release: prepare 1.0.1

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes are listed here. Versions follow [Semantic Versioning](https
 
 ## [Unreleased]
 
+## [1.0.1] - 2026-11-08
+
+Patch release: one robustness fix from the panic-path review, plus documentation. No feature changes.
+
 ### Fixed
 
 - Opening a CHD whose header declared an absurd size could abort the program while allocating the hunk map. The header is now checked first (AUDIT B-11).

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/if-core", "crates/if-hash", "crates/if-image", "crates/usbwri
     "crates/if-drive", "crates/isofoundry", "crates/isofoundry-helper"]
 
 [workspace.package]
-version = "1.0.0"
+version = "1.0.1"
 edition = "2021"
 license = "MIT"
 authors = ["Sean Shaffer"]

README.md

@@ -6,12 +6,13 @@
 
 ## TL;DR
 
-IsoFoundry is a single free Windows program for working with CDs, DVDs, Blu-rays, disc image files (like `.iso`) and bootable USB drives. You pick a job from a grid of big buttons — burn a disc, copy one, turn files into an image, check an image for errors — or run the same job from the command line. The current release (1.0.0) covers disc-image tools (create, browse, extract, edit, convert, mount, checksum and verify against known-good hash lists), bootable USB, audio conversion, disc burning, ripping and copying, and spanning backup. Disc, USB and audio hardware paths are proven against simulated drives and disk-image files, and stay **Unverified** on real hardware until field reports arrive (see [Status](#status)). Nothing in IsoFoundry needs the internet, and it never sends data anywhere.
+IsoFoundry is a single free Windows program for working with CDs, DVDs, Blu-rays, disc image files (like `.iso`) and bootable USB drives. You pick a job from a grid of big buttons — burn a disc, copy one, turn files into an image, check an image for errors — or run the same job from the command line. The current release (1.0.1) covers disc-image tools (create, browse, extract, edit, convert, mount, checksum and verify against known-good hash lists), bootable USB, audio conversion, disc burning, ripping and copying, and spanning backup. Disc, USB and audio hardware paths are proven against simulated drives and disk-image files, and stay **Unverified** on real hardware until field reports arrive (see [Status](#status)). Nothing in IsoFoundry needs the internet, and it never sends data anywhere.
 
 ## Status
 
-**1.0.0 (2026-11-08)** is the first stable release. Hardware paths stay **Unverified** until real-drive reports arrive; see [docs/LIMITATIONS.md](docs/LIMITATIONS.md) and [AUDIT.md](AUDIT.md).
+**1.0.1 (2026-11-08)** is the current release; 1.0.0 was the first stable release. Hardware paths stay **Unverified** until real-drive reports arrive; see [docs/LIMITATIONS.md](docs/LIMITATIONS.md) and [AUDIT.md](AUDIT.md).
 
+- **1.0.1** — patch: opening a CHD with a hostile header no longer aborts the program (AUDIT B-11); documentation refresh. No feature changes.
 - **1.0.0** — the 0.9.0 feature set promoted with no feature changes: image tools, bootable USB, audio conversion, burning, ripping/copying, spanning backup.
 - **0.9.0** — M6 integration plus the RC pass: spanning backup/restore with a catalog on every span, auto-action on disc insert, shell completion scripts, Explorer verbs, an opt-in update check, MusicBrainz CD lookup, completion actions (sound, notification, shutdown), failure drills, accessibility statement and measured budgets.
 - **0.5.0** — M4 burning plus M5 ripping and copying through the `if-drive` layer (IMAPI2 burning, MMC/SPTI raw reading): burn image/files/MP3/video, erase, drive info, disc → image with dump reports, disc → disc, secure audio ripping with AccurateRip checksums, audio CD burning, surface scans and recovery. Every flow also runs against a built-in simulated drive (`--fake`), the test gate for these milestones; no burn or rip has run on real hardware yet, so those paths are **Unverified**.

docs/roadmap.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-**Status: in development since 2026-10-31 (WinISOPilot 1.0.0 shipped).** Progress: M0 done (0.1.0). M1 done on `main` (reading, extraction, hashing, ISO creation, CD formats, CHD, conversion, editing, mounting and the GUI task windows); ships as 0.2.0. M2 USB built on `main` (usbwriter crate, both task windows, CLI, helper protocol v2); ships as 0.3.0 — physical-disk runs and QEMU boot checks still owed. M3 audio conversion built on `main` (if-audio crate: Symphonia decode, WAV/FLAC encode, MP3 via runtime LAME, AAC via Media Foundation, tags, ReplayGain, batch window + CLI); ships as 0.4.0 — the Media Foundation AAC path and LAME-on-Windows path are still to be exercised on a real machine. M4 burning built on `main` (if-drive crate: drive trait, fake drive with digest verify, IMAPI2 backend with hand-declared bindings; burn-image / burn-files with multisession append / burn-mp3 / burn-video / erase / drive-info windows + CLI, all runnable against `--fake`); shipped as 0.5.0 — no burn has run on real hardware, per this milestone's fake-drive test gate. M5 MMC ripping/copying built on `main` (SPTI raw reader with READ TOC / READ CD, rip/copy/scan engines in if-drive, fake drive read side with a damage map; copy-to-image / copy-disc / rip / burn-audio / surface-test / recover windows + CLI); shipped as 0.5.0 alongside M4 — no rip has run on real hardware either, per the same fake-drive gate. M6 integration built on `main` (spanning backup/restore with a catalog on every span, auto-action on disc insert, CLI completion scripts, Explorer verbs, opt-in update check, MusicBrainz disc lookup, and completion actions — sound/notification/shutdown); ships grouped with the RC pass as 0.9.0 (0.6.0 was never released separately). RC pass done on `main` (full audit, failure drills, accessibility pass, measured budgets, multi-drive burn from the command line); ships as 0.9.0. **1.0 released 2026-11-08** as the stable promotion of the 0.9.0 feature set (no feature changes; the release workflow marks it a full release, not a pre-release).
+**Status: in development since 2026-10-31 (WinISOPilot 1.0.0 shipped).** Progress: M0 done (0.1.0). M1 done on `main` (reading, extraction, hashing, ISO creation, CD formats, CHD, conversion, editing, mounting and the GUI task windows); ships as 0.2.0. M2 USB built on `main` (usbwriter crate, both task windows, CLI, helper protocol v2); ships as 0.3.0 — physical-disk runs and QEMU boot checks still owed. M3 audio conversion built on `main` (if-audio crate: Symphonia decode, WAV/FLAC encode, MP3 via runtime LAME, AAC via Media Foundation, tags, ReplayGain, batch window + CLI); ships as 0.4.0 — the Media Foundation AAC path and LAME-on-Windows path are still to be exercised on a real machine. M4 burning built on `main` (if-drive crate: drive trait, fake drive with digest verify, IMAPI2 backend with hand-declared bindings; burn-image / burn-files with multisession append / burn-mp3 / burn-video / erase / drive-info windows + CLI, all runnable against `--fake`); shipped as 0.5.0 — no burn has run on real hardware, per this milestone's fake-drive test gate. M5 MMC ripping/copying built on `main` (SPTI raw reader with READ TOC / READ CD, rip/copy/scan engines in if-drive, fake drive read side with a damage map; copy-to-image / copy-disc / rip / burn-audio / surface-test / recover windows + CLI); shipped as 0.5.0 alongside M4 — no rip has run on real hardware either, per the same fake-drive gate. M6 integration built on `main` (spanning backup/restore with a catalog on every span, auto-action on disc insert, CLI completion scripts, Explorer verbs, opt-in update check, MusicBrainz disc lookup, and completion actions — sound/notification/shutdown); ships grouped with the RC pass as 0.9.0 (0.6.0 was never released separately). RC pass done on `main` (full audit, failure drills, accessibility pass, measured budgets, multi-drive burn from the command line); ships as 0.9.0. **1.0 released 2026-11-08** as the stable promotion of the 0.9.0 feature set (no feature changes; the release workflow marks it a full release, not a pre-release).  **1.0.1 (2026-11-08)** is a patch release: the CHD header bound (AUDIT B-11) plus docs.
 
 All milestones ship as public **0.x pre-releases**. **1.0** = every 1.0 row done, tested, documented.
 Evidence label per feature: **Verified** (tested on real target), **Partially verified** (fake drive / VHDX / VM only), **Unverified**.