Correct guard policy documentation and prepare v0.4.1

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-polygraph",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Sends Claude back once when its final message says tests pass but the session shows no passing run after the last edit. Adds /agent-polygraph:check for a report on your past sessions. Runs locally, nothing is uploaded.",
   "author": {
     "name": "Eleftherios Chondros",

docs/releases/v0.3.2.md

@@ -1,6 +1,6 @@
 # agent-polygraph v0.3.2 — claim evidence fixes
 
-Prepared for the staged npm release process. This file does not establish that npm publication has completed. Check `npm view agent-polygraph version` and the public-install verification workflow.
+Published on npm and in [GitHub Releases](https://github.com/EleChon-pixel/agent-polygraph/releases/tag/v0.3.2). A clean public npm install was verified on 3 November 2026. The exact npm source commit is `c3cb6c329c5a2621319f74f9ecd2690bb864b33e`.
 
 - Check every detected passing-test claim sentence in a message. A backed first sentence no longer hides a later failed claim. The guard quotes the actual flagged sentence.
 - Abstain when a test ran in an unrelated checkout. Preserve subagent working directories in Claude Code and Codex, and avoid using another project's run for a generic claim in a multi-project session.
@@ -10,4 +10,4 @@ Prepared for the staged npm release process. This file does not establish that n
 
 Package and Claude plugin versions are both 0.3.2. No dependencies added. Reinstall shell integration with `agent-polygraph record --install --shell` after upgrading to regenerate its copied shell script; existing category-only receipts remain readable with unknown scope.
 
-Validation and the utility assessment are documented in [usefulness-review.md](../usefulness-review.md). Publication requires green main-branch CI, GitHub OIDC staging and maintainer npm 2FA approval. A later GitHub release tag must point to the exact staged source commit.
+Validation and the utility assessment are documented in [usefulness-review.md](../usefulness-review.md). The release used [GitHub OIDC staging](https://github.com/EleChon-pixel/agent-polygraph/actions/runs/41689551085) and maintainer npm 2FA approval. The GitHub release tag identifies the exact npm source commit.

docs/releases/v0.4.0.md

@@ -1,6 +1,6 @@
 # agent-polygraph v0.4.0 — executable guard verification
 
-Prepared for OIDC staged publishing. This document does not establish public npm availability. Check the registry and public-install verification after maintainer approval.
+Published on npm and in [GitHub Releases](https://github.com/EleChon-pixel/agent-polygraph/releases/tag/v0.4.0). The [public-install verification](https://github.com/EleChon-pixel/agent-polygraph/actions/runs/41697406992) passed. The exact npm source commit is `6c529ebd2717f51f5a71a30c03a7862d3033a875`; later documentation changes do not modify its immutable tarball.
 
 - Add `guard --install --mode verify --test-command "npm test"`: execute an explicitly selected command in the fixed project folder at Stop, including stops without any passing-test claim and continued stops after repairs.
 - Default to fresh execution without pass caching. Add optional content/environment-bound, expiring pass reuse for deterministic local suites.

docs/releases/v0.4.1.md

@@ -0,0 +1,12 @@
+# agent-polygraph v0.4.1 — README correction
+
+Prepared for the existing OIDC staged-release process. Check npm and the public-install workflow before treating this version as published.
+
+- Correct the claim that no guard policy executes tests. Distinguish the retrospective audit, transcript-only `claims`/`strict` policies and executable `verify` policy.
+- Put installation and executable-verification setup near the top. Explain that existing installations and the plugin retain the default claims policy.
+- Include executable verification in the controlled benchmark comparison, with its actual 12-run cost and the limits of authored scenarios.
+- Correct statements about unclaimed failures, fingerprints, repeatability and privacy so their scope matches the implementation.
+- Collapse the historical example and replace outdated policy-selection advice.
+- Update publication records for the already-published 0.3.2 and 0.4.0 releases without moving their tags or changing their tarballs.
+
+Only documentation and matching package/plugin version metadata change. Runtime behavior, dependencies and hook policy defaults are unchanged from 0.4.0. The new version is necessary because npm's archived 0.4.0 README cannot be overwritten.

docs/releasing.md

@@ -1,6 +1,6 @@
 # Publishing agent-polygraph to npm
 
-**Latest public release verified during development:** `agent-polygraph@0.3.2`. A clean public npm install on 3 November 2026 verified its CLI, demo, README, `explain`, `doctor` and integrity metadata after [OIDC staging](https://github.com/EleChon-pixel/agent-polygraph/actions/runs/41689551085). Published versions are immutable. The source now prepares 0.4.0; GitHub commits alone do not publish npm releases. See [v0.4.0 notes](releases/v0.4.0.md).
+**Latest public release verified:** `agent-polygraph@0.4.0`, installed and checked from npm on 3 November 2026. Its [GitHub Release](https://github.com/EleChon-pixel/agent-polygraph/releases/tag/v0.4.0) and npm `gitHead` identify source commit `6c529ebd2717f51f5a71a30c03a7862d3033a875`. The [public-install check](https://github.com/EleChon-pixel/agent-polygraph/actions/runs/41697406992) passed after [OIDC staging](https://github.com/EleChon-pixel/agent-polygraph/actions/runs/41695697316). Published versions are immutable. The source now prepares the README-only 0.4.1 patch; GitHub commits alone do not publish npm releases. See [v0.4.1 notes](releases/v0.4.1.md).
 
 ## Published v0.3.0
 
@@ -45,7 +45,7 @@ node scripts/release-check.mjs
 
 The archived `0.3.0` tarball cannot be modified in place. The published `0.3.1` patch corrects outdated version and feature-availability language in the README without changing runtime behavior. The public npm install and the corrected README were verified; see [v0.3.1 release notes](releases/v0.3.1.md).
 
-## Prepared evidence patch (v0.3.2)
+## Published evidence patch (v0.3.2)
 
 Version 0.3.2 was published and verified from the public npm registry on 3 November 2026. See [v0.3.2 release notes](releases/v0.3.2.md) and the [utility review](usefulness-review.md). Its exact npm source commit is `c3cb6c329c5a2621319f74f9ecd2690bb864b33e`; later source changes do not alter that tarball. Users of shell integration should regenerate the copied script after upgrading with `agent-polygraph record --install --shell`.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-polygraph",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Check your coding agents' \"tests pass\" claims against what actually ran. Reads Claude Code and Codex session logs locally.",
   "type": "module",
   "bin": {