Fix release publishing and add a CI token fallback

Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.

docs/RELEASING.md

@@ -37,8 +37,18 @@ The repository ships a Gitea Actions workflow (`.gitea/workflows/build.yml`):
   Linux/Windows/macOS, artifact upload, and — on tags — release publication via
   `tools/publish_release.sh`.
 
-For tag builds, set a repo secret named **`GITEA_TOKEN`** (write:repository scope).
-Without it the workflow still builds and tests, but the release publish step fails.
+For tag builds the workflow uses `GITEA_TOKEN` (write:repository scope) or, when the
+secret is absent, falls back to the workflow's built-in `github.token`. Either is
+enough for the publish step; with neither, the build succeeds but no release is
+created.
+
+> **Incident (2026-10-31):** `tools/publish_release.sh` never set `AUTH` in its
+> `~/.git-credentials` branch, so every API call failed silently (`AUTH[@]` was
+> unbound under `set -u`). Combined with no `GITEA_TOKEN` secret on the repo, tag
+> builds from v0.2.2 to v0.2.8 produced installers but published nothing. The script
+> is fixed (`AUTH=(-u "$CRED")`) and v0.2.9 was published locally with all five
+> artifacts. If CI publishing fails again, run
+> `./tools/publish_release.sh <version>` from a checkout with `~/.git-credentials`.
 
 > **No `actions/cache` for now:** the runner has no local actions-cache service, so
 > `actions/cache` times out against GitHub's cache API. We dropped it (Godot import

docs/adr/0008-cone-focus-and-head-ring.md

@@ -1,4 +1,4 @@
-# ADR-0008: Cone focus and head ring
+# ADR-0008: Cone focus and focus circle
 
 - **Status:** Accepted
 - **Date:** TBD
@@ -19,7 +19,7 @@ Focus is a **cone**, not a ray.
 - A few frames of grace keep walk-bob from dropping focus.
 - `Tab` still cycles people inside 12 m and sets the same focused person.
 
-When someone is in focus, draw a **thin ring** around their head, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Pale gold while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the ring. One ring at a time.
+When someone is in focus, draw a **blue, semi-transparent circle in front of the face**, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Blue while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the circle. One circle at a time.
 
 The world must not show the internal type name (`Trespasser`, `Violent Threat`). The debug overlay (`F`) can still print it.
 
@@ -28,19 +28,19 @@ The world must not show the internal type name (`Trespasser`, `Violent Threat`).
 ### Positive
 
 - Looking near a person is enough; the player does not have to pin a capsule.
-- The ring is visible in the scene, so the HUD is not the only focus cue.
+- The circle is visible in the scene, so the HUD is not the only focus cue.
 - `Tab` remains the accessibility path and shares the same focused person.
 - The action menu (ADR-0009) has a clear subject.
 
 ### Negative
 
 - Two heads in the same circle can steal focus; center-distance is a heuristic, not a lock-on.
-- Hats and protester signs can z-fight a 3D torus. A screen-space circle unprojected from the head is an allowed fallback.
+- Hats and protester signs can z-fight a 3D circle. A screen-space circle unprojected from the head is an allowed fallback.
 - Occlusion rays can fail on unusual geometry; grace frames hide some of that.
 
 ## Alternatives considered
 
 - **Keep the hairline ray:** Rejected because it drops people too easily and has no world mark.
 - **Sticky lock-on until cancelled:** Rejected because the job is to watch a crowd, not duel one person.
-- **Screen reticle only, no world ring:** Rejected; in a crowd the player needs a mark on the head, not only a HUD line.
+- **Screen reticle only, no world circle:** Rejected; in a crowd the player needs a mark on the face, not only a HUD line.
 - **Click a person to select, then act:** Rejected for default play. The mouse is captured for look (ADR-0007). Click opens the action menu on whoever is already in the cone.

docs/adr/0009-radial-action-menu.md

@@ -31,7 +31,7 @@ While the menu is open, walk and look freeze (ADR-0007) and the cursor is visibl
 
 **Confirm:** click a slice, or `Space` on the highlighted slice. The menu closes, the mouse is recaptured, and that action runs. Inspect, wand, and radio assist close the wheel and then open the existing panels. Walk and look stay frozen until that panel closes.
 
-**Cancel:** `Esc` or right mouse button. The menu hides. No action runs. No recorder event. Focus and the head ring stay. The mouse is recaptured.
+**Cancel:** `Esc` or right mouse button. The menu hides. No action runs. No recorder event. Focus and the focus circle stay. The mouse is recaptured.
 
 Number keys `1`–`6` may remain as shortcuts when the wheel is closed, so existing smoke tests still work. They must not fire while the wheel is open.
 
@@ -54,7 +54,7 @@ Number keys `1`–`6` may remain as shortcuts when the wheel is closed, so exist
 ## Alternatives considered
 
 - **Hold-to-open, release-to-confirm (GTA / Destiny):** Rejected. The requested input is click or Space to open, then click or Space to confirm, with Esc / RMB to abort. That is a toggle, not a hold.
-- **Vertical list / command menu:** Rejected because a round layout around a focused person matches the head ring and reads faster in a crowd.
+- **Vertical list / command menu:** Rejected because a round layout around a focused person matches the focus circle and reads faster in a crowd.
 - **One context-sensitive Use key:** Rejected; the game is about choosing among levels, not a single default verb.
 - **Emergency on the wheel:** Rejected because a misclick would dispatch armed response. ADR-0002 already keeps that path rare and confirmed.
 - **Drop number-key shortcuts immediately:** Deferred. They remain as a closed-menu fallback until the wheel is proven in play.

docs/adr/0010-procedural-npc-presentation.md

@@ -21,7 +21,7 @@ Make the body read as a person at conversation distance:
 - Shoes.
 - Hair cap whose color comes from the visual seed.
 - Two dark eye spheres so the head has a front.
-- Named `Head` node (`Rig/Head`) as the attach point for the focus ring (ADR-0008) and the focus cone.
+- Named `Head` node (`Rig/Head`) as the attach point for the focus circle (ADR-0008) and the focus cone.
 - Collision capsule scaled to the visible height so the cone hits the body the player sees.
 
 Keep archetype props, height / brightness variation, walk bob, and the notice head-turn.
@@ -49,5 +49,5 @@ AI clothing textures stay out unless a map is already the right size and is wire
 
 - **Skinned Mixamo / GLB characters now:** Rejected. Cost and pipeline exceed this pass; the sim only needs a readable body and a head node.
 - **Billboard sprites:** Rejected; first-person movement walks around people, and sprites fail at profile views.
-- **Keep colored capsules as-is:** Rejected; the head ring and cone need a real head, and capsules do not read as people at two metres.
+- **Keep colored capsules as-is:** Rejected; the focus circle and cone need a real head, and capsules do not read as people at two metres.
 - **World labels with archetype names:** Rejected because they leak sim truth and skip observation.

docs/architecture.md

@@ -153,7 +153,7 @@ Architecture decisions are recorded as ADRs:
 - [ADR-0005: Event-based incident recording](adr/0005-event-based-incident-recording.md)
 - [ADR-0006: Godot 4 with GDScript](adr/0006-godot-4-gdscript.md)
 - [ADR-0007: Locomotion and input layers](adr/0007-locomotion-and-input-layers.md)
-- [ADR-0008: Cone focus and head ring](adr/0008-cone-focus-and-head-ring.md)
+- [ADR-0008: Cone focus and focus circle](adr/0008-cone-focus-and-head-ring.md)
 - [ADR-0009: Radial action menu](adr/0009-radial-action-menu.md)
 - [ADR-0010: Procedural NPC presentation](adr/0010-procedural-npc-presentation.md)