diff --git a/data/ecosystem.toml b/data/ecosystem.toml
index c3ed019..84fc43f 100644
--- a/data/ecosystem.toml
+++ b/data/ecosystem.toml
@@ -1,8 +1,8 @@
 schema_version = 1
 as_of = "2026-07-30"
 source_repository = "hayatepy/.github"
-source_commit = "c9c19d02e15c3030be2e6eed9d8ab3c8cc6c9226"
-compatibility_url = "https://github.com/hayatepy/.github/blob/c9c19d02e15c3030be2e6eed9d8ab3c8cc6c9226/docs/COMPATIBILITY.md"
+source_commit = "74327adddc10cad0f3f802a4bfd29ef484572907"
+compatibility_url = "https://github.com/hayatepy/.github/blob/74327adddc10cad0f3f802a4bfd29ef484572907/docs/COMPATIBILITY.md"
 
 [[packages]]
 name = "hayate"
@@ -16,13 +16,13 @@ source_commit = "a1821a27a83a2406c491338a397b489856db15de"
 
 [[packages]]
 name = "create-hayate"
-version = "0.13.2"
+version = "0.14.0"
 status = "Published alpha"
-role = "Composable applications with drift-checked first-party TypeScript clients"
-use_when = "Start with a tested API, Workers, MCP, auth, SQL, admin, or frontend composition and keep its generated client in sync."
+role = "Composable applications with deployment identity and drift-checked TypeScript clients"
+use_when = "Start with a tested API, Workers, MCP, auth, SQL, admin, or frontend composition; identify each rollout and keep its generated client in sync."
 repository = "https://github.com/hayatepy/create-hayate"
 pypi = "https://pypi.org/project/create-hayate/"
-source_commit = "8bcca24bbd43854c05a6467d26b675c20a89b63e"
+source_commit = "261af98f18b1f97cbb94f7bf19a99ab34e92be4f"
 
 [[packages]]
 name = "hayate-auth"
@@ -99,4 +99,4 @@ status = "Reference application"
 role = "Executable production integration"
 use_when = "Review tested trust boundaries and deployment choices before shipping."
 repository = "https://github.com/hayatepy/golden-app"
-source_commit = "381c071f108e29b16eae6b19b7f870a4fc3f18a9"
+source_commit = "f0e334554f4b98e4be941dcb84feaaf6b47a9c89"
diff --git a/docs/ecosystem/compose.md b/docs/ecosystem/compose.md
index 7b30d29..3d34501 100644
--- a/docs/ecosystem/compose.md
+++ b/docs/ecosystem/compose.md
@@ -37,7 +37,7 @@ has no runtime npm dependency. Path, query, header, cookie, JSON,
 URL-encoded, and multipart inputs stay tied to the published schema.
 
 The [golden application executes the compiled client against a real ASGI
-process](https://github.com/hayatepy/golden-app/blob/842fd2486f3d8bd5c284e44e4f8528b0441a574a/client/check-api-client.ts)
+process](https://github.com/hayatepy/golden-app/blob/f0e334554f4b98e4be941dcb84feaaf6b47a9c89/client/check-api-client.ts)
 instead of treating generation or type-checking alone as interoperability.
 
 ## Server-rendered application
@@ -62,7 +62,7 @@ customer workflows.
 them:
 
 ```sh
-uvx --from create-hayate==0.13.2 create-hayate --help
+uvx --from create-hayate==0.14.0 create-hayate --help
 ```
 
 Use the [family map](index.md) for current release state and package links.
diff --git a/docs/ecosystem/index.md b/docs/ecosystem/index.md
index dabfa44..46e13d0 100644
--- a/docs/ecosystem/index.md
+++ b/docs/ecosystem/index.md
@@ -4,12 +4,12 @@
 
 Choose packages by the boundary your application needs. The core stays small; capabilities are explicit packages with their own release and evidence.
 
-This snapshot is dated **2026-07-30** and is pinned to [`hayatepy/.github` at `c9c19d02e15c`](https://github.com/hayatepy/.github/tree/c9c19d02e15c3030be2e6eed9d8ab3c8cc6c9226). Every package is pre-1.0; check the compatibility snapshot before combining versions.
+This snapshot is dated **2026-07-30** and is pinned to [`hayatepy/.github` at `74327adddc10`](https://github.com/hayatepy/.github/tree/74327adddc10cad0f3f802a4bfd29ef484572907). Every package is pre-1.0; check the compatibility snapshot before combining versions.
 
 | Project | Version | Responsibility | Release state |
 |---|---:|---|---|
 | [`hayate`](https://github.com/hayatepy/hayate) | [`0.15.3`](https://pypi.org/project/hayate/) | Core framework and native ASGI, Workers, and Lambda adapters | Published alpha |
-| [`create-hayate`](https://github.com/hayatepy/create-hayate) | [`0.13.2`](https://pypi.org/project/create-hayate/) | Composable applications with drift-checked first-party TypeScript clients | Published alpha |
+| [`create-hayate`](https://github.com/hayatepy/create-hayate) | [`0.14.0`](https://pypi.org/project/create-hayate/) | Composable applications with deployment identity and drift-checked TypeScript clients | Published alpha |
 | [`hayate-auth`](https://github.com/hayatepy/hayate-auth) | [`0.10.5`](https://pypi.org/project/hayate-auth/) | Sessions, API keys, OAuth, passkeys, and authorization server | Published alpha; independent audit pending |
 | [`hayate-mcp`](https://github.com/hayatepy/hayate-mcp) | [`0.12.1`](https://pypi.org/project/hayate-mcp/) | MCP 2026-07-28 Streamable HTTP and discovery | Published alpha |
 | [`hayate-openapi`](https://github.com/hayatepy/hayate-openapi) | [`0.8.2`](https://pypi.org/project/hayate-openapi/) | OpenAPI 3.1, Scalar, and generated zero-runtime TypeScript clients | Published alpha |
@@ -19,7 +19,7 @@ This snapshot is dated **2026-07-30** and is pinned to [`hayatepy/.github` at `c
 | [`hayate-htmx`](https://github.com/hayatepy/hayate-htmx) | `0.2.0` | Hypermedia, Jinja, htmx, fragments, and SSE | Pre-release source |
 | [`golden-app`](https://github.com/hayatepy/golden-app) | `0.1.0` | Executable production integration | Reference application |
 
-[Open the tested compatibility snapshot](https://github.com/hayatepy/.github/blob/c9c19d02e15c3030be2e6eed9d8ab3c8cc6c9226/docs/COMPATIBILITY.md)
+[Open the tested compatibility snapshot](https://github.com/hayatepy/.github/blob/74327adddc10cad0f3f802a4bfd29ef484572907/docs/COMPATIBILITY.md)
 
 ## hayate
 
@@ -31,9 +31,9 @@ Build one Fetch-style Python application for ASGI, Workers, or Lambda.
 
 ## create-hayate
 
-Start with a tested API, Workers, MCP, auth, SQL, admin, or frontend composition and keep its generated client in sync.
+Start with a tested API, Workers, MCP, auth, SQL, admin, or frontend composition; identify each rollout and keep its generated client in sync.
 
-**Current evidence:** Published alpha, version `0.13.2` · [source at `8bcca24bbd43`](https://github.com/hayatepy/create-hayate/tree/8bcca24bbd43854c05a6467d26b675c20a89b63e)
+**Current evidence:** Published alpha, version `0.14.0` · [source at `261af98f18b1`](https://github.com/hayatepy/create-hayate/tree/261af98f18b1f97cbb94f7bf19a99ab34e92be4f)
 
 [Repository](https://github.com/hayatepy/create-hayate) · [PyPI](https://pypi.org/project/create-hayate/)
 
@@ -97,6 +97,6 @@ Build progressively enhanced server-rendered applications without a JavaScript S
 
 Review tested trust boundaries and deployment choices before shipping.
 
-**Current evidence:** Reference application, version `0.1.0` · [source at `381c071f108e`](https://github.com/hayatepy/golden-app/tree/381c071f108e29b16eae6b19b7f870a4fc3f18a9)
+**Current evidence:** Reference application, version `0.1.0` · [source at `f0e334554f4b`](https://github.com/hayatepy/golden-app/tree/f0e334554f4b98e4be941dcb84feaaf6b47a9c89)
 
 [Repository](https://github.com/hayatepy/golden-app)
diff --git a/docs/evidence/compatibility.md b/docs/evidence/compatibility.md
index 57486ed..4fc9b74 100644
--- a/docs/evidence/compatibility.md
+++ b/docs/evidence/compatibility.md
@@ -4,7 +4,7 @@ The current public snapshot is dated **2026-07-30**. All packages remain
 pre-1.0, so compatible versions must be selected from evidence rather than
 assumed from package names.
 
-[Open the immutable compatibility snapshot](https://github.com/hayatepy/.github/blob/c9c19d02e15c3030be2e6eed9d8ab3c8cc6c9226/docs/COMPATIBILITY.md){ .md-button .md-button--primary }
+[Open the immutable compatibility snapshot](https://github.com/hayatepy/.github/blob/74327adddc10cad0f3f802a4bfd29ef484572907/docs/COMPATIBILITY.md){ .md-button .md-button--primary }
 
 ## Golden runtime lock
 
@@ -23,26 +23,32 @@ assumed from package names.
 
 - `hayate-openapi 0.8.2` generates the dependency-free callable TypeScript
   client and validates it against a real Hayate ASGI process.
-- `create-hayate 0.13.2` propagates the client, its types, and drift checks
-  into generated projects.
+- `create-hayate 0.14.0` propagates the client, its types, and drift checks
+  into generated projects. Its production Workers template also propagates
+  application and Cloudflare deployment identity to every response.
 - `hayate-mcp 0.12.1` passes the official 70-case MCP 2026-07-28
   conformance suite, real Workerd execution, and release provenance checks.
 - `hayate 0.15.3`, `hayate-sql 0.1.2`, `hayate-fetch 0.1.4`, and
   `hayate-auth 0.10.5` publish immutable wheels with SLSA provenance and SPDX
   SBOMs.
-- Its [release workflow](https://github.com/hayatepy/create-hayate/actions/runs/30502570222)
+- Its [release workflow](https://github.com/hayatepy/create-hayate/actions/runs/30510444651)
   resolved and imported all 52 supported backend compositions before publishing
   the signed, attested wheel.
-- The `0.13.2` wheel also passed the current
-  [10-case frontend smoke](https://github.com/hayatepy/create-hayate/actions/runs/30502309672)
-  across htmx renderers, React, Astro, ASGI, and real Workerd. The aggregate
+- The `0.14.0` public wheel also passed the full
+  [112-case composition matrix](https://github.com/hayatepy/create-hayate/actions/runs/30511183502)
+  across backend and frontend combinations, ASGI, and real Workerd. No expected
+  case was missing or failed. The aggregate
   evidence JSON SHA-256 is
-  `f207dcd979c695508c4bf672432848e5469ebf4ab1b58b0f2c4fecb8e004af05`.
+  `d980477da29e494182080adcd79b864ab533a1dcfbc8035b401f75f7dfa97e43`.
 - The [golden application main
-  run](https://github.com/hayatepy/golden-app/actions/runs/30507749113)
+  run](https://github.com/hayatepy/golden-app/actions/runs/30511141307)
   executes authenticated path, query, JSON, multipart, delete, and error
   flows through the compiled client and locks `hayate 0.15.3`,
   `hayate-mcp 0.12.1`, `hayate-openapi 0.8.2`, and `hayate-sql 0.1.2`.
+- The same run proves both class and global Workers entrypoints under real
+  Workerd. Each returns `X-Hayate-App-Version: 0.1.0` and a platform-issued
+  `X-Hayate-Worker-Version` UUID. The ASGI smoke returns the app version and
+  deliberately omits the Worker-only identifier.
 
 The generated [family map](../ecosystem/index.md) pins each listed project to
 the source commit used for this site snapshot.
diff --git a/docs/get-started/first-app.md b/docs/get-started/first-app.md
index ab8ca23..aa7d2b9 100644
--- a/docs/get-started/first-app.md
+++ b/docs/get-started/first-app.md
@@ -9,7 +9,7 @@ Cloudflare Access, checked SQL, request correlation, and production middleware.
 Install [uv](https://docs.astral.sh/uv/), then run:
 
 ```sh
-uvx --refresh --from create-hayate==0.13.2 \
+uvx --refresh --from create-hayate==0.14.0 \
   create-hayate my-app --template workers --preset production
 cd my-app
 ```
@@ -47,6 +47,12 @@ credentials.
   runtime package dependency.
 - The default Workers export is a `WorkerEntrypoint` class, preserving named
   RPC and class handlers such as `scheduled`.
+- Every response identifies the application release with `X-Hayate-App-Version`.
+  Native Workers responses also expose Cloudflare's immutable deployment UUID
+  as `X-Hayate-Worker-Version`; local ASGI responses intentionally omit it.
+- Protected production requests fail closed when either required deployment
+  identity is absent. CORS exposes both identifiers only to the configured
+  exact origin.
 
 ASGI is not involved in the native Workers path.
 
diff --git a/docs/index.md b/docs/index.md
index c110b01..09205c6 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -118,6 +118,6 @@ description: One Fetch-style Python application across ASGI, Cloudflare Workers,
 <section class="hayate-final">
   <p class="hayate-kicker">START FROM A TESTED COMPOSITION</p>
   <h2>From empty directory to passing production checks.</h2>
-  <p><code>uvx --from create-hayate==0.13.2 create-hayate my-app --template workers --preset production</code></p>
+  <p><code>uvx --from create-hayate==0.14.0 create-hayate my-app --template workers --preset production</code></p>
   <a class="md-button md-button--primary" href="get-started/first-app/">Follow the verified path</a>
 </section>