release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-observability/tests/recorder.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, test } from 'bun:test';
+import { createRecorder } from '../src/index.ts';
+
+describe('createRecorder', () => {
+  test('captures attributes and end-state', () => {
+    const rec = createRecorder();
+    const span = rec.startSpan('shade.test', { initial: 'on' });
+    span.setAttribute('extra', 1);
+    span.setAttributes({ batch1: 'a', batch2: 'b' });
+    span.setStatus('ok');
+    span.end();
+    expect(rec.spans).toHaveLength(1);
+    const s = rec.spans[0]!;
+    expect(s.name).toBe('shade.test');
+    expect(s.attributes).toEqual({ initial: 'on', extra: 1, batch1: 'a', batch2: 'b' });
+    expect(s.status).toBe('ok');
+    expect(s.ended).toBe(true);
+  });
+
+  test('records exceptions', () => {
+    const rec = createRecorder();
+    const span = rec.startSpan('shade.test');
+    const err = new Error('boom');
+    span.recordException(err);
+    span.setStatus('error', 'boom');
+    span.end();
+    expect(rec.spans[0]?.exceptions).toEqual([err]);
+    expect(rec.spans[0]?.status).toBe('error');
+    expect(rec.spans[0]?.statusMessage).toBe('boom');
+  });
+
+  test('scanForPII catches forbidden substrings', () => {
+    const rec = createRecorder();
+    const safe = rec.startSpan('shade.upload', { 'shade.peer.hash': 'abc12345' });
+    safe.end();
+    const leaky = rec.startSpan('shade.upload', { 'shade.peer.address': 'alice@example.com' });
+    leaky.end();
+    const hits = rec.scanForPII(['@', 'alice', 'peer.address']);
+    expect(hits.length).toBeGreaterThan(0);
+    // The safe span should not be in the hits.
+    const safeHit = hits.find((h) => h.spanName === 'shade.upload' && h.value === 'abc12345');
+    expect(safeHit).toBeUndefined();
+  });
+
+  test('clear() drops the buffer', () => {
+    const rec = createRecorder();
+    rec.startSpan('a').end();
+    expect(rec.spans).toHaveLength(1);
+    rec.clear();
+    expect(rec.spans).toHaveLength(0);
+  });
+});