[q1]

Cookie Loom now has a pinned Bun 1.4.3 toolchain and a verified, durable GitHub preview release path. An annotated preview tag on a merged commit runs all CI checks, rebuilds from the distributed source, verifies every browser archive file, and publishes unsigned packages with checksums and source metadata.

• Replace npm/Node commands, the npm lockfile, and Vitest with Bun workspaces, frozen scripts-disabled installs, native type checking, and isolated parallel tests. Keep WXT/Vite for browser-specific compilation.
• Patch web-ext's deprecated domain-based startup error handling so Firefox development and native testing work under Bun; add two real socket regressions.
• Add minimum-browser CI for Chrome 132 and Firefox 140, version/tag guards, source/archive reproducibility checks, and a preview-only release workflow with narrowly scoped publication permissions.
• Prepare both browser-store listings, permission disclosures, reviewer instructions, and correctly sized synthetic screenshots/promotional assets. Store signing/submission remains a separate publisher step.
• Record independent review and warm local toolchain measurements: typecheck 1.960s → 0.332s, unit suite 0.355s → 0.022s, both builds 1.046s → 0.758s. These measure development latency, not browser runtime speed.

Validation: 146 Bun unit tests (all original 144 retained), 57 Playwright tests, three compiled Chrome 132 workflows, and 13 native checks each on Firefox 140/151 passed. Native and retained TypeScript checks, frozen install, production audit, format, build verification, Firefox lint, and actionlint passed. Fresh source reconstruction reproduces all 22 files per browser byte for byte; a tampered ZIP is rejected. Seven tag-policy fixtures and abrupt-parent process cleanup were also verified. Independent review found no P0–P2 issues; its production-tooling exclusion observation was fixed.

Release: v0.1.0-preview.1 will be tagged after this merges and CI passes. Packages remain unsigned; manual permission prompts and signed/store installation/update paths are documented limits. See docs/review-2026-10-12.md, docs/verification.md, docs/toolchain-performance.md, and docs/store-listing.md.