chore: prepare v0.4.0 release

Author: Rajioba1

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.4.0 — 2026-07-26
+
+### Added
+
+- The browser Observatory now opens on a full-size codebase graph, with deterministic Auto layout,
+  explicit zoom, Fit, 100%, and fullscreen controls, plus a collapsed, lazy-loaded hotspot ranking.
+- The live agent assay can reuse isolated, locked specimen slots across trials while retaining
+  dependency and CodeGraph caches.
+
+### Changed
+
+- Browser Overview and History are combined into Activity; legacy dashboard hashes continue to open
+  the merged view.
+- Assay slots reset to the pinned specimen HEAD between subjects and use the production
+  status/sync/status graph boundary instead of recloning and fully indexing every arm.
+
+### Reliability and safety
+
+- Persistent assay slots use deterministic arm-neutral assignment, exclusive leases, clean-source
+  admission, generation-bound receipts, protected dependency/graph state, and rebuild-once graph
+  recovery.
+- Dashboard tabs now implement keyboard navigation and roving focus, hotspot actions are keyboard
+  accessible, unavailable graphs show setup guidance without an empty stage, and resize/fullscreen
+  transitions keep the Cytoscape viewport synchronized.
+
+### Evidence boundary
+
+- Persistent workspaces change assay execution cost and production realism, not the estimand or
+  efficacy evidence. A paid run is still required before drawing a new treatment-effect conclusion.
+
 ## 0.3.1 — 2026-07-25
 
 ### Fixed

SECURITY.md

@@ -2,17 +2,16 @@
 
 ## Supported Versions
 
-PEBRA's latest published release is `0.3.0`; `0.3.1` is the current development line on `main`.
-Security fixes are made against the published release and the current development branch.
+Security fixes are made against the latest verified PyPI release and the current development branch.
 
 | Version | Supported |
 | --- | --- |
-| Latest published: `0.3.0` | Yes |
-| Development: `0.3.1` / `main` | Yes |
+| Latest verified PyPI release | Yes |
+| Development branch: `main` | Yes |
 | Older versions | No |
 
-Update this table only after the corresponding PyPI release is verified; a version bump on `main`
-does not make that version a published release.
+Treat a version as the latest release only after its PyPI publication is verified; a version bump on
+`main` does not make that version a published release.
 
 ## Reporting A Vulnerability
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pebra"
-version = "0.3.1"
+version = "0.4.0"
 description = "Pre-edit benefit-risk analysis for coding agents — a deterministic, hexagonal decision controller."
 requires-python = ">=3.11"
 readme = "README.md"

tests/unit/test_project_metadata.py

@@ -29,9 +29,9 @@ def test_security_policy_defines_private_reporting_and_response_targets() -> Non
     assert "private vulnerability reporting" in policy
     assert "do not open a public issue" in policy
     assert "business days" in policy
-    assert "Latest published: `0.3.0`" in body
-    assert "Development: `0.3.1` / `main`" in body
-    assert "Update this table only after the corresponding PyPI release is verified" in body
+    assert "Latest verified PyPI release" in body
+    assert "Development branch: `main`" in body
+    assert "only after its PyPI publication is verified" in body
 
 
 def test_contribution_terms_cover_rights_license_and_private_security_reports() -> None:
@@ -137,7 +137,7 @@ def test_readme_installs_codegraph_and_pebra_before_workflow() -> None:
     assert "## Install & engines" not in body
 
 
-def test_project_version_is_0_3_1_release_candidate() -> None:
+def test_project_version_is_0_4_0_release_candidate() -> None:
     _, project = _project_metadata()
 
-    assert project["version"] == "0.3.1"
+    assert project["version"] == "0.4.0"