diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 43e3c13f..5a7c71cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -349,7 +349,7 @@ jobs:
           build-args: |
             VOGT_SOURCE_REF=dev
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.3.1
+            VOGT_PRODUCT_VERSION=0.4.0
           cache-from: |
             type=registry,ref=${{ env.CACHE_IMAGE }}:stack-dev
             type=registry,ref=${{ env.CACHE_IMAGE }}:demo-dev
@@ -465,7 +465,7 @@ jobs:
           build-args: |
             VOGT_SOURCE_REF=dev
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.3.1
+            VOGT_PRODUCT_VERSION=0.4.0
           provenance: true
           sbom: true
           cache-from: |
@@ -636,7 +636,7 @@ jobs:
             CORE_IMAGE=${{ env.IMAGE }}@${{ needs.image.outputs.digest }}
             VOGT_SOURCE_REF=${{ github.ref_name }}
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.3.1
+            VOGT_PRODUCT_VERSION=0.4.0
             INSTALL_AI_CLIENTS=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
             INSTALL_CADASTRE_MCP=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
             INSTALL_THECLAWBAY=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
@@ -701,7 +701,7 @@ jobs:
             CORE_IMAGE=${{ env.IMAGE }}@${{ needs.image.outputs.digest }}
             VOGT_SOURCE_REF=${{ github.ref_name }}
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.3.1
+            VOGT_PRODUCT_VERSION=0.4.0
             INSTALL_AI_CLIENTS=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
             INSTALL_CADASTRE_MCP=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
             INSTALL_THECLAWBAY=${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fa45477..afbdc9ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -209,7 +209,7 @@ jobs:
       - run: uv sync --locked
 
       - name: canonical product version is aligned
-        run: uv run --no-sync python scripts/check_product_version.py 0.3.1
+        run: uv run --no-sync python scripts/check_product_version.py 0.4.0
 
       - name: ruff (lint)
         run: uv run --no-sync ruff check .
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e6e43cb..bd5d0ea6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,53 @@ git log rather than being reconstructed here.
 
 Nothing yet.
 
+## [0.4.0] - 2026-09-01
+
+A feature release that opens session history to agents and tightens the
+terminal. Additive: three new read operations join the surface; no operation
+was renamed or removed and no schema migration is required.
+
+### Added
+
+- **Session history is searchable by agents, live and archived (#491).** The
+  engine's history search gains `include_live` (on by default) — a bounded,
+  write-free scan of each running session's scrollback supplements the archived
+  full-text index, and hits from a live session are flagged. The log endpoint
+  gains `strip_ansi` for readable plain text. vogt-core exposes three new read
+  operations on MCP, CLI and REST — `session.search_output`,
+  `session.log_tail`, `session.history_list` — so agents and scripts can reach
+  history that was previously GUI-only. The History tab now includes running
+  sessions in output search and badges live matches.
+- **History retention.** A configurable daily sweeper
+  (`history_retention_days`, default 30, `0` keeps forever) bounds both the
+  history database and the raw session logs.
+
+### Changed
+
+- **Public tree prepared for open source.** Retired historical docs, estate
+  references and backward-compatibility framing so the published tree documents
+  only its current state.
+- **Deployment docs** clarify that release images are CLI-free and the estate
+  is operator-private.
+
+### Fixed
+
+- **History replay is readable (#490).** Replays now resolve terminal escape
+  sequences and in-place redraws instead of dumping the raw byte stream.
+- **The "New session" button no longer renders oversized (#489).**
+- **Terminal lag and replay flood under many sessions (#466).** Lagging
+  clients are recovered in-band with burst coalescing, and leaked sockets no
+  longer duplicate a session's output.
+- **Promotion CI (#460).** `promote.yml` uses the GitHub REST API instead of
+  the `gh` CLI, so the green-gate validation and PR creation run on the
+  self-hosted runner. Superseded CI runs are now cancelled rather than banked.
+
+### Security
+
+- **Voice sidecar dependencies (#459).** Bumped ureq/url to clear the
+  rustls-webpki (high) and idna advisories. The affected crates live only in
+  the opt-in voice sidecar, not the default release images.
+
 ## [0.3.1] - 2026-08-31
 
 A feature and reliability release focused on the terminal, session history, and
@@ -118,7 +165,8 @@ minor bump.
 Baseline entry for this changelog. See the git log and release notes for the
 full history up to this tag.
 
-[Unreleased]: https://github.com/TheDancingDeveloper-org/vogt/compare/v0.3.1...HEAD
+[Unreleased]: https://github.com/TheDancingDeveloper-org/vogt/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/TheDancingDeveloper-org/vogt/compare/v0.3.1...v0.4.0
 [0.3.1]: https://github.com/TheDancingDeveloper-org/vogt/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/TheDancingDeveloper-org/vogt/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/TheDancingDeveloper-org/vogt/releases/tag/v0.2.0
diff --git a/deploy/.env.example b/deploy/.env.example
index 5813ef64..a3acc5cc 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -19,7 +19,7 @@ VOGT_BIND_IP=127.0.0.1
 
 # The image to run. Pin a digest in anything you would call a deployment.
 # Ignored when you add deploy/vogt.build.yml, which builds from the checkout.
-# VOGT_IMAGE=ghcr.io/thedancingdeveloper-org/vogt:0.3.1
+# VOGT_IMAGE=ghcr.io/thedancingdeveloper-org/vogt:0.4.0
 
 # The uid the container runs as. The gid is always 0 — that is what makes the
 # data directory writable at any uid. Set this to whoever owns the files this
diff --git a/deploy/engine.overlay.yml b/deploy/engine.overlay.yml
index 25654a7e..6ad492a3 100644
--- a/deploy/engine.overlay.yml
+++ b/deploy/engine.overlay.yml
@@ -59,7 +59,7 @@ services:
         # container carries both halves. Defaults to the same public image the
         # base would run, so the embedded core matches it; pin a digest for a
         # real deployment. The Dockerfile already carries a public default too.
-        CORE_IMAGE: "${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.3.1}"
+        CORE_IMAGE: "${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.4.0}"
         # Optional image-managed agent CLIs. When enabled, versions come from
         # engine/agent-versions.env unless an operator deliberately overrides
         # one with a reproducible build arg.
diff --git a/deploy/vogt.compose.yml b/deploy/vogt.compose.yml
index 71c07edb..c9d5b256 100644
--- a/deploy/vogt.compose.yml
+++ b/deploy/vogt.compose.yml
@@ -25,7 +25,7 @@ services:
     # digest — publishing an image and moving a deployment are separate acts
     # (NFR-D10), and a digest is the only form of "which image is this" a
     # rebuild cannot silently change.
-    image: ${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.3.1}
+    image: ${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.4.0}
     restart: unless-stopped
 
     # The image runs as any uid so long as the gid is 0: `/var/lib/vogt` is
diff --git a/docs/CUSTOMISATION.md b/docs/CUSTOMISATION.md
index 0e812b9a..a901c7b8 100644
--- a/docs/CUSTOMISATION.md
+++ b/docs/CUSTOMISATION.md
@@ -360,7 +360,7 @@ The published image is built to be a base:
   to it.
 
 ```dockerfile
-FROM ghcr.io/thedancingdeveloper-org/vogt:0.3.1
+FROM ghcr.io/thedancingdeveloper-org/vogt:0.4.0
 USER root
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ripgrep \
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index c36a02c4..1a3b0eed 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -91,7 +91,7 @@ What the base does, and why it does it that way:
 | `VOGT_PUBLIC_URL` | yes | — | The URL clients use to reach this instance. |
 | `VOGT_PORT` | no | `8080` | Host port the container's 8000 is published on. |
 | `VOGT_BIND_IP` | no | `127.0.0.1` | Host interface the port is published on. |
-| `VOGT_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt:0.3.1` | The image to run. |
+| `VOGT_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt:0.4.0` | The image to run. |
 | `VOGT_UID` | no | `1000` | The uid the container runs as (gid is always 0). |
 | `VOGT_LOG_LEVEL` | no | `info` | Verbosity of Vogt's own logger. |
 
@@ -118,7 +118,7 @@ cosign verify \
 ```
 
 ```console
-docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt:0.3.1 \
+docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt:0.4.0 \
   | grep -m1 Digest
 # then, in deploy/.env:
 VOGT_IMAGE=ghcr.io/thedancingdeveloper-org/vogt@sha256:<digest>
diff --git a/mobile/package.json b/mobile/package.json
index 9bfbf7f4..61621f42 100644
--- a/mobile/package.json
+++ b/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vogt-mobile",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/pyproject.toml b/pyproject.toml
index 901be297..14ce1f1d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vogt"
-version = "0.3.1"
+version = "0.4.0"
 description = "A product development environment for the AI era"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/vogt/__init__.py b/src/vogt/__init__.py
index 7bfb8868..4da037fa 100644
--- a/src/vogt/__init__.py
+++ b/src/vogt/__init__.py
@@ -2,6 +2,6 @@
 
 from __future__ import annotations
 
-__version__ = "0.3.1"
+__version__ = "0.4.0"
 
 __all__ = ["__version__"]
diff --git a/tests/test_product_version.py b/tests/test_product_version.py
index df3df8d7..da92c28d 100644
--- a/tests/test_product_version.py
+++ b/tests/test_product_version.py
@@ -16,7 +16,7 @@
 
 def test_product_version_contract_is_in_sync() -> None:
     result = subprocess.run(
-        [sys.executable, "scripts/check_product_version.py", "0.3.1"],
+        [sys.executable, "scripts/check_product_version.py", "0.4.0"],
         cwd=ROOT,
         capture_output=True,
         text=True,
@@ -28,6 +28,6 @@ def test_product_version_contract_is_in_sync() -> None:
 def test_android_version_name_is_derived_from_the_canonical_mobile_manifest() -> None:
     package = (ROOT / "mobile/package.json").read_text(encoding="utf-8")
     gradle = (ROOT / "mobile/android/app/build.gradle").read_text(encoding="utf-8")
-    assert '"version": "0.3.1"' in package
+    assert '"version": "0.4.0"' in package
     assert "new JsonSlurper().parse(file('../../package.json'))" in gradle
     assert "versionName androidVersionName" in gradle
diff --git a/uv.lock b/uv.lock
index ed61e164..02d5e67d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -995,7 +995,7 @@ wheels = [
 
 [[package]]
 name = "vogt"
-version = "0.3.1"
+version = "0.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },
diff --git a/web/package.json b/web/package.json
index ffeeea4f..ce3cb00f 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vogt-web",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "scripts": {