0.4.0-beta.1 — audit-driven beta

Multi-agent audit pass surfaced 35 findings across security, correctness, cross-version compatibility, and the merge algorithm itself. This beta closes the 2 CRITICAL and 10 HIGH-severity items. Marked as a beta until the deferred follow-ups land and the mod has more real-world validation.

Fixed — CRITICAL

• MoveEntities entity-id remap (the underlying cause of GitHub issue #1 for overlapping merges): the bulk-tick MoveEntities action is now decoded, every VarInt entityId is remapped through safeRemap, and the new bytes are re-emitted. Previously secondary sources' local ids collided with the primary's global namespace, producing the "frozen mobs / default rotations / missing equipment" symptoms.
• SET_ENTITY_LINK wire format: read/write int32 instead of VarInt (which mis-decoded any id above 127). Sentinel for "no holder" treated as <= 0 to cover both legacy (-1) and modern (0) encodings — leashes no longer randomly attach to the wrong entity.

Fixed — HIGH (security)

• Path traversal guard in FlashbackReader.open: every segment path is normalised and confined to the replay folder.
• Zip-bomb entry-count cap (65 536 entries per source) on top of the existing 5 GB byte cap.
• OverlapValidator refuses to probe replays whose first segment exceeds 256 MB (OOM guard).

Fixed — HIGH (correctness)

• PIU bulk re-emit no longer fires on mid-segment intercalation (5-arg overload bug closed).
• copyPrimarySnapshotForTick uses FileChannel.map instead of Files.readAllBytes, avoiding OOM on long replays.
• HURT_ANIMATION and PLAYER_COMBAT_KILL reclassified EGO → ENTITY so their entity id is remapped through the global namespace.

Fixed — HIGH (cross-version)

• fabric.mod.json java dependency is now templated: 1.21.x jars declare >= 21, the 26.1.x jar declares >= 25. Previously the 26.1 jar advertised >= 21 and crashed at classload on JDK 21 instead of failing cleanly via Fabric.
• addRenderableWidget reflection on 26.1+ iterates Screen.class.getDeclaredMethods() and binds to the first overload accepting our Button — resilient to method-rename churn.

Fixed — i18n

• English users no longer see French progress labels: MergeOrchestrator emits multiview.merge_progress.phase.* translation keys and the screen picks Component.translatable vs Component.literal based on the "multiview." prefix.

Deferred to follow-up

• EntityMerger UUID-overwrite race and safeRemap phantom-ID race (H8, H9) — real but carry regression risk; separate focused session.
• SOUND_ENTITY / LEVEL_EVENT remap (H7) — non-trivial wire format.
• MergeOrchestrator refactor (still ≥ 1300 lines).