CI: keep JVM crash logs and try C1-only JIT on the runner

Runs on the Gitea runner crash intermittently on three JDK vendors. Upload
hs_err/replay logs on failure so the failing frame survives the job
container, and drop C2 (TieredStopAtLevel=1) for the Gradle and Kotlin
daemons to test whether the optimising JIT is the trigger.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YGRgChhwbwWr5yYrHTd9pL

.github/scripts/stage-pages-site.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Assembles the Cloudflare Pages site for plg.wallacenet.ca into ./pages-out.
+#
+# Usage: stage-pages-site.sh <prod|dev> <tag> <apk-path>
+#
+# A Pages deploy replaces the whole site, and both channels live in one site,
+# so this stages the channel being published and then re-fetches the *other*
+# channel's current files from the live site so the deploy does not erase them.
+set -euo pipefail
+
+channel="$1"; tag="$2"; apk="$3"
+base="${PAGES_BASE_URL:-https://plg.wallacenet.ca}"
+out="pages-out"
+limit=$((25 * 1024 * 1024)) # Cloudflare Pages: 25 MiB per file
+
+case "$channel" in prod) other=dev ;; dev) other=prod ;; *) echo "bad channel: $channel" >&2; exit 2 ;; esac
+
+rm -rf "$out"
+mkdir -p "$out/$channel" "$out/$other"
+cp site/index.html site/404.html site/_headers "$out/"
+
+name="$(basename "$apk")"
+cp "$apk" "$out/$channel/$name"
+cp "$apk" "$out/$channel/ProLibertateGames.apk"
+# node rather than jq: the Gitea runner's image has node but not jq.
+node -e 'console.log(JSON.stringify({tag: process.argv[1], apkName: process.argv[2], apkUrl: process.argv[3], channel: process.argv[4]}, null, 2))' \
+  "$tag" "$name" "$base/$channel/$name" "$channel" > "$out/$channel/latest.json"
+
+# PLG_SKIP_OTHER=1 is for the very first deploy, when the site does not exist
+# yet and the domain answers 403 (Cloudflare error 1014) instead of 404.
+if [ -n "${PLG_SKIP_OTHER:-}" ]; then
+  echo "PLG_SKIP_OTHER set; not carrying over $other."
+  rm -rf "$out/$other"
+  find "$out" -type f | sort
+  exit 0
+fi
+
+# Carry the other channel over. 404 means it was never published; any other
+# failure must stop the deploy rather than silently dropping that channel.
+code="$(curl -sS -o "$out/$other/latest.json" -w '%{http_code}' "$base/$other/latest.json" || true)"
+: "${code:=000}"
+# Cloudflare error 1014 (403 + "error code: 1014") means the domain's CNAME
+# points at a Pages project that does not exist yet, so there is nothing to
+# preserve — the same as a 404, and what a push-triggered first deploy sees.
+if [ "$code" = 403 ] && grep -q 'error code: 1014' "$out/$other/latest.json" 2>/dev/null; then
+  code=404
+fi
+if [ "$code" = 404 ]; then
+  echo "No $other channel published yet; skipping."
+  rm -rf "$out/$other"
+elif [ "$code" = 200 ] && ! other_name="$(node -p 'const j = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8")); if (!j.apkName) process.exit(1); j.apkName' "$out/$other/latest.json" 2>/dev/null)"; then
+  # A 200 that is not our JSON: Pages without a 404.html answers unknown paths
+  # with index.html. Nothing is published on that channel.
+  echo "No $other channel published yet (200 but no latest.json); skipping."
+  rm -rf "$out/$other"
+elif [ "$code" = 200 ]; then
+  curl -fsS -o "$out/$other/$other_name" "$base/$other/$other_name"
+  cp "$out/$other/$other_name" "$out/$other/ProLibertateGames.apk"
+else
+  echo "Fetching $other/latest.json returned HTTP $code; refusing to deploy." >&2
+  exit 1
+fi
+
+find "$out" -name '*.apk' -size +"${limit}c" -print | grep . >&2 && {
+  echo "APK exceeds Cloudflare Pages' 25 MiB per-file limit." >&2; exit 1; } || true
+find "$out" -type f | sort

.github/workflows/ci.yml

@@ -1,27 +1,28 @@
 name: CI
 
 # Pre-merge checks. Runs on the dev branch and on every pull request aimed at
-# dev or main, so breakage is caught before it reaches main.
+# dev or main, so breakage is caught before it reaches main and triggers a
+# release.
 #
-# On a push to dev it also publishes the build as a dev-channel prerelease on
-# this Gitea instance, so the in-app updater can offer it to anyone on the dev
-# channel. Prereleases are used deliberately: the "latest release" endpoint
-# skips them, so a production-channel user never sees a dev build. Pull
-# requests only build and check — they never publish, which keeps a PR from a
-# fork from shipping anything.
-#
-# These files live in .github/workflows/ on purpose: Gitea Actions reads that
-# path as well as .gitea/workflows/, so one file serves both. Publishing goes
-# through Gitea's REST API (the same routes the app's updater reads) rather
-# than the `gh` CLI, which a runner image need not carry.
+# On a push to dev it also publishes the build as a dev-channel prerelease, so
+# the in-app updater can offer it to anyone who has switched to that channel.
+# Prereleases are used deliberately: GitHub's "latest release" endpoint skips
+# them, so a production-channel user never sees a dev build. Pull requests only
+# build and check — they never publish, which keeps a PR from a fork from
+# shipping anything.
 on:
   push:
     branches: [ dev ]
   pull_request:
     branches: [ main, dev ]
   workflow_dispatch:
+    inputs:
+      first_deploy:
+        description: "First Cloudflare deploy: skip carrying over the other channel (the site does not exist yet)"
+        type: boolean
+        default: false
 
-# Needed by the job token to create the release and attach the APK.
+# Needed to publish the dev-channel prerelease below.
 permissions:
   contents: write
 
@@ -34,6 +35,8 @@ jobs:
   build:
     name: Build and check
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.stage.outputs.version }}
     env:
       # Stamp the APK as a dev-channel build exactly when it is a build of the
       # dev branch, which is exactly when it can be published below. Pull
@@ -41,7 +44,10 @@ jobs:
       # <series>.0-dev: they are never published and must not claim a channel
       # version.
       #
-      # This condition has to stay in step with the publish steps' own.
+      # This condition has to stay in step with the publish steps' own. Stamping
+      # a build the publish steps would ship, or shipping one this left
+      # unstamped, both end the same way — an APK claiming versionCode 1, which
+      # the updater can never see as an upgrade over anything.
       PLG_CHANNEL: ${{ github.ref == 'refs/heads/dev' && 'dev' || '' }}
     steps:
       - name: Checkout
@@ -69,17 +75,30 @@ jobs:
       - name: Upload debug APK
         uses: actions/upload-artifact@v4
         with:
-          name: PilgrimsOfKatan-debug-apk
+          name: ProLibertateGames-debug-apk
           path: app/build/outputs/apk/debug/app-debug.apk
           if-no-files-found: error
           retention-days: 14
 
+      - name: Upload JVM crash logs
+        # A JVM crash writes hs_err_pid*.log into the workspace, which dies
+        # with the job container; keep it so the failing frame can be read.
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ProLibertateGames-jvm-crash
+          path: |
+            hs_err_pid*.log
+            replay_pid*.log
+          if-no-files-found: ignore
+          retention-days: 14
+
       - name: Upload lint and test reports
         # Reports are most useful precisely when a step above failed.
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: PilgrimsOfKatan-reports
+          name: ProLibertateGames-reports
           path: |
             app/build/reports/
           if-no-files-found: ignore
@@ -89,39 +108,74 @@ jobs:
       # branch itself, after it has built, tested and linted clean above.
       #
       # Gated on the branch alone rather than on the event, which is how
-      # release.yml gates main. A pull request is still excluded without
-      # needing to name it: a PR build runs against refs/pull/N/merge, never
-      # refs/heads/dev, so a fork still cannot ship anything.
+      # release.yml has always gated main. A pull request is still excluded
+      # without needing to name it: a PR build runs against refs/pull/N/merge,
+      # never refs/heads/dev, so a fork still cannot ship anything.
       - name: Stage dev APK
         id: stage
         if: github.ref == 'refs/heads/dev'
         run: |
           set -euo pipefail
-          # The series and the offset come from gradle.properties, which is
-          # the same file the build read when it stamped the APK — so the tag
-          # and what is inside it cannot name different versions. The number
-          # is run number + offset, exactly the arithmetic build.gradle.kts
-          # did for versionCode.
+          # The series comes from gradle.properties, which is the same file the
+          # build read when it stamped the APK — so the tag and what is inside
+          # it cannot name different versions.
           series="$(sed -n 's/^plgVersionSeries=//p' gradle.properties)"
-          offset="$(sed -n 's/^plgVersionRunOffset=//p' gradle.properties)"
           test -n "$series"
+          offset="$(sed -n 's/^plgVersionRunOffset=//p' gradle.properties)"
           test -n "$offset"
-          stamp="$(( ${{ github.run_number }} + offset ))"
-          version="v${series}.${stamp}-dev"
+          # Same arithmetic as build.gradle.kts, so the tag names the APK's own number.
+          version="v${series}.$(( ${{ github.run_number }} + offset ))-dev"
           src="app/build/outputs/apk/debug/app-debug.apk"
-          dest="PilgrimsOfKatan-${version}.apk"
+          dest="ProLibertateGames-${version}.apk"
           cp "$src" "$dest"
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "apk=$dest" >> "$GITHUB_OUTPUT"
 
-      - name: Publish dev channel prerelease
+      - name: Upload staged dev APK for the Pages deploy
         if: github.ref == 'refs/heads/dev'
+        uses: actions/upload-artifact@v4
+        with:
+          name: plg-dev-staged
+          path: ${{ steps.stage.outputs.apk }}
+          if-no-files-found: error
+          retention-days: 1
+
+  # Publishes the build to https://plg.wallacenet.ca (Cloudflare Pages), which is
+  # the only release channel: the in-app updater reads latest.json from there.
+  #
+  # Both workflows deploy into one Pages site, and a deploy replaces the whole
+  # site, so they share a concurrency group and never run at the same time.
+  deploy-pages:
+    name: Deploy to Cloudflare Pages
+    needs: build
+    if: github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: plg-pages-deploy
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download staged APK
+        uses: actions/download-artifact@v4
+        with:
+          name: plg-dev-staged
+          path: staged
+
+      - name: Assemble site
         env:
-          # The job's built-in token: contents: write is declared above.
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          RELEASE_TAG: ${{ steps.stage.outputs.version }}
-          RELEASE_APK: ${{ steps.stage.outputs.apk }}
-          RELEASE_KIND: prerelease
-          RELEASE_TARGET: ${{ github.sha }}
-        # One script, also runnable by hand — see docs/CI.md.
-        run: ./scripts/publish-release.sh
+          PLG_SKIP_OTHER: ${{ inputs.first_deploy && '1' || '' }}
+        run: .github/scripts/stage-pages-site.sh dev "${{ needs.build.outputs.version }}" "staged/ProLibertateGames-${{ needs.build.outputs.version }}.apk"
+
+      - name: Deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -euo pipefail
+          # Creates the project on first run; fails harmlessly if it exists.
+          npx --yes wrangler@3 pages project create plg --production-branch main || true
+          # --branch main makes this the production deployment, which is what
+          # plg.wallacenet.ca serves, whichever branch the workflow ran on.
+          npx --yes wrangler@3 pages deploy pages-out --project-name plg --branch main --commit-dirty=true

.github/workflows/release.yml

@@ -1,17 +1,18 @@
 name: Build and Release APK
 
-# Production-channel build. Runs on a push to main, or by hand
-# (workflow_dispatch), and publishes to this Gitea instance's releases — which
-# is the channel the in-app updater reads. See docs/CI.md.
-#
-# Publishing goes through Gitea's REST API rather than the `gh` CLI, which a
-# runner image need not carry.
+# Build an APK and publish it as a GitHub Release whenever commits land on main
+# (for example when a pull request is merged). Can also be run manually.
 on:
   push:
     branches: [ main ]
   workflow_dispatch:
+    inputs:
+      first_deploy:
+        description: "First Cloudflare deploy: skip carrying over the other channel (the site does not exist yet)"
+        type: boolean
+        default: false
 
-# Needed by the job token to create the release and attach the APK.
+# Allow the built-in token to create releases and upload the APK.
 permissions:
   contents: write
 
@@ -23,13 +24,16 @@ concurrency:
 jobs:
   build:
     name: Build APK and publish release
-    # workflow_dispatch can be aimed at any branch from the Actions UI. The
-    # production stamp belongs to main alone — anything else is a no-op rather
-    # than shipping unreviewed code to everybody.
+    # workflow_dispatch can be aimed at any branch from the Actions UI. Releases
+    # are what the in-app updater installs, so only main may produce one —
+    # anything else is a no-op rather than shipping unreviewed code to everyone.
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.stage.outputs.version }}
     env:
-      # Stamps the APK as a production-channel build.
+      # Stamps the APK as a production-channel build, versioned with the run
+      # number that matches the tag published below.
       PLG_CHANNEL: production
     steps:
       - name: Checkout
@@ -45,44 +49,76 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
 
-      - name: Build production APK
+      - name: Build debug APK
         run: ./gradlew assembleDebug --no-daemon --stacktrace
 
-      - name: Stage APK
+      - name: Stage APK for release
         id: stage
         run: |
           set -euo pipefail
-          # The series and the offset come from gradle.properties, which is
-          # the same file the build read when it stamped the APK — so the tag
-          # and what is inside it cannot name different versions. The number
-          # is run number + offset, exactly the arithmetic build.gradle.kts
-          # did for versionCode.
+          # The series comes from gradle.properties, which is the same file the
+          # build read when it stamped the APK — so the tag and what is inside
+          # it cannot name different versions.
           series="$(sed -n 's/^plgVersionSeries=//p' gradle.properties)"
-          offset="$(sed -n 's/^plgVersionRunOffset=//p' gradle.properties)"
           test -n "$series"
+          offset="$(sed -n 's/^plgVersionRunOffset=//p' gradle.properties)"
           test -n "$offset"
-          stamp="$(( ${{ github.run_number }} + offset ))"
-          version="v${series}.${stamp}"
+          # Same arithmetic as build.gradle.kts, so the tag names the APK's own number.
+          version="v${series}.$(( ${{ github.run_number }} + offset ))"
           src="app/build/outputs/apk/debug/app-debug.apk"
-          dest="PilgrimsOfKatan-${version}.apk"
+          dest="ProLibertateGames-${version}.apk"
           cp "$src" "$dest"
+          # The same build again under a name that never changes. GitHub's
+          # /releases/latest/download/<name> redirect needs a constant file
+          # name, so this second copy is what makes a permanent download link
+          # possible — the versioned copy stays as the traceable one.
+          cp "$src" "ProLibertateGames.apk"
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "apk=$dest" >> "$GITHUB_OUTPUT"
 
       - name: Upload APK as workflow artifact
         uses: actions/upload-artifact@v4
         with:
-          name: PilgrimsOfKatan-apk
+          name: plg-prod-staged
           path: ${{ steps.stage.outputs.apk }}
           if-no-files-found: error
 
-      - name: Publish production release
+  # Publishes the build to https://plg.wallacenet.ca (Cloudflare Pages), which is
+  # the only release channel: the in-app updater reads latest.json from there.
+  #
+  # Both workflows deploy into one Pages site, and a deploy replaces the whole
+  # site, so they share a concurrency group and never run at the same time.
+  deploy-pages:
+    name: Deploy to Cloudflare Pages
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: plg-pages-deploy
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download staged APK
+        uses: actions/download-artifact@v4
+        with:
+          name: plg-prod-staged
+          path: staged
+
+      - name: Assemble site
         env:
-          # The job's built-in token: contents: write is declared above.
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          RELEASE_TAG: ${{ steps.stage.outputs.version }}
-          RELEASE_APK: ${{ steps.stage.outputs.apk }}
-          RELEASE_KIND: release
-          RELEASE_TARGET: ${{ github.sha }}
-        # One script, also runnable by hand — see docs/CI.md.
-        run: ./scripts/publish-release.sh
+          PLG_SKIP_OTHER: ${{ inputs.first_deploy && '1' || '' }}
+        run: .github/scripts/stage-pages-site.sh prod "${{ needs.build.outputs.version }}" "staged/ProLibertateGames-${{ needs.build.outputs.version }}.apk"
+
+      - name: Deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -euo pipefail
+          # Creates the project on first run; fails harmlessly if it exists.
+          npx --yes wrangler@3 pages project create plg --production-branch main || true
+          # --branch main makes this the production deployment, which is what
+          # plg.wallacenet.ca serves, whichever branch the workflow ran on.
+          npx --yes wrangler@3 pages deploy pages-out --project-name plg --branch main --commit-dirty=true

CLAUDE.md

@@ -1,93 +1,120 @@
-# Working on this repo (agent notes)
+> **Moved to Gitea.** CI now runs on Gitea Actions at
+> `git.wallacenet.ca/devadmin/ProLibertateGames`, publishing to Cloudflare Pages
+> (`plg.wallacenet.ca`) only. The sandbox notes below describe the earlier GitHub
+> setup (no CI run from session pushes, `workflow_dispatch` as the workaround);
+> re-verify them against Gitea before relying on them.
 
-Pilgrims of Katan — an Android collection of card and board games, playable
-against AI or over Wi-Fi (LAN). Bootstrapped from
-[adrianoftyriel/ProLibertateGames](https://github.com/adrianoftyriel/ProLibertateGames)
-(GPL-3.0, kept as the `upstream` remote) for Wallacenet. Canonical repo:
-<https://git.wallacenet.ca/devadmin/PilgrimsOfKatan>.
+# Working on this repo with Claude
 
-## Ground rules
+## Nothing a session does triggers CI. Dispatch it explicitly.
 
-- **Licences travel.** `LICENSE` is GPL-3.0 and must stay. The Uncial Antiqua
-  font ships with its OFL licence at `docs/licenses/UncialAntiqua-OFL.txt`;
-  never delete or edit either. Attribution to the upstream lives in the README.
-- **No Catan trademarks or brand assets**, and none of the upstream's Wallace
-  clan branding (it was removed in the rebrand; see README → Branding). The
-  brand is: *Pilgrims of Katan*, `ca.wallacenet.pilgrimsofkatan` (+ `.dev`),
-  slate blue / dev green, hexagon emblem.
-- **The existing catalogue is the regression safety net.** Keep every game
-  green; new games (Catan) arrive as separate tasks, not edits to old ones.
-  All 22 games are `available = true`.
-- **Docs conventions**: every game gets `docs/RULES-<id>.md` (index and gaps in
-  `docs/README.md`); build/CI/release decisions go in `docs/CI.md`. Update the
-  docs when behaviour changes — they are the check against the rules code.
+GitHub creates **no workflow run** for anything this sandbox does — pushing a
+branch, opening a pull request, or merging one. All of it goes through the same
+integration, and GitHub suppresses event-triggered runs from it. The pull
+request will say it was opened by the repo owner; that is only how the UI
+attributes it, and it does not change the suppression.
 
-## Build
+This was measured, not assumed:
 
-```sh
-export JAVA_HOME=...   # JDK 17
-export ANDROID_HOME=...  # SDK with platform 34, build-tools 34
-./gradlew assembleDebug            # dev-channel APK (default)
-PLG_CHANNEL=production ./gradlew assembleDebug   # production APK
-./gradlew testDebugUnitTest        # JVM unit tests (rules/AI/net/score)
-./gradlew lintDebug                # Android lint (CI runs it)
-```
+| Action | Result |
+| --- | --- |
+| Human pushes a Claude-authored commit (`d165e5ef`, `469c900e`) | CI runs |
+| Session pushes `dev` / `main` (`43394b8`, `742add4`) | no run |
+| Session opens a PR against `dev` (#1) | no run |
+| Session calls `workflow_dispatch` | **runs** |
 
-On the Wallacenet project workspace a ready toolchain sits at
-`../.toolchain/` (`jdk17/`, `android-sdk/`) — export `JAVA_HOME` and
-`ANDROID_HOME` to it rather than installing again. Both variants must build:
-they install side by side (different applicationId, launcher name, colour).
+`workflow_dispatch` works because it creates a run directly instead of relying
+on an event. It is the only mechanism available from a session, so every build
+has to be asked for by hand.
 
-## Channels and OTA
+## Verify before merging, without publishing
 
-One flag — `isDevBuild` in `app/build.gradle.kts` — drives applicationId,
-launcher name and brand colour together. Never set them individually.
+`ci.yml` builds, tests and lints on any ref, but its staging and publishing
+steps are gated on `github.ref == 'refs/heads/dev'`. Dispatching it on a
+**feature branch** therefore gives the full check — build, unit tests, Android
+lint — and publishes nothing.
 
-In-app OTA points at this repo's own Gitea releases
-(`/api/v1/repos/devadmin/PilgrimsOfKatan/releases…`) and is **on**:
-`BuildConfig.OTA_ENABLED` is `true`. The channel is a decision already made and
-recorded — `docs/CI.md` documents the endpoints, the build-number scheme, and
-what publishing requires. Setting the flag to `false` is the kill switch.
+So the working loop is:
 
-## CI
+1. Commit and push the feature branch.
+2. Dispatch `ci.yml` on that branch. Wait for green. This is the real review
+   gate, and it is the only verification that exists (see below).
+3. Open the PR through the API and merge it there, so the change is reviewable
+   and the merge commit is honest about what happened. Neither step builds
+   anything.
+4. Dispatch the target branch's workflow to actually build and publish:
+   `ci.yml` on `dev`, `release.yml` on `main`.
 
-`.github/workflows/` — Actions-compatible so the Gitea instance runs them.
-`ci.yml`: build + test + lint + artifact, and a dev prerelease from `dev`.
-`release.yml`: production release from `main`. Both publish through
-`scripts/publish-release.sh` (Gitea REST API), which is also runnable by hand.
+Skipping step 4 leaves a branch whose head was never built and no release.
 
-**No Actions runner is registered on the instance yet**, so the workflows are
-idle until one is — the local gradle commands above are the source of truth,
-and CI green means those plus lint. Do not treat a workflow that has never run
-as evidence.
+## Merging is a shipping action
 
-## Code map
+Both long-lived branches publish, so a merge is a release, not just an
+integration:
 
-- `game/` — rules engines and AI, **pure Kotlin, no Android types**, unit
-  tested. `Catalog.kt` is the registry (id, title, blurb, options, `available`).
-- `net/` — wire protocol, LAN transport (mDNS + TCP), lobby, host-authoritative
-  match driver; `score/` the scorekeeper sheet, also pure.
-- `ui/` — Compose screens; `ui/theme/Theme.kt` holds the brand palette
-  (`BrandField`/`BrandDeep`/`BrandAccent`) and table accents.
-- `update/` — OTA policy (`UpdatePolicy.kt`, pure and tested) and the gated
-  fetch (`Updater.kt`).
-- `settings/` — DataStore preferences.
+- **`dev`** → `ci.yml` publishes a `v<series>.N-dev` **prerelease**, offered by the
+  in-app updater to anyone on the Dev channel.
+- **`main`** → `release.yml` publishes a **production** release, which the
+  updater installs for everyone on the Production channel.
 
-Host is authoritative over the wire; clients send intents, host re-validates
-against the rules. Keep `game/` free of Android imports — the JVM tests depend
-on it.
+Confirm before shipping to `main`. Note that `release.yml` runs `assembleDebug`
+only — no tests, no lint — so a `main` release is only as verified as the `dev`
+build it replays.
 
-## Git
+## Gradle does not run in the sandbox
 
-- Branches: `main` (production), `dev` (integration). Feature branches → PR
-  into `dev`.
-- Commits by Paperclip agents end with
-  `Co-Authored-By: Paperclip <[email protected]>`.
-- Pull upstream fixes with `git pull upstream` (the GitHub source); do not
-  point `origin` anywhere but this repo's Gitea URL.
+`./gradlew` cannot resolve the Android plugin here: the proxy blocks
+`dl.google.com` with a 403. No local build, no local test run, no local lint. A
+dispatched CI run is the only way to find out whether a change compiles.
 
-## Legacy files
+## A permanent fix, if you want one
 
-`.claude/` and `.rtk/` are the upstream author's assistant tooling, harmless
-and left as inherited. This file supersedes the upstream's CLAUDE.md (which
-documented their GitHub sandbox; that history is still in git).
+The suppression is a property of the sandbox's credential, so it cannot be
+fixed from inside a session. Giving the environment a personal access token to
+push with would make pushes and PRs behave normally for everyone. Until then,
+the dispatch step above is the workaround.
+
+## Bash output is filtered before it reaches the model
+
+`.claude/settings.json` registers a `PreToolUse` hook on `Bash` that rewrites
+each command through [rtk](https://github.com/rtk-ai/rtk): `git status` runs as
+`rtk git status`, and rtk compresses the output. Write commands normally — the
+rewrite is transparent and costs nothing to invoke.
+
+Measured on this repo rather than quoted from rtk's README:
+
+| Command | Raw | Filtered | Saved |
+| --- | --- | --- | --- |
+| `git diff HEAD~3` | 521 KB | 28 KB | 95% |
+| `grep -rn "fun " app/src/main` | 117 KB | 19 KB | 84% |
+| `find . -name "*.kt"` | 7.7 KB | 1.7 KB | 79% |
+| `git log -20` | 20 KB | 5.3 KB | 74% |
+| `git diff --stat` | 4.0 KB | 4.0 KB | 1% |
+| `ls` of a single package | 50 B | 62 B | −24% |
+
+The saving is all in the large outputs, which is the point — a full diff of a
+few commits is otherwise most of a context window. Already-compact output grows
+slightly, because rtk adds a header; at those sizes it does not matter. `rtk
+gain` reports what the current session has actually saved.
+
+Two limits are worth knowing. The `Read`, `Grep` and `Glob` tools are not
+`Bash`, so they never reach the hook and are unaffected; a deliberate `rg` or
+`find` in a shell *is* filtered. And filtering never truncates a file: `cat`
+becomes `rtk read`, which was checked byte-for-byte against this repo's longest
+Kotlin source (`GameSetupScreen.kt`, 946 lines) and came back identical. Commit
+messages survive the rewrite intact, quotes and colons included. To bypass
+filtering for one command, run `rtk proxy <cmd>`.
+
+## rtk is reinstalled at the start of every session
+
+The container starts empty, so `.claude/hooks/session-start.sh` installs rtk
+before the session does anything. It pins `RTK_VERSION`, because the installer
+otherwise asks `api.github.com` for the latest tag and the proxy answers 403 for
+every repository except this one — the lookup fails and takes the install with
+it. Bump that variable by hand.
+
+The hook is written not to matter when it fails. Outside the sandbox it installs
+nothing and just prints the command to run, since dropping a binary into
+someone's `~/.local/bin` uninvited is not its business; if the download fails it
+says so and exits clean. With rtk absent the rewrite hook no-ops, and the only
+consequence is verbose output.

README.md

@@ -1,14 +1,8 @@
-# Pilgrims of Katan
+# Pro Libertate Games
 
 A collection of card and board games for Android, playable against the computer
 or against other people over Wi-Fi (LAN).
 
-Derived from [ProLibertateGames](https://github.com/adrianoftyriel/ProLibertateGames)
-by adrianoftyriel, used under the GNU GPL v3 — see [LICENSE](LICENSE). Game
-rules documentation lives under [docs/](docs/README.md); build, CI and release
-decisions live in [docs/CI.md](docs/CI.md). Catan itself arrives in later work;
-this app ships the reference catalogue unchanged as the regression safety net.
-
 ## What works today
 
 The app shell is complete and every game in the catalogue is playable end to end:
@@ -117,52 +111,55 @@ it: every rule above is a pure function and unit-tested on the JVM.
 - **Sound** on/off.
 - **Animation speed**, 0.5×–2×. One multiplier drives card movement and how long
   the computer appears to think.
-- **Updates** — check on launch, or check on demand. The channel is this
-  project's own Gitea releases ([docs/CI.md](docs/CI.md)), and **there is no
-  channel to choose**: a build updates from its own channel and no other. The
-  settings screen states which one is running rather than offering a switch.
-  `BuildConfig.OTA_ENABLED` is the kill switch, not a preference.
+- **Updates** — check on launch, or check on demand. **There is no channel to
+  choose**: a build updates from its own channel and no other. A production
+  install is offered production builds from `main`; a dev install is offered dev
+  builds from `dev`. The settings screen states which one is running rather than
+  offering a switch.
 
   The check on launch **only ever speaks when there is a build to install**. It
   runs behind the splash and waits for it to clear, and an app that is already
-  current — or a phone that cannot reach the release server — says nothing,
-  because opening the app was not a question. The button in Settings is a
-  question, so it answers every time, including "you're on the latest" and
-  whatever went wrong.
+  current — or a phone that cannot reach GitHub — says nothing, because opening
+  the app was not a question. The button in Settings is a question, so it
+  answers every time, including "you're on the latest" and whatever went wrong.
 
   Wanting both means installing both — they are separate apps and each updates
   itself, see [Both channels on one device](#both-channels-on-one-device).
 
 ## Branding
 
-Neutral, original, and deliberately *not* Catan's: no third-party marks or
-trade dress ship in this app (rebrand scope: WALA-118). The launcher icon is a
-hexagonal ring around a solid core — a game tile, not any game's logo — drawn
-as vector drawables so it stays sharp at every density and needs no PNGs. The
-app opens on the brand field fading to its deep shade, the name set in a Celtic
-uncial hand for two seconds before it fades into the menu.
+The launcher icon is a single square of the Wallace tartan set on the bias, and
+the app opens on the same cloth carrying the name in a Celtic uncial hand for two
+seconds before fading into the menu.
 
-A dev build wears the **dev green** field where production wears **slate
-blue**, and installs as *Pilgrims of Katan DEV*. That is what tells the two
-copies apart when both are on the phone; see
-[Both channels on one device](#both-channels-on-one-device). The palette lives
-in `ui/theme/Theme.kt` (`BrandField`, `BrandDeep`, `BrandAccent`) and the two
-channel colours are generated per build by `resValue` in `app/build.gradle.kts`
-— the icon vectors reference `@color/brand_field` rather than a literal, which
-is how one set of vectors serves both colourways.
+A dev build wears **Wallace Hunting** instead — the same threadcount with green
+where the clan sett has red — and installs as *Pro Libertate Games DEV*. That is
+what tells the two copies apart when both are on the phone; see
+[Both channels on one device](#both-channels-on-one-device).
+
+The tartan is drawn, not an image: `ui/theme/Tartan.kt` lays the sett down as
+warp and then as weft at half opacity, which is what produces the blended
+squares instead of a flat grid. The icon is the same construction as a vector
+drawable, so it stays sharp at every density and needs no PNGs.
 
 Two honest caveats:
 
+- **The sett is the published threadcount: `K/4 R32 K32 Y/4`.** The slashes are
+  pivots, so `WallaceSett` holds the half-sett and reflects it out to
+  `K4 R32 K32 Y4 K32 R32` — 136 threads, about half black, half red, with a
+  yellow line worth 3%. Two details define the pattern and are easy to get
+  backwards: the yellow overstripe runs down the *centre of a wide black band*,
+  and the narrow black guard sits *between two red blocks*. The icon is
+  generated from the same numbers, so the icon and the splash cannot drift.
+  Weave scale is derived from the sett rather than fixed, so changing the
+  threadcount rescales both instead of silently zooming in. The hunting
+  colourway is the same threadcount passed a different field colour, not a
+  second copy of the numbers, so it cannot fall out of step either.
 - **The typeface is bundled under a licence.** Uncial Antiqua, © 2011 Brian J.
   Bonislawsky DBA Astigmatic, Reserved Font Name "Uncial Antiqua", used under
   the SIL Open Font License 1.1. The full licence is at
   [docs/licenses/UncialAntiqua-OFL.txt](docs/licenses/UncialAntiqua-OFL.txt) and
   must stay with the font — the OFL requires it to be distributed alongside.
-- **The upstream's clan tartan is gone; its code is not.** The Wallace tartan
-  was the upstream's brand and left with the rebrand. The GPL-licensed history
-  that produced this app remains in git, and the source stays at
-  [adrianoftyriel/ProLibertateGames](https://github.com/adrianoftyriel/ProLibertateGames)
-  as the `upstream` remote.
 
 ## Screen sizes
 
@@ -186,70 +183,122 @@ smaller than a fingertip.
 
 Requires JDK 17 and the Android SDK (compileSdk 34).
 
-A local build is a dev build: it installs as
-`ca.wallacenet.pilgrimsofkatan.dev` under the name *Pilgrims of Katan DEV* on
-the dev green field, so it goes on beside a production copy rather than over it.
-Set `PLG_CHANNEL=production` to build the production package
-(`ca.wallacenet.pilgrimsofkatan`, slate blue).
+A local build is a dev build: it installs as `org.prolibertate.games.dev` under
+the name *Pro Libertate Games DEV* in the hunting sett, so it goes on beside an
+installed release rather than over it. Set `PLG_CHANNEL=production` to build the
+production package instead.
 
 ## CI
 
-Full decision record: [docs/CI.md](docs/CI.md).
-
 - `.github/workflows/ci.yml` — builds, tests and lints on `dev` and on pull
-  requests into `dev` or `main`, and publishes a dev prerelease from `dev`.
-- `.github/workflows/release.yml` — builds and publishes the production release
-  on push to `main`, or by hand (`workflow_dispatch`).
-- Both publish through [scripts/publish-release.sh](scripts/publish-release.sh)
-  against Gitea's REST API, which is also runnable by hand. **No Actions runner
-  is registered on the instance yet**, so until one is, the local build is the
-  guaranteed path (`./gradlew assembleDebug && ./gradlew testDebugUnitTest`)
-  and releases go out via the script.
+  requests into `dev` or `main`. Its APK artifact is a dev build, versioned
+  `<series>.0-dev` — the series being whatever `plgVersionSeries` says in
+  `gradle.properties`, currently **1.3**.
+- `.github/workflows/release.yml` — on push to `main`, builds the APK and
+  publishes it as a GitHub Release tagged `v<series>.<run-number>`. The in-app updater
+  reads that tag, which is why the APK's `versionCode` is the same run number.
+
+### Hosting: plg.wallacenet.ca
+
+Both channels are also deployed to one Cloudflare Pages project (`plg`), served at
+`https://plg.wallacenet.ca`:
+
+```
+/                        landing page (reads both latest.json files)
+/prod/latest.json        {tag, apkName, apkUrl, channel} — what the updater reads
+/prod/ProLibertateGames.apk, /prod/ProLibertateGames-v<series>.<n>.apk
+/dev/...                 same, for the dev channel
+```
+
+Each workflow's `deploy-pages` job runs `.github/scripts/stage-pages-site.sh`,
+which stages its own channel and re-fetches the other channel from the live site,
+because a Pages deploy replaces everything. The two share a concurrency group so
+they cannot race. Needs repo secrets `CLOUDFLARE_API_TOKEN` (Account → Cloudflare
+Pages → Edit) and `CLOUDFLARE_ACCOUNT_ID`. Pages caps files at 25 MiB.
+
+**First deploy:** the site does not exist yet, so the domain answers 403 (Cloudflare error 1014) and the carry-over fetch would abort. Dispatch the workflow once with `first_deploy` ticked, then attach `plg.wallacenet.ca` as a custom domain on the new `plg` Pages project. Later runs need no input.
+
+The in-app updater reads these `latest.json` files, and this is the only release
+channel: the workflows no longer create GitHub or Gitea releases. They run on
+Gitea Actions (`https://git.wallacenet.ca/devadmin/ProLibertateGames`); the GitHub
+repository is frozen and should stay public with its last releases, because
+installs that predate the Cloudflare updater still read them to reach it.
+
+Build numbers are `run number + plgVersionRunOffset` (1000, in `gradle.properties`),
+so moving CI hosts, which restarts run numbers, can never publish a `versionCode`
+lower than one already installed.
+
+### Installing without the app
+
+The newest production build is always at **https://plg.wallacenet.ca/prod/ProLibertateGames.apk** (dev: `/dev/ProLibertateGames.apk`). The GitHub link below is the frozen pre-migration release:
+
+**https://github.com/adrianoftyriel/ProLibertateGames/releases/latest/download/ProLibertateGames.apk**
+
+Every release carries the same APK twice — once named for its version, and once
+as plain `ProLibertateGames.apk`, because GitHub's `/releases/latest/download/`
+redirect needs a file name that stays put. The in-app updater deliberately picks
+the versioned copy, so an installed build can always be traced back to its tag.
+
+There is no equivalent link for the dev channel: `/releases/latest` skips
+prereleases by design, and that is exactly what keeps a production install from
+being handed a dev build. A dev build is reached by the in-app updater of a dev
+install — which looks at the prerelease list rather than that endpoint — or from
+the releases page.
 
 ### The version series
 
-A version is **`<series>.<build number>`**. Both values are set by hand, once,
-in `gradle.properties`:
+A version is **`<series>.<run number>`**. The series is set by hand, once, in
+`gradle.properties`:
 
 ```properties
-plgVersionSeries=1.4
-plgVersionRunOffset=1000
+plgVersionSeries=1.3
 ```
 
-Both workflows read those same properties when they name a release tag, and the
-build reads them when it stamps the APK, so the tag and what is inside it cannot
-name different versions. Changing either is a one-line change to that file and
-nothing else — but they are not equivalent:
+Both workflows read that same property when they name a release tag, and the
+build reads it when it stamps the APK, so the tag and what is inside it cannot
+name different versions. Bumping a series is a one-line change to that file and
+nothing else.
 
-- The **series** is a name for people. Bumping it changes nothing about
-  ordering.
-- The **build number** is what the machines compare: `versionCode`, the tag's
-  trailing number, and the number in `versionName`, all the same figure —
-  `CI run number + plgVersionRunOffset`. Because the offset never changes and
-  the run number only climbs, going from 1.4 to 1.5 never looks like a downgrade
-  to Android and never interrupts an OTA update.
-
-The offset exists because Gitea Actions restarts run numbers at 1 for each
-workflow: without a floor, the first release of a fresh instance would collide
-with the `versionCode 1` every unstamped local build carries, and a counter
-reset would make Android refuse the next build outright. Full reasoning in
-[docs/CI.md](docs/CI.md).
+The number after it is the CI run number and keeps climbing on its own, which is
+what makes a series bump safe: `versionCode` is the run number *alone*, so
+going from 1.0 to 1.1 never looks like a downgrade to Android and never
+interrupts an OTA update. The series is a name for people; the run number is
+what the machines compare.
 
 ### Update channels
 
-`ci.yml` stamps builds of `dev` as dev-channel, `release.yml` stamps `main` as
-production, so an APK's identity is decided where it is built. Publishing goes
-to this project's Gitea releases, and the rules it keeps:
+Both pipelines publish, to two separate channels:
 
-- production comes only from `main` (`release.yml` refuses any other branch);
-- dev prereleases are marked so the "latest release" endpoint can never hand one
-  to a production install;
-- pull requests build and check but never publish.
+| Channel | Published by | Tag | Marked |
+| --- | --- | --- | --- |
+| Production | `release.yml`, push to `main` | `v<series>.<n>` | release |
+| Dev | `ci.yml`, any build of `dev` | `v<series>.<n>-dev` | prerelease |
+
+Dev builds are published as **prereleases** deliberately: GitHub's "latest
+release" endpoint skips prereleases, so a production-channel install can never
+be handed a dev build even by accident. Pull requests build and check but never
+publish, so a PR from a fork cannot ship anything.
+
+**Both pipelines gate publishing on the branch rather than on what triggered
+the build**, so a manual run from the Actions tab publishes exactly as a push
+does — useful when a push cannot fire the workflow itself, which is the case
+for anything pushed by an automation token. The safety property is unchanged,
+because publishing still happens only after that same job has built, tested and
+linted clean. A pull request is still excluded without having to be named: a PR
+build runs against `refs/pull/<n>/merge`, never `refs/heads/dev`.
+
+In `ci.yml` the `PLG_CHANNEL` stamp is gated on the same condition as the
+publish steps, and the two have to stay in step. Stamping a build that then
+ships, or shipping one that was left unstamped, both end with an APK claiming
+`versionCode` 1 — which the updater can never see as an upgrade over anything.
+
+`release.yml` refuses to run off any branch but `main`, so a manual dispatch
+aimed elsewhere does nothing rather than shipping unreviewed code.
 
 **The two channels have independent version sequences** — a build's `versionCode`
-is the build number of the workflow that produced it (run number + offset), and
-the two workflows count separately, so the numbers say nothing across the
-divide.
+is the run number of the workflow that produced it, and the two workflows count
+separately. Dev is on 69 while production is on 40, so the numbers say nothing
+across the divide.
 
 That is why **an install only ever updates within its own channel**, and why
 there is no setting for it. The app reads the `-dev` suffix in its own
@@ -261,18 +310,18 @@ unit-tested on the JVM like the rules engines are.
 
 ### Both channels on one device
 
-A dev build installs under its own `applicationId`,
-`ca.wallacenet.pilgrimsofkatan.dev`, so it is a separate app as far as Android
-is concerned and can sit beside the production copy rather than replacing it. Each channel still updates itself
+A dev build installs under its own `applicationId`, `org.prolibertate.games.dev`,
+so it is a separate app as far as Android is concerned and can sit beside the
+production copy rather than replacing it. Each channel still updates itself
 normally, because an update within a channel keeps the same package.
 
 Three things move together, all off `isDevBuild` in `app/build.gradle.kts`:
 
 | | Production | Dev |
 | --- | --- | --- |
-| `applicationId` | `ca.wallacenet.pilgrimsofkatan` | `ca.wallacenet.pilgrimsofkatan.dev` |
-| Launcher name | Pilgrims of Katan | Pilgrims of Katan DEV |
-| Brand field | slate blue | deep green |
+| `applicationId` | `org.prolibertate.games` | `org.prolibertate.games.dev` |
+| Launcher name | Pro Libertate Games | Pro Libertate Games DEV |
+| Sett | Wallace (red) | Wallace Hunting (green) |
 
 Anything that is not an explicit `PLG_CHANNEL=production` build is a dev build,
 so a local `assembleDebug` is a dev build too and installs alongside a release
@@ -282,11 +331,11 @@ They have to move together. A dev package wearing the production name and
 colours is precisely the mix-up that having both installed is meant to prevent,
 which is why one flag drives all three rather than each being set by hand. The
 name and the colours reach the resources through `resValue`, so `app_name`,
-`brand_field` and `splash_background` are generated by the build and are
-deliberately *not* in `res/values/` — the icon vectors reference
-`@color/brand_field` rather than a literal, which is how one set of vectors
-serves both colourways. `BuildConfig.DEV_BUILD` carries the same flag into
-Kotlin, where `BrandField` picks the matching Compose colour for the splash.
+`tartan_field`, `splash_background` and `ic_launcher_background` are generated
+by the build and are deliberately *not* in `res/values/` — the icon vectors
+reference `@color/tartan_field` rather than a literal, which is how one set of
+vectors serves both colourways. `BuildConfig.DEV_BUILD` carries the same flag
+into Kotlin, where `AppSett` picks the matching Compose sett for the splash.
 
 Because they are separate apps, having both is a matter of installing both, and
 each then updates itself down its own line. Nothing in the app moves a phone
@@ -300,7 +349,7 @@ for a signature mismatch.
 ## Rules
 
 The exact rules implemented, and the options that vary them, are documented per
-game (index: [docs/README.md](docs/README.md)):
+game:
 
 - [Euchre](docs/RULES-euchre.md)
 - [Sequence](docs/RULES-sequence.md) — **note the caveat about the board layout**
@@ -348,8 +397,7 @@ game/          rules engines and AI — pure Kotlin, no Android, unit-tested
 net/           wire protocol, LAN transport, lobby, match driver
 score/         scorekeeper sheet — pure Kotlin, unit-tested — and its store
 settings/      DataStore-backed preferences
-update/        OTA updater against this repo's Gitea releases, and the
-              channel rule — pure, tested
+update/        Cloudflare Pages OTA updater, and the channel rule — pure, tested
 ui/            Compose screens
 ```
 

app/build.gradle.kts

@@ -16,18 +16,10 @@ val buildChannel = System.getenv("PLG_CHANNEL").orEmpty()
 val runNumber = (System.getenv("GITHUB_RUN_NUMBER") ?: "").toIntOrNull() ?: 0
 val stampVersion = buildChannel.isNotEmpty() && runNumber > 0
 
-// The fixed floor every stamped build number is measured from, in
-// gradle.properties. Gitea Actions restarts its run numbers at 1 for each
-// workflow, so an unstamped build (versionCode 1) and the first release of a
-// fresh instance would otherwise collide — and once a phone has installed
-// versionCode N, Android refuses anything smaller as a downgrade. Adding a
-// permanent offset is what makes "the counter never resets" true by
-// construction: it is read from one place, it never changes, and the tag,
-// versionName and versionCode all get the same number (see docs/CI.md).
+// See plgVersionRunOffset in gradle.properties: the stamped build number is the
+// CI run number plus a permanent floor, so a counter that restarts on a new CI
+// host can never produce a lower versionCode than one already installed.
 val runOffset = (project.findProperty("plgVersionRunOffset") as String?)?.toIntOrNull() ?: 0
-
-// The stamped build number: what the release tag, the versionName and the
-// versionCode are all named after.
 val buildNumber = runNumber + runOffset
 
 // The version series, from gradle.properties. Both workflows read the same
@@ -40,36 +32,31 @@ val versionSeries = (project.findProperty("plgVersionSeries") as String?) ?: "1.
 //
 // This one flag drives everything that makes a dev build a separate app rather
 // than a replacement for the production one — its own applicationId, its own
-// launcher name, and its own brand colour. They have to move together: a dev
-// package wearing the production name and colours is exactly the confusion
-// having both installed is meant to avoid.
+// launcher name, and the hunting sett in place of the clan sett. They have to
+// move together: a dev package wearing the production name and colours is
+// exactly the confusion having both installed is meant to avoid.
 val isDevBuild = buildChannel != "production"
 
 android {
-    // Deliberately left at the upstream source package: R and BuildConfig stay
-    // in org.prolibertate.games for both channels, so no source file has to
-    // care which applicationId it ended up installed as. The *installed*
-    // identity is the applicationId below — that is what the rebrand changes
-    // (WALA-118), not the JVM package names.
     namespace = "org.prolibertate.games"
     compileSdk = 34
 
     defaultConfig {
         // A dev build installs under its own package, so a dev copy and a
         // production copy can sit side by side on one device instead of one
-        // replacing the other.
-        applicationId = if (isDevBuild) "ca.wallacenet.pilgrimsofkatan.dev" else "ca.wallacenet.pilgrimsofkatan"
+        // replacing the other. The namespace above is deliberately left alone:
+        // R and BuildConfig stay in org.prolibertate.games for both, so no
+        // source has to care which package it ended up installed as.
+        applicationId = if (isDevBuild) "org.prolibertate.games.dev" else "org.prolibertate.games"
         minSdk = 24
         targetSdk = 34
         // The -dev suffix in versionName is what the installed app reads to
         // know its own channel, so it must survive into the shipped APK. It
         // tracks isDevBuild rather than the stamp alone, so an unstamped local
         // build cannot end up claiming a channel its applicationId contradicts.
-        // versionCode is the stamped build number and nothing else, so it keeps
+        // versionCode stays the run number and nothing else, so it keeps
         // climbing across a change of series: bumping 1.0 to 1.1 must not make
-        // an update look like a downgrade to Android. An unstamped build is 1,
-        // below every release, which is the honest answer for a build nobody
-        // stamped.
+        // an update look like a downgrade to Android.
         versionCode = if (stampVersion) buildNumber else 1
         versionName = when {
             stampVersion && buildChannel == "production" -> "$versionSeries.$buildNumber"
@@ -83,27 +70,23 @@ android {
         resValue(
             "string",
             "app_name",
-            if (isDevBuild) "Pilgrims of Katan DEV" else "Pilgrims of Katan",
+            if (isDevBuild) "Pro Libertate Games DEV" else "Pro Libertate Games",
         )
 
-        // The one colour that separates the two installs: slate blue on
-        // production, deep green on dev. The launcher icon and the splash are
-        // both built from it, so the drawer shows at a glance which of the two
-        // copies is which — the two have to stay in step or the icon and the
-        // splash it opens on would be different brands.
-        resValue("color", "brand_field", if (isDevBuild) "#2A6B54" else "#2B4A78")
-        // A darker shade of the same hue, held behind the window for the
-        // instant before the splash draws, so a launch never flashes the wrong
-        // colour.
-        resValue("color", "splash_background", if (isDevBuild) "#153B2F" else "#182A44")
+        // The one colour that separates the two setts: Wallace red for
+        // production, Wallace Hunting green for dev. The icon vectors reference
+        // this rather than a literal, and Tartan.kt picks the matching Compose
+        // colour off DEV_BUILD below — the two have to stay in step or the
+        // launcher icon and the splash it opens on would be different cloth.
+        resValue("color", "tartan_field", if (isDevBuild) "#1E7A3C" else "#E01B24")
+        // Shades of the same field, so a launch does not flash the wrong colour
+        // before the tartan is drawn: splash_background is held behind the
+        // window for that instant, ic_launcher_background is the icon's flat
+        // fallback.
+        resValue("color", "splash_background", if (isDevBuild) "#0D2E17" else "#4A0B10")
+        resValue("color", "ic_launcher_background", if (isDevBuild) "#145C2D" else "#B3121B")
 
         buildConfigField("boolean", "DEV_BUILD", isDevBuild.toString())
-
-        // In-app OTA updates, pointed at this project's own Gitea releases
-        // (docs/CI.md). True in this build — the channel exists. Flipping it
-        // false is the kill switch: every check then reports that and fetches
-        // nothing, with the machinery and its tests still compiled.
-        buildConfigField("boolean", "OTA_ENABLED", "true")
     }
 
     signingConfigs {
@@ -131,7 +114,7 @@ android {
 
     buildFeatures {
         compose = true
-        // For DEV_BUILD, which is how the Compose splash picks its brand colour.
+        // For DEV_BUILD, which is how the Compose tartan picks its sett.
         buildConfig = true
     }
 

app/src/main/AndroidManifest.xml

@@ -1,9 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
-    <!-- LAN play over TCP sockets, plus hand-a-down permission for in-app
-         installs — the OTA updater installs releases published on this repo's
-         Gitea; see docs/CI.md. -->
+    <!-- OTA updates from plg.wallacenet.ca, plus LAN play over TCP sockets. -->
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <!-- Network Service Discovery needs multicast to see hosts on the LAN. -->
@@ -25,7 +23,7 @@
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
-        android:theme="@style/Theme.PilgrimsOfKatan">
+        android:theme="@style/Theme.ProLibertateGames">
 
         <!-- No fixed orientation: the UI adapts to portrait, landscape and
              tablet widths. configChanges keeps Compose state across rotation

app/src/main/java/org/prolibertate/games/MainActivity.kt

@@ -12,7 +12,7 @@ import org.prolibertate.games.score.ScorekeeperRepository
 import org.prolibertate.games.settings.SettingsRepository
 import org.prolibertate.games.ui.AppEnv
 import org.prolibertate.games.ui.AppRoot
-import org.prolibertate.games.ui.theme.PilgrimsTheme
+import org.prolibertate.games.ui.theme.ProLibertateTheme
 import org.prolibertate.games.update.Updater
 import java.util.UUID
 
@@ -43,7 +43,7 @@ class MainActivity : ComponentActivity() {
         )
 
         setContent {
-            PilgrimsTheme {
+            ProLibertateTheme {
                 AppRoot(env)
             }
         }

app/src/main/java/org/prolibertate/games/net/LanTransport.kt

@@ -308,6 +308,6 @@ class LanTransport(private val context: Context) : Transport {
             }
 
         const val CONNECT_TIMEOUT_MS = 8_000
-        const val WIFI_LOCK_TAG = "PilgrimsOfKatan:lan"
+        const val WIFI_LOCK_TAG = "ProLibertateGames:lan"
     }
 }

app/src/main/java/org/prolibertate/games/net/Protocol.kt

@@ -33,7 +33,7 @@ const val PURPOSE_SCOREKEEPER = "scorekeeper"
 
 /** Service type and name advertised over mDNS. */
 const val SERVICE_TYPE = "_plgames._tcp"
-const val SERVICE_NAME = "PilgrimsOfKatan"
+const val SERVICE_NAME = "ProLibertateGames"
 
 val protocolJson: Json = Json {
     ignoreUnknownKeys = true

app/src/main/java/org/prolibertate/games/ui/LaunchUpdateCheck.kt

@@ -49,7 +49,7 @@ fun LaunchUpdateCheck(env: AppEnv, visible: Boolean) {
     }
 
     // Held back behind the splash, so an update prompt cannot appear over the
-    // splash before the app itself has.
+    // tartan before the app itself has.
     val pending = release
     if (pending == null || dismissed || !visible) return
 

app/src/main/java/org/prolibertate/games/ui/SplashScreen.kt

@@ -4,6 +4,7 @@ import androidx.compose.animation.core.animateFloatAsState
 import androidx.compose.animation.core.tween
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.BoxWithConstraints
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxSize
@@ -19,7 +20,6 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.geometry.Offset
-import androidx.compose.ui.graphics.Brush
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.Shadow
 import androidx.compose.ui.text.TextStyle
@@ -30,9 +30,8 @@ import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import kotlinx.coroutines.delay
 import org.prolibertate.games.R
-import org.prolibertate.games.ui.theme.BrandAccent
-import org.prolibertate.games.ui.theme.BrandDeep
-import org.prolibertate.games.ui.theme.BrandField
+import org.prolibertate.games.ui.theme.TartanBackground
+import org.prolibertate.games.ui.theme.threadWidthFor
 
 /** How long the splash holds at full opacity before fading. */
 private const val SPLASH_HOLD_MILLIS = 2_000L
@@ -46,11 +45,7 @@ private const val SPLASH_FADE_MILLIS = 600
 val CelticFontFamily = FontFamily(Font(R.font.uncial_antiqua))
 
 /**
- * The launch screen: the brand field under the name of the game.
- *
- * The gradient runs from the same hue as the window's `splash_background`
- * held behind it, so the first frame and the splash are one brand in two
- * shades rather than a colour change.
+ * The launch screen: Wallace tartan under the name of the house.
  *
  * Drawn as an overlay rather than a separate destination, so the menu is
  * already composed and ready behind it and the fade reveals a live screen
@@ -75,17 +70,30 @@ fun SplashScreen(
         onFinished()
     }
 
-    BoxWithConstraints(
-        modifier = modifier
-            .fillMaxSize()
-            .alpha(alpha)
-            .background(Brush.verticalGradient(listOf(BrandField, BrandDeep))),
-    ) {
+    BoxWithConstraints(modifier = modifier.fillMaxSize().alpha(alpha)) {
         // Read the constraints here and hold them in locals: inside Column the
         // implicit receiver becomes ColumnScope, and maxWidth/maxHeight are no
         // longer in scope.
         val shortestSide = minOf(maxWidth, maxHeight).value
+
+        // Weave scale is derived from the sett, not a fixed fraction, so a
+        // couple of full repeats are always on screen whatever the threadcount
+        // says and whatever the display is.
+        val threadWidth = threadWidthFor(across = shortestSide.dp, repeats = 2f)
         val titleSize = (shortestSide * 0.13f).sp
+        TartanBackground(
+            modifier = Modifier.fillMaxSize(),
+            threadWidth = threadWidth,
+            // On the bias, matching the icon.
+            rotationDegrees = 45f,
+        )
+
+        // A scrim keeps the lettering legible over the busiest part of the sett.
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(Color.Black.copy(alpha = 0.45f))
+        )
 
         Column(
             modifier = Modifier
@@ -95,7 +103,7 @@ fun SplashScreen(
             horizontalAlignment = Alignment.CenterHorizontally,
         ) {
             Text(
-                text = "Pilgrims",
+                text = "Pro Libertate",
                 style = TextStyle(
                     fontFamily = CelticFontFamily,
                     fontSize = titleSize,
@@ -109,11 +117,11 @@ fun SplashScreen(
                 ),
             )
             Text(
-                text = "of Katan",
+                text = "Games",
                 style = TextStyle(
                     fontFamily = CelticFontFamily,
                     fontSize = titleSize,
-                    color = BrandAccent,
+                    color = Color(0xFFF2C200),
                     textAlign = TextAlign.Center,
                     shadow = Shadow(
                         color = Color.Black,

app/src/main/java/org/prolibertate/games/ui/game/CardTable.kt

@@ -19,7 +19,7 @@ import androidx.compose.ui.unit.dp
 import org.prolibertate.games.ui.common.CARD_ASPECT
 import org.prolibertate.games.ui.theme.FeltGreenDark
 import org.prolibertate.games.ui.theme.Parchment
-import org.prolibertate.games.ui.theme.AccentGold
+import org.prolibertate.games.ui.theme.WallaceGold
 
 /**
  * The furniture every patience table needs.
@@ -48,7 +48,7 @@ fun TableSlot(
         modifier = modifier
             .width(width)
             .border(
-                border = BorderStroke(if (highlighted) 3.dp else 0.dp, AccentGold),
+                border = BorderStroke(if (highlighted) 3.dp else 0.dp, WallaceGold),
                 shape = RoundedCornerShape(4.dp),
             )
             .clickable { onClick() },

app/src/main/java/org/prolibertate/games/ui/game/KlondikeScreen.kt

@@ -48,7 +48,7 @@ import org.prolibertate.games.ui.common.CardBackView
 import org.prolibertate.games.ui.common.PlayingCardView
 import org.prolibertate.games.ui.theme.FeltGreenDark
 import org.prolibertate.games.ui.theme.Parchment
-import org.prolibertate.games.ui.theme.AccentGold
+import org.prolibertate.games.ui.theme.WallaceGold
 
 private const val TITLE = "Klondike"
 
@@ -311,7 +311,7 @@ private fun Slot(
         modifier = modifier
             .width(CARD_WIDTH)
             .border(
-                border = BorderStroke(if (highlighted) 3.dp else 0.dp, AccentGold),
+                border = BorderStroke(if (highlighted) 3.dp else 0.dp, WallaceGold),
                 shape = RoundedCornerShape(4.dp),
             )
             .clickable { onClick() },

app/src/main/java/org/prolibertate/games/ui/game/PegSolitaireScreen.kt

@@ -41,8 +41,8 @@ import org.prolibertate.games.net.MatchController
 import org.prolibertate.games.ui.ScreenScaffold
 import org.prolibertate.games.ui.theme.FeltGreenDark
 import org.prolibertate.games.ui.theme.Parchment
-import org.prolibertate.games.ui.theme.AccentGold
-import org.prolibertate.games.ui.theme.AccentRed
+import org.prolibertate.games.ui.theme.WallaceGold
+import org.prolibertate.games.ui.theme.WallaceRed
 
 private const val TITLE = "Peg Solitaire"
 
@@ -214,15 +214,15 @@ private fun HoleView(
     Box(modifier = modifier.size(size), contentAlignment = Alignment.Center) {
         val diameter = size * 0.72f
         val ring = when {
-            selected -> AccentGold
-            isDestination -> AccentGold
+            selected -> WallaceGold
+            isDestination -> WallaceGold
             else -> Parchment.copy(alpha = 0.35f)
         }
         Box(
             modifier = Modifier
                 .size(diameter)
                 .background(
-                    color = if (filled) AccentRed else FeltGreenDark,
+                    color = if (filled) WallaceRed else FeltGreenDark,
                     shape = CircleShape,
                 )
                 .border(

app/src/main/java/org/prolibertate/games/ui/game/YahtzeeScreen.kt

@@ -42,8 +42,8 @@ import org.prolibertate.games.game.yahtzee.scoreOf
 import org.prolibertate.games.net.MatchController
 import org.prolibertate.games.ui.ScreenScaffold
 import org.prolibertate.games.ui.theme.Parchment
-import org.prolibertate.games.ui.theme.AccentGold
-import org.prolibertate.games.ui.theme.AccentRed
+import org.prolibertate.games.ui.theme.WallaceGold
+import org.prolibertate.games.ui.theme.WallaceRed
 
 private const val TITLE = "Yahtzee"
 
@@ -183,7 +183,7 @@ private fun Die(face: Int?, held: Boolean, enabled: Boolean, onClick: () -> Unit
             .background(if (face == null) Parchment.copy(alpha = 0.3f) else Parchment, RoundedCornerShape(8.dp))
             .border(
                 width = if (held) 3.dp else 1.dp,
-                color = if (held) AccentGold else AccentRed.copy(alpha = 0.4f),
+                color = if (held) WallaceGold else WallaceRed.copy(alpha = 0.4f),
                 shape = RoundedCornerShape(8.dp),
             )
             .clickable(enabled = enabled) { onClick() },
@@ -193,7 +193,7 @@ private fun Die(face: Int?, held: Boolean, enabled: Boolean, onClick: () -> Unit
             text = face?.toString() ?: "·",
             style = MaterialTheme.typography.titleLarge,
             fontWeight = FontWeight.Bold,
-            color = AccentRed,
+            color = WallaceRed,
         )
     }
 }
@@ -263,7 +263,7 @@ private fun CardRow(
                 },
                 modifier = Modifier.weight(1f),
                 style = MaterialTheme.typography.bodySmall,
-                color = if (written == null && open) AccentRed else MaterialTheme.colorScheme.onSurface,
+                color = if (written == null && open) WallaceRed else MaterialTheme.colorScheme.onSurface,
             )
         }
     }

app/src/main/java/org/prolibertate/games/ui/theme/Tartan.kt

@@ -0,0 +1,187 @@
+package org.prolibertate.games.ui.theme
+
+import androidx.compose.foundation.Canvas
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.geometry.Size
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.drawscope.DrawScope
+import androidx.compose.ui.graphics.drawscope.rotate
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.dp
+import org.prolibertate.games.BuildConfig
+
+/** One band of a tartan sett, measured in threads. */
+data class TartanStripe(val color: Color, val threads: Int)
+
+val WallaceRed = Color(0xFFE01B24)
+val WallaceBlack = Color(0xFF0C0C0C)
+val WallaceGold = Color(0xFFF2C518)
+
+/**
+ * The green the hunting sett puts where the clan sett puts red.
+ *
+ * Must match `tartan_field` for a dev build in app/build.gradle.kts, which is
+ * what the launcher icon is woven from — otherwise the icon and the splash it
+ * opens on would be visibly different cloth.
+ */
+val WallaceHuntingGreen = Color(0xFF1E7A3C)
+
+/**
+ * Expands a half-sett into a full repeat by reflecting it.
+ *
+ * Tartans are specified as a half-sett between two pivots and woven out to
+ * both sides, so `A B C` becomes `A B C B` — the pivot stripes are not
+ * doubled. Writing the data this way keeps it in the same form a threadcount
+ * is published in, instead of a flat list that has to be kept symmetric by
+ * hand.
+ */
+fun List<TartanStripe>.pivoted(): List<TartanStripe> =
+    if (size < 3) this else this + drop(1).dropLast(1).reversed()
+
+/**
+ * The Wallace sett, from its published threadcount: **K/4 R32 K32 Y/4**.
+ *
+ * The slashes mark the pivots, so this is the half-sett and it reflects out to
+ * `K4 R32 K32 Y4 K32 R32` — 136 threads, roughly half black, half red, with a
+ * yellow line worth 3%. Two consequences that are easy to get backwards and
+ * that define the pattern:
+ *
+ *  - the yellow overstripe runs down the **centre of a wide black band**, not
+ *    between red and black;
+ *  - the narrow black guard sits **between two red blocks**, splitting the red
+ *    into pairs.
+ *
+ * The threadcount itself lives in [wallaceSett], because the hunting colourway
+ * below is the same cloth in a different colour and must not drift from it.
+ */
+val WallaceSett: List<TartanStripe> = wallaceSett(WallaceRed)
+
+/**
+ * Wallace Hunting: the same threadcount woven in green.
+ *
+ * Hunting setts are the clan cloth in muted, outdoor colours, and for Wallace
+ * that is the one substitution — green for the red — with the black ground and
+ * the yellow overstripe untouched. Deriving it from the same builder rather
+ * than writing the numbers out twice is what keeps that true: a change to the
+ * threadcount cannot land in one colourway and miss the other.
+ */
+val WallaceHuntingSett: List<TartanStripe> = wallaceSett(WallaceHuntingGreen)
+
+/** The Wallace threadcount woven with [field] in place of the red. */
+private fun wallaceSett(field: Color): List<TartanStripe> = listOf(
+    TartanStripe(WallaceBlack, 4),
+    TartanStripe(field, 32),
+    TartanStripe(WallaceBlack, 32),
+    TartanStripe(WallaceGold, 4),
+).pivoted()
+
+/**
+ * The cloth this build wears: the clan sett on production, the hunting sett on
+ * dev.
+ *
+ * A dev build installs as its own app beside the production one, so it has to
+ * be recognisable at a glance in the app drawer and on the splash — the green
+ * says which of the two copies just opened without anything having to be read.
+ */
+val AppSett: List<TartanStripe> =
+    if (BuildConfig.DEV_BUILD) WallaceHuntingSett else WallaceSett
+
+/** Threads in one full repeat of a sett. */
+val List<TartanStripe>.threadsPerRepeat: Int get() = sumOf { it.threads }
+
+/**
+ * The thread width that fits [repeats] repeats of [sett] across [across].
+ *
+ * Scale has to be derived from the sett rather than fixed, because changing a
+ * threadcount changes how many threads a repeat contains — a fixed width and a
+ * larger sett silently zooms in until the cloth is a couple of enormous blocks
+ * and stops reading as tartan at all.
+ */
+fun threadWidthFor(
+    sett: List<TartanStripe> = AppSett,
+    across: Dp,
+    repeats: Float = 2f,
+): Dp = across / (sett.threadsPerRepeat * repeats)
+
+/**
+ * Draws a tartan by laying the sett down vertically as warp, then across as
+ * weft at half opacity. The overlap is what produces the blended squares and
+ * the sense of a woven cloth rather than a printed grid — red warp under black
+ * weft comes out a darker red, exactly as it does on the loom.
+ *
+ * [rotationDegrees] turns the cloth on the bias. The stripes are drawn well
+ * past the edges of the canvas so the corners stay covered once it is turned.
+ */
+fun DrawScope.drawTartan(
+    sett: List<TartanStripe> = AppSett,
+    threadSize: Float,
+    rotationDegrees: Float = 0f,
+) {
+    if (sett.isEmpty() || threadSize <= 0f) return
+    val repeat = sett.sumOf { it.threads } * threadSize
+    if (repeat <= 0f) return
+
+    // Turning a square by 45 degrees needs about 0.21 of its size spare on
+    // every edge; three quarters is generous enough for any angle.
+    val pad = if (rotationDegrees == 0f) 0f else size.maxDimension * 0.75f
+    val left = -pad
+    val top = -pad
+    val right = size.width + pad
+    val bottom = size.height + pad
+
+    rotate(degrees = rotationDegrees) {
+        // Warp: full-height bands.
+        var x = left - (left.mod(repeat))
+        while (x < right) {
+            var offset = x
+            for (stripe in sett) {
+                val width = stripe.threads * threadSize
+                drawRect(
+                    color = stripe.color,
+                    topLeft = Offset(offset, top),
+                    size = Size(width, bottom - top),
+                )
+                offset += width
+            }
+            x += repeat
+        }
+
+        // Weft: full-width bands, half opacity so the warp shows through.
+        var y = top - (top.mod(repeat))
+        while (y < bottom) {
+            var offset = y
+            for (stripe in sett) {
+                val height = stripe.threads * threadSize
+                drawRect(
+                    color = stripe.color.copy(alpha = 0.5f),
+                    topLeft = Offset(left, offset),
+                    size = Size(right - left, height),
+                )
+                offset += height
+            }
+            y += repeat
+        }
+    }
+}
+
+/**
+ * A tartan fill. [threadWidth] sets the weave scale, so the same cloth can be
+ * a fine weave on a phone and a coarse one on a tablet without redrawing it.
+ */
+@Composable
+fun TartanBackground(
+    modifier: Modifier = Modifier,
+    sett: List<TartanStripe> = AppSett,
+    threadWidth: Dp = 2.dp,
+    rotationDegrees: Float = 0f,
+) {
+    Canvas(modifier = modifier) {
+        drawTartan(
+            sett = sett,
+            threadSize = threadWidth.toPx(),
+            rotationDegrees = rotationDegrees,
+        )
+    }
+}

app/src/main/java/org/prolibertate/games/ui/theme/Theme.kt

@@ -6,7 +6,6 @@ import androidx.compose.material3.darkColorScheme
 import androidx.compose.material3.lightColorScheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.graphics.Color
-import org.prolibertate.games.BuildConfig
 
 /** Card-table green, which the board and table surfaces are drawn on. */
 val FeltGreen = Color(0xFF1B5E20)
@@ -15,31 +14,6 @@ val Parchment = Color(0xFFF4EFE4)
 val CardRed = Color(0xFFB3261E)
 val CardBlack = Color(0xFF1C1B1F)
 
-/**
- * The brand palette for Pilgrims of Katan — original and neutral, shared by
- * every game in the catalogue. Slate blue on production, deep green on dev, so
- * the two installs are told apart at a glance; both must stay in step with the
- * resValues in app/build.gradle.kts or the icon and the splash it opens on
- * would be different brands.
- *
- * The upstream shipped a clan tartan here. This project carries no clan or
- * third-party trade dress (WALA-118).
- */
-val BrandField: Color = if (BuildConfig.DEV_BUILD) Color(0xFF2A6B54) else Color(0xFF2B4A78)
-val BrandDeep: Color = if (BuildConfig.DEV_BUILD) Color(0xFF153B2F) else Color(0xFF182A44)
-
-/** The parchment accent: the emblem on the icon, the second line of the splash. */
-val BrandAccent: Color = Color(0xFFEFD9A4)
-
-/**
- * Accents used *inside* a game table — a highlight, a held die, a danger mark.
- * Deliberately channel-free: what a game shows must not change with which
- * install it is running in. Values unchanged from the upstream, so the games
- * themselves look exactly as they did.
- */
-val AccentRed = Color(0xFFE01B24)
-val AccentGold = Color(0xFFF2C518)
-
 val TeamColours: List<Color> = listOf(
     Color(0xFF1565C0), // blue
     Color(0xFFC62828), // red
@@ -65,7 +39,7 @@ private val LightColours = lightColorScheme(
 )
 
 @Composable
-fun PilgrimsTheme(
+fun ProLibertateTheme(
     darkTheme: Boolean = isSystemInDarkTheme(),
     content: @Composable () -> Unit,
 ) {

app/src/main/java/org/prolibertate/games/update/UpdatePolicy.kt

@@ -1,19 +1,17 @@
 package org.prolibertate.games.update
 
-import java.net.URI
-
 /**
  * Which line of builds an APK belongs to.
  *
  * This is a property of the build, never a preference. The two channels are
  * published by different workflows and have entirely separate version
- * sequences — a dev build's versionCode is its CI build number, a production
- * build's is its release build number, and the two are unrelated. There is no
+ * sequences — a dev build's versionCode is its CI run number, a production
+ * build's is its release run number, and the two are unrelated. There is no
  * meaning to be had from comparing across them, so nothing does.
  *
  * They also carry different applicationIds — a dev build installs as
- * `…pilgrimsofkatan.dev` — so both can sit on one device, each updating
- * itself down its own line and leaving the other alone.
+ * `…games.dev` — so both can sit on one device, each updating itself down its
+ * own line and leaving the other alone.
  */
 enum class UpdateChannel(val label: String, val blurb: String) {
     PRODUCTION("Production", "Stable builds released from main"),
@@ -23,7 +21,7 @@ enum class UpdateChannel(val label: String, val blurb: String) {
 /** Marks a tag or a version name as belonging to the dev channel. */
 const val DEV_SUFFIX = "-dev"
 
-/** One published build, as read off a repository release. */
+/** One published build, as read off a channel's `latest.json`. */
 data class Release(
     val tag: String,
     val versionCode: Int,
@@ -51,14 +49,14 @@ fun channelOfVersionName(versionName: String): UpdateChannel =
  * The channel a release belongs to.
  *
  * Two independent marks, and either is enough: the `-dev` suffix the workflow
- * puts on the tag, and the release's own prerelease flag. A release would have
- * to lose both to be mistaken for the other channel.
+ * puts on the tag, and GitHub's own prerelease flag. A release would have to
+ * lose both to be mistaken for the other channel.
  */
 fun channelOfTag(tag: String, prerelease: Boolean): UpdateChannel =
     if (tag.endsWith(DEV_SUFFIX) || prerelease) UpdateChannel.DEV else UpdateChannel.PRODUCTION
 
 /**
- * The build number out of a `v<series>.<n>` tag, which is what an APK's
+ * The run number out of a `v<series>.<n>` tag, which is what an APK's
  * versionCode is.
  *
  * Only the trailing number is read. The series is a name for people, and
@@ -67,37 +65,15 @@ fun channelOfTag(tag: String, prerelease: Boolean): UpdateChannel =
 fun versionCodeOfTag(tag: String): Int? =
     tag.substringAfterLast('.').removeSuffix(DEV_SUFFIX).toIntOrNull()
 
-/**
- * Rewrites a download URL onto [host], keeping its scheme, path and query.
- *
- * A release server can answer for more than one host name, and it hands out
- * asset URLs on whichever one it treats as canonical — which need not be the
- * one the app was told to talk to. Fetching the release list from one host and
- * the APK from another is a single DNS change away from a channel that half
- * works, so the app stays on the host it decided to trust and takes only the
- * path from what the server reported.
- *
- * Anything that cannot be parsed is returned unchanged: a broken URL fails
- * loudly at download time, while a swallowed one would fail as a silent
- * "something went wrong".
- */
-fun onReportedHost(url: String, host: String): String = try {
-    val reported = URI(url)
-    val scheme = reported.scheme ?: "https"
-    URI(scheme, null, host, -1, reported.path, reported.query, null).toString()
-} catch (e: Exception) {
-    url
-}
-
 /**
  * The build a check on launch should interrupt somebody for, or null to say
  * nothing at all.
  *
  * Only an actual update is worth a word. Opening the app is not asking a
- * question, so a check that finds nothing — or that cannot reach the release
- * server at all — stays quiet; a phone on a train would otherwise be told off
- * for it every single launch. The button in Settings *is* asking a question, and
- * reports every answer including those two.
+ * question, so a check that finds nothing — or that cannot reach the update server at all
+ * — stays quiet; a phone on a train would otherwise be told off for it every
+ * single launch. The button in Settings *is* asking a question, and reports
+ * every answer including those two.
  */
 fun launchOffer(verdict: UpdateVerdict): Release? =
     (verdict as? UpdateVerdict.Install)?.release

app/src/main/java/org/prolibertate/games/update/Updater.kt

@@ -8,36 +8,17 @@ import android.provider.Settings
 import androidx.core.content.FileProvider
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
-import org.json.JSONArray
 import org.json.JSONObject
-import org.prolibertate.games.BuildConfig
 import java.io.File
 import java.net.HttpURLConnection
 import java.net.URL
 
 /**
- * Over-the-air updates from the repository's releases.
+ * Over-the-air updates from plg.wallacenet.ca (Cloudflare Pages).
  *
- * The channel is the Gitea instance this app ships from
- * (`git.wallacenet.ca`), not GitHub. Gitea's release API answers with the
- * same shape the updater reads — `tag_name`, `prerelease`, `draft`, and
- * assets carrying `browser_download_url` — so this is the same code the
- * upstream ran, pointed at `/api/v1/repos/...` routes instead of
- * `api.github.com`, with `limit` where GitHub says `per_page`.
- *
- * Release tags are v<series>.<n>, where **n is the stamped build number the
- * APK's versionCode was built from** (the CI run number plus the fixed
- * `plgVersionRunOffset` — see docs/CI.md), so comparing the two is enough to
- * tell whether a newer build exists.
- *
- * The repository and its releases are public: no token is embedded in the
- * app, and every download is anonymous by design. If the repo were ever made
- * private, every check would simply start failing rather than leaking
- * anything.
- *
- * `BuildConfig.OTA_ENABLED` is a kill switch, not a channel decision — it is
- * true in this build; setting it false makes every check report that and
- * fetch nothing.
+ * Release tags are v<series>.<run-number> and the APK's versionCode is that same run
+ * number, so comparing the two is enough to tell whether a newer build exists.
+ * Everything there is public — no token is embedded in the app.
  *
  * There is nothing to choose here. The channel comes from the running APK, so
  * a dev install looks only at dev builds and a production install only at
@@ -52,11 +33,6 @@ class Updater(private val activity: Activity) {
      * this phone is on, and the phone already knows.
      */
     suspend fun check(): UpdateVerdict = withContext(Dispatchers.IO) {
-        if (!BuildConfig.OTA_ENABLED) {
-            return@withContext UpdateVerdict.Refused(
-                "In-app updates are not enabled for this build yet."
-            )
-        }
         try {
             val channel = installedChannel()
             verdictFor(
@@ -70,70 +46,37 @@ class Updater(private val activity: Activity) {
     }
 
     /**
-     * Production reads the "latest release", which by definition skips
-     * prereleases — Gitea implements it as the most recent non-prerelease,
-     * non-draft release, so the rule holds on this instance too.
-     *
-     * Dev walks the release list for the newest prerelease, which is what the
-     * CI pipeline publishes from the dev branch. The list is taken as the
-     * highest versionCode among the dev releases rather than the first one
-     * returned, so the answer does not depend on how the server chose to
-     * order the page.
+     * Each channel publishes a `latest.json` next to its APK on Cloudflare
+     * Pages: `/prod/latest.json` and `/dev/latest.json`. The two live in one
+     * site but separate paths, so a build can only ever look down its own line.
      */
-    private fun fetchLatestRelease(channel: UpdateChannel): Release? = when (channel) {
-        UpdateChannel.PRODUCTION ->
-            getJsonObject("$API/releases/latest")
-                ?.let { toRelease(it) }
-
-        UpdateChannel.DEV ->
-            getJsonArray("$API/releases?limit=30")
-                ?.let { releases ->
-                    (0 until releases.length())
-                        .mapNotNull { toRelease(releases.getJSONObject(it)) }
-                        .filter { it.channel == UpdateChannel.DEV }
-                        .maxByOrNull { it.versionCode }
-                }
+    private fun fetchLatestRelease(channel: UpdateChannel): Release? {
+        val path = if (channel == UpdateChannel.DEV) "dev" else "prod"
+        return getJsonObject("$BASE_URL/$path/latest.json")?.let { toRelease(it) }
     }
 
     private fun toRelease(json: JSONObject): Release? {
-        val tag = json.optString("tag_name").ifBlank { return null }
+        val tag = json.optString("tag").ifBlank { return null }
         val versionCode = versionCodeOfTag(tag) ?: return null
-        val channel = channelOfTag(tag, json.optBoolean("prerelease"))
-
-        val assets = json.optJSONArray("assets") ?: return null
-        val apks = (0 until assets.length())
-            .map { assets.getJSONObject(it) }
-            .filter { it.optString("name").endsWith(".apk") }
-
-        // A production release may carry the same build twice: once named for
-        // its version, and once under a fixed name so a permanent download link
-        // exists. Pick the versioned one explicitly rather than whichever was
-        // uploaded first, so what gets installed is traceable to its tag.
-        val chosen = apks.firstOrNull { it.optString("name").contains(tag) }
-            ?: apks.firstOrNull()
-            ?: return null
-
+        val apkUrl = json.optString("apkUrl").ifBlank { return null }
         return Release(
             tag = tag,
             versionCode = versionCode,
-            apkUrl = onReportedHost(chosen.getString("browser_download_url"), SERVER_HOST),
-            apkName = chosen.optString("name"),
-            channel = channel,
+            apkUrl = apkUrl,
+            apkName = json.optString("apkName"),
+            channel = channelOfTag(tag, prerelease = false),
         )
     }
 
-    private fun openConnection(url: String): HttpURLConnection =
-        (URL(url).openConnection() as HttpURLConnection).apply {
+    private fun getJsonObject(url: String): JSONObject? {
+        val connection = (URL(url).openConnection() as HttpURLConnection).apply {
             requestMethod = "GET"
-            setRequestProperty("Accept", "application/json")
-            setRequestProperty("User-Agent", "PilgrimsOfKatan-Updater")
+            setRequestProperty("User-Agent", "ProLibertateGames-Updater")
             connectTimeout = 15_000
             readTimeout = 15_000
         }
-
-    private fun getJsonObject(url: String): JSONObject? {
-        val connection = openConnection(url)
         try {
+            // 404 means the channel has nothing published yet.
             if (connection.responseCode != 200) return null
             return JSONObject(connection.inputStream.bufferedReader().use { it.readText() })
         } finally {
@@ -141,16 +84,6 @@ class Updater(private val activity: Activity) {
         }
     }
 
-    private fun getJsonArray(url: String): JSONArray? {
-        val connection = openConnection(url)
-        try {
-            if (connection.responseCode != 200) return null
-            return JSONArray(connection.inputStream.bufferedReader().use { it.readText() })
-        } finally {
-            connection.disconnect()
-        }
-    }
-
     /** Read back from the installed APK's own version name. */
     fun installedChannel(): UpdateChannel = channelOfVersionName(installedVersionName())
 
@@ -202,13 +135,6 @@ class Updater(private val activity: Activity) {
         activity.packageManager.getPackageInfo(activity.packageName, 0).versionName ?: "unknown"
 
     private companion object {
-        /** The Gitea instance that publishes this app's releases. */
-        const val SERVER = "https://git.wallacenet.ca"
-        const val SERVER_HOST = "git.wallacenet.ca"
-        const val OWNER = "devadmin"
-        const val REPO = "PilgrimsOfKatan"
-
-        /** Release routes, Gitea's `/api/v1` spelling of GitHub's API. */
-        const val API = "$SERVER/api/v1/repos/$OWNER/$REPO"
+        const val BASE_URL = "https://plg.wallacenet.ca"
     }
 }

app/src/main/res/drawable/ic_launcher_background.xml

@@ -1,16 +1,70 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  The flat field behind the launcher emblem: brand_field, slate blue on
-  production and deep green on dev, generated by the build (see resValue in
-  app/build.gradle.kts) so the two installs are told apart in the app drawer
-  by the icon alone.
+  A single square of the Wallace tartan, set on the bias.
+
+  Generated from the published threadcount K/4 R32 K32 Y/4 — the same numbers
+  as WallaceSett in Tartan.kt. The slashes are pivots, so the half-sett
+  reflects out to K4 R32 K32 Y4 K32 R32: the yellow overstripe runs down the
+  centre of a wide black band, and the narrow black guard splits the red into
+  pairs.
+
+  The stripes reference @color/tartan_field rather than a literal, because the
+  same threadcount is woven in two colourways: Wallace red on a production
+  build, Wallace Hunting green on a dev one, so the two installs are told apart
+  in the app drawer by the icon alone. The build generates that colour; see
+  resValue in app/build.gradle.kts.
+
+  Warp is opaque, weft laid over it at half opacity, which is what gives the
+  blended squares rather than a flat grid. Paths run well past the viewport
+  because the group is rotated 45 degrees; the overspill keeps the corners
+  covered. One full repeat fills the adaptive icon's safe zone.
 -->
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="108dp"
     android:height="108dp"
     android:viewportWidth="108"
     android:viewportHeight="108">
-    <path
-        android:fillColor="@color/brand_field"
-        android:pathData="M0,0h108v108h-108z" />
+    <group
+        android:rotation="45"
+        android:pivotX="54.0"
+        android:pivotY="54.0">
+        <path android:fillColor="@color/tartan_ground" android:pathData="M-90.00,-90.00h288.00v288.00h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-88.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-69.88,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M-36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-16.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M2.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M55.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M74.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M108.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M127.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M146.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M180.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-105.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-88.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-69.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-52.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,-36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-33.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-16.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,0.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,2.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,19.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,38.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,55.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,74.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,91.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,108.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,110.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,127.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,144.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,146.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,163.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,180.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,182.12h288.00v16.94h-288.00z" />
+    </group>
 </vector>

app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -1,23 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  The brand emblem: a hexagonal ring around a solid hexagonal core, in
-  parchment on the brand field behind it (see ic_launcher_background).
-
-  The hexagon is a game tile, not any game's mark — deliberately generic
-  branding for Pilgrims of Katan, carrying no third-party logo or trade dress.
-  Everything sits inside the adaptive icon's safe zone (a centred 66dp circle
-  on this 108dp canvas) so no launcher mask can clip it.
+  Deliberately empty. The icon is the cloth itself, so the adaptive icon's
+  foreground layer carries nothing — anything drawn here would sit on top of the
+  tartan and break the "single square of tartan" idea.
 -->
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="108dp"
     android:height="108dp"
     android:viewportWidth="108"
     android:viewportHeight="108">
-    <!-- Ring and core in one even-odd path: outer hexagon, inner hexagon,
-         core hexagon — odd coverage fills, so the ring and the core are drawn
-         and the gap between them stays open to the field showing through. -->
     <path
-        android:fillColor="@color/brand_accent"
-        android:fillType="evenOdd"
-        android:pathData="M84,54 L69,79.98 L39,79.98 L24,54 L39,28.02 L69,28.02 Z M72,54 L63,69.59 L45,69.59 L36,54 L45,38.41 L63,38.41 Z M63,54 L58.5,61.79 L49.5,61.79 L45,54 L49.5,46.21 L58.5,46.21 Z" />
+        android:fillColor="#00000000"
+        android:pathData="M0,0h108v108h-108z" />
 </vector>

app/src/main/res/mipmap/ic_launcher.xml

@@ -1,22 +1,70 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  The legacy (pre-API 26) launcher icon: the same brand emblem as the adaptive
-  icon's foreground, over the same brand field, in the one layer those
-  launchers get.
+  A single square of the Wallace tartan, set on the bias.
 
-  Field first, emblem second: two paths, because the emblem's ring relies on
-  even-odd parity and a filled background inside the same path would flip it.
+  Generated from the published threadcount K/4 R32 K32 Y/4 — the same numbers
+  as WallaceSett in Tartan.kt. The slashes are pivots, so the half-sett
+  reflects out to K4 R32 K32 Y4 K32 R32: the yellow overstripe runs down the
+  centre of a wide black band, and the narrow black guard splits the red into
+  pairs.
+
+  The stripes reference @color/tartan_field rather than a literal, because the
+  same threadcount is woven in two colourways: Wallace red on a production
+  build, Wallace Hunting green on a dev one, so the two installs are told apart
+  in the app drawer by the icon alone. The build generates that colour; see
+  resValue in app/build.gradle.kts.
+
+  Warp is opaque, weft laid over it at half opacity, which is what gives the
+  blended squares rather than a flat grid. Paths run well past the viewport
+  because the group is rotated 45 degrees; the overspill keeps the corners
+  covered. One full repeat fills the adaptive icon's safe zone.
 -->
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="48dp"
     android:height="48dp"
     android:viewportWidth="108"
     android:viewportHeight="108">
-    <path
-        android:fillColor="@color/brand_field"
-        android:pathData="M0,0h108v108h-108z" />
-    <path
-        android:fillColor="@color/brand_accent"
-        android:fillType="evenOdd"
-        android:pathData="M84,54 L69,79.98 L39,79.98 L24,54 L39,28.02 L69,28.02 Z M72,54 L63,69.59 L45,69.59 L36,54 L45,38.41 L63,38.41 Z M63,54 L58.5,61.79 L49.5,61.79 L45,54 L49.5,46.21 L58.5,46.21 Z" />
+    <group
+        android:rotation="45"
+        android:pivotX="54.0"
+        android:pivotY="54.0">
+        <path android:fillColor="@color/tartan_ground" android:pathData="M-90.00,-90.00h288.00v288.00h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-88.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-69.88,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M-36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-16.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M2.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M55.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M74.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M108.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M127.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M146.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M180.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-105.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-88.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-69.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-52.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,-36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-33.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-16.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,0.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,2.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,19.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,38.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,55.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,74.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,91.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,108.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,110.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,127.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,144.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,146.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,163.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,180.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,182.12h288.00v16.94h-288.00z" />
+    </group>
 </vector>

app/src/main/res/mipmap/ic_launcher_round.xml

@@ -1,22 +1,70 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  The legacy (pre-API 26) launcher icon: the same brand emblem as the adaptive
-  icon's foreground, over the same brand field, in the one layer those
-  launchers get.
+  A single square of the Wallace tartan, set on the bias.
 
-  Field first, emblem second: two paths, because the emblem's ring relies on
-  even-odd parity and a filled background inside the same path would flip it.
+  Generated from the published threadcount K/4 R32 K32 Y/4 — the same numbers
+  as WallaceSett in Tartan.kt. The slashes are pivots, so the half-sett
+  reflects out to K4 R32 K32 Y4 K32 R32: the yellow overstripe runs down the
+  centre of a wide black band, and the narrow black guard splits the red into
+  pairs.
+
+  The stripes reference @color/tartan_field rather than a literal, because the
+  same threadcount is woven in two colourways: Wallace red on a production
+  build, Wallace Hunting green on a dev one, so the two installs are told apart
+  in the app drawer by the icon alone. The build generates that colour; see
+  resValue in app/build.gradle.kts.
+
+  Warp is opaque, weft laid over it at half opacity, which is what gives the
+  blended squares rather than a flat grid. Paths run well past the viewport
+  because the group is rotated 45 degrees; the overspill keeps the corners
+  covered. One full repeat fills the adaptive icon's safe zone.
 -->
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="48dp"
     android:height="48dp"
     android:viewportWidth="108"
     android:viewportHeight="108">
-    <path
-        android:fillColor="@color/brand_field"
-        android:pathData="M0,0h108v108h-108z" />
-    <path
-        android:fillColor="@color/brand_accent"
-        android:fillType="evenOdd"
-        android:pathData="M84,54 L69,79.98 L39,79.98 L24,54 L39,28.02 L69,28.02 Z M72,54 L63,69.59 L45,69.59 L36,54 L45,38.41 L63,38.41 Z M63,54 L58.5,61.79 L49.5,61.79 L45,54 L49.5,46.21 L58.5,46.21 Z" />
+    <group
+        android:rotation="45"
+        android:pivotX="54.0"
+        android:pivotY="54.0">
+        <path android:fillColor="@color/tartan_ground" android:pathData="M-90.00,-90.00h288.00v288.00h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-88.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-69.88,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M-36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M-16.94,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M2.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M36.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M55.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M74.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M108.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M127.06,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_field" android:pathData="M146.12,-90.00h16.94v288.00h-16.94z" />
+        <path android:fillColor="@color/tartan_over" android:pathData="M180.00,-90.00h2.12v288.00h-2.12z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-105.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-88.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-69.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-52.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,-36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,-33.88h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,-16.94h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,0.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,2.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,19.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,36.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,38.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,55.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,72.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,74.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,91.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,108.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,110.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,127.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,144.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_field" android:fillAlpha="0.5" android:pathData="M-90.00,146.12h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,163.06h288.00v16.94h-288.00z" />
+        <path android:fillColor="@color/tartan_over" android:fillAlpha="0.5" android:pathData="M-90.00,180.00h288.00v2.12h-288.00z" />
+        <path android:fillColor="@color/tartan_ground" android:fillAlpha="0.5" android:pathData="M-90.00,182.12h288.00v16.94h-288.00z" />
+    </group>
 </vector>

app/src/main/res/values/colors.xml

@@ -1,16 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  The colours the brand shares between channels. The two that differ —
-  brand_field (slate blue on production, deep green on dev) and its darker
-  shade splash_background — are generated by the build. See resValue in
-  app/build.gradle.kts.
+  The colours the sett shares between channels. The one that differs —
+  tartan_field, red on production and hunting green on dev — is generated by the
+  build, along with splash_background and ic_launcher_background, which are
+  shades of it. See resValue in app/build.gradle.kts.
 -->
 <resources>
     <color name="black">#FF000000</color>
     <color name="white">#FFFFFFFF</color>
 
-    <!-- The parchment accent drawn on the brand field: the emblem on the
-         launcher icon and the second line of the splash. Same number as the
-         accent in Theme.kt. -->
-    <color name="brand_accent">#EFD9A4</color>
+    <!-- The ground the sett is woven on, and the overstripe down its centre.
+         Same numbers as WallaceBlack and WallaceGold in Tartan.kt. -->
+    <color name="tartan_ground">#0C0C0C</color>
+    <color name="tartan_over">#F2C518</color>
 </resources>

app/src/main/res/values/strings.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   app_name is generated by the build rather than declared here, because it
-  differs by channel: a dev build installs as "Pilgrims of Katan DEV"
+  differs by channel: a dev build installs as "Pro Libertate Games DEV"
   alongside the production copy. See resValue in app/build.gradle.kts.
 -->
 <resources>

app/src/main/res/values/themes.xml

@@ -2,7 +2,7 @@
 <resources>
     <!-- Compose supplies the real theme; this only needs to be a Material 3
          base with no action bar so the app draws its own top bars. -->
-    <style name="Theme.PilgrimsOfKatan" parent="android:Theme.Material.NoActionBar">
+    <style name="Theme.ProLibertateGames" parent="android:Theme.Material.NoActionBar">
         <item name="android:windowNoTitle">true</item>
         <item name="android:windowContentOverlay">@null</item>
         <item name="android:windowBackground">@color/splash_background</item>

app/src/test/java/org/prolibertate/games/net/ScorekeeperSessionTest.kt

@@ -164,6 +164,9 @@ class ScorekeeperSessionTest {
 
         await("the guest to be let in") { guest.state.value.connected }
         assertFalse(guest.state.value.awaiting)
+        // The sheet follows the connection over the socket, so on a slow runner
+        // it can still be in flight when `connected` flips: wait for it.
+        await("the guest to receive the sheet") { guest.state.value.sheet == host.state.sheet }
         assertEquals(host.state.sheet, guest.state.value.sheet)
         assertTrue(guest.state.value.sheet.started)
         assertTrue(host.state.requests.isEmpty())

app/src/test/java/org/prolibertate/games/update/UpdatePolicyTest.kt

@@ -22,7 +22,7 @@ class UpdatePolicyTest {
         tag = tag,
         versionCode = versionCode,
         apkUrl = "https://example.invalid/$tag.apk",
-        apkName = "PilgrimsOfKatan-$tag.apk",
+        apkName = "ProLibertateGames-$tag.apk",
         channel = channel,
     )
 
@@ -53,28 +53,6 @@ class UpdatePolicyTest {
         assertNull(versionCodeOfTag("nightly"))
     }
 
-    // -- Where the download happens ----------------------------------------
-
-    @Test
-    fun `a release asset is fetched from this app's host, keeping its path`() {
-        // The instance reports its canonical host; the app was told to trust
-        // another. Same bytes, one host, whatever the server names itself.
-        assertEquals(
-            "https://git.wallacenet.ca/devadmin/PilgrimsOfKatan/releases/download/" +
-                "v1.4.1001-dev/PilgrimsOfKatan-v1.4.1001-dev.apk",
-            onReportedHost(
-                "https://git.saskvalleytech.com/devadmin/PilgrimsOfKatan/releases/download/" +
-                    "v1.4.1001-dev/PilgrimsOfKatan-v1.4.1001-dev.apk",
-                "git.wallacenet.ca",
-            ),
-        )
-        // A URL that already says the right host is left exactly as it is.
-        val already = "https://git.wallacenet.ca/devadmin/PilgrimsOfKatan/releases/download/v1.4.1/a.apk"
-        assertEquals(already, onReportedHost(already, "git.wallacenet.ca"))
-        // Anything unparseable survives untouched rather than being dropped.
-        assertEquals("not a url", onReportedHost("not a url", "git.wallacenet.ca"))
-    }
-
     // -- The wall -----------------------------------------------------------
 
     @Test
@@ -151,7 +129,7 @@ class UpdatePolicyTest {
         assertNull("an up-to-date app has no business interrupting", launchOffer(UpdateVerdict.UpToDate))
         assertNull(
             "a phone with no network has nothing to apologise for",
-            launchOffer(UpdateVerdict.Refused("Unable to resolve host git.wallacenet.ca")),
+            launchOffer(UpdateVerdict.Refused("Unable to resolve host api.github.com")),
         )
         // Including the refusal that this whole change exists to produce: being
         // shown the other channel's build is not a thing to be told about.

docs/CI.md

@@ -1,136 +0,0 @@
-# CI, releases, and OTA — decisions and how to build
-
-Status as of the Pilgrims of Katan bootstrap (WALA-118).
-
-## Decisions
-
-1. **The release channel is this instance's own releases.** The app ships from
-   <https://git.wallacenet.ca/devadmin/PilgrimsOfKatan>, and the in-app updater
-   reads that repo's releases over Gitea's REST API. GitHub is not a channel for
-   this project; the only GitHub URLs left are the `upstream` remote and the
-   attribution link in the README.
-
-   The repo is **public on purpose**: the updater downloads anonymously, with no
-   token embedded in the APK. A private repo would make every check fail
-   (the API answers 404 to anonymous callers), not leak anything — but it would
-   also stop updates dead.
-
-2. **CI lives in Actions-compatible workflows in `.github/workflows/`.**
-   Gitea Actions runs workflows from `.github/workflows/` (or `.gitea/workflows/`),
-   so these files serve both a GitHub-style runner and the Gitea instance.
-   Publishing goes through `scripts/publish-release.sh` — Gitea's REST API, the
-   same routes the app's updater reads — rather than the `gh` CLI, which a runner
-   image need not carry.
-
-   | Workflow | Trigger | Publishes |
-   | --- | --- | --- |
-   | `ci.yml` | push to `dev`, PRs into `dev`/`main`, manual | dev prerelease, from `dev` only |
-   | `release.yml` | push to `main`, manual | production release, from `main` only |
-
-   Pull requests build and check but never publish. Prereleases are marked so
-   the "latest release" endpoint — which skips them — can never hand a dev build
-   to a production install.
-
-3. **A runner has to be registered before any of that executes.** As of the
-   bootstrap the instance has **no Actions runner**, so the workflows are
-   correct but idle: a Gitea runner (Docker or host) must be registered against
-   the instance and able to resolve `actions/checkout`,
-   `actions/setup-java`, `android-actions/setup-android` and
-   `actions/upload-artifact`. Until then the manual build below and the manual
-   publish script are the working paths.
-
-4. **The local build is the guaranteed path.** Workflows need a runner that may
-   not exist yet; `./gradlew assembleDebug` + `./gradlew testDebugUnitTest`
-   work on any machine with JDK 17 and the Android SDK (compileSdk 34), and CI's
-   green means exactly these two commands plus lint.
-
-## Build numbers, tags, and why updates never downgrade
-
-An APK is **`<series>.<build number>`**, the release tag is **`v<series>.<build
-number>`**, and the build number is what Android sees as `versionCode`:
-
-```
-build number = CI run number + plgVersionRunOffset      (gradle.properties)
-```
-
-- `plgVersionSeries` (currently `1.4`) is the human-facing series, set by hand
-  in `gradle.properties`.
-- `plgVersionRunOffset` (currently `1000`) is a **permanent floor**, also set by
-  hand in `gradle.properties`, set once at bootstrap and never changed.
-
-Why the offset exists: Gitea Actions restarts run numbers at 1 for each
-workflow, so without it the first release of a fresh instance would be build
-`1` — the number an unstamped local build already carries — and any reset of
-the counter would hand Android a *lower* `versionCode`, which it refuses as a
-downgrade. With the offset, every stamped build starts at 1001 and only ever
-climbs, because the run number is monotonic and the offset never moves. The
-gradle build and both workflows read the same two properties, so the tag and
-the APK inside it cannot name different versions.
-
-The series is a name for people: bumping it changes nothing about ordering,
-because `versionCode` never includes the series.
-
-Unstamped builds (local, or a PR build) are `versionCode 1`, below every
-release — the honest answer for a build nobody stamped.
-
-## Manual build (works today, no runner needed)
-
-```sh
-# JDK 17, Android SDK with platform 34 + build-tools 34
-export JAVA_HOME=...        # a JDK 17 install
-export ANDROID_HOME=...     # SDK root (or set sdk.dir in local.properties)
-
-./gradlew assembleDebug          # dev-channel app (default: ca.wallacenet.pilgrimsofkatan.dev)
-PLG_CHANNEL=production ./gradlew assembleDebug   # production app (ca.wallacenet.pilgrimsofkatan)
-./gradlew testDebugUnitTest      # JVM unit tests
-./gradlew lintDebug              # Android lint (CI runs this too)
-```
-
-The two variants install side by side: different applicationId, different
-launcher name (`Pilgrims of Katan DEV` vs `Pilgrims of Katan`), different brand
-colour.
-
-## Manual release (works today, no runner needed)
-
-```sh
-GITEA_TOKEN=… ./scripts/publish-release.sh v1.4.1001 app/build/outputs/apk/debug/app-debug.apk release "$(git rev-parse HEAD)"
-```
-
-The script takes `<tag> <apk> <prerelease|release> [target-sha]`, creates the
-release through `POST /api/v1/repos/{owner}/{repo}/releases`, and attaches the
-APK through `POST …/releases/{id}/assets` — which is the upload route Gitea's
-Swagger declares for this instance (1.27.3). If the tag already exists it
-publishes into the existing release instead of failing, so a retry is safe.
-
-## What the in-app updater reads
-
-`app/src/main/java/org/prolibertate/games/update/Updater.kt`:
-
-| Channel | Endpoint |
-| --- | --- |
-| production | `GET /api/v1/repos/devadmin/PilgrimsOfKatan/releases/latest` |
-| dev | `GET /api/v1/repos/devadmin/PilgrimsOfKatan/releases?limit=30` |
-
-- `/releases/latest` is documented by Gitea as *the most recent non-prerelease,
-  non-draft release* — the same rule GitHub implements, so the production
-  channel keeps skipping dev builds.
-- The dev path takes the highest `versionCode` among the prereleases rather
-  than whatever came first on the page, so it does not depend on server
-  ordering.
-- The JSON shape is the one the code already parsed from GitHub: `tag_name`,
-  `prerelease`, `draft`, and assets carrying `browser_download_url`. Gitea says
-  `limit` where GitHub says `per_page`.
-- Each asset must be named so it contains its tag —
-  `PilgrimsOfKatan-v1.4.1001.apk` for tag `v1.4.1001` — because the updater
-  picks the versioned APK out of the release's assets by that rule.
-
-`BuildConfig.OTA_ENABLED` is a kill switch, not a channel decision: it is
-`true`, and setting it `false` makes every check report that and fetch nothing.
-`UpdatePolicy.kt` — channel rules, tag parsing, verdicts — is pure and stays
-under test either way.
-
-## Keystore
-
-`app/debug.keystore` is committed deliberately and must never be rotated:
-every build — local, CI, release — signs with it, so an OTA update installs
-over the previous build instead of being rejected for a signature mismatch.

docs/README.md

@@ -1,45 +0,0 @@
-# docs/
-
-Conventions for this repo's documentation. Seeded at bootstrap (WALA-118).
-
-## Per-game rules: `RULES-<game>.md`
-
-Every game in `GameCatalog` gets one file describing how *this app* implements
-it — not a generic rule dump. The rules code
-(`app/src/main/java/org/prolibertate/games/game/<game>/`) is the source of
-truth; the doc exists so a human or an agent can check intent against
-behaviour without reading Kotlin first.
-
-Naming: the catalogue id, lowercase, e.g. `crazy8s` → `RULES-crazy8s.md`.
-
-| Game (catalogue id) | Rules doc |
-| --- | --- |
-| Backgammon | [RULES-backgammon.md](RULES-backgammon.md) |
-| Checkers | [RULES-checkers.md](RULES-checkers.md) |
-| Chess | [RULES-chess.md](RULES-chess.md) |
-| Crazy 8s | [RULES-crazy8s.md](RULES-crazy8s.md) |
-| Cribbage | [RULES-cribbage.md](RULES-cribbage.md) |
-| Euchre | [RULES-euchre.md](RULES-euchre.md) |
-| FreeCell | — (TODO) |
-| Golf | [RULES-golf.md](RULES-golf.md) |
-| Hearts | — (TODO) |
-| Kaiser | [RULES-kaiser.md](RULES-kaiser.md) |
-| Klondike | — (TODO) |
-| Mastermind | [RULES-mastermind.md](RULES-mastermind.md) |
-| Morris | [RULES-morris.md](RULES-morris.md) |
-| Peg solitaire | — (TODO) |
-| Pirates | [RULES-pirates.md](RULES-pirates.md) |
-| President | [RULES-president.md](RULES-president.md) |
-| Pyramid | — (TODO) |
-| Sequence | [RULES-sequence.md](RULES-sequence.md) |
-| Spider | — (TODO) |
-| Ta Yü | [RULES-tayu.md](RULES-tayu.md) |
-| Wizard | [RULES-wizard.md](RULES-wizard.md) |
-| Yahtzee | — (TODO) |
-
-## Other docs
-
-- [CI.md](CI.md) — build, CI, releases, OTA decisions.
-- `licenses/` — third-party licences that must travel with the app
-  (Uncial Antiqua under the SIL OFL; the app itself is GPL-3.0, see `/LICENSE`).
-- Repo-level agent notes live in [`CLAUDE.md`](../CLAUDE.md) at the root.

gradle.properties

@@ -1,5 +1,12 @@
 # Project-wide Gradle settings.
-org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# C1-only JIT (-XX:TieredStopAtLevel=1): the Gitea runner's JVMs have been
+# crashing intermittently (SIGSEGV in HotSpot's compiler, bad Kotlin compiler
+# codegen) on Zulu, Corretto and Temurin alike. Dropping C2 is the test for
+# whether the optimising JIT is the trigger; it costs some build speed. The
+# Kotlin daemon needs its own copy: setting its options stops it inheriting
+# org.gradle.jvmargs.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 -XX:TieredStopAtLevel=1
+kotlin.daemon.jvm.options=-Xmx2048m,-XX:TieredStopAtLevel=1
 org.gradle.parallel=true
 org.gradle.caching=true
 
@@ -24,10 +31,10 @@ android.nonTransitiveRClass=true
 # when this changes.
 plgVersionSeries=1.4
 
-# The permanent floor under every stamped build number: versionCode (and the
-# release tag, and versionName) are `run number + this`. Gitea Actions starts
-# run numbers at 1 for each workflow, so without it the first Gitea-era release
-# would be build 1 — the same number an unstamped local build already carries —
-# and any later reset would make Android reject the next build as a downgrade.
-# Set once, at bootstrap, and never changed again: see docs/CI.md.
+# The permanent floor under every stamped build number: versionCode, versionName
+# and the release tag are all `run number + this`. Run numbers restart at 1 on a
+# new CI host (Gitea Actions), and Android refuses any versionCode lower than the
+# one installed, so without a floor the first build after a move would look like
+# a downgrade. 1000 sits above every number GitHub reached (prod 30, dev ~172).
+# Set once and never changed.
 plgVersionRunOffset=1000

scripts/publish-release.sh

@@ -1,101 +0,0 @@
-#!/bin/sh
-# Publish a built APK to this repository's Gitea releases — the channel the
-# in-app updater reads (docs/CI.md).
-#
-# The workflows call this, and so can a person: it is the whole release step,
-# runnable by hand on any machine with curl, which matters because a Gitea
-# Actions runner has to exist before the workflows can run at all.
-#
-#   scripts/publish-release.sh <tag> <apk> <prerelease|release> [target-sha]
-#
-# Environment:
-#   GITEA_TOKEN   required — a token that may create releases on the repo.
-#   GITEA_API     API base, default https://git.wallacenet.ca/api/v1
-#   GITEA_REPO    owner/name,  default devadmin/PilgrimsOfKatan
-#
-# The four arguments can also arrive as RELEASE_TAG, RELEASE_APK,
-# RELEASE_KIND and RELEASE_TARGET, which is how the workflows pass them.
-set -eu
-
-usage() {
-    sed -n '2,17p' "$0" | sed 's/^# \{0,1\}//' >&2
-}
-
-tag="${1:-${RELEASE_TAG:-}}"
-apk="${2:-${RELEASE_APK:-}}"
-kind="${3:-${RELEASE_KIND:-}}"
-target="${4:-${RELEASE_TARGET:-${GITHUB_SHA:-HEAD}}}"
-
-case "$kind" in
-    prerelease|release) ;;
-    *) usage; exit 2 ;;
-esac
-[ -n "$tag" ] || { usage; exit 2; }
-[ -f "$apk" ] || { echo "publish-release: no such APK: ${apk:-<unset>}" >&2; exit 2; }
-[ -n "${GITEA_TOKEN:-}" ] || { echo "publish-release: GITEA_TOKEN is not set" >&2; exit 2; }
-
-api="${GITEA_API:-${GITHUB_API_URL:-https://git.wallacenet.ca/api/v1}}/repos/${GITEA_REPO:-${GITHUB_REPOSITORY:-devadmin/PilgrimsOfKatan}}"
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "$tmp"' EXIT INT TERM
-
-# Named for its tag, not for whatever the build happened to call it: the
-# updater picks the versioned APK out of a release's assets by finding the one
-# whose name contains the tag, so an asset called app-debug.apk would only be
-# found by the fallback rule.
-apk_name="PilgrimsOfKatan-${tag}.apk"
-
-# The tag and the file name are both derived from gradle.properties and a run
-# number, so neither can carry a quote or a backslash into this JSON.
-if [ "$kind" = "prerelease" ]; then
-    prerelease=true
-    note="Automated dev-channel build of ${target}. Newer than production and less tested — switch to the Dev update channel in Settings to be offered these. Published as a prerelease so production-channel installs never see it."
-else
-    prerelease=false
-    note="Production-channel build of ${target}. Download ${apk_name} below and install it on an Android device (you may need to allow installs from unknown apps). It is signed with the repo's fixed keystore, which is what lets the in-app updater install over it."
-fi
-
-cat > "$tmp/release.json" <<JSON
-{"tag_name":"${tag}","target_commitish":"${target}","name":"Pilgrims of Katan ${tag}","body":"${note}","prerelease":${prerelease},"draft":false}
-JSON
-
-code="$(curl -sS -o "$tmp/create.json" -w '%{http_code}' -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    -H "Content-Type: application/json" \
-    --data @"$tmp/release.json" \
-    "$api/releases")"
-
-# 422 is the usual answer when the tag already exists — a re-run of a
-# workflow, or a second attempt by hand. Publishing into the release that is
-# already there is the right thing to do, not a failure.
-if [ "$code" != "201" ] && [ "$code" != "200" ]; then
-    code="$(curl -sS -o "$tmp/create.json" -w '%{http_code}' \
-        -H "Authorization: token ${GITEA_TOKEN}" \
-        "$api/releases/tags/${tag}")"
-fi
-
-if [ "$code" != "201" ] && [ "$code" != "200" ]; then
-    echo "publish-release: creating release ${tag} failed (HTTP ${code})" >&2
-    cat "$tmp/create.json" >&2
-    echo >&2
-    exit 1
-fi
-
-# Gitea answers compact JSON, and the release's own id is the first "id" in
-# it — the author's object comes later in the document.
-id="$(grep -o '"id":[0-9]*' "$tmp/create.json" | head -n1 | tr -dc '0-9' || true)"
-[ -n "$id" ] || { echo "publish-release: no release id in response" >&2; cat "$tmp/create.json" >&2; echo >&2; exit 1; }
-
-code="$(curl -sS -o "$tmp/asset.json" -w '%{http_code}' -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    -F "attachment=@${apk};filename=${apk_name}" \
-    "$api/releases/${id}/assets")"
-
-if [ "$code" != "201" ] && [ "$code" != "200" ]; then
-    echo "publish-release: attaching ${apk_name} to release ${id} failed (HTTP ${code})" >&2
-    cat "$tmp/asset.json" >&2
-    echo >&2
-    exit 1
-fi
-
-echo "publish-release: ${tag} -> release ${id} on ${api#*/repos/}, asset ${apk_name}"

settings.gradle.kts

@@ -14,5 +14,5 @@ dependencyResolutionManagement {
     }
 }
 
-rootProject.name = "PilgrimsOfKatan"
+rootProject.name = "ProLibertateGames"
 include(":app")

site/404.html

@@ -0,0 +1,3 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Not found</title></head>
+<body><h1>404</h1><p>Not found. <a href="/">Pro Libertate Games downloads</a></p></body></html>

site/_headers

@@ -0,0 +1,7 @@
+/*/latest.json
+  Cache-Control: no-cache
+  Access-Control-Allow-Origin: *
+
+/*.apk
+  Content-Type: application/vnd.android.package-archive
+  Cache-Control: public, max-age=300

site/index.html

@@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Pro Libertate Games</title>
+<style>
+  :root { color-scheme: light dark; font-family: system-ui, sans-serif; }
+  body { max-width: 32rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; }
+  .card { border: 1px solid #8884; border-radius: .5rem; padding: 1rem; margin: 1rem 0; }
+  a.dl { display: inline-block; padding: .5rem 1rem; border-radius: .4rem; background: #2563eb; color: #fff; text-decoration: none; }
+  small { opacity: .7; }
+</style>
+</head>
+<body>
+<h1>Pro Libertate Games</h1>
+<p>Android builds. Allow <em>Install unknown apps</em> for your browser to sideload.</p>
+<div class="card" id="production"><h2>Production</h2><p>Loading…</p></div>
+<div class="card" id="dev"><h2>Dev</h2><p>Loading…</p></div>
+<script>
+for (const [channel, path] of [["production", "prod"], ["dev", "dev"]]) {
+  const box = document.getElementById(channel);
+  const title = box.querySelector("h2").outerHTML;
+  fetch(`/${path}/latest.json`, { cache: "no-cache" })
+    .then(r => r.ok ? r.json() : Promise.reject())
+    .then(j => {
+      box.innerHTML = `${title}<p><a class="dl" href="${j.apkUrl}">Download ${j.tag}</a></p>` +
+        `<small>Always newest: <a href="/${path}/ProLibertateGames.apk">/${path}/ProLibertateGames.apk</a></small>`;
+    })
+    .catch(() => { box.innerHTML = `${title}<p>No build published yet.</p>`; });
+}
+</script>
+</body>
+</html>