diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14b0af8..75d3a3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7063951..123bb38 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
@@ -82,7 +82,7 @@ jobs:
       # this workflow, so users can verify provenance with `gh attestation verify`.
       - name: Attest build provenance
         if: steps.guard.outputs.exists == 'false'
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             main.js
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d825ba6..33690c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.2] - 2026-07-28
+
+The remaining warning from Obsidian's plugin review. No change in behaviour.
+
+### Fixed
+
+- The inert footnote marker's dotted underline is drawn with a `border-bottom`
+  instead of `text-decoration`. 1.2.1 moved the rule to the
+  `text-decoration-line` / `text-decoration-style` longhands on the assumption
+  that only the multi-value shorthand was flagged; Obsidian's CSS check
+  actually maps the entire `text-decoration` family onto a single browser
+  feature that Chrome supports only partially, so every spelling of it warns.
+  The marker looks the same.
+
+### Internal — recurrence prevention
+
+- `scripts/validate.mjs` now fails the build if `styles.css` declares any
+  `text-decoration*` property. The reviewer's CSS check runs on their side
+  only, so the previous fix could not be verified before submission and the
+  same warning came back a second time; the local gate now carries the rule.
+
 ## [1.2.1] - 2026-07-28
 
 Compliance fixes raised by Obsidian's plugin review. No change in behaviour.
@@ -215,7 +236,8 @@ Initial public release.
   mode), not only in Reading view. The table being actively edited is left
   untouched.
 
-[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.1...HEAD
+[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.2...HEAD
+[1.2.2]: https://github.com/Post-Math/Lookout/compare/1.2.1...1.2.2
 [1.2.1]: https://github.com/Post-Math/Lookout/compare/1.2.0...1.2.1
 [1.2.0]: https://github.com/Post-Math/Lookout/compare/1.1.7...1.2.0
 [#28]: https://github.com/Post-Math/Lookout/issues/28
diff --git a/manifest.json b/manifest.json
index af9869b..06f31f8 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "id": "lookout",
   "name": "Lookout",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "minAppVersion": "1.6.6",
   "description": "Survey wide content instead of scrolling sideways. Pan and zoom Mermaid diagrams (wheel, Ctrl+wheel, or buttons), fit them to the frame, and open diagrams or wide tables full-screen.",
   "author": "Post-Math",
diff --git a/package-lock.json b/package-lock.json
index d677b5a..97f4ed4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2602,9 +2602,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "dev": true,
       "funding": [
         {
diff --git a/scripts/validate.mjs b/scripts/validate.mjs
index deefcde..dd088e9 100644
--- a/scripts/validate.mjs
+++ b/scripts/validate.mjs
@@ -56,6 +56,44 @@ if (manifest && versions) {
   }
 }
 
+/*
+ * styles.css: properties Obsidian's plugin CSS check rejects.
+ *
+ * That check maps each declared property to a caniuse feature and warns when
+ * the feature is not *fully* supported by the Chrome in the plugin's
+ * `minAppVersion`. The whole `text-decoration` family — shorthand and
+ * longhands alike — resolves to one feature that Chrome only partially
+ * supports, so no spelling of it passes; 1.2.1 shipped the longhands believing
+ * only the shorthand was flagged, and got the same warning back. Use a
+ * `border-bottom` for underline-like rules instead.
+ *
+ * This is a targeted guard, not a reimplementation of the reviewer's check:
+ * it encodes the one family we have actually been flagged on.
+ */
+const CSS_BANNED = [
+  [
+    /(^|[;{\s])text-decoration(-line|-style|-color|-thickness|-skip|-skip-ink)?\s*:/gm,
+    "Obsidian's CSS check flags the whole text-decoration family as only " +
+      "partially supported. Use `border-bottom: 1px dotted currentColor` " +
+      "(plus `padding-bottom` for offset) instead.",
+  ],
+];
+if (existsSync("styles.css")) {
+  const css = readFileSync("styles.css", "utf8");
+  // Comments carry the explanation of *why* these are banned; don't self-trip.
+  // Blank them out newline-for-newline so reported line numbers stay true.
+  const code = css.replace(/\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, " "));
+  let clean = true;
+  for (const [re, why] of CSS_BANNED) {
+    for (const m of code.matchAll(re)) {
+      const line = code.slice(0, m.index).split("\n").length;
+      fail(`styles.css:${line} uses \`${m[0].trim().replace(/:$/, "")}\`. ${why}`);
+      clean = false;
+    }
+  }
+  if (clean) ok("styles.css uses no unsupported browser features");
+}
+
 if (failed) {
   console.error("\nValidation failed.");
   process.exit(1);
diff --git a/styles.css b/styles.css
index 54e4b2e..0e51ab0 100644
--- a/styles.css
+++ b/styles.css
@@ -446,12 +446,14 @@
 .lookout-table-fs-scroll .lookout-fn-unresolved {
   color: var(--text-muted);
   cursor: default;
-  /* Longhands, not the `text-decoration` shorthand: Obsidian's plugin CSS check
-     flags the multi-value shorthand as only partially supported at our
-     `minAppVersion`, while these two have been safe for far longer. */
-  text-decoration-line: underline;
-  text-decoration-style: dotted;
-  text-underline-offset: 2px;
+  /* A border, not `text-decoration` — and not its longhands either. Obsidian's
+     plugin CSS check groups the whole `text-decoration` family under one
+     caniuse feature that Chrome only *partially* supports, so every spelling of
+     it is flagged; the dotted bottom border draws the same cue out of CSS1
+     properties nothing has ever qualified. `padding-bottom` stands in for the
+     underline offset. */
+  border-bottom: 1px dotted currentColor;
+  padding-bottom: 1px;
 }
 
 .lookout-fs-close {
diff --git a/versions.json b/versions.json
index fc76cd2..5193ec6 100644
--- a/versions.json
+++ b/versions.json
@@ -7,5 +7,6 @@
   "1.1.6": "1.0.0",
   "1.1.7": "1.0.0",
   "1.2.0": "1.6.6",
-  "1.2.1": "1.6.6"
+  "1.2.1": "1.6.6",
+  "1.2.2": "1.6.6"
 }