📝 record Storybook completion and 1.1 release scope

GITHUB_ISSUE_STORYBOOK.md

@@ -272,14 +272,19 @@ build` job so a broken documentation site cannot merge through auto-merge.
 ## Acceptance Criteria
 
 - [x] `npm run storybook` starts the site locally
-- [ ] `npm run build-storybook` succeeds in hosted CI (pending local review and
-      pull request)
+- [x] `npm run build-storybook` succeeds in hosted CI through
+      [PR #27](https://github.com/IsaacInsoll/react-grid-gallery/pull/27) and its
+      successful required
+      [CI run](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359292755)
 - [x] Storybook-backed Playwright scenarios use the same static build locally and
       in CI
 - [x] Existing dist-backed Playwright coverage remains green until an explicitly
       reviewed parity migration preserves equivalent built-artifact coverage
-- [ ] The deployed Pages site works from the repository's configured base path
-      (Pages is configured for Actions; deployment awaits merge)
+- [x] The deployed Pages site works from the repository's configured base path;
+      the first protected
+      [Pages deployment](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359400123)
+      succeeded and serves the
+      [maintained documentation](https://isaacinsoll.github.io/react-grid-gallery/)
 - [x] Component controls and curated docs accurately describe the public API
 - [x] Storybook does not duplicate authoritative Markdown documentation or load
       remote runtime assets

MODERNIZATION_PLAN.md

@@ -1802,6 +1802,15 @@ applications.`
     the manager never exposes an unpainted light strip below short stories in
     dark mode; keep inline documentation canvases content-sized to avoid
     restoring their resize feedback loop.
+  - Completed 2026-08-10 through
+    [PR #27](https://github.com/IsaacInsoll/react-grid-gallery/pull/27): all
+    required hosted checks passed in
+    [CI run #31359292755](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359292755),
+    including the clean-clone package-root type-resolution correction found by
+    the first hosted attempt. The protected
+    [Pages run #31359400123](https://github.com/IsaacInsoll/react-grid-gallery/actions/runs/31359400123)
+    then deployed the maintained documentation successfully at the configured
+    repository base path.
 - Consumer fixtures: keep at least one Vite + React + TypeScript smoke test for
   packed package installs.
 
@@ -2051,3 +2060,20 @@ informed this package API and is credited in the changelog and
 acknowledgements. Only the reusable library capability was adopted; PICR
 backend, GraphQL, branding, and administration work remain outside this
 package.
+
+## Post-1.0: Release 1.1.0
+
+The maintainer decided on 2026-08-10 to release `1.1.0` from the current
+post-Storybook `main` state after manually confirming npm's package-level
+**Require two-factor authentication and disallow tokens** publishing-access
+setting. Do not add upstream-triage fixes or unrelated features to this release
+without a new explicit scope decision.
+
+Immediately before running the documented release process, complete the
+existing `v1.1.0` changelog section with the maintained Storybook documentation
+launch and confirm its release date. Keep that changelog edit as the only
+unstaged tracked change required by `docs/RELEASING.md`; do not commit it through
+an ordinary documentation pull request first. Run the full stable-release flow,
+approve the staged package with npm 2FA, move `next` to `1.1.0` after npm
+publication, and require finalization to verify both `latest` and `next` before
+publishing the GitHub Release.

docs/RELEASING.md

@@ -83,6 +83,24 @@ Set and keep package publishing access configured to require 2FA and disallow
 tokens. npm trusted publishing continues to work because it uses short-lived
 OIDC credentials rather than traditional automation tokens.
 
+Verify this package-specific control in npm's web interface before a stable
+release, following npm's
+[trusted-publishing guidance](https://docs.npmjs.com/trusted-publishers/#recommended-restrict-token-access-when-using-trusted-publishers);
+the CLI cannot confirm that traditional tokens are disallowed:
+
+1. Sign in to npmjs.com and open `@picr/react-grid-gallery`.
+2. Open **Settings**, then find **Publishing access**.
+3. Select **Require two-factor authentication and disallow tokens
+   (recommended)**.
+4. Click **Update Package Settings** if the selection changed, completing the
+   requested 2FA challenge.
+5. Confirm the same option remains selected after the settings page reloads.
+
+This restriction applies to traditional granular-token authentication, not the
+short-lived OIDC credentials issued to the configured trusted publisher. Keep
+the trusted publisher limited to `npm stage publish`; the staged package still
+requires a maintainer's explicit 2FA approval before publication.
+
 The bootstrap token was read only by the `1.0.0-rc.0` publish step. Both the
 GitHub environment secret and the corresponding granular npm token have been
 removed, and the one-off token branch has been removed from the permanent