chore(release): prepare 0.4.0 scoped delivery observation

PARITY.md

@@ -1,14 +1,14 @@
 # Python compatibility and npm migration
 
-## Current development comparison — Python 1.1.0 / 0.4.0 candidate
+## Current comparison — Python 1.1.0 / TypeScript 0.4.0
 
-Updated 2026-10-11 KST. The unpublished 0.4.0 source candidate uses published
+Updated 2026-10-18 KST. TypeScript 0.4.0 uses published
 Python **1.1.0**, commit
 [`8ca77cf`](https://github.com/abruption/session-peer/tree/8ca77cf31254c8287a2593fe484bb30a7dba2727),
-as the ordinary list/discovery comparison baseline. Candidate JSON reports
+as the ordinary list/discovery comparison baseline. JSON reports
 `referenceVersion: "1.1.0"`; this identifies a comparison source, not complete
-runtime parity. The rebased candidate keeps published `VERSION=0.3.6`; its handoff features
-remain unpublished until a separately reviewed release. It does not change
+runtime parity. The source reports `VERSION=0.4.0`; publication evidence belongs
+to the dated validation and release records. This source does not change
 immutable public npm artifacts or their historical comparison markers.
 
 - The exact-release `compatibility-v1.json` and compatibility document are
@@ -30,7 +30,7 @@ immutable public npm artifacts or their historical comparison markers.
   were inspected statically; the 21 tests are not coverage of every new path.
 - Python 1.1.0 has an experimental local Claude receipt-only ACK path. This
   does not establish automated ACK, SSH handoff or Windows handoff support in
-  the TS 0.4.0 drafts. Receipt bootstrap, original generation, body-free native
+  the scoped TS 0.4.0 implementation. Receipt bootstrap, original generation, body-free native
   observation, cleanup and platform qualification remain separate gates.
   Neither a native queue result nor turn completion establishes ACK or safe
   retry; no end-to-end consumption/exactly-once guarantee is introduced.
@@ -358,7 +358,7 @@ Windows support, WSL/POSIX SSH and TS native Windows SSH are separate paths.
 
 **Design-freeze checkpoint: jointly approved, frozen DESIGN v0.2; runtime was
 unimplemented and unshipped at that checkpoint.** The current source implementation
-and its limited, unreleased scope are described below. All four issues
+and its limited 0.4.0 scope are described below. All four issues
 [#69](https://github.com/abruption/session-peer-ts/issues/69),
 [#70](https://github.com/abruption/session-peer-ts/issues/70),
 [#71](https://github.com/abruption/session-peer-ts/issues/71) and
@@ -372,7 +372,8 @@ and [synthetic fixture](https://github.com/abruption/session-peer/blob/99d8ec385
 Exact copies are retained in `test/fixtures/handoff-v1.md` and
 `test/fixtures/handoff-v1.json`; `handoff-v1.pin.json` records their SHA-256 hashes,
 review status and separate runtime/design references. These test-only files are
-excluded from the npm package; the existing 51-file package allowlist is unchanged.
+excluded from the npm package. The design-only checkpoint retained its then-current
+51-file allowlist; the implementation adds its runtime modules explicitly.
 
 The design review uses published Python 1.0.3 at
 `0d252550ab40c26d1ac4a19193df6ca2f84d830b` as its compatibility baseline.
@@ -398,7 +399,7 @@ The candidate adds a nested `handoff` object only in opted-in mode. Its proposed
 init/prepare/status/wait/confirm/ack commands, epoch IDs, private collector,
 30-second per-destination budget and 5-second cleanup reserve were **not CLI
 capabilities at the design-freeze checkpoint**. The source subset is described
-in the unreleased implementation sections below. Budgets 1–5 seconds are syntactically valid in the proposal
+in the scoped implementation sections below. Budgets 1–5 seconds are syntactically valid in the proposal
 but refuse before effect. Source-streamed SSH without a compatible receipt handler
 remains ACK-unsupported under this candidate. No transcript/body-returning observer
 or fallback after a possible submission is authorized.
@@ -1046,13 +1047,15 @@ original binding/generation guards remain mandatory in the included scope. This
 reference or establish runtime conformance.
 
 
-## Unreleased handoff implementation — #70
+<a id="unreleased-handoff-implementation--70"></a>
 
-The frozen #69 design pin is unchanged. Source-only private POSIX ledger and
+## 0.4.0 private handoff implementation — #70
+
+The frozen #69 design pin is unchanged. The private POSIX ledger and
 strict protocol helpers now implement prepare, at-most-once sender fencing,
 status, bounded wait records and explicit receipt/operator-confirmation
 validation. [CLI details](docs/api.md#unreleased-opt-in-handoff-cli--040-work)
-separate current source support from the published 0.3.5 runtime. Automated ACK
+describe the opt-in 0.4.0 scope; earlier 0.3.x packages lack these commands. Automated ACK
 bootstrap, Windows private ACL support and original-sender SSH collector
 coordination are deferred extensions (#131/#132), not prerequisites of the
 user-approved limited 0.4.0 scope. Fixture passes are not live receipt/injection
@@ -1072,7 +1075,9 @@ at-rest journal boundary, not protection against a reader of both private
 files. Duplicate committed operator confirmation returns the original receipt
 without rewriting its wait classification or journal.
 
-## Unreleased bounded app-server foundation — #71
+<a id="unreleased-bounded-app-server-foundation--71"></a>
+
+## 0.4.0 bounded app-server foundation — #71
 
 The opt-in internal client is qualified only for queue mechanics on Codex
 0.160.1 and 0.162.1 / macOS arm64, using separate isolated network-denied synthetic homes. One
@@ -1096,9 +1101,11 @@ owned Node children. These mechanics do not establish Python runtime delivery pa
 or implement automatic ACK.
 
 
-## Unreleased local observation integration — #72
+<a id="unreleased-local-observation-integration--72"></a>
+
+## 0.4.0 local observation integration — #72
 
-[Source-only runtime details](docs/api.md#unreleased-local-delivery-observation--72)
+[Scoped runtime details](docs/api.md#unreleased-local-delivery-observation--72)
 cover bounded one-shot/explicit-wait observation, native CID queueing, original
 writer generation checks, per-operation terminal waits and positive native fact
 preservation. Generated schema/native queue mechanics are distinct from
@@ -1109,8 +1116,9 @@ and no post-attempt fallback/resend occurs.
 
 Dedicated 0.162.1 Codex and Claude Code 2.1.296 test sessions supplied additional
 local evidence; native client ID injection is separate from plain model response
-or ACK. Retained qualified intents support independent read-only waits with no
-new native submission. Each process owns its wait cutoff; foreign pending and
+or ACK. Retained qualified intents support independent waits with no
+new native submission. Observation is read-only against native state; each wait
+persists its private operation and terminal record in the sender ledger. Each process owns its wait cutoff; foreign pending and
 old terminal waits are preserved. A separate voluntary matching reply was
 explicitly confirmed before any wait with `operator_confirmed`; ACK status and
 a later acknowledged wait succeeded. Confirmation after an earlier independent
@@ -1131,8 +1139,9 @@ Open capabilities include original-sender SSH collector coordination, Windows
 ACL/native observation and automated receipt producer/collector bootstrap. Other
 platform/version tuples and arbitrary blocking-filesystem deadlines are not
 qualified by these tests.
-#69/#70/#71/#72 remain together in 0.4.0 and open. Ordinary runtime parity and
-published version markers are unchanged.
+#69/#70/#71/#72 remain together in the scoped 0.4.0 milestone. The ordinary
+comparison is pinned to Python 1.1.0; version 0.4.0 does not claim broader
+runtime parity.
 
 
 Storage binding is checked on the owned queue transport before its effect:
@@ -1175,8 +1184,14 @@ evaluate body-bearing cells internally; bodies/errors do not cross into JS or
 ordinary output. Required unsupported goals refuse before effect; after any
 possible submission no fallback/resend is permitted.
 
-The four development issues stay open until their scoped acceptance and human
-PR review/merge are complete. Platform/collector follow-ups are not completion
+The four development PRs were merged in the authorized order #106→#107→#108→#109.
+Scoped evidence and separate release acceptance are tracked in their issues and
+[#150](https://github.com/abruption/session-peer-ts/issues/150). Platform/collector follow-ups are not completion
 conditions for this limited release. Companion skill candidate guidance and
-version/profile rollout is tracked in [companion #31](https://github.com/abruption/session-peer-skill/issues/31); an unreviewed new runtime
-version is not automatically compatible with the published skill metadata.
+version/profile rollout is tracked in [companion #31](https://github.com/abruption/session-peer-skill/issues/31)
+and [Draft #37](https://github.com/abruption/session-peer-skill/pull/37).
+The 0.4.0 finite row preserves the three reviewed published profiles and accepts
+the exact proposed skill 0.3.0/min0.1.0/full0.4.0/probe-help tuple after design/content
+review of the complete Draft #37 fixture. That fixture is not a published skill
+or installation pin; final skill bytes require renewed exact review. A new runtime
+version is never automatically compatible by numerical ordering.

README.ja.md

@@ -15,7 +15,9 @@
 
 <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->
 
-**文書・ソースのバージョン: 0.3.6。** インストール前に、選択したリリースとレジストリのメタデータを確認してください。日付付きの準備・検証記録は [VALIDATION.md](VALIDATION.md)、リリース手順は [RELEASING.md](RELEASING.md) にあります。SSH の両端には同じ TypeScript クライアントのバージョンが必要で、0.3.5 と 0.3.6 は互いの SSH 事前確認を拒否します。
+**文書・ソースのバージョン: 0.4.0。** インストール前に、選択したリリースとレジストリのメタデータを確認してください。日付付きの準備・検証記録は [VALIDATION.md](VALIDATION.md)、リリース手順は [RELEASING.md](RELEASING.md) にあります。SSH の両端には同じ TypeScript クライアントのバージョンが必要で、0.3.6 と 0.4.0 は互いの SSH 事前確認を拒否します。
+
+**0.4.0 handoff の範囲:** 任意の native 観測は macOS arm64 の厳密な Codex 0.160.1/0.162.1 に限定し、明示的な `operator_confirmed` 受領確認には対応する POSIX ledger を使います。Linux・Windows の native 観測と自動 ACK 収集は未対応です。
 
 **実行中の Claude Code・Codex セッションを見つけ、ローカルまたは SSH でメッセージを送信します。**
 Python 不要の Node.js クライアントです。パッケージ名とコマンド名は `session-peer` です。
@@ -56,15 +58,15 @@ SSH は既存の鍵・ホスト信頼設定と両端の**同じバージョン
 `Get-Command session-peer -All` で PATH を確認してください。利用する実装を選び、
 別の管理ツールのファイルを `--force` で上書きしないでください。
 
-**0.3.6 のインストール:** npm の導入・更新例を実行する前に、レジストリで公開状況と選択したリリースを確認してください。利用できない場合は[レビュー済みソースビルド](docs/guide.ja.md#ソースからビルド)を使います。
+**0.4.0 のインストール:** npm の導入・更新例を実行する前に、レジストリで公開状況と選択したリリースを確認してください。利用できない場合は[レビュー済みソースビルド](docs/guide.ja.md#ソースからビルド)を使います。
 
 ```sh
-npm view session-peer@0.3.6 version dist.integrity
-npm install --global --ignore-scripts session-peer@0.3.6
+npm view session-peer@0.4.0 version dist.integrity
+npm install --global --ignore-scripts session-peer@0.4.0
 session-peer --version
 ```
 
-期待する出力: `session-peer 0.3.6 (typescript)`。分離インストール・ソースビルド・
+期待する出力: `session-peer 0.4.0 (typescript)`。分離インストール・ソースビルド・
 Windows・削除の手順は以下の詳細ガイドを参照してください。
 
 任意の `sp` 短縮名は 0.3.0 以降に含まれ（0.2.1 以前にはありません）、自動では有効になりません。
@@ -73,12 +75,12 @@ Windows・削除の手順は以下の詳細ガイドを参照してください
 ### Update
 
 npm で導入したクライアントは npm で更新します。タグと対象バージョンを確認してから
-正確なバージョンを指定してください。以下は古い npm 版を選択した 0.3.6 に更新する例です。
+正確なバージョンを指定してください。以下は古い npm 版を選択した 0.4.0 に更新する例です。
 CLI は更新をインストールせず、`session-peer update --check` は確認のみ行います。
 
 ```sh
 npm view session-peer dist-tags
-npm install --global --ignore-scripts session-peer@0.3.6
+npm install --global --ignore-scripts session-peer@0.4.0
 session-peer --version
 ```
 
@@ -112,9 +114,9 @@ session-peer --version
 - [開発・貢献](CONTRIBUTING.md).
 - [リリース手順](RELEASING.md).
 
-- [0.4.0 handoff 設計と未公開実装の範囲](PARITY.md#handoff-v1-design-candidate--69).
+- [0.4.0 handoff 設計と実装の範囲](PARITY.md#handoff-v1-design-candidate--69).
 
-- [開発中の private handoff CLI と制限](docs/api.md#unreleased-opt-in-handoff-cli--040-work).
+- [private handoff CLI と制限](docs/api.md#unreleased-opt-in-handoff-cli--040-work).
 
 ## License
 

README.ko.md

@@ -20,7 +20,9 @@ Python을 설치하지 않아도 Node.js에서 실행되는 TypeScript 클라이
 
 <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.1.0 -->
 
-**문서·소스 기준 버전: 0.3.6.** 설치 전에 선택한 릴리스와 레지스트리 메타데이터를 확인하세요. 날짜별 준비·검증 기록은 [VALIDATION.md](VALIDATION.md), 릴리스 절차는 [RELEASING.md](RELEASING.md)에 있습니다. SSH 양쪽에는 같은 TypeScript 클라이언트 버전이 필요하며, 0.3.5와 0.3.6는 서로의 SSH 사전 확인을 거부합니다.
+**문서·소스 기준 버전: 0.4.0.** 설치 전에 선택한 릴리스와 레지스트리 메타데이터를 확인하세요. 날짜별 준비·검증 기록은 [VALIDATION.md](VALIDATION.md), 릴리스 절차는 [RELEASING.md](RELEASING.md)에 있습니다. SSH 양쪽에는 같은 TypeScript 클라이언트 버전이 필요하며, 0.3.6과 0.4.0은 서로의 SSH 사전 확인을 거부합니다.
+
+**0.4.0 handoff 범위:** 선택 기능인 native 관측은 macOS arm64의 정확한 Codex 0.160.1/0.162.1에 한정되며, 명시적 `operator_confirmed` 수령 확인에는 지원되는 POSIX ledger를 사용합니다. Linux·Windows의 native 관측과 자동 ACK 수집은 미지원입니다.
 
 <a id="demo"></a>
 ## 시연
@@ -65,15 +67,15 @@ PowerShell에서는 `Get-Command session-peer -All`로 PATH(명령 검색 경로
 실행 파일을 찾는지 확인하세요. 사용할 구현을 선택하고 다른 패키지 관리자가 설치한
 파일을 `--force`로 덮어쓰지 마세요. 설치와 갱신은 사용자가 npm으로 직접 수행합니다.
 
-**0.3.6 설치:** npm 설치·업데이트 예시를 실행하기 전에 레지스트리 제공 여부와 선택한 릴리스를 확인하세요. 해당 버전이 제공되지 않으면 [검토한 소스 빌드](docs/guide.ko.md#소스에서-빌드)를 사용하세요.
+**0.4.0 설치:** npm 설치·업데이트 예시를 실행하기 전에 레지스트리 제공 여부와 선택한 릴리스를 확인하세요. 해당 버전이 제공되지 않으면 [검토한 소스 빌드](docs/guide.ko.md#소스에서-빌드)를 사용하세요.
 
 ```sh
-npm view session-peer@0.3.6 version dist.integrity
-npm install --global --ignore-scripts session-peer@0.3.6
+npm view session-peer@0.4.0 version dist.integrity
+npm install --global --ignore-scripts session-peer@0.4.0
 session-peer --version
 ```
 
-예상 결과는 `session-peer 0.3.6 (typescript)`입니다. 별도 경로에 설치하거나,
+예상 결과는 `session-peer 0.4.0 (typescript)`입니다. 별도 경로에 설치하거나,
 소스에서 빌드하거나, Windows에서 설치·제거하는 방법은 [사용자 가이드](docs/guide.ko.md#설치)를 참고하세요.
 
 선택 사항인 `sp` 단축 명령은 0.3.0 이상에 포함되며(0.2.1 이하에는 없음) 자동으로
@@ -84,13 +86,13 @@ session-peer --version
 ### 업데이트
 
 npm으로 설치한 클라이언트는 사용자가 직접 npm으로 업데이트합니다. 사용 가능한 배포 태그
-(dist-tag)와 대상 버전을 확인한 뒤 해당 버전을 지정해 설치하세요. 아래 예시는 이전 npm 설치본을 선택한 0.3.6로
+(dist-tag)와 대상 버전을 확인한 뒤 해당 버전을 지정해 설치하세요. 아래 예시는 이전 npm 설치본을 선택한 0.4.0으로
 업데이트합니다. `session-peer` CLI는 업데이트를 설치하지 않습니다. `session-peer
 update --check`는 새 버전이 있는지 확인할 뿐입니다.
 
 ```sh
 npm view session-peer dist-tags
-npm install --global --ignore-scripts session-peer@0.3.6
+npm install --global --ignore-scripts session-peer@0.4.0
 session-peer --version
 ```
 
@@ -126,9 +128,9 @@ session-peer --version
 - [개발·기여 안내](CONTRIBUTING.md).
 - [릴리스 절차](RELEASING.md).
 
-- [0.4.0 handoff 설계와 미발행 구현 범위](PARITY.md#handoff-v1-design-candidate--69).
+- [0.4.0 handoff 설계와 구현 범위](PARITY.md#handoff-v1-design-candidate--69).
 
-- [개발 중인 private handoff CLI와 지원 한계](docs/api.md#unreleased-opt-in-handoff-cli--040-work).
+- [private handoff CLI와 지원 한계](docs/api.md#unreleased-opt-in-handoff-cli--040-work).
 
 <a id="license"></a>
 ## 라이선스