Finalize CleanMac v0.3.0 release metadata

contract.md

@@ -55,6 +55,6 @@
 
 ## Result
 
-- Status: in progress
-- Verification result: pending final main-branch package and GitHub release validation.
-- Notes: no Developer ID identity is installed, so the release will remain transparently labeled ad-hoc signed and not notarized.
+- Status: complete
+- Verification result: 40 SwiftPM tests, local Debug build/launch, green PR CI, main merge, Release packaging, strict fresh-extraction signature verification, 0.3.0 (4) metadata, arm64 architecture, portable SHA-256 verification, and downloaded GitHub asset verification all passed.
+- Notes: public latest release `v0.3.0` targets merge commit `515f591`, contains the verified ZIP and portable checksum, and is transparently labeled ad-hoc signed and not notarized because no Developer ID identity is installed.

progress.md

@@ -370,3 +370,13 @@ Append-only history. Do not erase previous entries.
 - Next step: Exercise the result and confirmation layout on a user-approved disposable folder, then cut a release only when requested.
 - Bottleneck: Full hashing of very large files is intentionally slow and remains an explicit opt-in; hidden files and package contents stay outside this stage.
 - Handoff: The current Debug app is running on the Russian Duplicate Finder initial screen. No user file was scanned or moved, and no destructive confirmation was accepted.
+
+## 2026-07-12 - TASK-041 - CleanMac v0.3.0 release
+
+- What changed: Bumped CleanMac to 0.3.0 build 4, updated the feature PR title and English summary, waited for green CI, merged PR #9 into `main`, rebuilt `dist/CleanMac.app` and the arm64 ad-hoc ZIP from merge commit `515f591`, published `v0.3.0` with English notes, and fixed checksum generation so downloaded `.sha256` files contain a portable ZIP basename rather than a developer-machine path.
+- Files touched: `CleanMac.xcodeproj/project.pbxproj`, `script/package_release.sh`, generated ignored `dist/CleanMac.app`, `dist/CleanMac-515f591-unsigned.zip`, `dist/CleanMac-515f591-unsigned.zip.sha256`, `contract.md`, `project-analysis.md`, `roadmap.md`, `progress.md`, `trace.md`, GitHub PR #9, and GitHub Release `v0.3.0`.
+- Checks run: `swift test --package-path CleanMacCore` (40/40); `./script/build_and_run.sh --verify`; Debug version/build/arm64/signature inspection; green GitHub PR CI; `./script/package_release.sh`; local and fresh-extraction strict codesign verification; local and clean downloaded SHA-256 verification; downloaded release bundle version/build/architecture inspection; GitHub release metadata inspection.
+- Result: Passed. PR #9 is merged. `v0.3.0` is public, latest, non-prerelease, targets `515f591`, and contains `CleanMac-515f591-unsigned.zip` plus its portable checksum. The ZIP SHA-256 is `cd5d94601d3a5e5bb5e8681f71ccf2decb216638ec83159cd6aca3d65c0a0cbf`; the extracted app reports 0.3.0 (4), arm64, and a valid strict ad-hoc signature.
+- Next step: Install the packaged app in `/Applications`; Developer ID signing and Apple notarization remain the next distribution upgrade when credentials are available.
+- Bottleneck: This Mac has no Developer ID identity, so Gatekeeper can reject the downloaded ad-hoc build even though its integrity and signature are valid.
+- Handoff: `dist/` contains the current 0.3.0 app and verified release assets. No security setting, Login Item, privacy permission, cleanup selection, application, or user file was changed.

script/package_release.sh

@@ -169,7 +169,10 @@ fi
 sanitize_app_bundle "$DIST_APP"
 verify_zip "$ZIP_PATH"
 
-shasum -a 256 "$ZIP_PATH" > "$ZIP_PATH.sha256"
+(
+  cd "$(dirname "$ZIP_PATH")"
+  shasum -a 256 "$(basename "$ZIP_PATH")"
+) > "$ZIP_PATH.sha256"
 
 echo "Created:"
 echo "  $DIST_APP"

trace.md

@@ -106,3 +106,10 @@ Append-only trace of failures, restarts, and judgment divergences.
 - Cause: the known local Finder/File Provider metadata behavior recurred on the build product.
 - Fix: cleared extended attributes only from `build/XcodeData/Build/Products/Debug/CleanMac.app` and repeated the standard verification command without touching source or user files.
 - Status: resolved; the repeated verification reported a valid on-disk signature and launched the current Debug app.
+
+## 2026-07-12 - TASK-041 - Non-portable checksum path
+
+- Symptom: the first downloaded `v0.3.0` checksum contained the absolute local `/Users/admin/Documents/CleanMac/dist/...` path, so `shasum -c` could resolve the developer machine's file instead of the ZIP beside the downloaded checksum.
+- Cause: `package_release.sh` passed the absolute `ZIP_PATH` directly to `shasum`.
+- Fix: generate the checksum from inside `dist` using only the ZIP basename, replace the GitHub checksum asset, and repeat verification from a clean temporary download directory.
+- Status: resolved; the published checksum now references `CleanMac-515f591-unsigned.zip`, and clean-directory verification checks the downloaded ZIP successfully.