Release 0.4.0: notes that file themselves, checked end to end, with or without AI

[Braydenh563]

What & why

Release 0.4.0. This branch started as the notes-flow rebuild (INBOX 432: creating, filing, sorting and managing notes) after 0.3.32 shipped with note capture and filing broken, and grew into a full release round: every main feature checked end to end, polish, security hardening, packaging, docs and a new landing site. The release highlights are the ## [0.4.0] section of CHANGELOG.md; in short:

• Capture and filing, checked end to end. A note typed in Capture is saved, filed and findable after a reload, with or without a model. 49 Playwright browser tests (tests-e2e/) now run in CI on every push; the same specs fail 20 of 45 against v0.3.32.
• Works fully with no AI model. Filing by the notebook's own words (now also files on a clear lead), search, Ask with cited sources, reminders from plain words; a crawl of 187 controls across 11 surfaces found no dead button, error or endless spinner.
• Trustworthy filing certainty. A model's pick never reads 100%, drops when the notebook's words disagree or the category is small, and offers other categories when unsure.
• Nothing lost. Unsaved note and document edits survive a reload or closed window and are offered back; expected situations show a plain notice, real faults keep "Report this".
• Mind maps and boards. A real hierarchy by default with four looks and per-level styles, an emoji and icon library (1,530 icons, 476 emoji) as stickers and in the editors, drag to delete with Undo, links that follow a turning item, a fixed map rail and curve undo.
• Interface. The Writing room, chat progress phases, refreshed Atlas avatars and AI-off status, Interface animations (with its own switch), editor current-line highlight and whole-line copy/cut, a rendered Back/Forward list, opaque timeline headers, phone width fixes.
• Security. HTTPS for other devices, password rules, private notes kept out of answers, backups and the index, consent before any update check, ReDoS fixes in imports and agent mode, release workflow input injection fixed.
• Windows. Installer and packaged app audited (17 fixes plus 4 follow-ups); CI builds, installs, upgrades over the last release and uninstalls on every push.
• Docs and site. A static GitHub Pages landing page, fresh README screenshots, a shorter README top, and a correctness pass over every user and contributor document.

Moved to the next PR, at the top of docs/ROADMAP.md: OneNote ideas and the meeting notes redesign, the code editor to VS Code standard, and the rest of the Coggle, Miro, Illustrator and Photoshop ideas.

How to test

1. PYTHONPATH=src python -m uvicorn memorymap.api.app:create_app --factory --port 8000, open it, set a password.
2. With no model configured: write a few notes in Capture (one per topic), reload, and check each is filed, tagged and searchable; ask a question in Ask and open a cited source.
3. Edit a note and a document, reload before saving, and accept "Put them back".
4. Open a mind map: central topic and branches styled by level; add an icon from the picker; drag a topic onto the delete target, then Ctrl+Z.
5. Settings, Appearance: toggle Interface animations; switch tabs and watch the indicator.
6. Automated: python -m pytest -n auto tests/, cd tests-e2e && npm ci && npx playwright test.

Checklist

• pytest passes locally (the suite is fully offline, no Ollama needed): full suite run on the release head, and CI green on every job
• ruff check . is clean
• Docs updated if behaviour changed (README, INSTALL, MODELS, PRIVACY, TROUBLESHOOTING, ARCHITECTURE, CONTRIBUTING, DESIGN, the landing page)
• Stayed offline-first: no new code path sends user data off the machine; the update check asks first and nothing touches the network before

Notes for the reviewer

• Measured in headless Chromium, not observed on real hardware: the desktop (WebView2) window, real touch screens and Safari or Firefox for the landing page. The Windows installer is exercised in CI only.
• Filing with a real model was measured once with a small local model (Qwen2.5 1.5B: 9 of 10 notes right); the certainty calibration factors are reasoned, not fitted to many models.
• Open, none blocking (docs/roadmap/agent-remaining/final-scan-1006.md): four slow regexes reachable only from the user's own notes or a model reply, Python 3.13 CI at 16 of its 25 minute timeout, the Linux release job's smoke test being lighter than the Windows one, and a raw error string in the Background jobs list.
• After merging: tag v0.4.0 on main; release.yml builds and publishes from the CHANGELOG section.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UvMLdXt2CL6M5pkTvwyV17

[Braydenh563]

The github-advanced-security check fails on every head since c2777c3, and the cause is outside this PR. Its job is the Copilot code-scanning agent ("autofind"). It stops about 6 seconds in with SessionModelError: You have exceeded your monthly quota (HTTP 402, errorCode: quota), before it reads any code. For example, see job 111192354377 on f97fe55. A re-run would hit the same quota, so I have not re-run it. It should pass once the account's Copilot quota resets or is raised.

The CodeQL analysis itself (Analyze (python) and the CodeQL alerts check) is separate. Its one open alert on this PR, 443 (polynomial regex in search_manager.py), is fixed in 1558c50, with a test that times the pattern on 20,000 tabs.

---

Generated by Claude Code