chore(main): release 0.3.0

[github-actions]

🤖 I have created a release beep boop

0.3.0 (2026-10-03)

Features

• linux: add native tray with WebUI menu and bounded lifecycle (513a34a)
• linux: stage native desktop packages with declared tray dependencies (7edcdb5)

Fixes

• accept Spotify loopback callback only once (dcd79cc)
• add Plex GDM and gateway identity discovery (3ff647d)
• allow bounded status card cache buster (fc52a06)
• analytics: send one Discord ping per process start when calls overlap (1126e31)
• apply privacy to Settings sample card preview (46857d4)
• atomically order hosted device ingests (2dae312)
• bind local card artwork to selected server (c67c5e7)
• card: pick auto text direction from the displayed title (cef0e17)
• classify revoked media server tokens as authentication failures (723ed56)
• clear hosted playback on privacy save during outage (5b9d572)
• clear stale Spotify consent link on sign-in failure (5ea5954)
• confine provider credential redirects to original origin (345edce)
• discard late sign-in start after Cancel (8f52243)
• discard Spotify sign-in completion after expiry (52d53bb)
• drive the injected test clock through both Discord client timers (#731) (cf15ab0)
• expire abandoned hosted sign-in guard (e0629c1)
• expire artwork cache by elapsed time (#721) (513c1af)
• expire Discord artwork by elapsed time (#723) (3693e51)
• expire local last-good card by elapsed time (7844ffe)
• expire YouTube tabs by elapsed time (bcc0465)
• explain server sign-in save failures in Settings (0260a5b)
• guard server sign-in and restore credentials on failed saves (057f648)
• hosted: require the exact application/json media type on ingest (be97948)
• identify current repository in MusicBrainz User-Agent (ede2712)
• invalidate cancelled provider sign-in polls (ef5cb56)
• invalidate last-good card after appearance save (9b21318)
• invalidate pending Spotify sign-in on disconnect (70f10e3)
• invalidate private card cache after privacy changes (76bfa90)
• keep a clickable auth link in WebUI provider flows (287c095)
• keep authenticated artwork redirects on original origin (f3f7090)
• keep committing sign-in flows through expiry (1412f5d)
• keep hosted heartbeat alive after client clock rollback (819a4ab)
• keep sign-in flow claimed throughout finish (61bd08e)
• keep sign-in visible while commit finishes (23a65a2)
• keep status snapshot ordered by provider poll start (9101ee8)
• linux: constrain native packaging scripts and tests to Linux (641763a)
• linux: disable RPM debug extraction for prebuilt Node bundles (f25d9da)
• linux: route tray pages to Settings until first-run setup completes (e9f7999)
• make sign-in cancellation honest during credential commit (bd0ec6a)
• measure Discord stuck and grace by elapsed time (#727) (dc42e39)
• newest overlapping Spotify sign-in supersedes older pending flows (#703) (b8649b2)
• normalize private subnet targets before probing (c8055b1)
• offer auth links in legacy setup page (ec3fe04)
• omit hidden subtitles from card metadata and uploads (4b2f4da)
• omit progress track when timing is hidden (17ad73e)
• prevent older hosted pushes from retrying above newer state (7801e7d)
• prioritize failed sources over hosted startup (ac10770)
• rank combined playback by activity order (d4b83f9)
• rank distinct same-title media items by stable ID (d44b0ed)
• rank multi-server playback by activity order (0bb954e)
• rank YouTube tabs by playback activity order (21c140f)
• re-check credential liveness before saving a rotated refresh token (#725) (3ff3ccb)
• recover hosted upload sequence after clock rollback (beb495d)
• reflect per-server auth failures in tray and diagnostics (1e6203d)
• reject hosted ingest committed after device revocation (2c668ce)
• reject oversized Discord IPC activity without leaking waiter (a94006a)
• remove saved sign-in when disconnecting a server (fdd7c70)
• replace prior hosted device on same-PC sign-in (e8e0755)
• report bounded discovery probe failure reasons (abcccbc)
• reset stuck detection for distinct same-title media (8e26ced)
• restore focus after cancelling server sign-in (83cee39)
• restore Spotify credential when config save fails (6f6b404)
• retain hosted revoke key and expose pending disconnect (abe2377)
• retry Discord clear after publish limiter (7a2203d)
• retry failed Plex owner checks (7729906)
• retry first-run activation after another sign-in (91c9fe2)
• retry unchanged Discord activity after publish failure (d6cff56)
• run optional setup before committing server config (89d9319)
• serialize same-account Spotify credential writes (#703) (be5fdd1)
• setup: accept a 4096-byte draft on load (7d68d1d)
• setup: settle LAN discovery when cancelled during bind (1757815)
• share first hosted registration across callers (0cb6d0e)
• show failed server in Settings notice (65d65dd)
• show localhost Plex probe failures in quick scan (85d0e28)
• show per-server sign-in failures in multi-server status (627a8b2)
• skip artwork fetch when card hides image (d039fcb)
• space MusicBrainz requests by elapsed clock (#734) (4a0cc23)
• stream first-run discovery probe bodies with a running byte cap (#745) (0ccf48b)
• surface failed first-run activation with recovery (192e8b6)
• surface hosted upload failures in app health (b670eca)
• time Discord publish throttle and reconnect backoff by elapsed clock (#731) (5794b1d)
• time hosted device flow by elapsed clock (#729) (692f110)
• time hosted sign-in restart guard by elapsed clock (#741) (18859b1)
• time status-only refresh interval by elapsed clock (#736) (d670e3a)
• track setup test rate window by elapsed clock (#739) (e79d193)
• tray: close the app on a stop request after the tray fails (031a0b7)
• tray: keep one quit waiter across Settings restarts (1b2d99f)
• tray: log tray outcomes with statuses the logger accepts (73b4110)
• use elapsed time for hosted stale playback guards (14b4cd9)
• use elapsed time for hosted upload backoff (e9cf458)
• use elapsed time for provider reconnect backoff (e81bc10)
• wait for cancel before switching server sign-in (a3e90a6)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

APPROVE the release metadata diff at 374746c02ddfbb246de09ff18a43fd4f40f628c2, checked with main 316c2712a995441ecf5ece710f8e5cad1bc34ea6 merged locally.

Only release manifest, changelog and package/lock version fields differ from main. The four version fields agree at 0.2.1, and no dependency versions change. The current-main merge is clean; full local suite passes 1285 tests with 22 skipped and no failures, and npm run check passes. The head check-runs endpoint returned no checks, so this is local test evidence, not a green-CI claim.

This is a metadata/code review, not a decision to publish now. Later fixes can still update the release notes before publication. No merge, tag or release performed.