Pullbox v1.0.0-rc1

What's Changed

Release candidate for the v1.0 production burn-in, focused on Mylar3 migration
correctness, rollback safety, metadata recovery, download retry handling, and
large-library UI stability.

Changed

• Adopted matching source folders during Mylar3 and folder imports when the
  source already lives inside the Pullbox library root, preserving adjacent
  Mylar artifacts instead of creating duplicate target folders.
• Surfaced catalog hydration state in series views so missing post-import
  metadata is visible while background recovery catches up.

Fixed

• Fixed import rollback cleanup for adopted folders, renamed folders, failed
  files, empty target directories, and rollback details that were previously
  not persisted early enough for later recovery.
• Fixed a stale intervention issue link interaction that could swap an issue
  detail page into the intervention table instead of navigating normally.
• Fixed pending download retries that could remain in retry pending without
  being failed and blocklisted when no active downloads were polling.
• Fixed import result retry visibility for file failures that need recovery
  after review or rollback.

Performance

• Reused catalog hydration indicators and import metadata recovery paths to
  keep large-library views responsive after production-scale imports.

Testing

• Added coverage for folder adoption, rollback edge cases, pending download
  retry processing, intervention navigation, import result recovery, catalog
  hydration banners, and reviewed template-safe macro attributes.

Commit Details

🐛 Bug Fixes

• preserve folder adoption during import rollback
• harden import folder adoption rollback
• prevent intervention issue links from htmx swapping
• process pending download retries when idle
• harden import rollback file cleanup
• surface catalog hydration after imports
• adopt library source folders during import

🧪 Testing

• review mission control safe attrs

🧰 Chores

• bump version to 1.0.0-rc1 for release
• bump develop to 0.9.13-dev

🐳 Docker Images

docker pull ghcr.io/pullboxapp/pullbox:1.0.0-rc1
docker pull docker.io/pullbox/pullbox:1.0.0-rc1

Digest: sha256:bd1e3f48bd15a1e6d837fd867937a5f96af3cf1ed8e04bcb39ff140e6510074d

🔐 Image Verification

Release images are signed with keyless Sigstore/Cosign using GitHub Actions OIDC.
These commands verify the exact multi-architecture image digest published by this release.

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.0-rc1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/pullboxapp/pullbox@sha256:bd1e3f48bd15a1e6d837fd867937a5f96af3cf1ed8e04bcb39ff140e6510074d

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.0-rc1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  docker.io/pullbox/pullbox@sha256:bd1e3f48bd15a1e6d837fd867937a5f96af3cf1ed8e04bcb39ff140e6510074d

Full Changelog: v0.9.12...v1.0.0-rc1