NhanAZ · Nov 14, 2026 · Nov 14, 2026
diff --git a/.github/workflows/axolotl-compatibility.yml b/.github/workflows/axolotl-compatibility.yml
@@ -103,7 +103,7 @@ jobs:
       - name: Build and analyze DevTools-owned example PHAR with the pinned stable builder
         if: steps.release.outputs.candidate == 'true'
         id: build
-        uses: AxolotlBucketLabs/DevTools@v4.0.3
+        uses: AxolotlBucketLabs/DevTools@v4.0.4
         with:
           project: examples/HelloShared
           virions: examples

diff --git a/docs/ecosystem.json b/docs/ecosystem.json
@@ -34,8 +34,8 @@
     ]
   },
   "devtools": {
-    "stable_version": "v4.0.3",
-    "stable_commit": "106547e8b142a3f6a65a4b3c66d1ace477e56f10",
+    "stable_version": "v4.0.4",
+    "stable_commit": "cd05e444a26b3c63720b443961b3646e22307f56",
     "reference_policy": "Use @v4 for compatible v4 updates or @latest to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin."
   },
   "summary": {

diff --git a/docs/ecosystem.md b/docs/ecosystem.md
@@ -2,7 +2,7 @@
 
 This page gives a short human-readable summary of public projects whose default-branch workflows reference DevTools. The complete inventory and its counts are stored in [`ecosystem.json`](ecosystem.json). The data contract is described by [`ecosystem.schema.json`](ecosystem.schema.json).
 
-The latest stable release represented by this inventory is DevTools `v4.0.3`, at commit `106547e8b142a3f6a65a4b3c66d1ace477e56f10`. Use `@v4` for compatible v4 updates or `@latest` to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin.
+The latest stable release represented by this inventory is DevTools `v4.0.4`, at commit `cd05e444a26b3c63720b443961b3646e22307f56`. Use `@v4` for compatible v4 updates or `@latest` to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin.
 
 ## Inventory
 

diff --git a/docs/github-actions.md b/docs/github-actions.md
@@ -2,7 +2,7 @@
 
 The composite action calls `bin/devtools.php build --json`, using the same builder as the CLI and server command. It accepts `type: plugin` (default) or `type: virion`, verifies the reported PHAR SHA-256 and exposes the actual path from that result. PHPStan and Composer dependency preparation are opt-in for plugin builds. Virion builds use `phpstan: off` because the action's PHPStan helper is plugin-oriented. A successful build verifies packaging. It does not prove an Axolotl-PM runtime boot.
 
-These interfaces are available in the `v4.0.3` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.3` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release.
+These interfaces are available in the `v4.0.4` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.4` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release.
 
 ## Short build workflow
 
@@ -185,24 +185,24 @@ DevTools moves `latest` only to a validated stable release. It may move from v4
 Use an exact release when a repository needs controlled upgrades.
 
 ```yaml
-uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.3
+uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.4
 ```
 
 Use a full commit SHA for strict reproducibility or a supply-chain policy. Resolve the commit behind the reviewed release tag and keep the version in a comment.
 
 ```sh
-git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.3^{}'
+git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.4^{}'
 ```
 
 ```yaml
-uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@106547e8b142a3f6a65a4b3c66d1ace477e56f10 # v4.0.3
+uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@cd05e444a26b3c63720b443961b3646e22307f56 # v4.0.4
 ```
 
 The called job reads its own `workflow_sha` and `workflow_repository`, checks out that revision, and verifies the checked-out HEAD and CLI contract before building. The same rule applies to release verification. The workflow contract no longer accepts the removed `devtools-ref` input. Remove it when migrating a v1 caller. GitHub's workflow identity context is available on GitHub.com. These reusable workflows are not supported on GitHub Enterprise Server without that context.
 
 ## Migrate from v1
 
-Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.3` or a full SHA when the repository requires a controlled or strict pin.
+Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.4` or a full SHA when the repository requires a controlled or strict pin.
 
 ```diff
  with:

diff --git a/tests/Validation/RepositoryMetadataTest.php b/tests/Validation/RepositoryMetadataTest.php
@@ -20,7 +20,7 @@
 final class RepositoryMetadataTest extends TestCase
 {
 	private const VERSION = '4.0.4';
-	private const COMPATIBILITY_BUILDER_VERSION = '4.0.3';
+	private const COMPATIBILITY_BUILDER_VERSION = '4.0.4';
 	private const PHP_ACTION_VERSION = '1.0.0';
 
 	public function test_release_version_is_synchronized() : void