release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-cli/tests/cli.test.ts

@@ -71,6 +71,37 @@ describe('CLI: init command', () => {
     );
   });
 
+  test('init with --doctor runs diagnostics against the new project', async () => {
+    const port = 19500 + Math.floor(Math.random() * 200);
+    const app = createPrekeyServer({
+      crypto,
+      store: new MemoryPrekeyStore(),
+      disableRateLimit: true,
+    });
+    const server = Bun.serve({ port, fetch: app.fetch });
+
+    const logs: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args) => logs.push(args.join(' '));
+
+    try {
+      await initCommand({
+        name: 'doc-app',
+        template: 'bun-server',
+        cwd: tmpDir,
+        prekeyServer: `http://localhost:${port}`,
+        runDoctor: true,
+      });
+    } finally {
+      console.log = originalLog;
+      server.stop();
+    }
+
+    const out = logs.join('\n');
+    expect(out).toContain('Shade doctor');
+    expect(out).toContain('Prekey server is reachable');
+  });
+
   test('chat-demo template scaffolds correctly', async () => {
     await initCommand({ name: 'chat', template: 'chat-demo', cwd: tmpDir });
 
@@ -81,6 +112,26 @@ describe('CLI: init command', () => {
     const alice = readFileSync(join(target, 'src/alice.ts'), 'utf-8');
     expect(alice).not.toContain('__PROJECT_NAME__');
   });
+
+  test('bun-server template wires the resumable-stream prune cron by default', async () => {
+    // V3.1 acceptance: a freshly-scaffolded bun-server must call
+    // shade.pruneStreamStates on startup + on a daily interval, with
+    // the SHADE_STREAM_RETENTION_DAYS env var as the override knob.
+    await initCommand({ name: 'cron-app', template: 'bun-server', cwd: tmpDir });
+
+    const indexSrc = readFileSync(
+      join(tmpDir, 'cron-app', 'src/index.ts'),
+      'utf-8',
+    );
+
+    expect(indexSrc).toContain('shade.pruneStreamStates(');
+    expect(indexSrc).toContain('SHADE_STREAM_RETENTION_DAYS');
+    expect(indexSrc).toContain('setInterval');
+    // Default horizon stays 14 days unless overridden.
+    expect(indexSrc).toMatch(/\?\?\s*14/);
+    // Cron timer must not keep the process alive on its own.
+    expect(indexSrc).toContain('.unref');
+  });
 });
 
 describe('CLI: config loading', () => {