Document the 1.4.0 release candidate

DEVELOPMENT_NOTES.md

@@ -31,6 +31,51 @@ policy, projection, task-comparison, package, clone, browser, benchmark, and sec
 pass before documentation closeout, tag creation, or publication. `main` remains the Milestone 4
 baseline while implementation proceeds on `dev`.
 
+### Release-candidate freeze — 2026-07-29
+
+The executable implementation froze at
+`d2bb95fe6190e659cf66ba57c78be53b63b53240`. It centralizes version `1.4.0`, binds generated
+clients to that version, adds MIT license and package metadata, proves reproducible artifacts,
+migrates a real archived `v1.0.0` project, maintains comparative real-task evidence, and hardens
+derived and canonical publication against measured race and durability failures.
+
+The clean executable release gate passed:
+
+- Ruff formatting and lint, web lint, strict Pyright, compilation, lock, dependency, build,
+  generated-reference, and documentation checks.
+- 142 contract tests plus 272 subtests and 371 complete tests plus 419 subtests.
+- Three manual, portable-graph, and live-viewer accessibility flows.
+- 116 compatibility tests plus 263 subtests.
+- 29 concurrency tests plus 2 subtests.
+- Offline fresh-wheel adoption, reproducible artifacts, version checks, and secret scans.
+- Every maintained full Milestone 0 through Milestone 4 benchmark.
+
+Commit `97f3b6b` made the fresh-clone rehearsal require and verify the exact annotated legacy tag.
+Commit `2b98059b44f4d46b4d4cce776f163e893c647c76` added four maintained recovery proofs without
+changing product code. The recovery aggregate now passes 72 tests plus 62 subtests. Those tests
+record exact canonical bytes, canonical collection hash, complete snapshot hash, and index
+graph-plus-Logic identity before corrupting and repairing the index attestation, manual render
+receipt, generation-diff receipt, and portable-graph manifest through normal public work paths.
+
+The real migration evidence uses tag object
+`2d7d306a37da89f1c860c7f0be161c45386acf61`, peeled commit
+`593c173b453236a6872d0a4e88e7a51a67a21cde`, and a real schema-1 index plus active proposal.
+Canonical bytes, the graph snapshot, proposal hash, and proposal file bytes remain exact after the
+schema-3 rebuild. The proof retains the inherited version-1 metadata/runtime mismatch: package
+metadata is `1.0.0`, while the module and server report `0.15.0`.
+
+The representative real-task track pins `markdown-it-py 4.2.0` at 66 Python files and 225,945
+bytes. Both workflows answer all three reviewed questions exactly. Graph-assisted work inspects
+349 versus 10,628 bytes, 419 versus 225,945 bytes, and 212 versus 225,945 bytes, with medians of
+0.008 versus 1.341 ms, 0.009 versus 32.108 ms, and 0.013 versus 32.142 ms. Source-only final
+responses are smaller, so the evidence claims reduced inspected source and faster maintained task
+latency rather than a universal response-size advantage.
+
+Documentation closeout is now being prepared against this frozen lineage. Milestone 5 remains
+active until the final documentation-bearing commit is pushed, passes the exact fresh-clone
+rehearsal, and is published through one annotated `v1.4.0` tag and Forgejo release. PyPI remains
+excluded.
+
 ## Milestone 0 — complete
 
 Milestone 0 established the public successor, preserved the complete lineage and v1 tag, integrated