0.4.0 was tagged but never reached the registry — the manual release ran
aground on the pin/restore dance the previous commit removed, so the
latest published version is still 0.3.0 while v0.4.0 points at a commit
three behind master.

Rather than move a public tag, 0.4.1 becomes the first release to go out
through the workflow. It carries everything 0.4.0 would have, plus the
permanent version pins, the examples fix, and the sandbox test fix. The
gap at 0.4.0 on npm is deliberate.