What a form actually depends on
Fragments are the obvious answer and the incomplete one. These are the edges that break estates.
Fragments and subforms
The shared components everyone knows about. Track them by revision, not by path, or a reorganisation silently repoints them.
Schemas and data bindings
A schema change can invalidate a form that renders perfectly. Bindings are a dependency edge and should resolve to a specific schema revision.
Fonts and glyph coverage
An embedded subset covers the characters someone expected the form to need. Language variants, accented names and currency symbols are where that assumption fails, usually in print.
Submit targets and external services
The endpoint a form posts to is a dependency even though nothing in the file looks like one. It is also the one most likely to be decommissioned without anyone checking which forms still point at it.
The renderer itself
Treat the engine version as part of the release manifest. A form is only correct with respect to something that renders it.