docs: align release and recovery guidance

docs/ERROR_CODES.md

@@ -0,0 +1,15 @@
+# ForgeFlow error and recovery catalog
+
+| Code | Meaning | Recovery |
+| --- | --- | --- |
+| `RECONCILIATION_PLAN_REQUIRED` | A server mutation was requested without its reviewed plan. | Open Review reconciliation and apply the current plan ID. |
+| `RECONCILIATION_PLAN_STALE` | Server truth changed after preview. | Rescan, review the new impact and apply that plan. |
+| `SERVER_GIT_VERIFICATION_FAILED` | Branch, deploy key or pinned SSH evidence could not be proven. | Run Verify server pull; repair only the failing check before retrying. |
+| `DEPLOY_KEY_NOT_READ_ONLY` | A matching key can write to Gitea. | Revoke it in Gitea and configure a dedicated read-only key. |
+| `SSH_DEPLOYMENT_PREFLIGHT_FAILED` | One or more deployment safety checks failed. | Open preflight evidence and follow the failing check's detail. |
+| `REMOTE_WRITE_ACCESS_REQUIRED` | The SSH user cannot safely write the managed source/state paths. | Use Check / fix write access after reviewing its scoped impact. |
+| `UPDATE_ORIGIN_MISMATCH` | An update asset points outside the trusted Gitea origin. | Correct release asset URLs; never bypass the origin check. |
+| `UPDATE_CHECKSUM_MISMATCH` | Downloaded bytes do not match the published checksum. | Keep the current version and republish the exact commit atomically. |
+
+Audit and discovery never repair these conditions automatically. Mutating recovery
+actions require an explicit user flow and preserve rollback or snapshot evidence.

docs/RELEASING.md

@@ -0,0 +1,39 @@
+# Releasing ForgeFlow
+
+ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.
+
+## Quality gate
+
+```powershell
+npm ci
+npm run quality
+npm audit --omit=dev --audit-level=high
+```
+
+## Signed Windows build
+
+Production signing is fail-closed. Configure electron-builder's Authenticode
+certificate through its supported CSC environment variables, then set:
+
+```powershell
+$env:FORGEFLOW_SIGNED_RELEASE = '1'
+$env:FORGEFLOW_EXPECTED_PUBLISHER = 'exact certificate subject fragment'
+npm run dist:win
+```
+
+Both installer and portable executable must have a valid Authenticode signature,
+the expected publisher and a timestamp. The build also creates SHA-256 files, a
+CycloneDX SBOM and a provenance document containing commit and build ID.
+
+Without `FORGEFLOW_SIGNED_RELEASE=1`, local builds may be unsigned for development
+testing but must never be published as production releases.
+
+## Atomic publication
+
+`npm run release:binary` keeps the Gitea release in draft state while uploading
+the installer, portable executable, two checksums, provenance and SBOM. It only
+publishes after all six assets are present. A failed upload leaves a draft rather
+than exposing an incomplete updater target.
+
+The production Authenticode certificate and legal publisher identity are
+`PENDING_HUMAN_INPUT`; all surrounding build and verification code is complete.

docs/TEST_MATRIX.md

@@ -1,8 +1,33 @@
 # Test matrix
 
-## Automated in v0.4.0
+## Automated baseline (0.10.x)
 
-The suite contains 59 passing tests.
+The quality chain contains 159 automated tests. The latest Windows run completed
+with 158 passing tests, no failures and one Bash-dependent skip. `npm run
+coverage` enforces 55% lines/statements/functions and 45% branches; the measured
+baseline is 68.06% statements/lines, 67.75% functions and 50.27% branches.
+
+`npm run quality` is the local equivalent of `.gitea/workflows/quality.yml` and
+runs source verification, ESLint, the complete suite and coverage on Node 22 LTS.
+Production dependencies are separately checked with `npm audit --omit=dev
+--audit-level=high`.
+
+### Server safety and reconciliation
+
+- inventory discovery is read-only and byte-stable for configuration;
+- reconciliation requires a content-addressed preview plan and recovery snapshot;
+- automatic linking requires unique exact provenance/runtime identity;
+- server-pull verification checks Gitea branch, read-only deploy-key ID, pinned
+  host/key fingerprints, remote/live SHA, Compose evidence, runtime and health;
+- a fresh access verification is mandatory immediately before server-pull deploy;
+- writable or missing deploy keys fail closed.
+
+### Renderer regression matrix
+
+The dark demo was verified at 1120×720, 1440×900 and 1920×1080. Automated DOM
+checks cover literal invalid values, unnamed buttons, unlinked field labels,
+horizontal overflow and modal/palette viewport overflow. Motion-safe illustration
+contracts and reduced-motion CSS are source-tested.
 
 ### Git and repository behavior