@@ -8,6 +8,10 @@ _Add entries here, never under a stamped version_ — a release commit renames t
 heading, and a branch that wrote beneath it merges without conflict straight into a
 published section (it happened to #170).
 
+## [0.48.1] - 2026-10-31
+
+PATCH: close Skills and resource discovery metadata inspection gaps.
+
 ### Added
 
 - Guard inspection of Skills frontmatter and resource discovery metadata, including
 
@@ -7,7 +7,7 @@
 
 ## What We're Building
 
-**Unreleased Skills guard coverage (2026-10-31):** `discovery_metadata` inspects
+**v0.48.1 release preparation (2026-10-31; publication pending):** `discovery_metadata` inspects
 Skills list/get frontmatter and resource discovery metadata with shared metadata
 patterns. Critical matches block; ordinary skill resource text remains warn-only.
 The candidate-only SDK2.4 fixture exercises modern and legacy wire paths; fixed
 
@@ -448,7 +448,7 @@ The guard sits inline on the stdio channel between your AI client and each MCP s
 
 - **The request your agent sends** — the tool name and arguments, checked for sensitive-path exfil and injection smuggled into call parameters.
 - **The response the server returns** — checked for instruction injection hidden in the tool's output (the Slack message, web page, or calendar invite your agent is about to read).
-- **Skills discovery metadata (unreleased)** — skill list/get frontmatter and resource listing metadata use the same injection/concealment checks. Critical metadata matches block; file text remains warn-and-forward. See [Skills guard validation](docs/SKILLS-GUARD-VALIDATION.md) for measured scope and host-approval limits.
+- **Skills discovery metadata (v0.48.1 release preparation)** — skill list/get frontmatter and resource listing metadata use the same injection/concealment checks. Critical metadata matches block; file text remains warn-and-forward. See [Skills guard validation](docs/SKILLS-GUARD-VALIDATION.md) for measured scope and host-approval limits.
 - **The tool's own definition** — `tools/list` descriptions, schemas, and annotations, checked against the schema pinned at approval time, so a server can't quietly rewrite a tool you already trusted.
 
 When a frame trips a signature, drift check, or policy rule, the guard **drops it and hands your agent a JSON-RPC error in its place** — carrying the signature id and a `remediation` string — so the poisoned content never reaches your model. Clean calls pass straight through (p99 ~0.065 ms on small frames). Server-initiated `sampling` / `elicitation` requests are inspected the same way, with the error routed back to the server rather than to your agent.
 
@@ -41,7 +41,7 @@ Detection is layered:
 The stdio relay inspects message content; it does not negotiate versions or
 translate protocols. Legacy and modern peers must still be compatible with each
 other. The base modern coverage shipped in v0.47.0; the Skills discovery row
-below is unreleased. This matrix uses
+below is prepared for v0.48.1; publication is pending. This matrix uses
 using the [MCP 2026-07-28 changes](https://modelcontextprotocol.io/specification/2026-07-28/changelog),
 [discovery](https://modelcontextprotocol.io/specification/2026-07-28/server/discover),
 and [MRTR contract](https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr).
@@ -55,7 +55,7 @@ and [MRTR contract](https://modelcontextprotocol.io/specification/2026-07-28/bas
 | Unknown/malformed `inputRequests` | Emits `guard-unsupported-input-request` (`high`, default `warn`). Coverage is incomplete; the frame is forwarded and logged. Supported siblings are still inspected and can block. Local policy overrides apply normally. |
 | `roots/list` input requests | No model/user prompt content to scan. Forwarded; directory authorization remains the client's responsibility. |
 | `requestState` and retries | Opaque retry state is preserved without decoding or inspecting it. Retry correlation and the authorization of returned input are responsibilities of the client/server. |
-| Skills and resource discovery metadata (unreleased) | `skills/list` entries and `skills/get` entry frontmatter/`_meta`, plus resource listing name/title/description/annotations/`_meta`, reach the shared metadata patterns and concealment/budget checks under `discovery_metadata`. Critical instruction matches block; ordinary `resources/read` file text stays warn-and-forward. Directory reads and `resources/list` share a reply shape, so both resource listing surfaces are inspected regardless of URI scheme. |
+| Skills and resource discovery metadata (v0.48.1 preparation) | `skills/list` entries and `skills/get` entry frontmatter/`_meta`, plus resource listing name/title/description/annotations/`_meta`, reach the shared metadata patterns and concealment/budget checks under `discovery_metadata`. Critical instruction matches block; ordinary `resources/read` file text stays warn-and-forward. Directory reads and `resources/list` share a reply shape, so both resource listing surfaces are inspected regardless of URI scheme. |
 | Ordinary tool/resource/prompt results | Existing field-scoped detectors and retrieved-data warn clamp remain unchanged, including results that omit `resultType`. |
 | External schema references, skill archives, binary media | No external `$ref` resolution, archive fetching/extraction, image/audio understanding, or complete extension validation. Existing in-frame string scanning does not establish coverage of these contents. |
 | HTTP transports | No runtime relay inspection. Existing deny-by-default/explicit unguarded consent behavior remains. |
 
@@ -119,7 +119,7 @@ clients/platforms only with named versions and observed results; real provider
 or agent behavior may need dedicated test-account access.
 
 
-## Skills carrier candidate checks (unreleased)
+## Skills carrier candidate checks (v0.48.1 preparation)
 
 The explicit candidate-archive mode additionally resolves the candidate's actual
 SDK server dependency to serve the Skills extension, without changing the fixed
 
@@ -1,6 +1,7 @@
 # Skills-over-MCP guard validation
 
-Unreleased candidate, measured 2026-10-31 (Asia/Hong_Kong).
+v0.48.1 release preparation; publication pending. Candidate measurements from
+2026-10-31 (Asia/Hong_Kong) remain distinct from published-artifact evidence.
 
 ## Contract and scope
 
@@ -97,3 +98,9 @@ prompt injection. Binary blobs and external content remain outside this slice.
 The SDK also supports these handlers on legacy transports; that measurement is
 separate from the stable extension's modern base-protocol requirement. Two
 unsupported reference combinations remain legacy→modern-only and modern-pinned→legacy.
+
+
+## v0.48.1 release preparation
+
+PR #299 merged as `ae59d9b`, byte-identical to reviewed `d08eb1e`, after all nine
+checks passed. Release publication and actual-package validation are pending.