diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04c801c..8b3fb93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.40] - 2026-07-06
+
+### Added
+- Added non-extension session parity so managed and CDP-connected sessions can share the same runtime capability surface without requiring the Chrome extension path.
+
+### Changed
+- Aligned release-facing package, lockfile, extension manifest, extension package metadata, and evidence docs for `0.0.40`.
+- Tightened workflow readiness and shopping-report gates so authority sidecars, compact output tokens, and product-readiness evidence stay aligned with runtime behavior.
+
+### Fixed
+- Hardened Codex bundled skill sync so OpenDevBrowser skills coalesce through the shared Agents root and avoid duplicate `opendevbrowser-*` discovery entries.
+- Closed workflow-readiness review blockers around output authority, evidence gates, and stale runtime assertions.
+
 ## [0.0.39] - 2026-07-02
 
 ### Changed
@@ -307,7 +320,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Core browser management
 - Basic snapshot pipeline
 
-[Unreleased]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.39...HEAD
+[Unreleased]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.40...HEAD
+[0.0.40]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.39...v0.0.40
 [0.0.39]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.38...v0.0.39
 [0.0.38]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.37...v0.0.38
 [0.0.37]: https://github.com/freshtechbro/opendevbrowser/compare/v0.0.36...v0.0.37
diff --git a/README.md b/README.md
index d0ad84c..900c9c1 100644
--- a/README.md
+++ b/README.md
@@ -94,7 +94,7 @@ export CLAUDECODE_HOME="$ISOLATED_ROOT/claudecode-home"
 export AMP_CLI_HOME="$ISOLATED_ROOT/ampcli-home"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser --help
 npx --no-install opendevbrowser help
 ```
diff --git a/docs/AGENTS.md b/docs/AGENTS.md
index 3687f51..261bbcb 100644
--- a/docs/AGENTS.md
+++ b/docs/AGENTS.md
@@ -96,7 +96,7 @@ When release-gate automation changes:
 - `docs/RELEASE_RUNBOOK.md`
 - `docs/EXTENSION_RELEASE_RUNBOOK.md`
 - `docs/DISTRIBUTION_PLAN.md`
-- the current version-scoped release evidence doc (for this release: `docs/RELEASE_0.0.39_EVIDENCE.md`)
+- the current version-scoped release evidence doc (for this release: `docs/RELEASE_0.0.40_EVIDENCE.md`)
 - older ledgers stay historical-only and should receive explicit status clarifications only
 - automation scripts:
   - `scripts/audit-zombie-files.mjs`
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 3748688..bb6cb60 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -485,7 +485,7 @@ When hub mode is enabled, the hub daemon is the **sole relay owner** and enforce
 - **Parity gate** via `tests/parity-matrix.test.ts` (contract coverage for CLI/tool/runtime surface checks + mode coverage).
 - **Provider performance gate** via `tests/providers-performance-gate.test.ts` (deterministic fixture SLO checks).
 - **Strict live release gates** via `node scripts/provider-direct-runs.mjs --release-gate` and `node scripts/live-regression-direct.mjs --release-gate` (active live release proof layer).
-- **Release checklist** in `docs/RELEASE_RUNBOOK.md` with evidence tracking in the current version-scoped release ledger (for this cycle: `docs/RELEASE_0.0.39_EVIDENCE.md`).
+- **Release checklist** in `docs/RELEASE_RUNBOOK.md` with evidence tracking in the current version-scoped release ledger (for this cycle: `docs/RELEASE_0.0.40_EVIDENCE.md`).
 - **Benchmark fixture manifest** in `docs/benchmarks/provider-fixtures.md`.
 - **First-run onboarding checklist** in `docs/FIRST_RUN_ONBOARDING.md`.
 
diff --git a/docs/CLI.md b/docs/CLI.md
index db57b37..5c9aee4 100644
--- a/docs/CLI.md
+++ b/docs/CLI.md
@@ -62,7 +62,7 @@ export CLAUDECODE_HOME="$ISOLATED_ROOT/claudecode-home"
 export AMP_CLI_HOME="$ISOLATED_ROOT/ampcli-home"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser --help
 npx --no-install opendevbrowser help
 ```
@@ -1919,7 +1919,7 @@ npm run test -- tests/providers-performance-gate.test.ts
 
 These commands are release guards, not the live release-proof lane. Use the direct-run harness commands above for release evidence.
 
-Release gate source of truth: `docs/RELEASE_RUNBOOK.md` and `docs/RELEASE_0.0.39_EVIDENCE.md`.
+Release gate source of truth: `docs/RELEASE_RUNBOOK.md` and `docs/RELEASE_0.0.40_EVIDENCE.md`.
 Benchmark fixture manifest: `docs/benchmarks/provider-fixtures.md`.
 
 ---
diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md
index 6922691..cd8de71 100644
--- a/docs/DEPENDENCIES.md
+++ b/docs/DEPENDENCIES.md
@@ -1,17 +1,17 @@
 # OpenDevBrowser Dependency Inventory
 
 Status: active  
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 This document tracks runtime and build dependencies across the repository.
 
-## Source metadata audit (2026-07-02)
+## Source metadata audit (2026-07-06)
 
 Verified source files:
-- `package.json` version: `0.0.39`
-- `package-lock.json` top-level version and `packages[""]` version: `0.0.39`
-- `extension/manifest.json` version: `0.0.39`
-- `extension/package.json` version: `0.0.39`
+- `package.json` version: `0.0.40`
+- `package-lock.json` top-level version and `packages[""]` version: `0.0.40`
+- `extension/manifest.json` version: `0.0.40`
+- `extension/package.json` version: `0.0.40`
 - `eslint.config.js`: flat config for `src/**/*.ts` and `tests/**/*.ts`, using `@typescript-eslint/parser`, `ecmaVersion: "latest"`, module source type, and no custom rules
 - public repo config files found for this audit: `eslint.config.js`, `tsconfig.json`, `vitest.config.ts`, and `extension/tsconfig.json`
 - no public Vite config and no public `frontend/` application directory are present in this repo
diff --git a/docs/DISTRIBUTION_PLAN.md b/docs/DISTRIBUTION_PLAN.md
index 2b4a712..bd07f14 100644
--- a/docs/DISTRIBUTION_PLAN.md
+++ b/docs/DISTRIBUTION_PLAN.md
@@ -1,6 +1,6 @@
 # OpenDevBrowser Distribution Plan
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 This document is the active distribution plan for the split model:
 - public repo for runtime + release artifacts
@@ -17,10 +17,10 @@ Public repo no longer carries the `frontend/` application directory.
 
 ### Current public package baseline
 
-As of the 2026-07-02 package metadata audit:
-- root package version: `0.0.39`
-- root lockfile version and root package entry: `0.0.39`
-- extension manifest and extension package version: `0.0.39`
+As of the 2026-07-06 package metadata audit:
+- root package version: `0.0.40`
+- root lockfile version and root package entry: `0.0.40`
+- extension manifest and extension package version: `0.0.40`
 - package binary: `opendevbrowser` -> `dist/cli/index.js`
 - package file allowlist includes `dist`, bundled `skills`, native scripts, and built extension assets listed in `package.json`
 
@@ -174,7 +174,7 @@ npm run build --prefix frontend
 - [x] Public repo frontend source was extracted after private validation baseline.
 - [ ] Hosting production branch is enforced to `website-production`.
 - [x] Public first tagged release completed through new workflow path.
-- [x] Current public package metadata is aligned at `0.0.39` across root package, root lockfile, extension manifest, and extension package.
+- [x] Current public package metadata is aligned at `0.0.40` across root package, root lockfile, extension manifest, and extension package.
 
 ## Operational references
 
diff --git a/docs/EXTENSION_RELEASE_RUNBOOK.md b/docs/EXTENSION_RELEASE_RUNBOOK.md
index a7b36d0..590ee1b 100644
--- a/docs/EXTENSION_RELEASE_RUNBOOK.md
+++ b/docs/EXTENSION_RELEASE_RUNBOOK.md
@@ -1,12 +1,12 @@
 # Extension Release Runbook
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 Operational runbook for publishing extension artifacts from the public repo.
 
 ## Current source-backed extension reference
 
-As of the 2026-07-02 release prep, `package.json`, `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json` are all aligned at `0.0.39`. `extension/manifest.json` is MV3, names the extension `OpenDevBrowser Relay`, and packages the background service worker at `dist/background.js`.
+As of the 2026-07-06 release prep, `package.json`, `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json` are all aligned at `0.0.40`. `extension/manifest.json` is MV3, names the extension `OpenDevBrowser Relay`, and packages the background service worker at `dist/background.js`.
 
 Use `npm run extension:sync` before release prep to write extension version metadata from the root package version. Use `npm run version:check` after sync to verify the root package, lockfile, manifest, and extension package agree.
 
@@ -55,7 +55,7 @@ Configure in public GitHub repo secrets:
 1. Run tag-driven public release flow (`docs/RELEASE_RUNBOOK.md`).
 2. Confirm the release workflow completed the registry-consumer smoke lane for the published npm package before treating the extension artifact as fully released.
 3. Confirm GitHub release includes extension zip + checksum.
-4. Confirm the active release evidence ledger, currently `docs/RELEASE_0.0.39_EVIDENCE.md` for package version `0.0.39`, records whether external release workflow evidence is complete or deferred.
+4. Confirm the active release evidence ledger, currently `docs/RELEASE_0.0.40_EVIDENCE.md` for package version `0.0.40`, records whether external release workflow evidence is complete or deferred.
 5. Verify checksum locally if required:
 
 ```bash
diff --git a/docs/FIRST_RUN_ONBOARDING.md b/docs/FIRST_RUN_ONBOARDING.md
index c8ce7e4..7772e93 100644
--- a/docs/FIRST_RUN_ONBOARDING.md
+++ b/docs/FIRST_RUN_ONBOARDING.md
@@ -27,7 +27,7 @@ This guide is the shipping checklist for validating OpenDevBrowser as a new user
 ```bash
 cd <public-repo-root>
 npm pack
-# -> opendevbrowser-0.0.39.tgz
+# -> opendevbrowser-0.0.40.tgz
 ```
 
 ## 2) Simulate a brand-new isolated user workspace
@@ -44,7 +44,7 @@ export AMP_CLI_HOME="$WORKROOT/amp-home"
 mkdir -p "$WORKDIR" "$HOME" "$OPENCODE_CONFIG_DIR" "$OPENCODE_CACHE_DIR" "$CODEX_HOME" "$CLAUDECODE_HOME" "$AMP_CLI_HOME"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.39.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.40.tgz
 npx --no-install opendevbrowser version --output-format json
 ```
 
diff --git a/docs/README.md b/docs/README.md
index 8f3a276..fe9d44d 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -34,7 +34,8 @@ Generated help is the canonical first-contact discovery surface and must keep th
 
 ## Version-scoped evidence
 
-- `<public-repo-root>/docs/RELEASE_0.0.39_EVIDENCE.md` - current release evidence ledger for the active ship cycle confirmed by `package.json` version `0.0.39`
+- `<public-repo-root>/docs/RELEASE_0.0.40_EVIDENCE.md` - current release evidence ledger for the active ship cycle confirmed by `package.json` version `0.0.40`
+- `<public-repo-root>/docs/RELEASE_0.0.39_EVIDENCE.md` - historical v0.0.39 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.38_EVIDENCE.md` - historical v0.0.38 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.37_EVIDENCE.md` - historical v0.0.37 release evidence ledger
 - `<public-repo-root>/docs/RELEASE_0.0.36_EVIDENCE.md` - historical v0.0.36 release evidence ledger
diff --git a/docs/RELEASE_0.0.40_EVIDENCE.md b/docs/RELEASE_0.0.40_EVIDENCE.md
new file mode 100644
index 0000000..7d56512
--- /dev/null
+++ b/docs/RELEASE_0.0.40_EVIDENCE.md
@@ -0,0 +1,160 @@
+# v0.0.40 Release Evidence
+
+Status: release prep complete; external publish pending
+Release date: 2026-07-06 UTC, pending final publish
+Tag: `v0.0.40`
+Release URL: pending
+
+## Scope
+
+Tracks the `0.0.40` release cycle from local release preparation through npm publish, registry smoke, GitHub release, and Chrome Web Store manual release evidence or exact browser-visible blocker.
+
+## Final Release State
+
+- npm package: pending
+- npm `latest`: pending
+- npm tarball shasum: pending
+- npm tarball integrity: pending
+- Release tag: pending
+- Tag target: pending
+- GitHub release: pending
+- Successful release workflow run: pending
+- Chrome Web Store: pending manual browser release or exact auth/session blocker.
+
+## Release History
+
+- Release prep branch: `codex/release-0.0.40`.
+- Release prep base: `fe15388eae1ad260341877b2feb9d58da019f2d6`.
+- npm publish: pending local-auth publish for `opendevbrowser@0.0.40`.
+- GitHub release workflow: pending dispatch with `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, and `run_release_live_gates=false`.
+- Chrome Web Store manual release: pending browser dashboard flow.
+
+## Version Alignment
+
+- `package.json`: `0.0.40`
+- `package-lock.json`: `0.0.40`
+- `extension/package.json`: `0.0.40`
+- `extension/manifest.json`: `0.0.40`
+
+## Dependency And Audit Evidence
+
+- `package.json` dependency ranges were not changed for this release prep.
+- `npm ci`: passed from the current lockfile.
+- `npm audit --omit=dev`: passed with `found 0 vulnerabilities`.
+- `npm audit --audit-level=moderate`: passed. Residual advisory is one low-severity dev-only `esbuild` advisory from the current toolchain range, below the release audit gate.
+
+## Local Release Prep Gates
+
+- [x] `npm version 0.0.40 --no-git-tag-version`
+- [x] `npm run extension:sync`
+- [x] `npm run version:check`
+- [x] `node scripts/docs-drift-check.mjs`
+- [x] `git diff --check`
+- [x] `npm ci`
+- [x] `node scripts/chrome-store-compliance-check.mjs`
+- [x] `npm run test:release-gate`
+- [x] `npm run lint`
+- [x] `npm run typecheck`
+- [x] `npm run build`
+- [x] `npm run extension:build`
+- [x] `npm run test`
+- [x] `node scripts/audit-zombie-files.mjs`
+- [x] `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`
+- [x] `./skills/opendevbrowser-motion-design/scripts/validate-skill-assets.sh`
+- [x] `npx opendevbrowser --help`
+- [x] `npx opendevbrowser help`
+- [x] `npm run extension:pack`
+- [x] `npm pack --dry-run`
+
+## Full Gate Matrix Rerun
+
+Evidence directory: `artifacts/release/v0.0.40/`
+
+- Formatter: not available. `package.json` has no formatter script.
+- `git status --short --branch`: release-prep branch dirty only with intended tracked release files plus preserved unrelated untracked investigation/review docs.
+- `git diff --check`: passed in the local gate set and rerun after review-driven doc edits.
+- `npm ci`: passed.
+- `npm audit --omit=dev`: passed with `found 0 vulnerabilities`.
+- `npm audit --audit-level=moderate`: passed with only the existing low-severity dev-only `esbuild` advisory.
+- `npm run lint`: passed.
+- `npm run typecheck`: passed.
+- `npm run version:check`: passed with `0.0.40`.
+- `npm run build`: passed.
+- `npm run extension:build`: passed.
+- `npm run test`: passed, 302 files passed, 1 skipped; 5802 tests passed, 1 skipped; branch coverage `26831/27655 = 97.02043030193454%`.
+- `node scripts/docs-drift-check.mjs`: passed.
+- `node scripts/audit-zombie-files.mjs`: passed.
+- `node scripts/chrome-store-compliance-check.mjs`: passed.
+- `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`: passed.
+- `./skills/opendevbrowser-motion-design/scripts/validate-skill-assets.sh`: passed.
+- `npx opendevbrowser --help`: passed.
+- `npx opendevbrowser help`: passed.
+- `npm run extension:pack`: passed and produced `opendevbrowser-extension.zip` locally for packaging proof.
+- `npm pack --dry-run`: passed through `prepack`, `npm run version:check`, `npm run build`, and `npm run extension:build`; dry-run tarball inventory reported `opendevbrowser-0.0.40.tgz`, package size `3.0 MB`, unpacked size `15.2 MB`, total files `1390`, shasum `47a2437ec3853e471b68eae3791207deb11e66dd`.
+
+## Live Release Gate Evidence
+
+- Strict live release gates are deferred unless explicitly enabled for this release run. If deferred, record that `run_release_live_gates=false` was used for GitHub release workflow dispatch and keep this distinct from grouped contract gates.
+
+## npm Publish Evidence
+
+Prepublish baseline captured before local release prep publish:
+
+- Evidence path: `.omo/ulw-loop/release-0-0-40-2026-07-06/evidence/prepublish-absence-and-auth.txt`.
+- `npm view opendevbrowser version dist-tags --json`: reported version `0.0.39` and `latest` `0.0.39`.
+- `npm view opendevbrowser@0.0.40 version`: returned `E404` before publish, confirming the version was absent.
+- `gh release view v0.0.40`: returned release not found.
+- `git ls-remote --tags origin v0.0.40`: returned no refs.
+- `npm whoami`: authenticated successfully with identity redacted.
+
+Final duplicate-release recheck after release prep merge and immediately before `npm publish`: pending.
+
+Publish result: pending.
+
+## Registry Consumer Smoke
+
+- Result: pending.
+- Evidence path: `artifacts/release/v0.0.40/registry-consumer-smoke.json`.
+- Purpose: verify a registry consumer can install and smoke `opendevbrowser@0.0.40` from npm after publish.
+
+## GitHub Release Evidence
+
+Workflow dispatch after npm publish:
+
+```bash
+gh workflow run release-public.yml \
+  -f release_ref=main \
+  -f release_tag=v0.0.40 \
+  -F publish_npm=false \
+  -F publish_github_release=true \
+  -F draft_release=false \
+  -F run_release_live_gates=false
+```
+
+- Release URL exists for `v0.0.40`: pending.
+- Release is draft: pending.
+- Release is prerelease: pending.
+- Release published at: pending.
+- Tag `v0.0.40` points to: pending.
+- Release target commitish: pending.
+- Asset `opendevbrowser-extension.zip`: pending.
+- Asset `opendevbrowser-extension.zip.sha256`: pending.
+- Checksum verification: pending.
+
+## GitHub Workflow Evidence
+
+- Successful release workflow: pending.
+- Workflow job: pending.
+- Workflow head SHA: pending.
+- Workflow inputs: `release_ref=main`, `release_tag=v0.0.40`, `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, `run_release_live_gates=false`.
+
+## Chrome Web Store Release Lane
+
+- Status: pending manual browser flow.
+- Required artifact: GitHub release `opendevbrowser-extension.zip` for `v0.0.40`.
+- Required proof: redacted Chrome Web Store Developer Dashboard screenshot or action log showing uploaded/submitted version `0.0.40`, or an exact browser-visible auth/account/session blocker.
+- Secrets and private account identifiers must not appear in screenshots, logs, or copied JSON.
+
+## Out Of Scope For This Evidence Update
+
+- Website deploy cutover, governed by `docs/CUTOVER_CHECKLIST.md` and the private website repository.
diff --git a/docs/RELEASE_RUNBOOK.md b/docs/RELEASE_RUNBOOK.md
index f26fb71..6235ab0 100644
--- a/docs/RELEASE_RUNBOOK.md
+++ b/docs/RELEASE_RUNBOOK.md
@@ -1,12 +1,12 @@
 # Public Release Runbook
 
-Last updated: 2026-07-02
+Last updated: 2026-07-06
 
 Canonical runbook for shipping OpenDevBrowser public releases (npm package + GitHub release artifacts) from this repository.
 
 ## Current source-backed release reference
 
-As of the 2026-07-02 release prep, the checked-in release version is `0.0.39` across `package.json`, root `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json`. The current version-scoped release ledger is `docs/RELEASE_0.0.39_EVIDENCE.md`; `docs/RELEASE_0.0.38_EVIDENCE.md` and older ledgers are historical.
+As of the 2026-07-06 release prep, the checked-in release version is `0.0.40` across `package.json`, root `package-lock.json`, `package-lock.json#packages[""]`, `extension/manifest.json`, and `extension/package.json`. The current version-scoped release ledger is `docs/RELEASE_0.0.40_EVIDENCE.md`; `docs/RELEASE_0.0.39_EVIDENCE.md` and older ledgers are historical.
 
 Use `npm run version:check` as the authoritative local parity check for those five version fields before tagging or publishing.
 
@@ -242,7 +242,7 @@ npm deprecate opendevbrowser@X.Y.Z "deprecated: use <fixed-version>"
 
 ## Evidence to retain
 
-- Active version-scoped release evidence ledger path, currently `docs/RELEASE_0.0.39_EVIDENCE.md` for package version `0.0.39`
+- Active version-scoped release evidence ledger path, currently `docs/RELEASE_0.0.40_EVIDENCE.md` for package version `0.0.40`
 - Release workflow run URL
 - npm published version output (or explicit publish deferral for manual dry runs)
 - `artifacts/release/vX.Y.Z/registry-consumer-smoke.json`
diff --git a/docs/plans/release-0.0.40-workflow-2026-07-06.md b/docs/plans/release-0.0.40-workflow-2026-07-06.md
new file mode 100644
index 0000000..69aa43a
--- /dev/null
+++ b/docs/plans/release-0.0.40-workflow-2026-07-06.md
@@ -0,0 +1,79 @@
+# Release 0.0.40 Workflow Plan
+
+Goal: release OpenDevBrowser `0.0.40` to npm, GitHub Releases, and the Chrome Web Store manual release lane with evidence-backed local and external release proof.
+
+## Task 1 - Prepare Versioned Release Surface
+Reasoning: Release commands must run from source metadata that already matches the target version.
+What to do: Align package metadata, extension metadata, changelog, runbooks, docs pointers, and the active evidence ledger for `0.0.40`.
+How:
+1. Run `npm version 0.0.40 --no-git-tag-version`.
+2. Run `npm run extension:sync` and `npm run version:check`.
+3. Update release docs, changelog compare links, and evidence pointers from `0.0.39` to `0.0.40`.
+Files impacted: `package.json`, `package-lock.json`, `extension/package.json`, `extension/manifest.json`, `CHANGELOG.md`, `README.md`, `docs/**/*.md`, `src/cli/AGENTS.md`.
+Acceptance criteria:
+- [ ] `npm run version:check` reports `0.0.40`.
+- [ ] Documentation drift checks accept `docs/RELEASE_0.0.40_EVIDENCE.md` as the active ledger.
+
+## Task 2 - Run Local Release Gates
+Reasoning: Release prep must be proven before protected merge and external publishing.
+What to do: Run the local release gate matrix from `docs/RELEASE_RUNBOOK.md`.
+How:
+1. Run version, docs drift, zombie audit, Chrome compliance, skill validators, help commands, lint, typecheck, build, test, extension build, extension pack, and npm pack.
+2. Record command results and package evidence in the release ledger.
+Files impacted: `docs/RELEASE_0.0.40_EVIDENCE.md`; ignored generated outputs under `coverage/`, `dist/`, `extension/dist/`, tarball and zip artifacts.
+Acceptance criteria:
+- [ ] All required local gates pass.
+- [ ] Release evidence records any unavailable formatter or deferred strict live lanes explicitly.
+
+## Task 3 - Merge Release Prep
+Reasoning: npm and GitHub release surfaces should be produced from protected `main`, not an unmerged branch.
+What to do: Commit the release-prep diff, push, open a PR, wait for required checks, merge, and update local `main`.
+How:
+1. Review and stage only release-prep tracked files.
+2. Commit with a scoped Conventional Commit message.
+3. Push `codex/release-0.0.40`, open PR, watch checks, merge, and fast-forward local `main`.
+Files impacted: git branch `codex/release-0.0.40`, release PR, protected `main`.
+Acceptance criteria:
+- [ ] PR checks pass.
+- [ ] Local `main` equals `origin/main` after merge.
+
+## Task 4 - Publish npm And GitHub Release
+Reasoning: The user explicitly requested npm and GitHub release, using local npm auth.
+What to do: Publish npm locally, verify registry installation, dispatch the GitHub release workflow with npm publishing disabled, and verify assets.
+How:
+1. After the release prep PR is merged and local `main` is fast-forwarded, reverify `opendevbrowser@0.0.40` is absent from npm and `v0.0.40` is absent from GitHub immediately before publish.
+2. Run `npm publish --access public`.
+3. Run registry-consumer smoke for `0.0.40`.
+4. Dispatch `.github/workflows/release-public.yml` with `release_ref=main`, `release_tag=v0.0.40`, `publish_npm=false`, `publish_github_release=true`, `draft_release=false`, and `run_release_live_gates=false`.
+5. Wait for workflow success, verify the GitHub release, download assets, and validate checksum.
+Files impacted: npm registry, GitHub release `v0.0.40`, ignored `artifacts/release/v0.0.40/registry-consumer-smoke.json`.
+Acceptance criteria:
+- [ ] npm `latest` is `0.0.40`.
+- [ ] Registry consumer smoke passes.
+- [ ] GitHub release `v0.0.40` exists with extension zip and checksum assets.
+- [ ] Checksum verification passes.
+
+## Task 5 - Drive Chrome Web Store Manual Release
+Reasoning: The user explicitly requested a Chrome release via browser, and store state must be observed on the real dashboard or blocked by a precise auth/session reason.
+What to do: Use a real Chrome browser session to upload or submit the verified `0.0.40` extension artifact, or capture the exact browser-visible blocker.
+How:
+1. Open the Chrome Web Store Developer Dashboard in Chrome.
+2. Use the GitHub release `opendevbrowser-extension.zip` artifact for the upload, verifying the checksum against the release asset first.
+3. Capture dashboard-visible version/submission status, upload errors, or the exact auth/account blocker with redacted screenshots.
+Files impacted: browser/dashboard state, ignored ULW evidence screenshots/logs.
+Acceptance criteria:
+- [ ] Browser evidence shows uploaded/submitted version `0.0.40`, or the exact auth/account blocker is captured.
+- [ ] Screenshots and logs do not expose secrets, private account identifiers, or tokens.
+
+## Task 6 - Land Final Evidence And Close
+Reasoning: Live publish proof is only known after external release surfaces exist and should be preserved through protected review.
+What to do: Update evidence with live npm, GitHub, and Chrome proof, land a protected evidence PR if tracked files changed, and verify final state.
+How:
+1. Patch `docs/RELEASE_0.0.40_EVIDENCE.md` with npm, workflow, release, checksum, Chrome dashboard or blocker, and final git proof.
+2. If tracked files changed, commit, push an evidence branch, open PR, wait checks, merge, and fast-forward local `main`.
+3. Verify no tracked dirty files remain beyond intended preserved untracked docs.
+Files impacted: `docs/RELEASE_0.0.40_EVIDENCE.md`, optional evidence PR, final `main`.
+Acceptance criteria:
+- [ ] Evidence PR is merged or no tracked evidence diff remains.
+- [ ] Final npm, GitHub release, and Chrome Web Store manual lane checks still pass.
+- [ ] `main == origin/main`.
diff --git a/extension/manifest.json b/extension/manifest.json
index adb6287..3a0a9c7 100644
--- a/extension/manifest.json
+++ b/extension/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "OpenDevBrowser Relay",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "Optional bridge to reuse existing Chrome tabs with OpenDevBrowser.",
   "permissions": [
     "debugger",
diff --git a/extension/package.json b/extension/package.json
index e56aa95..3331676 100644
--- a/extension/package.json
+++ b/extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "opendevbrowser-extension",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/package-lock.json b/package-lock.json
index 390e72b..6005cb3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "opendevbrowser",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "opendevbrowser",
-      "version": "0.0.39",
+      "version": "0.0.40",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 48c4b6e..94c177d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "opendevbrowser",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "Browser automation runtime with snapshot-refs-actions, browser replay screencasts, public read-only desktop observation, and browser-scoped computer-use orchestration",
   "type": "module",
   "main": "dist/index.js",
diff --git a/src/cli/AGENTS.md b/src/cli/AGENTS.md
index 89e4695..d251bdc 100644
--- a/src/cli/AGENTS.md
+++ b/src/cli/AGENTS.md
@@ -144,7 +144,7 @@ src/cli/
 - Run strict live release gates:
   - `node scripts/provider-direct-runs.mjs --release-gate`
   - `node scripts/live-regression-direct.mjs --release-gate`
-- Follow `docs/RELEASE_RUNBOOK.md` and the current version-scoped release evidence doc for final sign-off. For package version `0.0.39`, use `docs/RELEASE_0.0.39_EVIDENCE.md`.
+- Follow `docs/RELEASE_RUNBOOK.md` and the current version-scoped release evidence doc for final sign-off. For package version `0.0.40`, use `docs/RELEASE_0.0.40_EVIDENCE.md`.
 - Keep command/flag/channel inventories synchronized with `docs/CLI.md` and `docs/SURFACE_REFERENCE.md`.
 
 ## Layered AGENTS