chore(master): release 0.28.0

[arcbox-labs]

🤖 I have created a release beep boop

0.28.0 (2026-08-28)

Features

• mobile: add remote push notifications (#386) (53b6420)

Bug Fixes

• desktop: verify better-sqlite3's shipped prebuild (#485) (2679cb4)

---

This PR was generated with Release Please. See documentation.

[greptile-apps]

Greptile Summary

Updates the desktop application’s release metadata to version 0.28.0.

• Advances the Release Please manifest and desktop package version from 0.27.0 to 0.28.0.
• Adds the 0.28.0 release notes to the desktop changelog.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.release-please-manifest.json	Advances the tracked release version to 0.28.0 consistently with the package metadata.
apps/desktop/CHANGELOG.md	Adds the generated 0.28.0 release notes covering the included feature and bug fix.
apps/desktop/package.json	Updates the desktop package version from 0.27.0 to 0.28.0.

_{Reviews (2): Last reviewed commit: "chore(master): release 0.28.0" | Re-trigger Greptile}

[pullfrog]

✅ No new issues found.

Reviewed changes — the release-please cut of 0.28.0 for the desktop component, verified mechanically rather than read as code.

• Version bump consistency — .release-please-manifest.json, apps/desktop/package.json, and the new apps/desktop/CHANGELOG.md section all name 0.28.0.
• Bump size — the only commit since v0.27.0 (2d66882c) is 53b64207 feat(mobile): add remote push notifications (#386); a feat: under bump-minor-pre-major is a minor, so 0.27.0 → 0.28.0 is right.
• Changelog link — v0.27.0...v0.28.0 resolves; git ls-remote --tags origin shows v0.27.0 at 2d66882c.
• No stale references — repo-wide grep for 0.27.0 excluding CHANGELOGs hits only pnpm-lock.yaml's unrelated scheduler@0.27.0.
• No undocumented riders — git log --oneline origin/master --not HEAD^ is empty, so the PR base is master HEAD and nothing beyond #386 ships in this tag.

ℹ️ The release exercises no new packaging machinery, and its user-visible content is mobile-only

git diff --stat 2d66882c...HEAD^ shows the shipped work is 15 files under apps/mobile plus locale additions in packages/presentation/i18n/src/locales/{en,zh-cn}.ts — no workflow, composite action, packaging script, or toolchain pin. So no release-desktop.yml dry_run: true rehearsal is needed before tagging; the signed build path is unchanged from v0.27.0.

Two things worth being aware of rather than acting on: the desktop artifact gains only the i18n strings from #386 despite the changelog headline reading mobile: add remote push notifications (the commit escaped exclude-paths precisely because it touched shared i18n), and the mobile app itself is not released by this tag — apps/mobile/app.json keeps its own unmanaged expo.version (1.0.0), deliberately outside this release train.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found — but one conclusion from my previous review is now wrong, corrected below.

Reviewed changes — release-please recut 0.28.0 after fix(desktop) #485 landed on master. The delta against my prior review (11249ad5) is changelog-only.

• New Bug Fixes entry — 2679cb4f fix(desktop): verify better-sqlite3's shipped prebuild (#485) now appears under a ### Bug Fixes heading in the 0.28.0 section.
• Header date — 2026-08-27 → 2026-08-28.
• Version unchanged, and correctly so — .release-please-manifest.json, apps/desktop/package.json, and the changelog heading all still say 0.28.0; a fix: landing on top of an already-minor cut does not change the bump, and the v0.27.0...v0.28.0 compare link stays valid.
• No new riders — git log --oneline origin/master --not HEAD^ is still empty, so the PR base is master HEAD and the tag will carry exactly #386 + #485.

ℹ️ This release now ships packaging machinery that CI has never executed

My review on 11249ad5 concluded the release "exercises no new packaging machinery" and that no release-desktop.yml dry_run rehearsal was needed. The recut invalidates that: 2679cb4f rewrote the post-pack native-binding gate in apps/desktop/scripts/verify-artifacts.mts, replacing the NATIVE_BINDING constant (build/Release/better_sqlite3.node) with sqliteBinding(platform, arch) resolving prebuilds/<darwin|win32|linux>-<arch>.node.

That gate does not run on ordinary PR CI — build-desktop.yml's pull_request: trigger is commented out (lines 49–53), so verify-artifacts.mts only executes under workflow_call (from release-desktop.yml / release-brand-matrix.yml) or an explicit workflow_dispatch. Unless a build was hand-dispatched on #485, the v0.28.0 tag push is the first execution of the rewritten verifyNativeBindings across all four platform-arch targets.

The path itself checks out mechanically: better-sqlite3@13.0.2 ships all eight prebuilds (darwin-{arm64,x64}, linux-{arm64,x64}, linuxmusl-{arm64,x64}, win32-{arm64,x64}), so every NODE_PLATFORM token maps to a real file, and nothing in files/pruneStaging removes prebuilds/. The residual unknown is whether electron-builder's smart-unpack places them under app.asar.unpacked where the gate looks. Worst case is a loud failed release build rather than a shipped defect, so this is a rehearsal recommendation, not a merge blocker.

Technical details

# Rehearse the reworked verify-artifacts native-binding gate before tagging v0.28.0

## Affected sites
- `apps/desktop/scripts/verify-artifacts.mts` (changed by `2679cb4f`, shipping in this tag) —
  `verifyNativeBindings` now asserts
  `<resourceDir>/app.asar.unpacked/node_modules/better-sqlite3/prebuilds/<nodePlatform>-<arch>.node`
  via the new `sqliteBinding()` helper; the previous `build/Release/better_sqlite3.node`
  assertion is gone.
- `.github/workflows/build-desktop.yml:49-53` — the `pull_request:` trigger is commented out, so
  the `node scripts/verify-artifacts.mts` step (line 359) never ran on #485's PR.

## Required outcome
- The reworked gate is proven green on every platform-arch target before a tag push turns a
  gate failure into a failed public release.

## Suggested approach
- Dispatch `release-desktop.yml` with `dry_run: true` (its default) against this branch or
  master HEAD. It builds and signs the full matrix and publishes nothing, which exercises
  `verify-artifacts.mts` exactly as the tag build would.
- If that run is green, merge and tag as normal; `finalize-releases.yml` tags post-merge master
  HEAD, so the dry run and the real build cover the same commits.

## Open questions for the human
- Was a `build-desktop.yml` / `release-brand-matrix.yml` dispatch already run on #485? If so this
  is already satisfied and no rehearsal is needed.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[arcbox-labs]

🤖 Created releases:

• v0.28.0

🌻