diff --git a/.github/release-notes/v4.0.2.md b/.github/release-notes/v4.0.2.md
new file mode 100644
index 0000000..33f63f2
--- /dev/null
+++ b/.github/release-notes/v4.0.2.md
@@ -0,0 +1,17 @@
+## What's new
+
+Threadnote 4.0.2 keeps graph queries responsive after pulling a new clean commit, improves compatibility for canonical
+MCP reads, and refreshes the runtime and release pipeline.
+
+- **Query immediately after clean pulls.** Ordinary graph queries, node lookups, and explanations can use the ready
+  graph snapshot while the new commit is indexed instead of blocking on a refresh. Dirty-worktree overlays still
+  refresh before answering, and exact path and impact queries retain their stricter freshness requirements.
+- **Avoid unnecessary semantic scans.** When lexical graph matches already fill the candidate budget, Threadnote skips
+  the vector search instead of spending up to its semantic timeout without changing the result set.
+- **Read canonical MCP content reliably.** Canonical content metadata now travels in protocol metadata rather than
+  model-facing structured output, including for clients that prefer structured results and for large payloads.
+- **Refresh dependencies and security overrides.** The release updates Effect, React, YAML and compression libraries,
+  and pins patched transitive versions for the affected networking and parsing packages.
+- **Harden release evidence.** Stable Threadnote 4 tags are accepted by the production benchmark provenance gate, CI
+  scopes checks by changed paths, and checked-in measurements document graph-equivalent and one-file worktree
+  readiness.
diff --git a/package.json b/package.json
index 615398d..b920a82 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "threadnote",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "type": "module",
   "description": "Shared local context and handoffs for development agents",
   "license": "AGPL-3.0-or-later",