diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 292aef3..f7c5cdd 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -33,6 +33,12 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest
 
+      - name: Derive version metadata for image labels
+        id: version
+        run: |
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+          echo "spec_version=$(grep -m1 'const SpecVersion' fusa.go | sed -E 's/.*"(.*)".*/\1/')" >> "$GITHUB_OUTPUT"
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
@@ -40,3 +46,6 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}
+            SPEC_VERSION=${{ steps.version.outputs.spec_version }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff0e762..63d29d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,36 @@ Dates reference the merged commit timestamp.
 
 ## [Unreleased]
 
+## v0.33.5 — 2026-07-27
+
+### Fixed (issue #43)
+- **Stale Dockerfile OCI labels** — the custom `io.x-fusa.spec-version` label
+  was hardcoded to `"1.9"` (four spec versions behind the current
+  `fusa.SpecVersion` of `1.10.12`), and `org.opencontainers.image.version`
+  was hardcoded to `"0.25.1"`. Both are now `ARG`-driven (`VERSION`,
+  `SPEC_VERSION`) with sane defaults for a plain local `docker build`.
+  `.github/workflows/docker-publish.yml` now derives `SPEC_VERSION` by
+  grepping `fusa.go`'s `SpecVersion` constant at build time and `VERSION`
+  from the pushed tag, and passes both via `--build-arg`, so these labels
+  can no longer silently drift from the source of truth. (The standard
+  `org.opencontainers.image.version` label is also overwritten at publish
+  time by `docker/metadata-action`, so the previously *published* image was
+  unaffected — only local builds and the raw label value in this file were
+  stale.)
+
+### Added (issue #43)
+- **README package table** — the `cmd/gofusa` row now lists all 43
+  subcommands; previously it omitted `hara`, `iso26262`, `iec61508`,
+  `disposition`, `impact`, `metrics`, `misra`, `capabilities`, and `version`.
+- **README Quick Start** — added `gofusa version` and `gofusa capabilities`
+  examples; these two commands had zero README mentions before this release.
+
+### Documented (issue #43)
+- **CHANGELOG.md** — backfilled 5 entries for tagged/released versions that
+  had no changelog coverage: `v0.29.1`, `v0.25.1`, `v0.25.0`, `v0.24.0`, and
+  `v0.8.0`, each inserted in its correct chronological slot with content
+  derived from the actual commit history and GitHub release notes.
+
 ## v0.33.4 — 2026-07-27
 
 ### Fixed (function-tag coverage retrofit)
@@ -144,6 +174,14 @@ Dates reference the merged commit timestamp.
 - Fix SpecVersion constant from "1.9" to "1.10.4"
 - Auto-detect CI builder field in provenance.json; add --builder flag
 
+## [0.29.1] — 2026-06-12
+
+### Fixed
+- Removed a stray duplicate `cmd/gofusa/conform_test 2.go` (an editor-created
+  exact copy of `conform_test.go`) that had been committed by mistake.
+- Added `.claude/` (AI session state) and `cmd/gofusa/safety-case.json`
+  (generated evidence artifact) to `.gitignore`.
+
 ## [0.30.0] — 2026-06-12
 
 ### Fixed
@@ -214,6 +252,47 @@ Dates reference the merged commit timestamp.
 - **10 new requirements** — REQ-SLSA-ASSESS001–004, REQ-CLI-SLSA-001,
   REQ-IEC62443-ASSESS001–004, REQ-CLI-IEC62443-001 added to `.fusa-reqs.json`.
 
+## [0.25.1] — 2026-06-10
+
+### Added
+- Test suite expansion to raise overall coverage from 81.5% to ≥85%: targeted
+  error-path tests for `cmd/gofusa` (render-failure/bad-format paths,
+  `os.Create` error paths, no-dir tests exercising the `os.Getwd()` branch
+  across 16 commands), a new `gapreport_test.go` (100% coverage), and
+  additional branch-coverage tests for `auditpack`, `comp`, `coupling`,
+  `qualify`, `coverage`, `disposition`, and `metrics`.
+- `//fusa:req` annotations added to `gapreport`, `cmd_capabilities.go`, and
+  `helpers.go`.
+
+## [0.25.0] — 2026-06-10
+
+### Changed
+- **x-FuSa spec v1.9 conformance** — `fusa.SpecVersion` bumped `"1.8"` →
+  `"1.9"`, which propagates automatically to the `schemaVersion` field on
+  every emitted document (check report, gap reports, SBOM/provenance/manifest,
+  audit-pack, capabilities). Spec v1.9 promotes four SHOULD→MUST fields
+  (`category`, `remediation`, `fingerprint`, `capabilities`); go-FuSa already
+  implemented all four as of v0.24.0, so this is a mechanical version bump
+  with no behavioral change.
+- `fusa.Version` bumped `0.24.0` → `0.25.0`.
+
+## [0.24.0] — 2026-06-10
+
+### Added
+- **x-FuSa spec v1.8 exit codes (§2.3)** — all ~40 `cmd_*.go` files now return
+  the spec-mandated codes (`ExitOK`=0, `ExitGateFail`=1, `ExitUsage`=2,
+  `ExitRuntime`=3) via new constants in `fusa.go` and a `parseFlags()` helper
+  in `cmd/gofusa/helpers.go`. Previously every failure returned bare `1`,
+  making it impossible for CI pipelines to distinguish a gate failure from a
+  bad flag.
+- **Canonical §9.3 gap-report JSON** — `iso26262`, `iec61508`, `do178`,
+  `iso21434`, and `unece` `Render()` functions now delegate to the new
+  `gapreport/` package instead of encoding private structs, so every gap
+  report shares one schema: `{schemaVersion, kind, tool, toolVersion,
+  language, generatedAt, projectRoot, standard, objectives[], summary}` with
+  status values `satisfied`/`partial`/`gap`/`skip`.
+- `cmd_capabilities.go` and `report/summary.go` added.
+
 ## [0.23.0] — 2026-06-09
 
 ### Added
@@ -583,6 +662,19 @@ Dates reference the merged commit timestamp.
 - Fuzz tests in `config`, `release`, `lint`, `analyze`, `trace`, and `verify` packages
 - 8 new requirements (REQ-CLI008–011, REQ-CFG008, REQ-ENG007, REQ-RELEASE007–008), total 77
 
+## [0.8.0] — 2026-06-07
+
+Tagged from the same squash-merged commit as v0.9.0 (`feat: v0.8 Docker + v0.9
+Tool Qualification + full auditor evidence package`), which bundled the
+Docker deliverable below alongside v0.9.0's tool-qualification suite.
+
+### Added
+- Docker multi-stage build (`Dockerfile`), `.dockerignore`, `docker-compose.yml`, CI Docker build job
+- `docs/release-process.md` — release process documentation
+- `.github/PULL_REQUEST_TEMPLATE.md` and issue templates
+- `CHANGELOG.md`, `SECURITY.md`, `Makefile` added to the repo
+- `sbom.json` and `provenance.json` committed in-tree; tool now passes its own RELEASE001/002 checks
+
 ## [0.9.0] — 2026-06-07
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index d544dab..1ebbf82 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,6 +12,13 @@
 #   docker run --rm -v "$(pwd)":/project go-fusa verify
 #   docker run --rm -v "$(pwd)":/project go-fusa release
 
+# Image label values. Overridden at CI build time via --build-arg (see
+# .github/workflows/docker-publish.yml) so they always track fusa.go's
+# Version/SpecVersion constants instead of going stale in this file. The
+# defaults below are best-effort for plain local `docker build` runs.
+ARG VERSION=0.33.5
+ARG SPEC_VERSION=1.10.12
+
 # ── Stage 1: build ────────────────────────────────────────────────────────────
 FROM golang:1.22-alpine AS builder
 
@@ -31,6 +38,11 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
 # ── Stage 2: runtime ─────────────────────────────────────────────────────────
 FROM alpine:3.20
 
+# Re-declare to bring the global ARGs (and any --build-arg override) into
+# this stage's scope; Docker clears ARG scope at each FROM.
+ARG VERSION
+ARG SPEC_VERSION
+
 # git is needed for provenance VCS info; ca-certificates for TLS.
 RUN apk add --no-cache git ca-certificates
 
@@ -38,13 +50,13 @@ COPY --from=builder /bin/gofusa /usr/local/bin/gofusa
 
 LABEL org.opencontainers.image.title="go-FuSa" \
       org.opencontainers.image.description="Functional safety enablement toolkit for Go" \
-      org.opencontainers.image.version="0.25.1" \
+      org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.source="https://github.com/SoundMatt/go-FuSa" \
       org.opencontainers.image.licenses="MPL-2.0" \
       io.x-fusa.tool="go-FuSa" \
       io.x-fusa.language="go" \
       io.x-fusa.binary="gofusa" \
-      io.x-fusa.spec-version="1.9"
+      io.x-fusa.spec-version="${SPEC_VERSION}"
 
 # Default working directory is /project; mount your Go project here.
 WORKDIR /project
diff --git a/README.md b/README.md
index 923d390..486ea02 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ for ISO 26262, IEC 61508, ISO 21434, and DO-178C.
 | `sas/` | Software Accomplishment Summary — 20 evidence items (DO-178C §11.20) |
 | `iso21434/` | ISO 21434 cybersecurity engineering — CAL 1–4 gap assessment, TARA evidence checking |
 | `unece/` | UN R.155 Annex 5 — threat-category coverage assessment (TC-1 through TC-9) |
-| `cmd/gofusa` | CLI — `init`, `check`, `lint`, `analyze`, `template`, `report`, `trace`, `verify`, `release`, `qualify`, `safety-case`, `fmea`, `boundary`, `vuln`, `audit-pack`, `cyber`, `tara`, `diff`, `badge`, `req`, `fix`, `hooks`, `sign`, `do178`, `sas`, `sci`, `coverage`, `pr`, `coupling`, `iso21434`, `unece`, `iec62443`, `slsa`, `comp` |
+| `cmd/gofusa` | CLI — `init`, `check`, `lint`, `analyze`, `template`, `report`, `trace`, `verify`, `release`, `qualify`, `safety-case`, `fmea`, `boundary`, `vuln`, `audit-pack`, `cyber`, `tara`, `diff`, `badge`, `req`, `fix`, `hooks`, `sign`, `do178`, `sas`, `sci`, `coverage`, `pr`, `coupling`, `iso21434`, `unece`, `iec62443`, `slsa`, `comp`, `hara`, `iso26262`, `iec61508`, `disposition`, `impact`, `metrics`, `misra`, `capabilities`, `version` |
 
 ## Install
 
@@ -59,6 +59,13 @@ go install github.com/SoundMatt/go-FuSa/cmd/gofusa@latest
 ## Quick start
 
 ```bash
+# Print the tool/spec version
+gofusa version                          # text
+gofusa version --format json            # {"tool","version","specVersion"}
+
+# Discover supported commands, formats, and standards (§9.1 discovery document)
+gofusa capabilities
+
 # Initialise a project
 gofusa init
 
@@ -274,7 +281,7 @@ docker build -t go-fusa .
 docker run --rm -v "$(pwd)":/project go-fusa check
 ```
 
-Published tags: `latest`, `0.33`, `0.33.4` (and matching semver for every release).
+Published tags: `latest`, `0.33`, `0.33.5` (and matching semver for every release).
 
 ## Standards coverage
 
diff --git a/docs/tool-safety-manual.md b/docs/tool-safety-manual.md
index e930ff1..a078323 100644
--- a/docs/tool-safety-manual.md
+++ b/docs/tool-safety-manual.md
@@ -1,6 +1,6 @@
 # go-FuSa Tool Safety Manual
 
-**Version:** 0.33.4  
+**Version:** 0.33.5  
 **Module:** `github.com/SoundMatt/go-FuSa`  
 **License:** Mozilla Public License 2.0  
 **Standards addressed:** ISO 26262, IEC 61508, ISO 21434, DO-178C
diff --git a/fusa.go b/fusa.go
index 574c282..aa1a9ea 100644
--- a/fusa.go
+++ b/fusa.go
@@ -15,7 +15,7 @@ import (
 )
 
 // Version is the current release of go-FuSa.
-const Version = "0.33.4"
+const Version = "0.33.5"
 
 // SpecVersion is the x-FuSa spec version this release implements.
 const SpecVersion = "1.10.12"