build: release 4.10.0

[danielplohmann]

Cuts 4.10.0: __version__ goes from 4.9.0 to 4.10.0. ## [Unreleased] becomes ## [v4.10.0] - 2026-10-14 without its empty subsections (Added, Deprecated, Security). A fresh empty ## [Unreleased] goes above it, and the compare links at the foot are updated.

What 4.10.0 carries

Milestone v4.10.0, 6 closed, 0 open:

• Fixed:
  • MSVC function boundaries (Functions split at shrink-wrapped prologues and after early returns (MSVC arm64 / x86, also with PDB) #384, fix: keep shrink-wrapped prologues, early-return bodies and switch tables in their function #386): shrink-wrapped AArch64 prologues stay in their function, x86 early-return bodies are no longer split off, and decoding stops at switch tables behind a call that does not return. The fixtures for this are in test: add msvc function-boundary fixtures for #384 #385.
  • The gap scan resumes past nop padding after a failed candidate (fix(intel): resume the gap scan past nop padding after a failed candidate #381).
  • Go 1.22+ type-switch jump tables are bounded by their and mask (fix(intel): bound jump tables by and masks in Go type switches #380).
• Changed:
  • Symbols are demangled through the demangle package instead of the vendored demanglers and pycxxfilt (refactor(labels): read symbols through the demangle package #379), pinned at ==0.5.1 so plugins cannot replace built-in schemes (build(labels): pin demangle 0.5.1 so plugins cannot replace built-ins #383), then bumped to ==0.6.0 (build(labels): bump demangle to 0.6.0, take #383 review nits #387).
  • The Binary Ninja exporter reads instruction lengths instead of rendering block text (perf(binja): read instruction lengths instead of rendering block text #378).
• Removed: the vendored MSVC and Rust demanglers and the Swift subprocess (refactor(labels): read symbols through the demangle package #379).
• Compatibility:
  • Function boundaries move on AArch64 shrink-wrapped functions, x86 early-return layouts and switch tables behind noreturn calls.
  • Labels move on non-ASCII Itanium/Swift and ARM64e MSVC names. None of these occur in the bundled fixtures.

Not in this release: #382 (Go/Rust string lengths) and #389 (#388, bodies analyzed before their entry), both in review; #364 (ARM32, draft).

Checked before opening

• master is green on 9a2a3a1: CI, Security, and the Performance & Correctness Benchmark.
• After fix(intel): resume the gap scan past nop padding after a failed candidate #381 the Malpedia gate on a867148 flagged 3 files. All three were the additions fix(intel): resume the gap scan past nop padding after a failed candidate #381 announced (Akira +120, two Konni +1), with 0 functions lost.
• testPackageMetadata.py and testReleaseGuard.py pass on this branch. release_guard.py --tag v4.10.0 passes and extracts the 66-line notes section.
• A local python -m build produced a 371 KB sdist with no tests/ and a wheel with py.typed. twine check --strict passed, and the metadata reads Version: 4.10.0 and Requires-Dist: demangle==0.6.0.
• publish-release.yml and release_guard.py are unchanged since v4.9.0, so no TestPyPI rehearsal is due.

After merge

Once CI is green on the merge commit, tag it and push the tag:

git tag -a v4.10.0 -m "SMDA 4.10.0"
git push origin v4.10.0

🤖 Generated with Claude Code

https://claude.ai/code/session_01NwKmgDYyACUh15PWL5XkFa

[github-actions]

📊 SMDA Performance Evaluation Benchmark Results

Generated on: 2026-10-14 14:46:25

Summary

Metric	Result
Correctness	✅ PASS — 0 / 155 common file(s) differ
Determinism	✅ PASS — base 3 run(s), PR 3 run(s)
Verdict	inconclusive — within run-to-run noise (±9.2%)
Median paired speedup	-0.98% (95% CI [-2.28%, +0.18%])
Timing noise band	±9.2%

Per-side Timing Context (best of 3/3 runs per file)

Side	Files	Functions	Median best time/file (s)	Sum of best times (s)	Throughput estimate (func/s)
base	155	173541	0.5122	186.64	~930
pr	155	173541	0.5042	188.46	~921

These context rows sum each file's best observed time across repeated runs; they are normalized comparison estimates, not single-run CI wall-clock times.

Paired per-file timing (positive speedup = PR faster):

Statistic	Value
Files compared	155
Median paired speedup	-0.98% (95% CI [-2.28%, +0.18%])
Mean speedup	-7.71% (95% CI [-20.27%, +0.55%])
Std dev / IQR	68.95% / 12.84%
Wilcoxon signed-rank p	0.2056 (n=155)

ℹ️ base and PR are timed in the same job on the same runner, with their passes interleaved base/PR/PR/base/base/PR so that drift over the job cancels rather than landing on whichever side ran last. The noise band above is therefore run-to-run variation on one machine, which is what it is able to measure; a difference inside it is reported as inconclusive. Correctness and determinism are not timing-based and are unaffected either way.

Determinism (self-check across repeated runs)

Side	Runs	Files	Deterministic	Median timing CV
base	3	155	✅	9.2%
pr	3	155	✅	7.4%

Pairwise run matrix (individual run medians, diagnostic)

Diagnostic only: each row compares one raw PR run against one raw base run. The headline verdict above uses paired per-file best-of-runs timings.

Comparison Run	PR Files	Base Files	Common	Function Set Matches	Med PR (s)	Med Base (s)	Med Diff (s)	Speedup %
pr_0 vs base_0	155	155	155	155/155	0.6771s	0.7089s	-0.0318s	+4.48%
pr_0 vs base_1	155	155	155	155/155	0.6771s	0.6306s	+0.0466s	-7.39%
pr_0 vs base_2	155	155	155	155/155	0.6771s	0.6200s	+0.0571s	-9.21%
pr_1 vs base_0	155	155	155	155/155	0.6489s	0.7089s	-0.0600s	+8.47%
pr_1 vs base_1	155	155	155	155/155	0.6489s	0.6306s	+0.0184s	-2.91%
pr_1 vs base_2	155	155	155	155/155	0.6489s	0.6200s	+0.0289s	-4.66%
pr_2 vs base_0	155	155	155	155/155	0.6921s	0.7089s	-0.0168s	+2.37%
pr_2 vs base_1	155	155	155	155/155	0.6921s	0.6306s	+0.0616s	-9.77%
pr_2 vs base_2	155	155	155	155/155	0.6921s	0.6200s	+0.0721s	-11.63%