v4.0.2

[4.0.2] — 2026-06-07

Tests

• stableSalt clean-rebuild e2e regression — added end-to-end coverage
  for the headline stableSalt guarantee that previously had none. With
  stableSalt: true + autoSave: true, a clean static rebuild re-emits the
  same permalink-derived salt but a fresh nonce and ciphertext. A new
  Playwright test seeds the localStorage key cache from one build, then
  simulates a rebuild (re-encrypting the same plaintext under the same salt
  via the server crypto, yielding a new nonce/ciphertext) and asserts the
  cached key still auto-decrypts the new payload (mode="cached", no
  re-prompt). A companion self-heal test proves that when the salt itself
  changes (permalink change / stableSalt off), storage.load() drops the
  stale entry and the visitor is re-prompted. New fixture
  templates/stablesalt-post.md → stablesalt-default.md. No runtime or
  crypto behavior changed — tests and docs only.

Docs

• Refreshed the wiki and in-repo docs to describe stableSalt, correct the
  per-post salt size (32 bytes), and note the deterministic-salt tradeoff.

---

Commits since v4.0.1

• test: add stableSalt clean-rebuild e2e regression; bump v4.0.2 (#236) (8613cc7)
• Feat/stable salt (#234) (b88fa11)
• chore(claude): add CHANGELOG-gate hook for version tags (53cf48f)

Full changelog: v4.0.1...v4.0.2