v0.4.1

Fixed

• readResourceLog now consults the chain-head pin on an absent log: with a pin
  held for logId, a store.read() of null is refused as
  ResourceLogContinuityError (reason rollback, pinned head attached) instead
  of reported as pre-genesis. appendResourceLog and sealResourceLog surface
  the same refusal, and createResourceLog checks the pin before building or
  writing anything, adopting the served log or refusing the absent one rather
  than landing a fresh genesis over a hidden log. With no pin held, an absent
  log still reads as null.

Changed

• resourceLogPinId now throws a TypeError for an empty or slash-bearing
  spaceId, collectionId, or resourceId, instead of silently building an
  ambiguous slot key. Valid (URL-safe) ids produce the same pin id as before.
• confirmAppend compares the served and sent entries with the kernel's
  canonicalizeStrict; the direct json-canonicalize dependency is dropped.
• Internal cleanup: one shared verify-then-pin step in the append path, one
  versionId ordinal reader, and the sealing sweep resolves a controller's
  assertion key sets concurrently.
• The versioned verification-method DID URL is built and parsed by one codec,
  buildVersionedVm / parseVersionedVm (exported). The verifier now rejects a
  proof verificationMethod whose query is anything other than a single
  non-empty versionId parameter; previously extra parameters were ignored and
  the value was percent-decoded.