[ashhart]

What this changes

Releases TensorFold app 1.0.0-beta.10 with the released 1.1.4 engine, pinned archive and internal file checksums. Updates the shipped undici, nodemailer and transitive Zod dependencies to patched releases.

Engine 1.1.4 emits community-v2 benchmark receipts. The app now validates the exact v2 digest and fields, recorded routes and KV cache format, and sampled natural stops of at least 128 tokens. Historical community-v1 receipts remain readable; live runs must match the bundled engine, incomplete cells retain no performance aggregate, and result labels follow the recorded protocol.

Fixes #1253.

Receipt

• Environment: macOS arm64, Node 22.23.3, npm 10.9.8; source based on main 91eab7d. Bundled engine reports 1.1.4 and its archive matches the published SHA-256. No model checkpoint was loaded.
• Exactness, decode and cold-prompt performance: n/a for this app integration. This PR changes no inference arithmetic or GPU kernel and makes no new performance claim.
• npm run verify: 854/854 desktop test files passed, 0 failures; desktop typecheck and mobile lock validation, security checks, typecheck and lint passed.
• npm run pack:mac:dev: renderer/main/preload build and packaging passed; native computer helper passed 248 self-tests; engine and fuse checks passed.
• npm run smoke:mac:packaged: isolated health/UI requests passed, unauthenticated snapshot was refused, temporary profile and listener were removed.
• Actual 1.1.4 benchmark inspect accepted the app's synthetic v2 receipt and reported all four complete cells. Receipt tests cover natural-stop boundaries, greedy short-output rejection, missing/unknown v2 fields, inconsistent routes, historical v1 loading and current-version binding.
• npm audit --omit=dev --audit-level=low: 0 reported vulnerabilities.
• Release artifacts: Developer ID app, stapled DMG and update ZIP passed signing, notarization, bundled engine and fuse checks on the signing Mac and independently on the Studio. The Studio's isolated packaged smoke also passed. All three app copies share the same signed code hash.
• Public release: v1.0.0-beta.10, tagged at 4e7cedba5ec934d9a8295b26bdd55582c94db632. GitHub's server-side digests match all four uploaded assets.
• Live website: Mac download and signed update feed. Both complete public artifact downloads match the signed SHA-256 values; HEAD lengths, versioned/current redirects and feed revalidation were verified.
• Website: 57/57 tests passed, 0 failures; release readiness, exact deployment review and dry-run passed. Prior immutable releases were retained. The homepage and current release catalog show Beta 10 / Engine 1.1.4.
• Not requalified: live-account integrations or checkpoint performance. The documented beta limitations still apply.

Installer SHA-256: 2c322ccebffef585a69b6110372959fbe375686700fae92024d19ef3f6d15efc.

Update ZIP SHA-256: ec8d22a70cb1183f344d10edfc7d8b45ef9bf0ba06d3a68b5d053db7a01664a8.

Coordination

During preparation, ATC reported a clean merge with #1223 for its two shared packaging files. ATC's file-list limit leaves its overall overlap report incomplete; complete REST file lists for the three over-limit PRs (#1211, #1050, #728) were checked separately and share no changed files with this PR.

Checklist

• No inference precision, lane, kernel or scheduler changes; native performance/bitwise qualification is outside this app-only integration.
• Ran macOS arm64 app checks; no CUDA or other platform runtime claim.
• The engine upgrade initially failed four benchmark test files; all four pass after the schema integration.
• Historical receipts retain their original protocol; incomplete metrics are not presented as scores.
• Source changes contain no signing material, internal hosts, local paths or AI attribution lines.
• Verify signed, notarized release artifacts and publish the matching update feed and website.