Release 0.4.0 — cut the accumulated Unreleased section

[carochacs]

Found during a cross-repository audit of the eight feedBack repos.

The problem

plugin.json and package.json have both sat at 0.3.0 since 2026-07-08 while four commits landed on main. The plugin manager keys update detection off version, so none of that work was ever offered to anyone already on 0.3.0 — it was written, merged, and then invisible.

Minor, not patch

I started with 0.3.1 for the one unrecorded fix, then read the whole [Unreleased] block. It also carries a new Metronome feature and a removal (study-mode preroll count-in), so a patch bump would have understated the release. Cut as [0.4.0] — 2026-08-13, with package.json synced to match.

Changelog

One commit had shipped with no entry at all — 2883dfa, "Percent-encode the filename in _buildWsUrl". Now recorded under Fixed:

_buildWsUrl's docstring claimed the filename was decoded and then re-encoded "same as tabview", but the code only decoded it before splicing the result into the ws(s)://…/ws/highway/<name> URL. A filename containing &, #, or ? went in unescaped, so it could override the arrangement query parameter or truncate the path at a fragment.

Worth keeping the original commit's framing: filenames come from the app's own library data attributes rather than being directly attacker-supplied here, and the socket stays same-origin, so this was a robustness bug rather than a demonstrated exploit. Covered by tests/ws_url.test.js.

Also in here

compliance.yml — this repo's ci.yml calls the shared reusable-ci.yml, which runs the test suites and nothing else, so fork-derived plugins had no spec enforcement while the org's original-repo plugins had enforcement but not always tests. Three targeted jobs rather than the originals' full sixteen: version-bumped-on-change, changelog-updated, idempotent-top-level-guard — the ones that map to defects the audit actually found. version-bumped-on-change and changelog-updated are precisely the checks that would have caught this PR's own subject, which is the argument for adding them here.

The right long-term home is got-feedback/.github's reusable-ci.yml, so every repo picks them up from one reference instead of four copies. The file says so, and says to delete it when that lands.

All 130 tests across the 12 test files still pass.

---

Generated by Claude Code

[pullfrog]

Important

The [0.4.0] cut is missing a changelog entry for commit 2929344 (got-feedBack#24, "keep one staff-system row of lookahead visible") — a user-facing auto-scroll fix that shipped on 2026-07-23, after the 0.3.0 release. Every other post-0.3.0 functional commit is recorded; this one slipped, which is exactly the defect class this PR exists to close.

Reviewed changes

• Version release 0.4.0 — cut the accumulated [Unreleased] section into [0.4.0] — 2026-08-13, recording the Metronome feature, the study-preroll removal, and the pickup/cursor/WS-URL fixes; synced plugin.json and package.json 0.3.0 → 0.4.0.
• New compliance.yml workflow — three self-skipping jobs (version-bumped-on-change, changelog-updated, idempotent-top-level-guard) enforcing the plugin-spec checks the audit found missing for fork-derived plugins, documented as a stopgap until got-feedback/.github's reusable-ci.yml hosts them.

The version cut, plugin.json/package.json sync, and the three jobs' base-commit handling and set -eu pipelines all check out; the workflow passes on this repo's own screen.js.

ℹ️ Nitpicks

• version-bumped-on-change compares OLD_VERSION != NEW_VERSION, so a downgrade would satisfy the "bump" check. An ordering comparison would be stricter, though for a targeted stopgap the inequality check is defensible.
• idempotent-top-level-guard requires some window.__* flag file-wide, and this repo already has window.__feedBackStaffviewArrangementSubscribed (screen.js:819) — so the job can never trip here again, even if a future PR adds an unguarded top-level listener. Fine as a cross-repo gate, but it's a one-time check, not ongoing protection.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — delta since the prior pullfrog review (33263a8), one commit (e53055b):

• Recorded the got-feedBack#24 scroll-lookahead fix — added the _svUpdateMarker auto-scroll entry to CHANGELOG.md's [0.4.0] Fixed list. Verified the entry's claims against the code (screen.js:3474-3510): next-staff-system lookahead at a ~25% top inset, backward-seek guard at the 15% top edge, last-row centre fallback, page-layout-only. Accurate.
• Hardened compliance.yml — both version/changelog jobs now diff against the merge base instead of pull_request.base.sha (so a stale branch isn't failed for a bump it doesn't owe); changelog-updated now compares the [Unreleased] section between merge-base and HEAD rather than just requiring CHANGELOG.md to be touched; .css counts as functional source; the guard job's known limitation is documented in-code.

I simulated the new unreleased()/merge-base logic against this repo's actual history: the awk extraction correctly isolates [Unreleased], the release PR itself has no functional source so all three jobs self-skip, and the workflow passes on this repo's own screen.js. Both prior review threads are addressed and resolved.

  ^{｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}