Prepare v0.4.1: desktop version and release review

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modex/desktop",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Modex desktop — a Codex-App-style GUI: projects, parallel agent threads, worktrees, inline approvals, and a live Changes panel.",
   "license": "MIT",
   "private": true,

docs/reviews/2026-10-30-v0.4.1-release-review.md

@@ -0,0 +1,89 @@
+# v0.4.1 release review
+
+Desktop v0.4.1 is a patch release. It fixes the three observations from the CF-7 close-out's live
+runs (#280):
+
+- a turn's files list no longer looks complete when a shell command may have changed files no CLI
+  named;
+- a thread named after its opening message is cut at a word break with "…", not mid-word.
+
+Val asked on 2026-10-30 for the CF-7 work to land and the next patch release to ship. The iPhone
+Companion stays at 0.4.0 (9); nothing in this release changes it.
+
+This preparation starts from protected `main` at `9f85d61` (#455), which includes #450 as
+`108b814`. It changes only the desktop version and the release records. The tag source is this
+PR's squash merge on protected `main`.
+
+## Scope since v0.4.0
+
+| Area | Pull requests |
+| --- | --- |
+| Commands that may have changed unlisted files are named in the context map, footer, Task view and note; opening-message titles cut at a word break (CF-7 follow-ups) | #450 |
+| Local child admission refuses enabled or missing subagent settings. Local coding execution stays unadmitted in production | #448 |
+| Tests: native Canvas readiness before Escape (the flake in #443's first queue run), secure answer field focus, local auxiliary dispatch boundaries | #446, #455, #447 |
+| Records: v0.4.0 publication and site fallback, CF-7 close-out receipt, CF-4 deferral and full-suite record | #445, #443, #444, #449, #454 |
+
+Any other pull request that reaches `main` before this one merges is listed in the publication
+section with its merge SHA.
+
+## Candidate behavior and compatibility
+
+- **Updates.** v0.4.0 reaches v0.4.1 through the background update: a check downloads and verifies
+  it without a click, and it installs on **Restart to update** or the next time Modex quits. v0.2.0
+  and older still need one **Download update** click. Windows and Linux still install by hand.
+  [Download and restart](../update-recovery.md#download-and-restart).
+- **Files touched.** A finished turn that ran a command which may have written files, and is
+  neither a check nor known to be read-only, now shows that command under the files list. The label
+  reads "N, maybe more", or "not listed" when no file was named. A turn that only reads, or only
+  edits through patch tools, looks as before.
+  [Context map](../task-context.md#context-map).
+- **Saved notes.** Notes and task records saved by v0.4.0 reopen unchanged, without the command
+  list. Nothing is backfilled or inferred. A new save of the same turn writes the list.
+- **Thread titles.** Only new threads change. An existing thread keeps its title, and a Retry of a
+  first turn that carries the old 60-character cut is still renamed once the turn completes.
+- **Not changed.** The release workflow, signing scripts, release verifier, native updater verifier
+  and desktop build hooks are unchanged from v0.4.0, so no rc rehearsal is needed.
+
+## Local preparation — 2026-10-30
+
+This Mac has only an Apple Development identity, and the 1Password CLI is signed out, so
+`scripts/release-mac.sh` cannot sign or notarize here. The local rehearsal is the ad-hoc package
+(`pnpm --filter @modex/desktop dist`) with the packaged e2e. Its artifacts must not be published.
+Developer ID signing, notarization, packaged acceptance, native updater scenarios and native platform
+checks run in the protected `Release` workflow.
+
+Machine: Apple M5 Max, 18 cores, macOS 27.0.1, Node 24.22.0, pnpm 10.34.5.
+
+| Check | Source | Result |
+| --- | --- | --- |
+| `pnpm build && pnpm test` | #450 head `2fffd9c` | exit 0. Desktop 2,071 passed, 20 skipped, 0 failed; every other package green |
+| `pnpm test:e2e` (development Electron) | #450 head `2fffd9c` | exit 0. Desktop 476 passed, 7 skipped; site 7 passed |
+| Ad-hoc package, `pnpm --filter @modex/desktop dist` | `2ccb808`, version 0.4.1 | exit 0. `Modex-0.4.1-arm64.dmg` and `.zip`; bundle version 0.4.1, `Signature=adhoc` |
+| Packaged e2e, `MODEX_PACKAGED_APP=… pnpm test:e2e` | `2ccb808` | exit 1. Desktop 475 passed, 7 skipped, **1 failed**; the site stage did not run. Transcript median 243.5 ms against the approved 500 ms |
+| The failed case alone, `--repeat-each 10`, same packaged app | `2ccb808` | 10 passed |
+
+`2ccb808` is this branch before its rebase onto `9f85d61`. The rebase added #447, #448, #454 and
+#455 from `main`; their own PR and queue runs cover them, and the protected `Release` workflow runs
+the full packaged suite on the exact tag source.
+
+**The first packaged failure stays on record.** `e2e/attachment-lifecycle.spec.ts:305`, "failed
+creation restores files while keeping newer text and other drafts usable", expected the relaunched
+composer to read `another draft` and found `yanother draft` at line 362. The extra leading `y` was
+never typed by the test, and its source is not explained. The same case passed in the development
+Electron run above and in ten unchanged packaged repetitions. This release changes neither the
+composer nor drafts, so it is recorded as an unexplained flake, not cleared. The trace and error
+context are kept outside the tree under
+`~/.claude/task-evidence/release-041-2026-10-30/first-failure/`, with the full logs beside it.
+
+Packaged selection covers the shared desktop launcher, window lifecycle and Code Review launchers.
+Store, standalone desktop-host and fixture launchers keep their development or fixture paths, as
+[release-signing.md](../release-signing.md#cutting-a-release) describes. The protected `Release`
+workflow runs the full packaged suite again on the Developer ID signed bundle.
+
+## Release steps still to run
+
+1. CI and the merge queue for this PR (#450 merged as `108b814`).
+2. Signed tag `v0.4.1` at this PR's squash SHA with the approved key
+   (`SHA256:Apqee2EOZLXmfVUUy/QX1QLBn9g10SuzHbK5ARks19E`).
+3. The `Release` workflow behind the `release-signing` reviewer.
+4. Independent checks of the downloaded draft assets, then publication.

docs/status.md

@@ -72,7 +72,9 @@ PR #422's CR-6 review found two blockers: unconfirmed child exit was reported as
 
 The published application source is `2eda138` (v0.4.0). Later source deliveries belong here; the release inventory and its incomplete acceptance gates are recorded separately below.
 
-- **CF-7 close-out follow-ups (#280, 2026-10-30).** The three observations from the live close-out
+- **v0.4.1 candidate (2026-10-30).** A patch release of the follow-ups below. See the
+  [v0.4.1 review](reviews/2026-10-30-v0.4.1-release-review.md).
+- **CF-7 close-out follow-ups (#280, #450, 2026-10-30).** The three observations from the live close-out
   runs are fixed. A turn's files list now names any command that may have changed files no CLI
   reported, such as a shell redirect or `perl -pi`, and says "maybe more" or "not listed" instead of
   looking complete. It never guesses the file. A thread named after its opening message is cut at a