Added
"Continue with Email" on the login screen — a peer button beside the Lightning QR, opening memestack.ai's one-click connect page (which handles email or Lightning login and hands the extension its restricted token). The email path always existed via that page, but nothing in the popup said so — the first screen read as crypto-required to walletless installs.
Reserved-hostname refusals (shared SSRF guard): internal-by-definition names — .local, .localhost, .internal, .lan, .home, .corp, .mail, .home.arpa, and single-label hostnames — are refused before ANY network I/O. Closes the mDNS/search-domain gap the DNS lookup structurally could not see: public DNS answers empty for printer.local while the browser resolves it via mDNS, so the old check passed exactly the names it existed to stop.
Changed
DoH failure mode split — fail-open on an unreachable resolver. The pre-download 1.1.1.1 safety lookup no longer fails the save when the resolver cannot be reached: corporate networks and Pi-hole-class setups block DoH endpoints wholesale, and the old fail-closed rule turned every save there into an unexplained refusal. A resolver that ANSWERS "private network" still always refuses, in every mode. Extension-only (resolverUnavailable: 'allow') — server callers of the shared guard keep the fail-closed default byte-for-byte.
DNS lookups parallelized — the A and AAAA queries now run concurrently, halving the lookup latency added to every save.
Icons: transparent corners. Toolbar/store icons are now rasterized from the vector favicon; the previous set inherited opaque white corners from a flattened PNG, visible on dark toolbars and store surfaces.
Store artifacts renamed bitcoin-index-extension- → memestack-extension-* (wxt zip.name; the internal workspace package name is unchanged).
Internal / tooling
Packaging guard hardened: scripts/assert-manifest.mjs gained --zip mode (asserts the actual upload artifact — a --dist assertion once passed a stale clean build while the zips were contaminated) plus a package-wide dev-URL scan (http://localhost, localhost:<port>). Added after wxt zip --mode prod (Vite mode prod ≠ production) baked .env's localhost URLs into the packages. Rule: never pass --mode to wxt zip.
e2e/popup-visuals.mjs pinned to the Saves tab — 0.3.0's default-Find tab left every Saves-view scenario timing out.
Site disclosures updated alongside (/privacy §5: Insert flow + the DoH fail-open behavior; store reviewer notes likewise).

New in 0.3.0 — Find & Paste:
• A new Find tab in the popup: search MemeStack's public gallery without signing in, or your own saved images and collections once signed in.
• Click a result to copy it to your clipboard as a PNG; on sites whose editors accept pasted images, it's inserted straight into the field you were typing in.
• Open the popup with Alt+M, or right-click a text field and choose "Insert image from MemeStack".
• No new permissions — the permission set is identical to 0.1.