Patch release. See CHANGELOG.md#042---2026-08-06.
If you copied docs/vault-ci/guard.yml before this release, bump its ENGINE_REF. It shipped pinned to v0.2.0, which predates the commit-author check — so the push-time guard, the one tier --no-verify cannot skip, ran green while never looking at authorship. Both templates now track the current release, and a test ties VERSION, the changelog and both ENGINE_REFs together so it can't drift again.
If your vault predates v0.4.0, it has no identity block and the author check is not running on it. There is no automatic upgrade — --adopt fills scaffold files and never edits a manifest — so it's a hand edit, now documented at Upgrading an existing vault. make doctor now names the exact key to add instead of reporting a bland optional ok.
Also fixes sync-skills.sh printing link targets shortened to the checkout while writing absolute ones.