docs: out of beta, and what 1.0 promises

README.md

@@ -20,7 +20,7 @@ sudo fpm-tune install-service    # keep measuring under systemd, in advisory mod
 sudo fpm-tune mode apply         # let it act, once the plan has looked right for a day
 ```
 
-It is beta. Run it advisory first and read what it recommends. When it does act, a change is validated against a copy of the configuration, written atomically, reloaded with SIGUSR2, and rolled back if the master does not come back ([how it fails safe](docs/safety/how-it-fails-safe.md)).
+Run it advisory first and read what it recommends. When it does act, a change is validated against a copy of the configuration, written atomically, reloaded with SIGUSR2, and rolled back if the master does not come back ([how it fails safe](docs/safety/how-it-fails-safe.md)).
 
 ## Docs
 
@@ -30,4 +30,6 @@ It is beta. Run it advisory first and read what it recommends. When it does act,
 - [Forge and Ploi](docs/cookbook/forge-and-ploi.md): the recipe for those hosts
 - [How it decides](docs/how-it-decides/_index.md), [Operating](docs/operating/_index.md), [Safety](docs/safety/_index.md)
 
+1.x is stable: commands, flags, config keys, the two drop-in names, the metric names and the `/history.json` fields do not change within it, and a change that would break any of them bumps the major.
+
 Built on [phpfpm](https://github.com/cboxdk/phpfpm). MIT.

SECURITY.md

@@ -25,4 +25,4 @@ fpm-tune writes production PHP-FPM configuration and reloads a live master, so t
 
 ## Supported versions
 
-During the beta, only the latest tagged release is supported. Please reproduce against it before reporting.
+The latest release is supported. Please reproduce against it before reporting.

docs/getting-started/installation.md

@@ -21,7 +21,7 @@ It never runs `sudo`. On a server, run it as root so the binary lands in `/usr/l
 The script reads two environment variables:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/cboxdk/fpm-tune/main/install.sh | FPM_TUNE_VERSION=v0.1.0-beta.22 sh
+curl -fsSL https://raw.githubusercontent.com/cboxdk/fpm-tune/main/install.sh | FPM_TUNE_VERSION=v1.0.0 sh
 curl -fsSL https://raw.githubusercontent.com/cboxdk/fpm-tune/main/install.sh | FPM_TUNE_INSTALL_DIR=/opt/bin sh
 ```
 
@@ -46,12 +46,12 @@ Download the archive, `SHA256SUMS` and `SHA256SUMS.cosign.bundle` from the [rele
 ```bash
 cosign verify-blob \
   --bundle SHA256SUMS.cosign.bundle \
-  --certificate-identity "https://github.com/cboxdk/fpm-tune/.github/workflows/release.yml@refs/tags/v0.1.0-beta.22" \
+  --certificate-identity "https://github.com/cboxdk/fpm-tune/.github/workflows/release.yml@refs/tags/v1.0.0" \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
   SHA256SUMS
 sha256sum --check --ignore-missing SHA256SUMS
-tar -xzf fpm-tune-0.1.0-beta.22-linux-amd64.tar.gz
-sudo install -m 0755 fpm-tune-0.1.0-beta.22-linux-amd64/fpm-tune /usr/local/bin/fpm-tune
+tar -xzf fpm-tune-1.0.0-linux-amd64.tar.gz
+sudo install -m 0755 fpm-tune-1.0.0-linux-amd64/fpm-tune /usr/local/bin/fpm-tune
 ```
 
 Substitute the tag you downloaded. Keep `--certificate-identity`: without it cosign accepts any valid Sigstore signature, including one made by someone else. `python -m sigstore verify identity` with the same bundle, identity and issuer verifies it without cosign.
@@ -89,7 +89,7 @@ fpm-tune version
 fpm-tune plan
 ```
 
-`version` prints `0.1.0-beta.22`. `plan` reads the host and writes nothing. If it reports no pools, the cause is one of three:
+`version` prints `1.0.0`. `plan` reads the host and writes nothing. If it reports no pools, the cause is one of three:
 
 1. A master is running but its pools have no status page. This is the usual case on a fresh host; the error names the pools and the fix, `sudo fpm-tune enable-status`.
 2. No php-fpm master is running. `systemctl status php8.4-fpm` or `pgrep -a php-fpm` says so. The unit is `php8.4-fpm` on Debian and Ubuntu, which is what Forge and Ploi run, and `php-fpm` elsewhere.

docs/index.md

@@ -28,10 +28,14 @@ In advisory mode it does all of that and changes nothing: the plan is printed, p
 
 Follow the [Quickstart](quickstart.md): install, read a plan, run it advisory for a day, then let it apply. On Laravel Forge or Ploi, the [Forge and Ploi](cookbook/forge-and-ploi.md) recipe is the same path with those hosts' details filled in.
 
-fpm-tune is beta. Run it in advisory mode on a real host and read what it recommends before you let it write.
+Run it in advisory mode on a real host and read what it recommends before you let it write.
 
 When it does write, the change is validated against a copy of the configuration, written atomically, reloaded with SIGUSR2 rather than a restart, and rolled back if the master does not come back; see [How it fails safe](safety/how-it-fails-safe.md).
 
+## What 1.0 promises
+
+Within 1.x the commands, their flags, the config keys, the names of the two drop-ins, the metric names and labels, and the `/history.json` fields stay as they are. A release that would break any of them bumps the major; a new command, flag, key or series is a minor. The numbers a plan reaches can change with a minor, because the measurement improves; the shape of what you read and script against does not.
+
 ## Going deeper
 
 - [How it decides](how-it-decides/_index.md): the budget, the measurement, the division, and when it holds still.

docs/maintaining/releasing.md

@@ -13,7 +13,7 @@ This page is for a maintainer cutting a release. A release is one tag push; the
 Changes reach `main` by squash-merged pull requests. The version is stamped into the binary from the tag and the Homebrew formula's version is rewritten from the tag when it is published, so nothing else needs bumping. Push the tag:
 
 ```bash
-git tag -a v0.1.0-beta.22 -m "v0.1.0-beta.22" && git push origin v0.1.0-beta.22
+git tag -a v1.0.0 -m "v1.0.0" && git push origin v1.0.0
 ```
 
 Do not run `gh release create` yourself. The Release workflow creates the release, and if one already exists for the tag the workflow fails with "already exists" and publishes nothing.
@@ -26,13 +26,13 @@ On a `v*` tag, [`release.yml`](https://github.com/cboxdk/fpm-tune/blob/main/.git
 
 1. Builds the four archives (linux and darwin, amd64 and arm64) with `scripts/build-release.sh`, the same script `make dist` runs, so a local build and this one produce the same archives. The Linux binaries are fully static, and the script refuses to ship one that is not. Each archive carries the binary, `README.md`, `LICENSE`, `SECURITY.md` and `docs/`.
 2. Signs `SHA256SUMS` with a keyless [Sigstore](https://www.sigstore.dev/) signature via `cosign`. The signer is the workflow's own OIDC identity, so there is no private key to store or rotate, and one signature over the checksum file covers every archive.
-3. Runs `gh release create` with the archives, `SHA256SUMS` and the signature bundle, with generated notes. A tag with a suffix (`-beta.22`, `-rc.1`) is created as a pre-release.
+3. Runs `gh release create` with the archives, `SHA256SUMS` and the signature bundle, with generated notes. A tag with a suffix (`-rc.1`, `-beta.1`) is created as a pre-release.
 
 It does not touch the Homebrew tap.
 
-## What "latest" means during the beta
+## Versions and what "latest" means
 
-A pre-release is not what GitHub's `releases/latest` returns. While no stable release exists, `install.sh` falls back to the highest version among all releases, pre-releases included, so `latest` resolves to the newest beta. Once a stable release exists, `latest` is that release and betas are only reachable with `FPM_TUNE_VERSION`.
+The version is semantic. Within a major, the commands, flags, config keys, drop-in names, metric names and `/history.json` fields are stable; a release that breaks one of them bumps the major, and anything added is a minor. A tag with a suffix (`v1.1.0-rc.1`) is published as a pre-release, which GitHub's `releases/latest` does not return; `install.sh` then keeps resolving `latest` to the newest stable release, and the pre-release is reachable only with `FPM_TUNE_VERSION`. (Before 1.0 there was no stable release, and `latest` fell back to the newest beta.)
 
 ## The Homebrew formula
 
@@ -55,7 +55,7 @@ That is the only secret involved. The client id identifies the App rather than a
 Without the secret the release still succeeds. `formula.yml` warns and prints the command to run by hand:
 
 ```bash
-python3 scripts/publish-formula.py v0.1.0-beta.22
+python3 scripts/publish-formula.py v1.0.0
 ```
 
 A missing tap update should not fail a release that is otherwise good, and it must not pass silently either, because a tap that has stopped updating looks like one that is current.
@@ -69,7 +69,7 @@ A missing tap update should not fail a release that is otherwise good, and it mu
 `workflow_dispatch` on `formula.yml` checks out the tag you give it and runs that tag's copy of `publish-formula.py`. For a recent tag that is right; for an old tag it runs the publisher as it was then. To republish an older release with the current publisher, run it from a current checkout:
 
 ```bash
-python3 scripts/publish-formula.py v0.1.0-beta.22
+python3 scripts/publish-formula.py v1.0.0
 ```
 
 It reads the release's own `SHA256SUMS`, so it works for any tag with a published release.

docs/operating/metrics-and-alerting.md

@@ -102,7 +102,7 @@ The shape, with one round from a real host:
     "capacity": 2880,
     "host": {
         "hostname": "cbox-web",
-        "version": "0.1.0-beta.22",
+        "version": "1.0.0",
         "apply": true,
         "cpu_ceiling": true,
         "cpu_headroom": 2,