@@ -151,7 +151,12 @@ Add the `CHANGELOG.md` entry (Keep-a-Changelog format) if not already committed.
 
 ## Phase 9 — Cleanup
 
-`npm dist-tag rm <pkg> next` and `npm deprecate <pkg>@<version>-rc.1 "superseded; use <version>"` for each package.
+`npm deprecate <pkg>@<version>-rc.1 "superseded; use <version>"` for each package.
+
+Retire the RC's `next` tag by **repointing, not deleting**: `npm dist-tag rm` 403s for every
+token we hold (local and CI both — npm's bypass-2FA package-access rule, not a missing OTP).
+Run Actions → **npm dist-tag** → tag `next`, action `add`, version `<version>`, which does the
+whole lockstep set from the publish token. See `docs/RELEASING.md` §4.
 
 ## Phase 10 — Propagate versions (docs + websites)
 
@@ -199,8 +204,10 @@ version FAILS by design — skip what's done, never force.
 npm removes **direct publishing from 2FA-bypass tokens around January 2027**
 ([changelog](https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens/));
 since 2026-07-31 such tokens already cannot change package access — including
-**deleting a dist-tag**, which breaks Phase 9's `npm dist-tag rm` and needs an
-interactive-2FA session. The replacement is **OIDC Trusted Publishing** via
+**deleting a dist-tag**. Measured 2026-09-10: the local token and the CI `NPM_TOKEN`
+both 403 on `DELETE …/dist-tags/next` and `--otp` changes neither, so this is a grant
+boundary and no OTP session was going to clear it. Phase 9 repoints with `dist-tag add`
+instead, which is not restricted. The replacement is **OIDC Trusted Publishing** via
 `publish-npm.yml` (which exists), the same mechanism `publish-csharp.yml` already
 uses for NuGet; the remaining work is a trusted-publisher registration per package
 on npmjs.com. Caveat: OIDC can't drive `npm dist-tag` yet, so RC→promote still needs
 
@@ -2,8 +2,11 @@
 
 All notable changes to `@metaobjectsdev/*` TypeScript packages are documented
 here. The format follows [Keep a Changelog](https://keepachangelog.com/), and
-this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
-(pre-1.0; MINOR bumps may introduce breaking changes with notice).
+this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+Since `1.0.0` the two version axes are separate (ADR-0035 Amendment 2): the package number
+promises the **software** surface, `metamodelVersion` promises the **metadata** contract, and
+`^1.0.0` accepts a MINOR — so **a release that moves `metamodelVersion` says so in its entry
+here.**
 
 ## [1.0.0] — 2026-09-09
 
 
@@ -1,5 +1,23 @@
 # MetaObjects 1.0 readiness checklist
 
+> **CLOSED 2026-09-09 — the cut shipped. This is history, not a live gate list.**
+> npm / PyPI / NuGet are at `1.0.0`, Maven Central at `8.0.0`, and `metamodelVersion` is
+> frozen at `1.0`. The declared blocking path this doc named in its own footer — **G3d, then
+> G1/G2/G4** — is closed end to end: G3d on nine adopter estates that ran the release
+> candidate with their own drift gates enforced (not a bare `meta verify`), and G1/G2/G4 at
+> the cut itself.
+>
+> Items still marked 🔶/⬜ below (C2, D2, D3, E3, F3) were never on that path and are not
+> waivers. They are ordinary post-1.0 work, tracked where that work is tracked. Their marks
+> are left exactly as they stood at the cut rather than tidied, so the record shows what was
+> true then rather than what would look neatest now.
+>
+> **Do not reintroduce a waiting gate in any form** — not a release count, not a calendar
+> window, not "one more quiet cut" (ADR-0035 Amendment 3; the reasoning is under G3 below,
+> kept because it is the point). Post-1.0 the live documents are
+> [`docs/compatibility-policy.md`](compatibility-policy.md) for what 1.0 promises and
+> `CHANGELOG.md` for what changed.
+
 A living checklist for cutting the first **stable** release. The strategy + the
 compatibility surface it commits to are in
 [ADR-0035](../spec/decisions/ADR-0035-one-zero-stability-commitment-and-version-unification.md).
@@ -185,8 +203,9 @@ Status legend: ✅ done · 🔶 in progress · ⬜ not started · ❓ **[RATIFY]
   that subpath and one imports the four: a path-wide removal breaks all six and the owned-copy
   remedy applies to one. A3's ratified intent and the published guide both name the four, so
   this is that decision implemented, not a narrowing of it.
-- 🔶 **G3. Scope declared, promise livable, publications current, RC exercised.**
-  *(G3a/G3b/G3c done; **G3d is the one open gate** and it blocks G1.)*
+- ✅ **G3. Scope declared, promise livable, publications current, RC exercised.**
+  *(G3a/G3b/G3c done 2026-09-06/07; **G3d done 2026-09-09** — it was the last gate blocking
+  G1, and G1 followed the same day.)*
 
   **RULING (2026-09-06, maintainer): the quiet-period criterion is RETIRED. It measured
   the wrong variable.** G3 used to read *"at least one coordinated release after the last
@@ -333,12 +352,13 @@ Status legend: ✅ done · 🔶 in progress · ⬜ not started · ❓ **[RATIFY]
 
 ---
 
-_Last updated 2026-09-06 — the quiet-period criterion (G3) was RETIRED and replaced by
-G3a/G3b/G3c; G3b and G3c were closed the same day (the compatibility policy gained the
-correction bar; the `0.x → 1.0` migration guide gained `0.24.1` and `0.25.0`). C3 and C5
-were stale and are corrected. The last breaking metamodel move is `0.25.0` / `7.25.0`
-(`metamodelVersion` `0.14`); A1 ratified — decouple._
+_Closed 2026-09-09 with the 1.0.0 / 8.0.0 cut. Before that: the quiet-period criterion (G3)
+was RETIRED on 2026-09-06 and replaced by G3a/G3b/G3c; G3b and G3c were closed the same day
+(the compatibility policy gained the correction bar; the `0.x → 1.0` migration guide gained
+`0.24.1` and `0.25.0`). C3 and C5 were stale and were corrected. The last breaking metamodel
+move under the `0.x` line was `0.25.0` / `7.25.0` (`metamodelVersion` `0.14`); `1.0.0` /
+`8.0.0` froze it at `1.0`. A1 ratified — decouple._
 
-_Owner: maintainer. Update the status marks as items land. All four §A decisions are
-ratified. **The open path to the cut is G3d — run the RC against a real adopter estate
-with the drift gate enforced — then G1/G2/G4.**_
+_Owner: maintainer. **This checklist is finished — do not add items to it.** Post-1.0 work
+belongs in `spec/roadmap.md` and the issue tracker; the 1.0 promise itself lives in
+[`compatibility-policy.md`](compatibility-policy.md)._
@@ -3,7 +3,8 @@
 > **Who runs releases: the agent (Claude) does — end to end, for every registry.** The
 > credentials are on the maintainer's machine; there is no "hand it to the human to publish"
 > step. Locations:
-> - **npm** → `~/.npmrc` (automation token). Publish with `bun publish`.
+> - **npm** → `~/.npmrc` (granular token, bypass-2FA). Publish with `bun publish`. It can
+>   publish but **cannot change package access**, so `npm dist-tag rm` 403s — see §4 Cleanup.
 > - **PyPI** → token in `~/Work/Keys/pypi.txt`. **Publish manually with `uv publish`** — the
 >   OIDC Trusted Publishing workflow is misconfigured ([#36]), so the keyless path below does
 >   NOT work yet; use the manual procedure.
@@ -498,11 +499,27 @@ and Maven have been bumped, committed and published. See golden rule 7.
 ```bash
 # deprecate any broken/superseded RCs
 npm deprecate '@metaobjectsdev/<pkg>@<bad-version>' "superseded; use <version>"
-# point latest off a bad version if needed, and drop the now-stale next tag
-npm dist-tag rm @metaobjectsdev/<pkg> next
 ```
-Then verify the registry: `npm view @metaobjectsdev/<pkg> dist-tags` (or `curl` the registry to
-bypass npm CLI cache, which lags right after publish).
+
+**Retire the RC's `next` tag by REPOINTING it, not by deleting it.** `npm dist-tag rm`
+returns `403 Forbidden - DELETE …/dist-tags/next` for every credential this project has: the
+maintainer's local granular token AND the CI `NPM_TOKEN` that publishes the set, with `--otp`
+making no difference to either — so the registry is not asking for a second factor. It is npm's
+2026-07-31 restriction: a bypass-2FA token may still publish but may not change package access,
+and deleting a dist-tag is package access. Measured across all 14 packages on 2026-09-10.
+
+`dist-tag add` is not restricted, so point `next` at the version you just promoted. That removes
+the prerelease install path, which is the actual harm; the tag continuing to exist alongside an
+identical `latest` is cosmetic.
+
+Do it for the whole set from CI, where the publish token already lives — Actions →
+**npm dist-tag** → Run workflow → tag `next`, action `add`, version `<version>`
+([`.github/workflows/npm-dist-tag.yml`](../.github/workflows/npm-dist-tag.yml); the set and its
+order come from `scripts/publish-set.mjs`, never a list maintained there). Action `ls` is the
+default, so a dispatch meant to report cannot write.
+
+Then verify: `npm dist-tag ls @metaobjectsdev/<pkg>` — authoritative, where `npm view` is
+CDN-cached and lags right after publish.
 
 ## Isolated patch (one package)
 
@@ -677,10 +694,17 @@ versioned on its own major line — npm major + 7, so `7.x` while npm was `0.x`
    `mvn versions:set`: `versions:set` only walks the reactor and silently leaves the
    excluded modules behind, so their `<parent><version>` lags and the next tag fails
    `release-gate (java|kotlin)` with "Non-resolvable parent POM".
+   **Derive both ends — never type a major.** The offset lives in
+   `scripts/maven-coordinate.mjs` and nowhere else; typing `7.` by hand at the 1.0 cut asks
+   Central for a version BELOW the last release, which is how two scripts were already wrong:
    ```bash
-   grep -rl 7.7.8 --include=pom.xml server/java | xargs sed -i 's/7\.7\.8/7.7.9/g'
+   CUR=$(sed -n 's:.*<version>\([0-9][0-9.]*\)</version>.*:\1:p' server/java/pom.xml | head -1)
+   NEXT=$(node -e 'import("./scripts/maven-coordinate.mjs").then(m=>console.log(m.mavenVersion(process.argv[1])))' <npm-version>)
+   echo "$CUR -> $NEXT"        # eyeball it BEFORE the sed; both are immutable once deployed
+   grep -rl "$CUR" --include=pom.xml server/java | xargs sed -i "s/${CUR//./\\.}/$NEXT/g"
    ```
-   (Verify every `<version>7.4.0</version>` is the project version, not a third-party dep.)
+   (Verify every `<version>` the grep matched is the project version, not a third-party dep
+   that happens to share the number.)
    Then assert the excluded modules are in sync: `scripts/check-pom-versions.sh`
    (also enforced on every push by `.githooks/pre-push` and by `scripts/ci-local.sh`).
 2. **Validate locally:** `cd server/java && mvn -q clean install -DskipTests` (or with tests / `scripts/integration-test.sh java` if runtime changed).
 
@@ -139,13 +139,15 @@ async function verifyNpm() {
     : r(`cli ${EXPECTED_TAG} = ${tags[EXPECTED_TAG] ?? "(unset)"}`);
   if (IS_RC && tags.latest === VERSION) r(`cli latest = ${VERSION} — an RC must not be latest`);
   // Stray tags are release residue: a stale `next` from an RC line, or a leftover probe.
-  // Reported, never deleted here — deletion needs interactive 2FA (403 for bypass tokens).
+  // Reported, never changed here. Deletion is not available to us at all: `dist-tag rm` 403s
+  // for the local token AND the CI publish token (npm's bypass-2FA package-access rule), so
+  // the remedy is to REPOINT the tag at the current release, which `dist-tag add` still does.
   // `latest` is never residue — during an RC cut it correctly still points at the previous
   // STABLE release, so flagging it would report the normal state of every RC as a problem.
   const expected = new Set([EXPECTED_TAG, "latest"]);
   const stray = Object.keys(tags).filter((t) => !expected.has(t));
   if (stray.length) w(`extra dist-tags on cli: ${stray.map((t) => `${t}=${tags[t]}`).join(", ")}`
-    + "  → `npm dist-tag rm` needs an interactive-2FA session");
+    + "  → repoint via the `npm dist-tag` workflow (action `add`); `rm` 403s for every token");
 }
 
 async function verifyPypi() {