chore: bump version to 4.0.3

docs/release-notes/v4.0.3.md

@@ -0,0 +1,80 @@
+# dotbot v4.0.3 — Release Notes
+
+**Released:** August 2026
+**Previous version:** v4.0.2 (July 10, 2026)
+**Type:** Patch release
+
+> 7 bugs fixed · 3 new features · 9 issues closed
+
+---
+
+## Highlights
+
+**Windows PATH now includes Machine and User registry scopes** — [#504](https://github.com/andresharpe/dotbot/issues/504) [#658](https://github.com/andresharpe/dotbot/issues/658)
+dotbot reported `git: MISSING` / `claude: MISSING` on Windows whenever the process inherited a PATH that was missing Machine or User registry scope entries — e.g. Git installed system-wide, Claude installed per-user. dotbot now merges both scopes before probing, matching the PATH a user sees in a normal terminal session.
+
+**Orphaned process tree cleanup via Job Object** — [#645](https://github.com/andresharpe/dotbot/issues/645)
+On abrupt worker death (console close, `Stop-Process -Force`, crash), the harness `finally` cleanup never ran and the worker's entire child tree — `claude.exe`, MCP servers, tool children — stayed alive. dotbot now attaches child processes to a kill-on-close Windows Job Object so the whole subtree is reaped automatically when the worker exits.
+
+**`dotbot logs` — inspect runs after the window closes** — [#657](https://github.com/andresharpe/dotbot/issues/657)
+Operators can now tail the activity log and view the last crash without needing the terminal still open. `dotbot logs` streams the last N events from `.bot/.control/activity.jsonl`; `dotbot logs --crash` shows the last fatal error with full context.
+
+**v3.5 YAML manifests auto-migrated to v4 JSON** — [#654](https://github.com/andresharpe/dotbot/issues/654)
+dotbot v4 was silently ignoring all v3.5 `workflow.yaml`, `manifest.yaml`, and `registry.yaml` files after the switch to JSON — workflows just disappeared with no warning. dotbot now detects these files, converts them in-place, and logs a migration notice so teams can review and commit the result at their own pace.
+
+---
+
+## Stabilization — 7 bugs fixed
+
+### Process & state
+
+| Issue | PR | Fix |
+|---|---|---|
+| [#612](https://github.com/andresharpe/dotbot/issues/612) | [#637](https://github.com/andresharpe/dotbot/pull/637) | `Write-ProcessFile` and `Test-ProcessStopSignal` resolved `BotRoot` from `$PWD` during task execution. Since the runtime `Push-Location`s into the task's worktree, all process-state reads and writes landed in the worktree's `.bot/.control` instead of the project root's, causing state to be invisible outside the worktree |
+| [#645](https://github.com/andresharpe/dotbot/issues/645) | [#660](https://github.com/andresharpe/dotbot/pull/660) | On abrupt worker exit, child process tree (`claude.exe` → MCP servers → tool children) was not reaped. Worker now registers a kill-on-close Windows Job Object so the whole subtree terminates with the parent |
+
+### Workflow & hooks
+
+| Issue | PR | Fix |
+|---|---|---|
+| [#668](https://github.com/andresharpe/dotbot/issues/668) | [#639](https://github.com/andresharpe/dotbot/pull/639) | Workflow status handler sent a double response on certain state transitions, crashing the dispatcher. Escalation state also persisted incorrectly across status calls. Guard added to the runtime dispatcher; state-consistency issues in [#611](https://github.com/andresharpe/dotbot/issues/611) tracked separately |
+| [#628](https://github.com/andresharpe/dotbot/issues/628) | [#642](https://github.com/andresharpe/dotbot/pull/642) | `enter-done` verify chain (e.g. `01-git-clean.ps1`) ran `git status` relative to the runtime's launch directory instead of the task's actual worktree/project path. Outcome was arbitrary and depended on where dotbot was started from |
+| — | [#662](https://github.com/andresharpe/dotbot/pull/662) | `Complete-TaskWorktree` pushed the integration branch to `origin` after every single task completion. In a multi-task run this fired the remote CI pipeline N times — once per task — instead of once per run |
+
+### MCP & dependencies
+
+| Issue | PR | Fix |
+|---|---|---|
+| [#646](https://github.com/andresharpe/dotbot/issues/646) | [#650](https://github.com/andresharpe/dotbot/pull/650) | MCP server treated stdin EOF (`ReadLine()` returning `$null`) as an empty line and `continue`d, spinning at 100% CPU indefinitely after the parent process closed. Server now exits cleanly on EOF |
+| [#658](https://github.com/andresharpe/dotbot/issues/658) | [#661](https://github.com/andresharpe/dotbot/pull/661) | On Windows, dotbot reported `git: MISSING` / `claude: MISSING` when the inherited `PATH` was missing Machine or User registry scope entries. dotbot now merges both registry PATH scopes before dependency probing |
+
+---
+
+## New features — 3 items
+
+| Issue | PR | Feature |
+|---|---|---|
+| [#657](https://github.com/andresharpe/dotbot/issues/657) | [#663](https://github.com/andresharpe/dotbot/pull/663) | **`dotbot logs`** — tail the last N events from `.bot/.control/activity.jsonl` after the terminal window closes. `dotbot logs --crash` shows the last fatal error with full context. `--n <count>` controls how many events to show (default 50) |
+| [#654](https://github.com/andresharpe/dotbot/issues/654) | [#665](https://github.com/andresharpe/dotbot/pull/665) | **v3.5 YAML auto-migration** — `workflow.yaml`, `manifest.yaml`, and `registry.yaml` files from dotbot v3.5 are detected and converted to v4 JSON in-place, with a migration notice logged. Workflows previously invisible after the v4 upgrade now surface automatically |
+| [#656](https://github.com/andresharpe/dotbot/issues/656) | [#666](https://github.com/andresharpe/dotbot/pull/666) | **Quality gate hook** — optional `quality-gate` hook added to the `enter-done` verify chain. When enabled, runs tests and/or a linter before a task is allowed to transition to `done`. Prevents tasks from opening PRs that immediately fail CI |
+
+---
+
+## Get this release
+
+```bash
+# Homebrew (macOS / Linux)
+brew upgrade dotbot
+
+# Scoop (Windows)
+scoop update dotbot
+
+# From source
+git pull && pwsh bootstrap.ps1
+```
+
+Run `dotbot status` after updating to confirm you're on v4.0.3.
+
+---
+
+*Release notes: [`docs/release-notes/`](../release-notes/)*