@@ -8,6 +8,12 @@ _Add entries here, never under a stamped version_ — a release commit renames t
 heading, and a branch that wrote beneath it merges without conflict straight into a
 published section (it happened to #170).
 
+## [0.47.1] - 2026-10-10
+
+PATCH by content: test tooling and documentation only; production source and
+dependencies are unchanged. Tagged during the 2026-09-15 → 10-15 release freeze
+on the maintainer's explicit "merge #248, release" instruction.
+
 ### Added
 
 - Reproducible offline container validation of the pinned published CLI against
 
@@ -1,7 +1,7 @@
 # MCP Registry — Project Context
 
 > This file is automatically read by Claude Code on every session.
-> Keep it updated as decisions are made. Last updated: 2026-10-08.
+> Keep it updated as decisions are made. Last updated: 2026-10-10.
 
 ---
 
@@ -30,11 +30,17 @@ No SDK upgrade, HTTP relay, or full protocol-conformance claim. Installed-client
 interoperability and usage-skill behavior remain unmeasured; Jev/Clef stays
 deferred for user subscription/access. See `docs/GUARD.md` and `CHANGELOG.md`.
 
-**Next validation work (unreleased):** `scripts/dogfood-protocol.sh` runs a
+**v0.47.1 release preparation:** PR #248 merged as `235fd21`, byte-identical to
+Astra-reviewed `a6e8fcb`. PATCH: test tooling/docs only; production source and
+dependency locks are unchanged. `scripts/dogfood-protocol.sh` runs a
 separately locked, offline container matrix against published 0.47.0 and official
 SDK v1/v2 peers. See `docs/PROTOCOL-VALIDATION.md` for measured scope and evidence;
 this tests a published baseline, not candidate runtime code. Native client/adapter
-and model/skill validation remains pending.
+and model/skill validation remains pending. Local Linux/arm64 and hosted Linux/amd64
+runs passed 40 comparisons, with two expected unsupported combinations, seven
+container self-checks and a launcher regression. All nine PR checks passed;
+tagging/publication verification is pending. The maintainer explicitly requested
+"merge #248, release" during the recorded release freeze.
 
 **Previous release context (historical):**
 
 
@@ -385,6 +385,11 @@ embedded sampling/elicitation requests. Unknown embedded request shapes produce
 a coverage warning. See the [protocol coverage matrix](docs/GUARD.md#protocol-and-carrier-coverage)
 for the exact stdio boundaries and remaining gaps.
 
+v0.47.1 adds a reproducible [sandbox compatibility harness](docs/PROTOCOL-VALIDATION.md)
+for the pinned published v0.47.0 baseline and official SDK v1/v2 peers. Its named
+stdio matrix passes on Linux/arm64 and Linux/amd64; installed native clients and
+complete protocol conformance remain unverified. Runtime behavior is unchanged.
+
 Install-time trust scoring catches most poisoned servers before they ship. But what about **rug-pulls** — a server that changes its tool definitions after you've already approved them? Or **prompt-injection in tool responses** — adversarial text embedded in a Slack message, web page, or calendar invite that the agent reads through your trusted MCP server?
 
 `mcpm guard` adds a runtime inspection layer. It wraps every installed MCP server with a stdio relay, scans tool descriptions / responses / arguments for OWASP MCP Top 10 attack patterns, pins each tool's schema at install time, and blocks calls when the live response drifts from the pin (rug-pull defense).
 
@@ -1,5 +1,8 @@
 # Sandboxed stdio compatibility validation
 
+Repository test tooling added in v0.47.1. The reference baseline deliberately
+remains published v0.47.0; a release does not silently repin the matrix.
+
 Run the pinned **published** CLI against official SDK reference peers, both
 directly and through `mcpm guard run --inner`:
 
 
@@ -335,14 +335,16 @@ is the big content vehicle.
 
 ---
 
-## Agent-trend follow-up (2026-10-09)
+## Agent-trend follow-up (2026-10-10)
 
 The v0.46.0 evidence/usage-skill pilot is released. v0.47.0 adds
 modern MCP guard carrier coverage: discovery metadata and declaration
 pins, embedded sampling/elicitation content, and explicit unsupported-input
 warnings. The [coverage matrix](GUARD.md#protocol-and-carrier-coverage) records
-what is inspected and what remains outside this slice. Authored fixtures exercise
-offline inspection and a guarded stdio subprocess; installed-client protocol
+what is inspected and what remains outside this slice. v0.47.1 adds the
+[isolated reference-peer matrix](PROTOCOL-VALIDATION.md): 40 passing direct/guarded
+comparisons and two explicitly unsupported combinations on Linux/arm64 and
+Linux/amd64, against the pinned published v0.47.0 baseline. Installed native-client
 interoperability and usage-skill behavior still need evaluation. Jev/Clef stays
 deferred until users have subscription/access. No SDK or HTTP expansion is implied.