chore(release): prep CHANGELOG for v4.0.1 GA

[bpamiri]

Summary

Pre-flight prep for the v4.0.1 GA tag. Mirrors #2606 (the v4.0.0 analog). Once this lands, the remaining release-day step is a single release/v4.0.1-to-main PR.

What changed

• CHANGELOG header — promoted ## [Unreleased] to # [4.0.1](...) => 2026-05-20. This is the line release.yml grep-validates for => TBD. Bump the date here on develop if the release-to-main PR slides past today.
• Section terminator fix — changed the ---- (4 dashes) separator between the new 4.0.1 block and the 4.0.0 block to --- (3 dashes). release.yml's release-notes extraction is awk '/^# \[VERSION\]/,/^---$/' — that pattern matches only the 3-dash form. Without this fix, the GitHub Release body for 4.0.1 would bleed into the 4.0.0 section. Same issue, same fix as chore: prep CHANGELOG for v4.0.0 GA #2606.
• Short patch tagline — one-line blockquote summarizing the release theme (Adobe CF 2023/2025 compat hardening, Windows Scoop install fixes, paginationNav() framework presets, plural mappings).

Pre-flight checks

• CHANGELOG has no => TBD for 4.0.1 → release.yml validation step passes
• wheels.json version is clean (4.0.1, no -snapshot suffix) → already bumped by bump-develop-version.yml after the v4.0.0 GA
• Release-notes awk extraction terminates at the correct boundary: awk '/^# \[4\.0\.1\]/,/^---$/' CHANGELOG.md | wc -l reports 85 lines, ending immediately before # [4.0.0]
• develop CI is green (last push, run 26171463495, success in 8m31s)

Scope of v4.0.1

103 commits / ~97 unique PR references since the v4.0.0 tag (8 days). Highlights:

• Adobe CF 2023/2025 compat hardening — cfheader attributeCollection trap (fix(dispatch): copy arguments to a plain struct in $header() for Adobe CF 2023 #2750), env() reserved-word parameter (fix(dispatch): swallow cfheader InvalidHeaderException when response committed #2756), Vite asset-walk array-by-value (fix(dispatch): swallow cfheader InvalidHeaderException when response committed #2756). Documented in .ai/wheels/cross-engine-compatibility.md and CLAUDE.md anti-patterns Fixed bug in $findRoute() that causes blow up on unmatched named route #10/New master #11.
• Windows Scoop install — wheels.cmd cmd.exe bat-jar pre-parser (fix(cli): scoop wheels.cmd invokes java.exe directly to dodge cmd.exe bat-jar pre-parse #2766), .zip.sha512 sidecar layout (fix(release): emit .zip.sha512 sidecars + close Scoop install gotchas (#2758) #2761), Git prereq doc fix (docs: add scoop install git prereq to Windows install steps #2763), scoop bucket add java doc fix (docs: drop scoop bucket add java step after scoop-wheels#4 #2762).
• paginationNav presets — viewStyle argument with Bootstrap 4/5 and Tailwind presets (feat(view): add viewStyle preset to paginationNav and pageNumberLinks #2731), anchor-mode auto/always/never (fix(view): paginationNav anchor modes default to window-aware auto-suppress #2733), unknown-arg validation (fix(view): paginationNav rejects unknown sub-helper arguments #2726).
• Package system — plural mappings for legacy CFML aliases (wheels-sentry@1.0.0 is broken when installed via 'wheels packages add' — hardcoded plugins.sentry.SentryClient path doesn't resolve in vendor/wheels-sentry/ #2705/feat(config): plural mappings in package.json for legacy CFML aliases (#2705) #2739), auto-registered per-package mapping in PackageLoader (PackageLoader does not auto-register a per-package Lucee mapping — installed packages can't reference their own internal CFCs by static path #2712), wheels packages add is now the canonical install verb (fix(cli): wheels packages help now documents add as canonical install verb #2729).
• CLI deploy — flat-alias bootstrap/exec/fetch-secrets/extract-secrets/print-secrets to dodge picocli root-token absorption (fix(cli): add wheels deploy bootstrap/exec flat aliases (#2677) #2690/fix(cli): add wheels deploy fetch-secrets/extract-secrets/print-secrets flat aliases (#2697) #2699), --release alias for --version (fix(cli): add --release alias for deploy --version to dodge picocli (#2674) #2691), Dockerfile/.dockerignore scaffolding in wheels deploy init (feat(cli): scaffold Dockerfile and .dockerignore in wheels deploy init #2686).
• Compat-matrix fixes — CockroachDB advisory-lock skip (fix(model): override $supportsAdvisoryLocks=false on CockroachDB so lockingSpec skips #2746/fix(model): skip CockroachDB advisory-lock specs via capability override #2747), Oracle insertAll + system-tables transaction skip (fix(model): Oracle insertAll uses INSERT ALL form to avoid RETURNING-with-VALUES error #2749/fix(migrator): renameSystemTables skips transaction wrapper on Oracle (#2745) #2753), MySQL addColumnOptions text-default carve-out (fix(migrator): carve out MySQL in addColumnOptionsSpec text-default assertion #2748), BoxLang lockingSpec catch-scope discard workaround (fix(test): work around BoxLang catch-scope discard in lockingSpec #2754).

Manual steps for me (after this PR merges to develop)

1. Pull develop locally.
2. Verify the date in CHANGELOG still reflects the release day; bump on develop if it slid.
3. Cut archive branches: archive/develop-pre-v4.0.1, archive/main-pre-v4.0.1 (keep for at least one cycle in case rollback is needed).
4. Open release/v4.0.1-to-main (merge develop into main, since main's PR-required ruleset blocks direct push — see Release 4.0.0 — merge develop into main #2607 for the v4.0.0 pattern).
5. PR to main, merge with "Create a merge commit". release.yml fires on the push to main, creates the v4.0.1 tag via softprops/action-gh-release, and publishes the GitHub Release.
6. bump-develop-version.yml should auto-fire via repository_dispatch (the fix for #2609 shipped on develop), opening a follow-up PR to bump wheels.json to 4.0.2.

Test plan

• commitlint passes on this PR
• No-op CI on develop (this is a CHANGELOG-only change)

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR: CHANGELOG-only pre-flight prep for the v4.0.1 GA tag. The three changes (header promotion, blockquote tagline, 4-dash to 3-dash separator) are all mechanically correct and well-motivated. Approving.

---

Correctness

Header promotion (## [Unreleased] to # [4.0.1](...) => 2026-05-20): heading level matches the # [4.0.0] precedent; date matches the PR landing date; URL follows the same pattern as the 4.0.0 entry.

Separator fix (line 102 area): release.yml uses awk '/^# [VERSION]/,/^---$/' CHANGELOG.md to extract release notes; the 4-dash form ---- would not match the ^---$ anchor, causing the GitHub Release body for 4.0.1 to bleed into the 4.0.0 section. The fix is correct and identical to the v4.0.0 analog (#2606). The preamble separators above the version header (lines 8 and 20) intentionally remain ---- — those precede the rebrand note and intro, not version blocks, so the awk range never reaches them.

Tagline accuracy: cross-checked against the CHANGELOG body. env() (#2756, confirmed at line 46 of the merged file), Vite asset-walk (lines 150-151), cfheader attributeCollection (#2750), Scoop wheels.cmd (#2766), viewStyle (#2718/#2731), and plural mappings (#2705/#2739) all have matching entries in the 4.0.1 ### Fixed / ### Added sections. The "~100 PRs" figure (PR body quotes 103 commits / ~97 unique PR refs) is a reasonable approximation.

Pre-flight checks in the PR body — awk line count reported at 85, no => TBD remaining, wheels.json already at 4.0.1 — provide strong independent assurance that the extraction boundary terminates correctly.

Commits

chore(release): prep CHANGELOG for v4.0.1 GA — type chore, scope release, subject under 100 chars, not ALL-CAPS. Conforms to commitlint.config.js.

Docs

This PR IS the doc change; no secondary docs update needed.

---

No correctness, cross-engine, test, or security concerns (CHANGELOG-only, no executable code). Clean approval.

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review checks out. The three claims (header level matches precedent, separator fix is mechanically correct, commit message conforms to commitlint) are all verified against the diff. No padding, no unsupported assertions.

Sycophancy

None detected. A cited specific evidence for every claim before approving.

False positives

None detected. Spot-checked each of A's assertions:

• Header promotion: diff shows ## [Unreleased] → # [4.0.1](...) => 2026-05-20, matching the # [4.0.0] H1 precedent at the end of the diff. Correct.
• Separator fix: removed line is ---- (4 dashes), added line is --- (3 dashes). release.yml's awk range pattern /^---$/ requires exactly 3 dashes. Fix is correct.
• A notes the preamble ---- separators (lines 8 and 20) intentionally remain — confirmed: they are outside any version block and the awk range never hits them.
• Commit message: chore(release): prep CHANGELOG for v4.0.1 GA — valid type, optional scope, subject under 100 chars, sentence case. Correct.

Missed issues

None detected. This is a CHANGELOG.md-only change with no executable code. DCO is not a missed issue — the commit carries Signed-off-by: Peter Amiri <peter@alurium.com> (human-authored, not bot-authored) and the PR merged with the required DCO check passing.

Verdict alignment

APPROVE is consistent with the findings: pure documentation change, no cross-engine risk, no security surface, pre-flight assertions independently verifiable.

Convergence

Aligned. A's review is accurate and complete; verdict is correct. No changes needed.