Audit documentation language and links

.github/workflows/markdown.yml

@@ -12,15 +12,17 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DavidAnson/markdownlint-cli2-action@v19
+      - uses: actions/checkout@v5
+      - uses: DavidAnson/markdownlint-cli2-action@v23.2.0
         with:
-          globs: '**/*.md'
+          globs: |
+            **/*.md
+            #node_modules/**
 
   links:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --verbose "**/*.md"

.markdownlint.json

@@ -1,4 +1,7 @@
 {
   "MD013": false,
+  "MD024": {
+    "siblings_only": true
+  },
   "MD033": false
 }

CHANGELOG.md

@@ -7,14 +7,10 @@ and this project intends to follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-- Separated canonical generator orchestration (`generator/`), generated file
-  templates (`templates/`), and repository tests (`tests/`) while retaining
-  compatibility re-exports for existing `scripts/` and `src/` imports.
-- Added independent forms, table, charts, and localization capability/template
-  boundaries plus a generated-application manifest contract test.
-
 ### Added
 
+- Independent forms, table, charts, and localization capability/template
+  boundaries plus a generated-application manifest contract test.
 - Capability options for client state, UI libraries, icons, notifications, and
   local API mocking, with isolated generated dependencies and source.
 - Capability options for date/time helpers, standard or Lodash utilities,
@@ -28,17 +24,27 @@ and this project intends to follow [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- Separated canonical generator orchestration (`generator/`), generated file
+  templates (`templates/`), and repository tests (`tests/`) while retaining
+  compatibility re-exports for existing `scripts/` and `src/` imports.
 - Replaced the implementation-specific `shadcn` option with the capability-based
   `uiLibrary` option. The previous input remains as a deprecated compatibility
   alias.
 - Declared the supported Node.js range as `^20.19.0 || >=22.13.0` in both the
   generator and generated projects.
 - Added a standalone generated-project typecheck script while preserving the
   existing build script behavior.
-- Moved canonical generator internals to scoped `scripts/` modules while
-  preserving the previous `src/` imports as compatibility re-exports.
-- Reduced `scripts/generator.mjs` to capability composition; base, UI, testing,
-  resilience, and extended templates now have independent ownership modules.
+- Introduced scoped generator modules under `scripts/`, then moved the canonical
+  implementation to `generator/` and `templates/`. Existing `scripts/` and
+  `src/` imports remain compatibility re-exports.
+- Split base, UI, testing, resilience, forms, table, charts, localization, and
+  other capability templates into explicit ownership modules.
+
+### Fixed
+
+- Upgraded Markdown workflow actions from Node.js 20 to Node.js 24 runtimes.
+- Added repository-local Markdown linting and configured release-scoped
+  changelog headings so CI failures are caught before a pull request is pushed.
 
 ## [1.0.0] - 2026-06-28
 

README.md

@@ -74,11 +74,12 @@ project has this shape:
 
 ```text
 my-app/
-├── .github/
-├── public/
+├── e2e/                  # only with testing=e2e
 ├── src/
-├── tests/
+├── components.json       # only with uiLibrary=shadcn
+├── index.html
 ├── package.json
+├── tsconfig.json
 └── vite.config.ts
 ```
 

SECURITY.md

@@ -2,8 +2,9 @@
 
 ## Supported versions
 
-No stable version has been released. Security support begins with the first
-published stable release; this policy will then list supported release lines.
+The `1.x` release line is supported. Older major versions are unsupported unless
+a release-specific notice states otherwise. See the
+[compatibility policy](docs/engineering/COMPATIBILITY.md) for runtime support.
 
 ## Reporting a vulnerability
 

docs/GETTING_STARTED.md

@@ -3,7 +3,9 @@
 ## Prerequisites
 
 - Node.js `20.19` or newer, `22.13` or newer, or Node.js `24`.
-- npm available on `PATH`.
+- npm available on `PATH` to install this repository from its committed
+  `package-lock.json`.
+- pnpm available on `PATH` for the primary generated-application workflow.
 
 ## Generate the default project
 
@@ -13,8 +15,8 @@ From this repository:
 npm ci
 npm run generate -- my-app
 cd my-app
-npm install
-npm run dev
+pnpm install
+pnpm run dev
 ```
 
 Open the URL printed by Vite. The default includes routing, an API client, a
@@ -25,8 +27,8 @@ capabilities.
 ## Verify before development
 
 ```bash
-npm run build
-npm test
+pnpm run build
+pnpm test
 ```
 
 Both commands must pass. If generation rejects an option combination, change
@@ -35,8 +37,10 @@ files are written.
 
 ## Generate a minimal project
 
+From the template repository root:
+
 ```bash
-npm run generate -- minimal-app \
+pnpm run generate -- minimal-app \
   --router=false \
   --apiClient=false \
   --layout=none \