Finalize CleanMac v0.4.0 release documentation

contract.md

@@ -56,6 +56,6 @@
 
 ## Result
 
-- Status: in progress
-- Verification result: pending.
-- Notes: PR #14 is merged and green; release versioning/package publication remains.
+- Status: complete
+- Verification result: PR #14 and PR #15 core/macOS CI passed; 47/47 core tests; Debug build/sign/launch passed; local Release packaging and clean extraction passed; published workflow run `29220077936` passed; downloaded ZIP checksum, version `0.4.0` build `5`, `arm64` architecture, and strict ad-hoc signature all passed.
+- Notes: `v0.4.0` points to merge commit `125e528` and is published as the latest GitHub Release with ZIP and SHA-256 assets. Developer ID certificate and notary key steps were skipped because those secrets are not configured; the notes accurately label the asset ad-hoc signed and not notarized.

progress.md

@@ -430,3 +430,13 @@ Append-only history. Do not erase previous entries.
 - Next step: Commit and push the feature only when explicitly requested; package or publish a release separately when approved.
 - Bottleneck: physical-media erasure cannot be guaranteed on SSD/APFS; the known stale CoreSimulator warning remains non-blocking for macOS builds.
 - Handoff: The current Debug app builds, signs, and launches. CleanMac preferences were restored to English/light after RU/dark review. No real user file, setting, permission, package, release, or remote repository state was changed.
+
+## 2026-07-13 - TASK-047 - CleanMac v0.4.0 release
+
+- What changed: Merged the thermal optimization and Smart Shredder in PR #14, bumped the app from `0.3.0 (4)` to `0.4.0 (5)` in PR #15, refreshed the Dashboard/Scan/Applications screenshots, added a dark Smart Shredder screenshot and README coverage, tagged verified `main` as `v0.4.0`, and published accurate feature, safety, checksum, architecture, signing, and notarization notes.
+- Files touched: `CleanMac.xcodeproj/project.pbxproj`, `README.md`, `docs/screenshots/overview.png`, `docs/screenshots/scan-areas.png`, `docs/screenshots/applications-multiselect.png`, `docs/screenshots/shredder.png`, `contract.md`, `project-analysis.md`, `roadmap.md`, `progress.md`, `trace.md`.
+- Checks run: PR #14 core/macOS CI; PR #15 core/macOS CI; `swift test --package-path CleanMacCore` (47/47); `./script/build_and_run.sh --verify`; `./script/package_release.sh`; local and downloaded SHA-256 verification; clean ZIP extraction; `CFBundleShortVersionString`/`CFBundleVersion`; `lipo -archs`; strict `codesign`; Release workflow run `29220077936`; live English/light and English/dark screenshot review without starting a scan or accepting any removal action; `git diff --check`.
+- Result: Passed. GitHub Release `v0.4.0` is published as latest with `CleanMac-125e528-unsigned.zip` and its `.sha256`; a clean download reports version `0.4.0`, build `5`, `arm64`, matching checksum, and a valid strict ad-hoc signature.
+- Next step: Configure Developer ID and notarization secrets before a future trusted-distribution release.
+- Bottleneck: the release remains ad-hoc signed and not notarized because no Developer ID certificate/notary credentials are configured; Gatekeeper may reject it. The known stale CoreSimulator warning remains unrelated and non-blocking for macOS builds.
+- Handoff: Tag `v0.4.0` points to `125e528`. Release assets and verification copies are preserved under the task diagnostics folder. No user file was deleted and no destructive Shredder action was accepted.

project-analysis.md

@@ -72,7 +72,7 @@ CleanMac is a macOS menu bar and windowed system cleanup utility. The project wa
 - Settings can enable read-only auto scan while the app is running; it supports daily, hourly, and every-two-hours frequencies, uses the currently selected scan areas, and updates menu bar status.
 - Settings can register the main app through `SMAppService.mainApp` to launch at login, displays the authoritative macOS enabled/disabled/approval/unavailable status, reports registration failures, and links to Login Items when user action is required. Login-style background launch keeps the main window hidden until the user activates CleanMac or chooses Open from the menu bar.
 - Scheduled auto scan can show localized macOS completion notifications when the notification toggle is enabled and system permission allows it; Settings includes a test notification button to diagnose macOS permission/delivery state. Manual scans remain silent.
-- Public GitHub Release `v0.3.0` is the latest release and includes the verified arm64 ad-hoc zip and sha256 assets.
+- Public GitHub Release `v0.4.0` is the latest release and includes the verified arm64 ad-hoc ZIP and SHA-256 assets. It ships the low-disk warning, custom-folder picker fix, scan thermal optimization, Smart Shredder, and refreshed public screenshots.
 - Release packaging creates a clean unsigned/ad-hoc local zip plus sha256, strips Finder/resource-fork metadata before archiving, retries codesign when File Provider reattaches metadata between passes, strictly verifies a fresh ZIP extraction, and can optionally sign with Developer ID, enable hardened runtime, submit to Apple notary service, staple, and re-zip when credentials are configured.
 
 ## Unfinished Or Risky Parts

roadmap.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-- [ ] ID: TASK-047
+- [x] ID: TASK-047
   Title: CleanMac v0.4.0 release
   Goal: Publish the verified thermal optimization and Smart Shredder as the next feature release.
   What to do: Bump version/build to 0.4.0 (5), verify core/Debug/Release artifacts, merge the version commit, tag main, publish accurate notes, and validate downloaded assets.

trace.md

@@ -148,3 +148,10 @@ Append-only trace of failures, restarts, and judgment divergences.
 - Cause: the known local Finder/File Provider metadata behavior recurred on the build product.
 - Fix: cleared extended attributes only from `build/XcodeData/Build/Products/Debug/CleanMac.app` and repeated the standard verification command.
 - Status: resolved; the Debug app is valid on disk, satisfies its designated requirement, and launches successfully.
+
+## 2026-07-13 - TASK-047 - Finder metadata on local convenience app
+
+- Symptom: the local Release ZIP and checksum passed, but a later direct signature check of `dist/CleanMac.app` found `com.apple.FinderInfo` reattached after packaging.
+- Cause: File Provider can mutate the Documents-backed convenience copy after the packaging script sanitizes and signs it.
+- Fix: treated the fresh ZIP extraction as the distribution source of truth, matching the packaging contract, and repeated checksum, version, architecture, and strict signature verification on both a clean local extraction and a clean GitHub asset download.
+- Status: resolved for the release artifact; both fresh extractions are valid, while the mutable convenience app is not used as release evidence.