diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79039cb..b83de16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,30 @@
 
 Reconstructed from git history for everything up to `v0.1.1`; kept by hand from there.
 
-## unreleased
+## 0.4.0 — 2026-10-01
+
+- **feat**: adopt the October 1 Spaces alpha contract. Credentials use holder-bound HTTP
+  message signatures, expire after ten minutes, and support persistent revocation. Spaces
+  callers must replace DPoP and the `type` request field with signatures and `spaceType`;
+  OAuth DPoP is unchanged. No legacy Spaces compatibility path is retained.
+- **feat**: persist coalesced writer notifications with bounded retries, order authority
+  updates with `spaceRev`/`prevSpaceRev`, and paginate writer listings by space revision.
+  Startup backfills revisions for existing writers. Clients must discard old writer cursors.
+- **fix**: store residents' own space writes independently of the authority's write policy;
+  that policy controls writer registration and notification forwarding.
+- **feat**: simplespace access uses independent read/write policies and `putMember` grants.
+  Space owners can manage collaborators without conflating read and write permissions.
+- **feat**: remember browser password sign-ins during OAuth authorization, with consent,
+  account binding, expiry, and revocation checks. Account pages group app access and sessions,
+  paginate details, and retain sign-in across tab reloads.
+- **feat**: configurable navigation drawings and a shared resident account presentation.
+  Custom drawing manifests are opt-in; bundled navigation and account assets work by default.
+- **fix**: startup recovery avoids scanning retained payload tables and indexes commit lookups
+  during revision backfill.
+- **fix**: permissioned CAR validation permits the commit block in addition to the record
+  limit; tests document the deniable commitment's verification and provenance limits.
+- **feat**: deployment now waits for formatting, unit tests, both HTTP smoke suites, and an
+  ARMv6 ReleaseSafe build. Dependency fetching retries transient failures.
 
 - **fix**: the OAuth authorize page no longer sends `form-action 'self'`. Chromium and WebKit
   apply that directive to every hop of a form submission's redirect chain, so the 303 from the
diff --git a/build.zig.zon b/build.zig.zon
index fb2207d..a285032 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .zds,
-    .version = "0.3.1",
+    .version = "0.4.0",
     .fingerprint = 0x6ebabab1f62e1904,
     .minimum_zig_version = "0.16.0",
     .dependencies = .{