v1.3.1 — Buying list & one-tap restock

[1.3.1] — 2026-05-29

Changed

• Re-cut of v1.3.0 with no functional change — everything listed under
  1.3.0 below, re-released under a new version. The v1.3.0 tag was consumed
  by a release-tooling error under the repo's immutable-releases policy (assets
  can't be added to a published release after the fact, and deleting it burns
  the tag name), so v1.3 ships as v1.3.1. See
  docs/release/SHIPPING.md "Common gotchas".

[1.3.0] — 2026-05-29

Added

• Per-item low-stock limits with an auto-generated buying list and one-tap restock (#191).

Changed

• Home list rows now show the manufacturer beneath the product name (#190).

Security

• Bound OFF response JSON nesting depth (#59) and type-encode the OFF
  host invariant as an enum (#61).

---

APK: app-release.apk — SHA-256 81e1fcd3291c6cdbfec79f5f9ca2cf8943eee7402c286b94b2048502840e2e15

Signing: jarsigner/apksigner with the project lifetime keystore — certificate SHA-256 ec9a4bb8…b3d9 (unchanged since v1.0.0). Verify: apksigner verify --print-certs app-release.apk and compare the SHA-256 above. Note: this release is jarsigner-signed only (as v1.0–v1.2 were); cosign signature + SLSA provenance are NOT attached — the release.yml cosign step is being repaired separately.