v4.10.1

v4.10.1 — corrective release

Full entry: CHANGELOG.md § [4.10.1] and § [4.10.0]. This file records release evidence and the
upgrade note.

v4.10.0 was tagged but never published. Its release run failed, and the cause was self-inflicted:
the fingerprint-row check shipped in v4.9.2 made it impossible for any release to pass its own gate.
The tag was left in place rather than moved. v4.10.1 contains everything v4.10.0 intended to ship,
plus the fix.

What changed since v4.10.0

hooks/local/preflight.sh read a tag's target with
git for-each-ref --format='%(refname:short) %(*objectname)%(objectname)'. For an annotated tag
those two fields concatenate — the commit SHA immediately followed by the tag-object SHA — so the
field is 80 characters. The self-reference exemption compared it against a 40-character HEAD and
could never match.

Every release tag in this project is annotated, so the tag being cut always looked like a missing
fingerprint row, and preflight failed on the release runner. That deadlocks against PUBLISHING.md,
which correctly requires the row to be appended after tagging, because a tree cannot contain a row
describing its own digest.

The comparison is now a prefix match, which is exact for both shapes: %(*objectname) is empty for a
lightweight tag (so the field is the commit) and leads for an annotated one.

The fixture was the real defect. head-tag-is-exempt passed throughout because it built a
lightweight tag — a shape this project never ships. The test and the code agreed with each other
while both were wrong about the artifact. The oracle now uses git tag -a, with a second pair of rows
keeping lightweight coverage rather than trading one blind spot for the other.

Everything from v4.10.0

Identical — see docs/release-notes/v4.10.0.md and CHANGELOG.md § [4.10.0]. In short: Flow's
vendored CLI-owned assets moved from CLI 0.25.16 to 0.29.8; --app <appId> corrected to
<appPath>; 40 unrendered <%= template expressions removed and tripwired; two provider skills
adopted (20 → 22); /fusebase-health gained a CLI-version signal; a problem-catalog entry for a
deploy 502 misread as a logout; and the stampers no longer record digests of bytes that never ship.

Upgrade note

No migration, no config change beyond what v4.10.0 described.

Identify which tree you have

docs/release-fingerprints.md maps every released tree to its manifest fingerprint, including the
three unpublished tagged trees (v4.9.0, v4.9.1, v4.10.0). A released tree cannot contain its
own row — adding it changes the digest it describes — so each tree's row is published in the
following release. The v4.10.1 row will appear in the next one.

Release evidence

Item	Value
Tag verification	the v4.10.1 run is the authoritative gate; a local run is never release evidence
Superseded	v4.10.0 — tagged, release run failed at preflight, never published, tag not moved
Pre-tag verification	db369d6 green on both platforms, 1094/1094 on Windows (the CLI 0.29.8 content)

Known residuals

Unchanged from v4.10.0:

• The command gate still denies honest prose quoting a destructive pattern (K21/M8).
• Tag immutability is enforced by operator confirmation, not a repository ruleset.
• The vendored CLI layer is a materialized installation snapshot, not a compatibility certification.
  A CLI newer than the bundled version is advisory, never a failure.
• stamper-hashes-worktree-not-artifact remains open and deliberately undecided: hashing committed
  bytes would fix artifact fidelity but trade away local-tamper detection. The trade-off is the ticket.
• Local pre-push detection of the manifest-freshness class is not shipped; CI enforces it.