[bpamiri]

Why

Several 4.1 guide pages still describe behaviour that changed in 4.0.4–4.1.2.

What

All changes are under web/sites/guides/src/content/docs/v4-1-0/:

• deployment/production-config.mdx. It said an empty error-email recipient "still tries to send… fails silently". Since 4.1.2, errorEmailAddress defaults to "" (GHSA-8gcv-3v9h-7gj2): with no recipient, no error email is sent and Wheels writes a one-time warning to wheels.log, so set it explicitly. Checked against events/init/debugging.cfm and events/EventMethods.cfc.
• core-concepts/environments-and-configuration.mdx. It said a blank reloadPassword "permits anonymous ?reload=true", but it has failed closed since 4.0.4 (Reload-password contract drift: empty password leaves ?reload=true open to anonymous restarts, warm-app wrong-password attempts are never logged or rate-limited, and the boot warning misstates behavior #3062). It also called wheels reload reports "Application reloaded successfully." when the HTTP reload request fails (4xx/5xx) #3059 an open issue; it was fixed in 4.0.4.
• upgrading/performance-notes.mdx. It said the fix was "not in any stable release yet" and pointed to the bleeding-edge channel. It now lists the released work: 4.0.6 (perf(model): cache mixin-integration plan to fix per-instance overhead (#3213) #3236), 4.1.0 (perf(model): inherit the model mixin surface instead of copying it per instance #3462 compile-time includes, perf(model): construct model instances without the DI resolve + reflective invoke #3464 direct constructor), and 4.1.1 (perf(controller): narrow flash locking to the session scope #3656 per-session flash locking, by @zspitzer).
• start-here/manual-installation.mdx. It named the 4.0.5 artifacts and tag. It now uses 4.1.2, with a note to use the latest release. Asset names were checked against the v4.1.2 release.
• command-line-tools/wheels-commands/upgrade.mdx. Documents the template drift advisory that every run includes since 4.1.0 (Element wo is undefined in a Java object of type class [Ljava.lang.String #3379): a byte-exact compare of public/Application.cfc and public/index.cfm against the bundled template, reported by file name.
• upgrading/3x-to-4x.mdx. It said the wheels.Test check was "on develop / post-4.0.3"; it shipped in 4.0.4.
• upgrading/manual-upgrades.mdx. A new caution: the 4.1.1 .env boolean fix (A .env value of numeric 1 is silently coerced to the boolean true (seven copies of the parser) #3641/fix(env): stop coercing a .env value of numeric 1 to the boolean true #3642) lives in the app-owned public/Application.cfc, so existing apps patch it by hand. It shows the before and after lines from the template.

Docs-only.

🤖 Generated with Claude Code

[bpamiri]

rev1-r1 review @ 44169ac: APPROVE. I checked every version claim against the release tags and the code.

Claim	Evidence
reloadPassword fails closed since 4.0.4 (#3062)	CHANGELOG 4.0.4. onapplicationstart.cfc requires Len(application.$wheels.reloadPassword) and a $secureCompare match
#3059 (wheels reload checks the 302) fixed in 4.0.4	CHANGELOG 4.0.4
errorEmailAddress defaults to "" since 4.1.2 (GHSA-8gcv)	events/init/debugging.cfm:16 at v4.1.2; EventMethods.$runOnErrorSendEmail uses errorEmailToAddress, falling back to errorEmailAddress, and calls $warnNoErrorEmailRecipient() when there's no recipient
#3641 .env fix in 4.1.1, app-owned	the v4.1.0 template has the == lines; the v4.1.1 and v4.1.2 templates have exactly the Compare(lCase(...)) lines quoted in the caution
#3236 shipped in 4.0.6; #3461 / #3462 / #3464 in 4.1.0; #3656 in 4.1.1	git tag --contains on each merge commit
wheels.Testbox upgrade rule ships in 4.0.4	first tag containing the rule commit is v4.0.4
Template-drift advisory added in 4.1.0 (#3379)	CHANGELOG 4.1.0

Nit (optional): "the sender falls back to the recipient" skips one step. The chain is errorEmailFromAddress, then errorEmailAddress, then the recipient (EventMethods.cfc:37-43). It only matters when someone sets just errorEmailToAddress together with a separate errorEmailAddress.

[bpamiri]

rev1-r1 delta 44169ac → 83ef521: APPROVE. The sender chain now matches EventMethods.cfc:37-43 exactly: errorEmailFromAddress, then errorEmailAddress, then the recipient.