification for the Basicrum Magento 2 module",
   "engines": {

tests/integration/README.md

@@ -48,7 +48,7 @@ From a clean committed checkout with the containers running:
 docker compose -f tests/integration/docker/compose.yaml exec -T -w /module php sh tests/integration/build-artifact.sh
 docker compose -f tests/integration/docker/compose.yaml exec -T -w /module php php tests/integration/test-artifact.php
 docker compose -f tests/integration/docker/compose.yaml exec -T php sh /module/tests/integration/docker/install-artifact.sh
-docker compose -f tests/integration/docker/compose.yaml exec -T -w /module -e BASICRUM_RELEASE_TAG=0.1.0 php sh tests/integration/release-gate.sh
+docker compose -f tests/integration/docker/compose.yaml exec -T -w /module -e BASICRUM_RELEASE_TAG=0.1.1 php sh tests/integration/release-gate.sh
 docker compose -f tests/integration/docker/compose.yaml down
 ```
 
@@ -280,18 +280,21 @@ fixture is not evidence of end-to-end verification for that page.
 
 ## Required pre-release native gate
 
-The `0.0.2` identity must not be reused for this breaking, previously
-unreleased technical-namespace change. The Phase 1 release candidate is
-`0.1.0`, and the guarded release script accepts only `0.1.0` (with an optional
-`v` tag prefix). Change that explicit policy in review if the intended release
-number changes; do not bypass the gate or add a Composer `version` field.
+The release candidate is `0.1.1`, and the guarded release script accepts only
+`0.1.1` (with an optional `v` tag prefix). The withdrawn `0.1.0` and earlier
+published versions must not be reused. Packagist permanently locks a stable
+version's source and distribution references, even after a maintainer deletes
+the version; see its [version immutability policy](https://packagist.org/about/version-immutability).
+Change the explicit gate policy, regression tests, and CI invocation together
+when preparing another release. Do not bypass the gate or add a Composer
+`version` field.
 
 Before creating the tag, first require the fast CI jobs to pass, then run the
 following against the pinned disposable Magento baseline:
 
 ```sh
 BASICRUM_DISPOSABLE_MAGENTO=1 \
-BASICRUM_RELEASE_TAG=0.1.0 \
+BASICRUM_RELEASE_TAG=0.1.1 \
 MAGENTO_ROOT=/absolute/path/to/disposable-magento \
 MAGENTO_STOREFRONT_URL=https://magento.test/ \
 MAGENTO_ADMIN_URL=https://magento.test/admin/ \

tests/integration/release-gate.sh

@@ -6,8 +6,8 @@ if [ "${BASICRUM_DISPOSABLE_MAGENTO:-}" != "1" ]; then
     exit 1
 fi
 
-if [ "${BASICRUM_RELEASE_TAG:-}" != "0.1.0" ] && [ "${BASICRUM_RELEASE_TAG:-}" != "v0.1.0" ]; then
-    echo "BASICRUM_RELEASE_TAG must be the new Phase 1 tag 0.1.0 (or v0.1.0); 0.0.2 must not be reused." >&2
+if [ "${BASICRUM_RELEASE_TAG:-}" != "0.1.1" ] && [ "${BASICRUM_RELEASE_TAG:-}" != "v0.1.1" ]; then
+    echo "BASICRUM_RELEASE_TAG must be 0.1.1 (or v0.1.1); published versions, including withdrawn 0.1.0, must not be reused." >&2
     exit 1
 fi
 

tests/php/run.php

@@ -415,15 +415,19 @@ function () use ($runDisposableGuard): void {
     basicrum_assert_not_contains('configuration mutation', $missingRunner['stderr'], 'no mutation without the runner');
 };
 
-$tests['native release gate requires a new 0.1.0 tag identity'] = function () use ($runReleaseGateGuard): void {
-    $oldTag = $runReleaseGateGuard('0.0.2');
-    basicrum_assert_same(1, $oldTag['status'], 'previous release tag must fail');
-    basicrum_assert_contains('0.0.2 must not be reused', $oldTag['stderr'], 'actionable old-tag error');
-    basicrum_assert_not_contains('MAGENTO_ROOT', $oldTag['stderr'], 'old tag fails before native work');
-
-    $phaseOneTag = $runReleaseGateGuard('0.1.0');
-    basicrum_assert_same(1, $phaseOneTag['status'], 'missing Magento root must still fail closed');
-    basicrum_assert_contains('MAGENTO_ROOT must point', $phaseOneTag['stderr'], '0.1.0 passes the tag guard');
+$tests['native release gate accepts only the new 0.1.1 tag identity'] = function () use ($runReleaseGateGuard): void {
+    foreach (['', '0.0.2', '0.1.0', 'v0.1.0', '0.1.2', '0.1.1-rc1', 'not-a-version'] as $tag) {
+        $rejected = $runReleaseGateGuard($tag);
+        basicrum_assert_same(1, $rejected['status'], 'unsupported release tag must fail: ' . $tag);
+        basicrum_assert_contains('must be 0.1.1 (or v0.1.1)', $rejected['stderr'], 'actionable tag error');
+        basicrum_assert_not_contains('MAGENTO_ROOT', $rejected['stderr'], 'tag fails before native work');
+    }
+
+    foreach (['0.1.1', 'v0.1.1'] as $tag) {
+        $accepted = $runReleaseGateGuard($tag);
+        basicrum_assert_same(1, $accepted['status'], 'missing Magento root must still fail closed');
+        basicrum_assert_contains('MAGENTO_ROOT must point', $accepted['stderr'], $tag . ' passes the tag guard');
+    }
 };
 
 $tests['native release gate stops before mutations when identity or baseline checks fail'] = function () use ($runReleaseGateGuard): void {
@@ -472,15 +476,15 @@ function () use ($runDisposableGuard): void {
             'MAGENTO_ADMIN_USERNAME' => 'synthetic',
             'MAGENTO_ADMIN_PASSWORD' => 'synthetic',
         ];
-        $artifactMismatch = $runReleaseGateGuard('0.1.0', $environment + ['BASICRUM_FAKE_ARTIFACT_MISMATCH' => '1']);
+        $artifactMismatch = $runReleaseGateGuard('0.1.1', $environment + ['BASICRUM_FAKE_ARTIFACT_MISMATCH' => '1']);
         basicrum_assert_same(67, $artifactMismatch['status'], 'artifact mismatch propagates');
         basicrum_assert_not_contains('unexpected Magento mutation', $artifactMismatch['stderr'], 'no mutation on artifact mismatch');
-        $mismatched = $runReleaseGateGuard('0.1.0', $environment + ['BASICRUM_FAKE_SOURCE_MISMATCH' => '1']);
+        $mismatched = $runReleaseGateGuard('0.1.1', $environment + ['BASICRUM_FAKE_SOURCE_MISMATCH' => '1']);
         basicrum_assert_same(68, $mismatched['status'], 'installed candidate mismatch propagates');
         basicrum_assert_contains('installed candidate mismatch', $mismatched['stderr'], 'installed identity was checked');
         basicrum_assert_not_contains('baseline rejected', $mismatched['stderr'], 'identity fails before native baseline bootstrap');
         basicrum_assert_not_contains('unexpected Magento mutation', $mismatched['stderr'], 'no mutation on identity mismatch');
-        $result = $runReleaseGateGuard('0.1.0', $environment);
+        $result = $runReleaseGateGuard('0.1.1', $environment);
         basicrum_assert_same(69, $result['status'], 'baseline failure propagates');
         basicrum_assert_contains('check-baseline.php', $result['stderr'], 'baseline check was executed');
         basicrum_assert_not_contains('unexpected Magento mutation', $result['stderr'], 'no native mutation ran');