v4.0.0

"Stable Platform" (LOG #94): fewer new things, more promises. Nothing in the content format or the save format
changes: a 3.x game on schema 3 moves without a rewrite (docs/en/UPGRADING.md § 10), and every save of the 3.x line
loads. What changes is what is kept: the public API (docs/en/API.md) follows semantic versioning and the
deprecation policy of docs/en/SUPPORT.md. Human passes: 0 of 7 (D12, docs/dev/passes/4.0.0.md).

API

• Stable from this release: web-scumm/content, web-scumm/player, web-scumm/minigames, web-scumm/testing, the
  authoring schema 3, the save envelope (schema 3), the Studio/MCP tools' arguments and the web-scumm command. Any
  other path into src/engine is internal.

Added

• npm run upgrade-check -- --from=<version | previous>, a CI job: a game created with the previous release's
  package, a save made by that engine, then this engine installed, migrate --check, verify, build, and the old
  save loaded and played to the end.
• The independent game, "The Lighthouse", moved from 3.9.0 to 4.0.0 by installing the new tarball: nothing to
  migrate, release --commercial green, its 3.9.0 save loaded and played to the end (LOG #94).

Added (asked for 4.0)

• A double tap acts with the verb a player means (core/default-verb.ts): through an exit, talk to a character,
  look at anything else; a single tap still only walks. A prop, a hotspot, an actor or an exit can name its own with
  defaultVerb (a cupboard: open). An item picked from the bag without a verb is given to a character and
  used on anything else, and the sentence line says which before the tap. Checked in Chromium and WebKit
  (npm run e2e:taps, in the reference job).

Dependencies

• The open Dependabot pull requests are settled: taken, earcut 3.2.4 and the GitHub Actions majors (setup-node 7,
  setup-python 7, upload-artifact 7, upload-pages-artifact 5, deploy-pages 5); not taken, Vite 8 (its new
  bundler breaks a CommonJS default import: the game does not start) and TypeScript 7 (it drops baseUrl and
  non-relative paths): toolchain migrations for a minor of their own; nor the raised minimums of Pillow, NumPy and
  SciPy (a minimum is what the tools need, not the latest: NumPy 2.5 breaks other packages of a shared Python).

Migration

• From 3.x: import from the four public entries instead of @engine/* (which keeps working, without the promise);
  use EndingDef instead of RevealDef; npx web-scumm migrate --check says whether anything else is due.

Manual passes (D12: reported, not blocking)

0 of 7 done.

Pass	Status	Who, when	Device, OS, browser, versions	What failed
Screen reader (docs/dev/SCREEN-READER.md, VoiceOver iOS or TalkBack Android)	not done
Safari offline (docs/dev/SAFARI-OFFLINE.md: first visit online, airplane mode, a room never visited, a reload)	not done
Real phone, frame rate of the heaviest scene (≥ 30 FPS)	not done
Playtesters who do not know the puzzles (npm run verify:field: sessions, finished, device families)	not done
Recorded voices (lines approved / lines with an id)	not done
Listening (each score on a phone speaker and on headphones, each bridge, a save loaded mid-transition)	not done
Signed tag (git tag -s)	not done