release: follow-ups for code health, CI, setup and the docs site #373

Items still open from the audit issues #359 and #355. The fixed items landed in #363; this issue tracks what is left. Each item says why it was not part of that fix.

From #359 (code health and CI)

Partly done (the rest is open):

• High: compat matrix skips the private-API collectors (+ *-real variants, pinned 20.3.x): Added the 9 listed tests plus new injector-tree-real and defer-blocks-real to pageSide in packages/devtools/vitest.compat.config.ts. Running them on real Angular 20.0.7 and 21.2.25 found two collector bugs, both fixed with tests: user-provided component providers were hidden from the injector tree on every version, and @defer blocks were all dropped on Angular 20 because ɵgetDeferBlocks returns no hostNode. Not done: real-app variants for change-detection, cd-recorder and the signal tests. Also not done: the 20.3.x pin, because on 20.3.33 the existing signal-graph-real resource test fails (resources never fold into cards on 20.x). That needs its own look before the pin goes in. (done in fix(components): report silent limits, fix two notices, add real-app CD tests and an API canary #380 and fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)
• Medium: Node and OS coverage does not match engines: Added a node-22 job to ci.yml that runs pnpm test:devtools on Node 22. It passes locally on Node 22.22 (162 files, 1800 tests). Documented. The windows-latest job is skipped because Windows could not be checked here. (done in fix: work through the follow-up lists and mask Signal Forms secrets in signal graphs #438 and ci: test on Windows, keep coverage and the extension zip, and check the extension panel #468)
• Low: commit and docs checks only warn: Removed --warn from the PR title step in commit-message.yml, so a bad title now fails. Commit range still only warns. Updated docs/contributing/commit-message-guidelines.md, apps/docs contributing/development.md and the devtools-commit skill. The optional docs-check failure was left as is. (done in feat: refetch, rule presets, redaction counts, device pick, router types and Firefox build #491 and fix: pre-release cleanup of review findings and tracker leftovers #494)
• Improvement: private-API canary test: The new *-real tests assert that ɵgetInjectorProviders, ɵgetInjectorResolutionPath and ɵgetDeferBlocks/ɵgetControlFlowBlocks exist on each compat version. There is still no full per-symbol canary. (done in fix(components): report silent limits, fix two notices, add real-app CD tests and an API canary #380)

Open:

• Medium: very large files (split devframe.ts and panel pages, line-count CI check): Large refactor across many files; out of scope for a small, safe change. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489, refactor(ui): split the network page into section components #495 and refactor(mcp): split devframe.ts into per-area modules #496: devframe.ts went from 3,235 to 772 lines and the network page from 3,142 to 349; the line ratchet in pnpm lint runs in CI, so no file over 1,500 lines can grow and no new one can pass the limit)
• Medium: no linter (NgDebugApi type, eslint/oxlint, ratchet): Brings in new tooling and touches hundreds of call sites; needs a design decision. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489)
• Medium: no coverage measurement: New dependency, CI thresholds and several new test suites; larger than a local fix. (done in ci: test on Windows, keep coverage and the extension zip, and check the extension panel #468)
• Medium: Vite peer range tested at one version: Needs a new matrix and a decision between testing Vite 5-7 or raising the peer floor. (done in fix: pre-release cleanup of review findings and tracker leftovers #494)
• Low: axe runs on a static build only: Needs a new Playwright harness against the live SSR demo; larger than a local fix. (done in fix: release blockers found by the 1.0.0 test campaign #432)
• Improvement: overlay debug-api.ts with @SInCE notes and generated compat docs: Cross-cutting refactor plus docs generation. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489 and fix: pre-release cleanup of review findings and tracker leftovers #494)
• Improvement: Vite tab with module graph and timings: New feature needing a product decision. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489 and feat(hub): ng serve dev-server builder, and module timings in the Build tab #493)

From #355 (setup, distribution and the docs site)

Partly done (the rest is open):

• Setup Low: no supported builder list: Reworded the /vite entry and vite.md: the plugin works in any Angular app built with its own vite.config, but not the Angular CLI dev server. Skipped the webpack/Nx/Rsbuild table because those setups are untested and the claims can't be checked in code. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470)
• Setup Improvement: vite startup hint via printUrls: The Vite plugin wraps server.printUrls, so the banner gets a Pangular Inspector: <origin>/__devframes/ line. It is skipped on servers without printUrls, and the URL uses the origin because the hub ignores Vite's base. Tested in vite-server.test.ts and documented in vite.md. There is no global popup keyboard shortcut to print.

Open:

• Setup Low: Node floor above Angular 20 (to confirm): Couldn't confirm: only Node 22 is available here, so a Node 20.19 run isn't possible, and lowering engines without a CI run is risky. (done in feat!: fix the readiness review findings and settle the agent API #433 and fix: work through the follow-up lists and mask Signal Forms secrets in signal graphs #438)
• Setup Improvement: hub extra devframes passthrough: Adds new public options to initPangularHub and the Vite plugin, which needs a design decision. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489)
• Setup Improvement: docs Supported setups matrix: Needs claims about builders that aren't verified; this is the same table as the Low item. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470)
• Docs Medium: setup and guide pages repeat each other: Merging pages restructures the docs and the nav; that is a content decision, not a local fix. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470)
• Docs Medium: no API reference: Needs ngmd.api.ts plus finishing the per-symbol routes in the docs generator; too large. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470)
• Docs Medium: troubleshooting is scattered: A new cross-cutting page linked from every Getting Started page and the panel empty states; too large for this batch. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470 and fix: pre-release cleanup of review findings and tracker leftovers #494)
• Docs Low: sidebar badges mean nothing: Needs a version-based expiry design in ngmd.config. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470)
• Docs Low: no page for planned platforms: A new page plus a link from the panel's coming-soon view touches app/; that is a product and content decision. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470 and fix: pre-release cleanup of review findings and tracker leftovers #494)
• Docs Improvements (features overview, llms.txt, videos, generated tools reference, agent recipes, shortcuts reference, version matrix): Each is a new page or generator, not a small local change. (done in docs: add troubleshooting, platforms and setup pages, and merge the setup guides #470 and fix: pre-release cleanup of review findings and tracker leftovers #494; videos moved to release: manual checks for 1.0.0 #482, for the maintainer)

Tracked elsewhere

These items from the audit are not listed above because another issue already tracks them:

• A setup codemod: phase 3 of 4: a shell you live in #342 (ng add schematic)
• Extension standalone mode: hub: follow-ups for hub security, the extension and the native overlays #371
• A release workflow with provenance: build(release): publish the package from a release workflow #190