v1.0.2

• Fixed the reason no release since 2026.08.25 had ever actually installed on a host that
  already had this plugin. The .plg wrote a versionless md5 sidecar to the flash plugin
  directory via its own FILE block, and its install script re-checked the downloaded package
  against that sidecar. The Unraid plugin manager never overwrites an existing FILE that
  declares no MD5 or SHA256 tag of its own, so the sidecar stayed pinned to the md5 of the
  first version ever installed, and every later upgrade failed its own check with "package md5
  mismatch, refusing to install" — an error that reads like a corrupted download and is
  nothing of the kind. Both halves are gone: the plugin manager already verifies the package
  against the MD5 tag on the .txz FILE block, in the same function, on the branch that
  re-fetches on a mismatch. The install script now also deletes the orphaned sidecar left by
  any earlier install. The sibling plugin docker.netman hit this identical bug and removed it
  in its 0.2.0; it was never carried across until now.
• Note for anyone upgrading from a date-based version: Unraid compares plugin versions with
  strcmp, not semantically, so "1.0.2" sorts BEFORE "2026.08.25" and the manager will refuse
  the upgrade as an older version. Install once with the "forced" argument to cross that line;
  releases after this one compare normally. The same trap applies to any version component
  reaching double digits (strcmp puts "1.0.10" before "1.0.9"), and the release workflow now
  refuses to publish a version that does not sort after the previous tag.

v1.0.1

• Fixed: this plugin's row on the Plugins tab rendered several times the size of every stock
  plugin beside it. That row's description is Markdown-rendered from the plugin's installed
  README.md (dynamix.plugin.manager/include/ShowPlugins.php), and the file being packaged was
  the repo's own README, whose "# unraid-secretsman" heading became a real H1 in a table where
  every stock plugin renders a bold paragraph — dragging roughly 11KB of repo documentation in
  behind a read-more chevron with it. Now ships plugin/README.md instead: bold name, one
  paragraph, no headings, the same shape as unassigned.devices-plus and unbalanced. Verified
  by rendering old and new through the host's own Markdown() function rather than by eye. The
  displayed name is now SecretsMan, matching this plugin's own page title and menu entry
  rather than the repo slug.
• Releasing is now automatic. .github/workflows/release.yml runs on every push to main that
  names a version with no tag yet: it lints, runs the suite, builds the package, writes the
  built package's real md5 back into the .plg, tags, and publishes the release with both
  assets attached. This plugin verifies that md5 twice, once in the plugin manager and again
  in its own install script, so a hand-typed value was the single most likely way to break an
  install outright; it is now derived from the artefact that was just built.
• Rule 7 (any patch-layer change needs the RECOVERY.md drill) is now a gate rather than a
  habit: the release workflow refuses to publish if src/patch.php, scripts/apply_patch.php or
  scripts/uninstall.php changed since the previous tag and the new version's entry here does
  not record the outcome on a line beginning "RECOVERY drill:". Not applicable to 1.0.1 — the
  patch layer is untouched by this release.
• scripts/install-on-host.sh installs a published release on the Unraid host and verifies it:
  flash .plg version, plugin registration, the installed tree, that Helpers.php actually
  carries the patch marker, and that the packaged README is still the stock-shaped
  description. It refuses to install until the raw .plg's own version and md5 both match the
  published release, rather than trusting a status code against the 5-minute CDN cache.

v1.0.0

First tagged release. See CHANGES in unraid-secretsman.plg and CLAUDE.md for the full verification history (resolver, boot-time patch, Settings GUI, backup/restore, clean removal, and a reboot cron durability check all verified live). Install via Plugins -> Install Plugin using this repo's unraid-secretsman.plg raw URL — see README.md.