v3.2.0

• Date: 2026-10-25
• Status: version bumped to 3.2.0; the v3.2.0 tag is pushed after merge and publishes a
  GitHub Release only. The Chrome Web Store stays at 3.1.0 — submitting 3.2.0 is the
  separate, manual Publish to Chrome Web Store workflow (ADR-026).
• Content since 3.1.0: the Firefox build (108cf00) and the Firefox bookmark-event fix
  (ecff457); no product change on the Chrome surface.
• Pipeline (ADR-026):
  • .github/workflows/release.yml no longer touches a store. On a tag it verifies the version,
    runs tests, builds/validates/packages the Chrome target, then builds/validates/packages the
    Firefox target, writes dist/SHA256SUMS, creates a draft Release, uploads
    marktab-3.2.0.zip, marktab-firefox-3.2.0.zip and SHA256SUMS, writes the body from this
    entry via scripts/release-notes.mjs (falling back to generated notes) and publishes the
    draft last. It reads no CWS_* secret and runs no cws:publish.
  • .github/workflows/publish-store.yml is the only store path: manual dispatch with an
    existing tag, refuses a draft Release, verifies the tag against the checked-out version
    files, downloads the attached marktab-<version>.zip and submits that asset. It never
    rebuilds, so the store and the Releases page cannot drift.
  • publish_github_release_only is gone with the coupling it served; no draft is held for a
    store verdict. scripts/release-workflow.test.mjs asserts both workflow shapes, and
    scripts/release-notes.test.mjs covers the notes extraction.
• Validation (this tree, npm run release:check):
  • npm run typecheck — passed.
  • npm test — passed: 335 unit tests in 18 files (vitest), 101 script tests
    (node --test scripts/*.test.mjs), no failures or skips.
  • npm run build — passed; Vite still warns that theme-boot.js is a classic script, which is
    deliberate.
  • npm run validate — Release validation passed. Runtime payload 239.8 KiB (JS 160.6 KiB,
    CSS 55.1 KiB) across 18 files; five permissions, empty host/optional permissions, no content
    scripts and no remote-code patterns.
  • npm run package — dist/marktab-3.2.0.zip, 18 files, 92 952 bytes on disk, sha256
    e4eceb9ec3ca8b3342a501e6de23d259e7957c536d7b726fa6393f93c84b71a8.
• Firefox (npm run check:firefox): build:firefox → validate:firefox → package:firefox
  passed; dist/marktab-firefox-3.2.0.zip, 18 files, 92 985 bytes, sha256
  605febbbbca69faee052034a97aca4f4221950e162e8051f59acdd8a92981df5. Its manifest reports
  3.2.0, three permissions and the derived background.scripts event page.
• Version: npm run bump -- 3.2.0 wrote package.json, public/manifest.json, README.md,
  CHROME_STORE_SUBMISSION.md and the landing worker's FALLBACK_VERSION; npm install --package-lock-only synced the lock file's root version. Two hand fixes the script cannot do:
  the submission guide's headline and pre-submission checklist still said 3.1.0, and
  public/manifest.json was re-serialized with its permissions array expanded — restored to one
  line so the manifest diff is the version field alone.
• Still manual: wrangler deploy for cloudflare/marktab-home-worker.js (it serves 3.1.0 as its
  fallback until then), and the Chrome Web Store submission of marktab-3.2.0.zip.