diff --git a/CHANGELOG.md b/CHANGELOG.md
index cae7eba..92a1ffc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,15 @@ All notable changes are documented here.
 
 ## Unreleased
 
+## 1.0.1 - 2026-08-01
+
+- Make crawl receipt verification recompute the top-level status from page records.
+- Return fixed, bounded failures for malformed receipts and invalid SQLite state without reflecting
+  input text, local paths, or tracebacks.
+- Read crawl receipts through one non-blocking, no-follow file descriptor with a 16 MiB limit,
+  complete-chunk checks, and pre/post identity validation.
+- Preserve complete Autopilot lineage for the rejected and accepted security-boundary candidates.
+
 ## 1.0.0 - 2026-07-24
 
 - Promote TraceFetch from an evidence-acquisition alpha to an agent-first local and public search
diff --git a/README.md b/README.md
index 663556a..4ef4328 100644
--- a/README.md
+++ b/README.md
@@ -27,10 +27,10 @@ data.
 
 ## Install
 
-After the `v1.0.0` GitHub release is published:
+After the `v1.0.1` GitHub release is published:
 
 ```bash
-pipx install "git+https://github.com/estelledc/tracefetch.git@v1.0.0"
+pipx install "git+https://github.com/estelledc/tracefetch.git@v1.0.1"
 tracefetch --version
 tracefetch doctor
 ```
@@ -192,7 +192,7 @@ FIRECRAWL_API_KEY=... tracefetch fetch https://example.com \
 Install local document conversion separately:
 
 ```bash
-pipx install "tracefetch[markitdown] @ git+https://github.com/estelledc/tracefetch.git@v1.0.0"
+pipx install "tracefetch[markitdown] @ git+https://github.com/estelledc/tracefetch.git@v1.0.1"
 tracefetch ingest report.pdf \
   --source-url https://example.com/report.pdf \
   --output /tmp/tracefetch-report
diff --git a/docs/releasing.md b/docs/releasing.md
index bd8f95a..05118bf 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -7,8 +7,8 @@ verified.
 ## 1.0 acceptance gates
 
 1. `make check` passes on Python 3.11, 3.12, and 3.13.
-2. `python scripts/check_version.py --tag v1.0.0` confirms pyproject, package, changelog, and tag
-   coherence.
+2. `python scripts/check_version.py --tag vMAJOR.MINOR.PATCH` confirms pyproject, package,
+   changelog, and tag coherence.
 3. A clean clone can install the wheel and execute `tracefetch --version`, local search, doctor,
    schema, and provider-example smoke tests.
 4. Public search runs at least one configured provider and reports partial failure rather than
diff --git a/pyproject.toml b/pyproject.toml
index 04c4558..f94f99f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tracefetch"
-version = "1.0.0"
+version = "1.0.1"
 description = "Agent-first local and web search with provenance-bearing evidence bundles."
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/tracefetch/__init__.py b/src/tracefetch/__init__.py
index b5e3ad4..6a11a57 100644
--- a/src/tracefetch/__init__.py
+++ b/src/tracefetch/__init__.py
@@ -15,4 +15,4 @@
     "SearchResultsEnvelope",
     "search_everywhere",
 ]
-__version__ = "1.0.0"
+__version__ = "1.0.1"
diff --git a/tests/test_release_contract.py b/tests/test_release_contract.py
index 58e8314..d8e4b3c 100644
--- a/tests/test_release_contract.py
+++ b/tests/test_release_contract.py
@@ -10,7 +10,7 @@
 
 def test_version_sources_and_release_tag_are_coherent() -> None:
     completed = subprocess.run(
-        [sys.executable, "scripts/check_version.py", "--tag", "v1.0.0"],
+        [sys.executable, "scripts/check_version.py", "--tag", "v1.0.1"],
         cwd=ROOT,
         capture_output=True,
         text=True,
@@ -23,18 +23,21 @@ def test_version_sources_and_release_tag_are_coherent() -> None:
         "failures": [],
         "schema_version": "tracefetch.version-check.v1",
         "status": "ok",
-        "version": "1.0.0",
+        "version": "1.0.1",
     }
 
 
 def test_release_workflow_builds_smokes_and_publishes_assets() -> None:
     workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8")
     readme = (ROOT / "README.md").read_text(encoding="utf-8")
+    release_docs = (ROOT / "docs/releasing.md").read_text(encoding="utf-8")
 
     assert 'tags:\n      - "v*.*.*"' in workflow
     assert "make check" in workflow
     assert 'scripts/check_version.py --tag "$GITHUB_REF_NAME"' in workflow
     assert "uv pip install" in workflow
     assert "gh release create" in workflow
-    assert "v1.0.0" in readme
+    assert readme.count("v1.0.1") == 3
+    assert "v1.0.0" not in readme
+    assert "scripts/check_version.py --tag vMAJOR.MINOR.PATCH" in release_docs
     assert "PyPI publication is not claimed" in readme
diff --git a/uv.lock b/uv.lock
index 32000e0..305546c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1618,7 +1618,7 @@ wheels = [
 
 [[package]]
 name = "tracefetch"
-version = "1.0.0"
+version = "1.0.1"
 source = { editable = "." }
 dependencies = [
     { name = "beautifulsoup4" },