release: WRNexusJS 0.4.0

docs/TEST-CHECKLIST-0.4.md

@@ -0,0 +1,57 @@
+# WRNexusJS 0.4 test checklist
+
+## Automated
+
+Run from the repository root:
+
+```bash
+bun install
+bun run verify:0.4
+bun run validate:0.4
+```
+
+`validate:0.4` performs:
+
+1. structural release verification;
+2. TypeScript checking;
+3. ESLint;
+4. all package tests;
+5. Prettier verification;
+6. 0.4 integration tests;
+7. basic application tests and production build;
+8. component showcase generation, tests, and build;
+9. CAPTCHA showcase tests and build;
+10. managed CAPTCHA service tests.
+
+## Package runtime
+
+- Package absent and marker absent: no runtime script.
+- Package installed but component unused: no runtime script.
+- One or many components used: one runtime script.
+- Script has correct MIME and `nosniff` headers.
+- TypeScript runtime entries compile in development.
+- Production runtime filename is content hashed.
+- CSR navigation to a runtime page loads and mounts it.
+- Navigation away calls unmount and removes listeners/timers.
+- Runtime and asset public-path collisions fail clearly.
+
+## CAPTCHA
+
+- No application public copy of `captcha.js` exists.
+- No manual script tag exists.
+- Number, alphabet, alphanumeric, calculation, audio, image, and not-robot modes work.
+- Compact, normal, and big layouts work at mobile and desktop widths.
+- Listen can be hidden or shown.
+- Disturbance values 25–75 affect image difficulty.
+- All image styles and random pools render.
+- Protected page grants and redirects after verification.
+- Validated form rejects invalid fields and unverified CAPTCHA.
+- Tokens expire, are single use, and are action/host bound.
+
+## Migration
+
+- Updating an old app creates a backup.
+- Legacy CAPTCHA script tags are removed once.
+- Legacy runtime files are archived, not silently lost.
+- Re-running the migration is idempotent.
+- Existing deployed apps continue to build.