[jderochervlk]

The alpha readiness review found that runtime fixtures could silently remain compile-only, the generated-JavaScript drift check inspected ignored outputs, the rescript@>=13 peer range excluded the intentionally supported ReScript 13 alpha, and release versions were generated from commit hashes rather than a numbered alpha series.

This branch adds explicit compile-only, documentation-example, Node-runtime, and Chromium-runtime fixture categories with registration checks; meaningful assertions for the existing Node-compatible Fetch and URL fixtures; and a native Chromium runner that imports compiled ReScript modules and reports fixture-specific async failures. Negative consumer compilations verify intended diagnostics rather than accepting arbitrary compiler failures.

The packed-consumer check installs the actual npm tarball with ReScript 13.0.0-alpha.5, compiles default, Fetch, and SafeFetch consumers, runs a Node smoke test, verifies rejection of unsupported compiler versions and Fetch-only SafeFetch, and checks package contents. The release machinery uses package.json/package-lock.json version 1.0.0-alpha.1, validates the explicit alpha version and registry availability, exercises the same packed artifact, and separates no-OIDC validation/dry-run from a main-only publication job. Only that publish job receives id-token: write; it verifies the downloaded artifact name/version and publishes with the alpha dist-tag.

Closes #384.
Closes #396.
Refs #383 and #385. The binding-specific Chromium and negative type-contract fixtures are being added in the stacked bindings PR. The npm trusted-publisher account configuration cannot be confirmed from repository access; #385 remains release-gated until a maintainer verifies owner rescript-lang, repository experimental-rescript-webapi, workflow filename release.yml, environment unset, and that direct npm publish is allowed. This PR does not publish or merge.

[jderochervlk]

Independent review of exact head 77b59836d6ef1838795f78496f7dd89cd98816de against live issue bodies #383/#384/#385/#396 (base ebe9cca601fb85e6064c786367e546ded9b07d05). No source edits or approval submitted.

One P2 finding: tests/browser/native-api.spec.mjs:24–28: the failure formatter can itself throw. In Chromium, injecting an awaited module rejection shaped as {RE_EXN_ID: "Review_bigint", _1: 1n, Error: new Error("original")} produces only page.evaluate: TypeError: Do not know how to serialize a BigInt; a cyclic payload similarly produces the circular-JSON error. These replace the original exception and lose fixture/source-stack diagnostics. This is not a false pass, but violates the requested robust failure reporting. Use a nonthrowing formatter that always retains fixture, exception identity and original stack; cover these cases. Ordinary async ReScript Assert_failure diagnostics work.

Independent evidence: fresh npm ci, formatting, build, feature checks, packed consumers, negative consumers, Node tests, Chromium tests, docs build, release check, full/prod audits, and npm publish <same consumer-validated tarball> --dry-run --access public --tag alpha all passed. Artifact SHA-256 was unchanged. Local toolchain: Node 24.16.0/npm 11.15.0; GitHub CI and Release also passed on the configured Node 26 (release pins npm 11.5.1), with actual publication skipped. In-memory probes confirmed Node assertion and registration-omission failures, empty browser-registry failure, useful ordinary async assertion diagnostics, and main/event/published-version/fail-closed registry guards.

Acceptance still open: #383 needs the formatter fix above; binding-specific native/unsafe/nullable cases are intentionally stacked, not missing foundation dependencies. #384 installation/artifact behavior passes, but supported/tested compiler-version prose is absent from this head. #385 machinery passes inspection/execution, but release/tag/release-note/changelog/dist-tag-verification instructions are absent here, and external npm configuration remains unverified: owner rescript-lang, repository experimental-rescript-webapi, workflow release.yml, environment unset, direct npm publish allowed. Keep #385 open. Documentation gaps can be owned by the docs stack; the intentionally deferred docs-link gate is not a foundation defect. #396 passes: narrow patched overrides, clean install, zero full/prod audit findings, no added runtime dependencies.