v1.0.0

verify-trail.mjs for this release, and the SHA-256 of the exact file attached below.

73fa6f548a8fd25cea979fa9546dab8bc6187854b1c79e3557b6b24276410ae3  verify-trail.mjs

Check your copy with shasum -a 256 verify-trail.mjs, or on Windows
certutil -hashfile verify-trail.mjs SHA256. This digest is computed by the
release job from the bytes it attaches, so it is not a value anybody typed.

Added 2026-09-17: fixtures.zip, the fixtures directory exactly as it stands at this tag, built with git archive --format=zip <tag> fixtures. Extract it beside verify-trail.mjs and run the verifier against each fixture before you trust it with your own record. It was attached after release; verify-trail.mjs and the digest above are unchanged.