Close out installer/AppImage verification; note v0.2.1 release; document NSIS/appstream gotchas

- CI run 1110 proved NSIS + AppImage packaging and published v0.2.1
  (installers uploaded); Mark TODO installer/appimage items done (moved to
  DONE.md), README Latest -> v0.2.1, MEMORY records NSIS -D/absolute-path/
  BMP-ICO gotchas and appstreamcli strictness

DONE.md

@@ -173,6 +173,10 @@ Completed task sections moved from `TODO.md`. Sections are moved only when every
 - [x] `config/version` → `0.2.0`; `build/` artifacts rebuilt and Linux binary smoke-tested.
 - [x] New world/lighting headless tests (56 total).
 
+## Screenshot Refresh
+
+- [x] Regenerate and verify the six README screenshots from the current build.
+
 ## 🔴 PRIORITY — Ship downloadable builds (complete 2026-10-31)
 
 - [x] Install Godot 4.3 export templates locally.
@@ -216,7 +220,13 @@ Completed task sections moved from `TODO.md`. Sections are moved only when every
       ran it headless (0 script errors).
 - [x] CI: NSIS + AppImage steps added to `.gitea/workflows/build.yml` build job; publish glob
       already uploads `build/step-line-*<ver>*` (covers setup/AppImage names).
-- [ ] (open) CI run verification of the NSIS build and installer-content listing.
+- [x] CI run 1110 verified end-to-end (v0.2.1): NSIS installer `step-line-setup-0.2.1.exe`
+      built, `7z l` shows `step-line.exe` + `uninstall.exe`, AppImage built (33.9 MB),
+      release `v0.2.1` published, `Job succeeded`.
+  - Gotchas fixed on the way: makensis needs `-D` defines (not `/D`) and absolute paths
+    (it resolves relatives against the script dir); installed exe must be space-free
+    (`step-line.exe`); icon.ico must use classic BMP entries (ImageMagick; PIL emits
+    PNG-compressed ICOs NSIS rejects).
 
 ## 🎮 Assets & detailed graphics pass (textures, rigs, UI feedback)
 

MEMORY.md

@@ -15,7 +15,16 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 ## Current State
 
-- **Release v0.2.0 is LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
+- **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
+  and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
+- NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines
+  (never `/D`), resolves relative `-DICON`/`-DARTIFACT` against the **script directory** so CI
+  passes `$PWD`-absolute paths; installed exe must be space-free (`step-line.exe`); ICO must be
+  classic BMP entries (ImageMagick `icon:auto-resize=48,32,16`; PIL emits PNG-compressed ICOs NSIS
+  cannot load).
+- appimagetool runs system `appstreamcli` if present (strict, exit 3 on warnings) — project
+  metadata now passes `--pedantic`.
+- **Release v0.2.0 was LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
   and publish automatically (host has the `GITEA_TOKEN` secret). Tag page and `/releases` are
   public (HTTP 200). Caveat: anonymous **asset downloads** redirect to login on this host
   (host setting — tracked in TODO). Future releases = bump `config/version`, `git tag vX.Y.Z`,

README.md

@@ -28,8 +28,8 @@ The central design goal is simple:
 
 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>
 
-> **Latest: v0.2.0** (2026-10-31) — built and published by Gitea Actions from the
-> `v0.2.0` tag. Releases are built automatically when a `vX.Y.Z` tag is pushed
+> **Latest: v0.2.1** (2026-10-31) — built and published by Gitea Actions from the
+> `v0.2.1` tag, including the Windows installer and Linux AppImage. Releases are built automatically when a `vX.Y.Z` tag is pushed
 > (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline
 > (NSIS + appimagetool) and uploads with the portable binaries.

TODO.md

@@ -1,49 +1,5 @@
 # TODO
 
-## 🎨 AI texture generation (OpenRouter)
-
-- [x] Extend `tools/generate_textures.py` with an OpenRouter image-API mode
-      (`--ai`, `--prompt`, `--name`, `--model`, `--size`), decoding base64 PNG
-      responses and clamping output to ≤1024px.
-- [x] Add prompts for all 15 game textures (world surfaces, awning, skyline,
-      vignette, 4 HUD icons, 5 access cards) and generate them under `assets/textures/ai/`.
-- [ ] Make the `ai/` icons/vignette/skyline truly transparent: seedream-4.5 ignores
-      `background: transparent` (returns opaque images). Either switch to a
-      transparency-capable model or post-process (e.g. chroma-key the flat background).
-
-## 🪟 Windows installer (self-contained, all game data)
-
-Goal: a real Windows installer that includes the entire game (executable + data),
-Start-Menu/desktop shortcuts, and an uninstaller — instead of a bare .exe + .pck.
-
-- [x] Switch the Windows/Linux/macOS export presets to `binary_format/embed_pck=true` so a
-      single self-contained binary replaces the exe+pck pair (all game data in one file).
-- [x] Add a game icon: `assets/icon.png` (AppImage/desktop) + `assets/icon.ico` and
-      `packaging/windows/step-line.ico` generated by `tools/generate_textures.py`.
-- [x] Author `packaging/windows/step-line.nsi` (NSIS): installer that installs the exe, writes
-      the uninstaller, shortcuts, and registry uninstall entry.
-- [x] Add CI packaging steps to `.gitea/workflows/build.yml` (NSIS via apt; AppImage via
-      appimagetool) so tags/dispatch produce `step-line-setup-<ver>.exe` and
-      `step-line-<ver>-x86_64.AppImage` next to the portable binaries.
-- [x] Extend `tools/publish_release.sh` artifact glob to upload the installer/AppImage too.
-- [ ] Verify on CI: NSIS installer builds (cannot be run locally — no `makensis` on this box).
-- [ ] Verify the Windows installer contents in CI (e.g. `7z l` shows the embedded data file).
-
-## 🐧 Linux AppImage (self-contained, all game data)
-
-Goal: a single executable `.AppImage` that runs the full game on any recent distro.
-
-- [x] Author AppDir files: `packaging/linux/step-line.desktop`, `packaging/linux/AppRun`,
-      icon wiring.
-- [x] Add `packaging/linux/build_appimage.sh` (appimagetool; `APPIMAGE_EXTRACT_AND_RUN=1` to
-      avoid FUSE dependency) producing `step-line-<ver>-x86_64.AppImage`.
-- [x] Local verification: built the AppImage on this machine and ran it headless
-      (`--appimage-extract-and-run --headless --quit-after 90` → 0 script errors,
-      `[Step Line] game started`).
-- [x] AppStream metainfo added (`packaging/linux/step-line.appdata.xml`); tool validates clean.
-- [ ] CI verification: AppImage step runs on tags/dispatch and the artifact uploads.
-- [x] README Downloads table documents installer + AppImage rows and naming.
-
 ## Distribution follow-up (host config, no code work)
 
 - [ ] Asset downloads currently require sign-in on the host (`/releases/download/…` redirects to
@@ -68,7 +24,3 @@ performance hardening only.
 - [ ] Profile the crowd: ensure textured materials and props hold target frame rate around a
       busy entrance.
 - [ ] Add LOD or culling for distant NPCs/props if the crowd grows.
-
-## Screenshot Refresh
-
-- [ ] Regenerate and verify the six README screenshots from the current build.