Expand the 0.9.5 release-candidate checklist

Replace the remaining-gap table with v0.9.0 baselines and break the release
candidate into detailed workstreams for content lock/playtests, balance,
save migration, release engineering, legal/credits, documentation/visual
sign-off and final QA. Sync the README development status to v0.9.0.

README.md

@@ -118,11 +118,12 @@ Full setup, every run/test/smoke command, and the controls table are in
 
 ## Development Status
 
-v0.8.0 adds the first-shift tutorial, campaign shell, checkpoint resume,
-difficulty presets and an in-game Help overlay on top of the v0.7.x venue, gear,
-judge and Desktop HQ work. See [`docs/development-status.md`](docs/development-status.md)
-for the implemented list and [`TODO.md`](TODO.md) for the v1.0.0 roadmap. Manual
-verification uses the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
+v0.9.0 adds the production-quality baseline: mixer/accessibility settings, a
+24-NPC performance budget and the documented Godot 4.3-CI/4.7-local matrix, on
+top of v0.8's tutorial, campaign, checkpoint resume, difficulty and Help. See
+[`docs/development-status.md`](docs/development-status.md) for the implemented
+list and [`TODO.md`](TODO.md) for the v1.0.0 roadmap. Manual verification uses
+the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
 
 ## Development Workflow
 

TODO.md

@@ -5,10 +5,11 @@ see `AGENTS.md` for the workflow and `MEMORY.md` for the decisions behind these
 
 ## Gap Analysis and v1.0.0 Roadmap
 
-Baseline: **v0.8.1** (2026-11-01). Three playable venues, tutorial/campaign/checkpoint resume,
-difficulty/help, a complete escalation/access/radio loop, shift review, the Blender asset library,
-249 headless + 94 Python tests, a clean screen-design judge and an optional Forward+ Desktop HQ
-build. This is a strong first-hour vertical slice, not yet a 1.0 product.
+Baseline: **v0.9.0** (2026-11-01). Three playable venues, tutorial/campaign/checkpoint resume,
+difficulty/help, audio/accessibility settings, a 24-NPC budget baseline, a complete
+escalation/access/radio loop, shift review, the Blender asset library, 250 headless + 94 Python
+tests, a clean screen-design judge and an optional Forward+ Desktop HQ build. This is a strong
+release-candidate foundation, not yet a 1.0 product.
 
 ### Documentation audit (completed 2026-11-01)
 
@@ -27,44 +28,111 @@ build. This is a strong first-hour vertical slice, not yet a 1.0 product.
       decisions (ADRs), status (`development-status.md`), roadmap (`TODO.md`), operations
       (tooling/release docs).
 
-### Gap register
+### Gap register (remaining to 1.0)
 
-| Area | Current baseline | Gap to 1.0 | Risk | Milestone |
+| Area | Current baseline | Remaining gap | Risk | Milestone |
 | --- | --- | --- | --- | --- |
-| First-hour experience | Venue menu and controls exist; no tutorial | No guided first shift, control coaching, objective recap or "what went wrong" debrief | New players bounce before the de-escalation loop lands | 0.8.0 |
-| Campaign/progression | Venue selection and debug cycle | No career/venue order, unlocks, difficulty curve or persistent player progression | Shift loop feels like a tech demo rather than a game | 0.8.0 |
-| Authored content | 3 venues, small event pools, one-line dialogue | Need a larger event matrix per venue, repeat/remix rules, failure/recovery events and more NPC dialogue | Repetition after a few shifts | 0.8.0 |
-| NPC behavior | FSM intents, reactions, crowd/theater poses | Deeper negotiation, memory of earlier interactions, group dynamics, believable refusal/escalation edges | NPCs still feel deterministic/scripted | 0.8.0 |
-| Access/evaluation | Recognition, wristbands/IDs/tickets/credentials, reputation/review | Fairness tuning, ambiguous cases, clearer evidence trail, richer grades and actionable feedback | Players cannot learn why a decision scored poorly | 0.8.0 |
-| Shift lifecycle | Settings + completed-shift history persist | No mid-shift save/resume, pause-safe serialization, versioned save schema or replay | Interrupted sessions lose the run; future changes can break saves | 0.8.0 |
-| Accessibility | Key remapping, gamepad, HUD font scale, shape escalation cue | Subtitles/captions, colour-independent cues, motion/audio sensitivity, text expansion, menu narration and full input alternatives need an audit | Public 1.0 cannot claim accessible play | 0.8.0–0.9.0 |
-| Localization | English strings in `content/strings.en.json` | String extraction/coverage, pseudo-locale test, font fallback, text-length layout budgets and translator workflow | Text bugs and unsupported locales at release | 0.9.0 |
-| Audio | Procedural crowd bed and radio crackle | Music/ambience direction, event SFX, voice/VO decision, caption hooks and mix budgets | Scene can feel silent/placeholder | 0.9.0 |
-| Animation/presentation | Procedural poses, walk/idle theater, LOD impostor | More reaction/idle/negotiation poses, transitions, facial readability at portrait distance, camera-height decision | Cinematic close-ups expose the prototype layer | 0.9.0 |
-| Performance/platform | 16-NPC budget measured headlessly; Compatibility default; optional Vulkan HQ | Target hardware matrix, 24-NPC profiling, draw-call/memory budgets, Web/HQ parity and frame-time regression gates | Crowded studio or Web drops frames | 0.9.0 |
-| Content tooling | ScenarioFactory/.tres export, Blender manifest, asset audits | Schema validation, previews, event authoring workflow, reproducible asset rebuild notes and contributor onboarding | Content expansion becomes expensive/error-prone | 0.8.0–0.9.0 |
-| QA/CI | Headless suite, smokes, screenshot compare, model-aware judge | End-to-end shift automation, full venue matrix, CI Godot-version strategy, manual judge budget and release checklist automation | Regressions escape or CI becomes non-reproducible | 0.9.0 |
-| Release/legal | Tag-driven unsigned builds, Web zip, optional HQ | Signing/notarization, checksums, AI-asset provenance/licensing, credits, privacy/body-camera statement and storefront requirements | Public release blocked by trust/policy issues | 0.9.5 |
-| Documentation | Layered docs consolidated; drift was found | Keep changelog/status/roadmap/ADR links synchronized per release; add contributor architecture tour | Docs become stale again | Continuous |
+| Content and balance | 3 venues with validated 12+ event matrices, recovery events and contextual dialogue | External playtest evidence, balance/fairness pass, event-weight tuning and final content lock | Repetition or unfair outcomes survive into 1.0 | 0.9.5 |
+| Animation/presentation | Procedural pose layers, portrait captures, reduced hem clipping | Final animation/readability acceptance and no remaining P0/P1 clipping in the release candidate | Close-up jank reduces perceived quality | 0.9.5 |
+| Audio/accessibility | Procedural ambience/SFX, volume controls, captions/reduce-motion settings, searchable Help | Full accessibility/localization acceptance review, audio caption coverage and P0/P1 fixes | Public 1.0 cannot claim accessible play | 0.9.5 |
+| Localization | English JSON table, validation and input-generated Help | Pseudo-locale/layout audit and translator workflow sign-off | Text expansion/clipping at release | 0.9.5 |
+| Performance/platform | 24-NPC headless budget (6.9 ms), Compatibility/Web/HQ paths | Target hardware matrix, Web/HQ manual profiling, frame-time/memory evidence | Platform-specific drops or startup failures | 0.9.5 |
+| Save lifecycle | Settings/campaign/history/checkpoint files, atomic writes | Migration fixtures from 0.8/0.9, fresh-install/upgrade verification, rollback instructions | Player progress loss on upgrade | 0.9.5 |
+| QA/CI | Headless suite, smokes, screenshot compare, optional judge | Full release-candidate smoke matrix, final gallery/judge, CI/release dry run and checksums | Regressions escape the release gate | 0.9.5 |
+| Release/legal | Unsigned desktop/macOS builds, Web/HQ packages | Signing/notarization decision, checksums, AI-asset provenance, credits, privacy/body-camera and rating review | Public release blocked by trust/policy | 0.9.5 |
+| Documentation | Architecture/ADR/status/roadmap ownership established | Final README/changelog/status/TODO/smoke-checklist sign-off and known-limitations page | Docs drift at launch | 0.9.5 |
+| Post-launch | Stable 0.9 feature set | Live replay, more venues, VO/music, image-to-mesh props and seasonal content | Scope creep before launch | Post-1.0 |
 
 ## Milestone 0.9.5 — Release candidate
 
-Goal: freeze content, prove it with external players, clear release/legal blockers and verify
-every distribution path.
+Goal: freeze the feature set, prove it with external players, clear release/legal blockers and
+verify every distribution path. This is the next shipped version before 1.0.
 
-- [ ] Content lock and external playtest round (at least five first-time players); triage findings
-      by severity and fix all P0/P1 issues.
-- [ ] Balance and fairness pass across all venues: scoring, difficulty, event weights, NPC
-      compliance and emergency false-positive/negative rates.
-- [ ] Save migration test from 0.8/0.9 saves; verify settings, shift history and resume paths.
-- [ ] Release engineering: signed/notarized macOS where possible, checksums, Windows/Linux install
-      smoke tests, AppImage update, Web hosting verification and Desktop HQ Vulkan fallback.
-- [ ] Legal/credits review: AI-assisted asset provenance, music/SFX licenses, privacy/body-camera
-      language, age/content rating and storefront requirements.
-- [ ] Documentation sign-off: architecture/ADR/status/TODO/changelog/README/smoke checklist all
-      match the release candidate; capture final gallery and run compare + judge.
-- [ ] Exit: release candidate passes the manual smoke checklist on every target; no release-blocking
-      legal or platform issue remains.
+### Content lock and external playtest
+
+- [ ] Declare a content/feature freeze for 0.9.5; only release-blocking fixes and balance changes
+      may land after the freeze.
+- [ ] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
+      accessibility settings and checkpoint/resume enabled.
+- [ ] Run at least five first-time-player sessions covering the tutorial and one full venue shift;
+      record where players get stuck, misunderstand evidence or choose disproportionate escalation.
+- [ ] Triage findings by severity (P0/P1/P2) and fix every P0/P1 onboarding/accessibility issue;
+      keep the rest as explicit known limitations or post-1.0 items.
+- [ ] Re-run the affected tutorial/campaign smokes after each fix and capture a fresh first-hour
+      walkthrough for the release notes.
+
+### Balance and fairness pass
+
+- [ ] Define measurable targets for routine compliance, access-decision accuracy, peaceful
+      resolution, justified emergency calls and false-positive/false-negative rates.
+- [ ] Run scripted venue sweeps across easy/normal/hard and all four phases; compare outcomes and
+      tune event weights, reaction tables, compliance and report strictness where targets fail.
+- [ ] Review emergency calls against actual danger: no routine behavior should make emergency the
+      dominant winning move, and genuine threats must remain answerable.
+- [ ] Verify the reputation grades, debrief explanations and campaign progression still communicate
+      the de-escalation-first design after tuning.
+- [ ] Record the balance evidence and any deliberate exceptions in `docs/development-status.md`
+      or `MEMORY.md`.
+
+### Save migration and session reliability
+
+- [ ] Add fixtures for a 0.8-era settings/campaign/history save and a 0.9.0 checkpoint; verify
+      migration/default-filling and a clean first launch with no files.
+- [ ] Test fresh install → tutorial → campaign → pause → quit → resume → review → next venue on
+      an isolated user-data directory.
+- [ ] Test corrupt JSON, partial temp files, missing optional fields and a failed atomic rename;
+      confirm fallback behavior never destroys a valid save.
+- [ ] Verify checkpoint resume after all three venues, after an incident, with NPCs at the door and
+      with flashlight/body-camera/door state set.
+- [ ] Document save locations, schema versions, reset behavior and rollback/export instructions in
+      `docs/getting-started.md` and the release notes.
+
+### Release engineering and distribution
+
+- [ ] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
+      artifact names, sizes and checksums.
+- [ ] Smoke-test fresh Linux portable/AppImage, Windows portable/installer, macOS unzip/launch,
+      Web static hosting and Desktop HQ Vulkan fallback on the target matrix.
+- [ ] Add a disk-space preflight and retention policy to the release/publish scripts so a full
+      Gitea host cannot leave a partially uploaded release.
+- [ ] Verify release metadata, tag/version consistency, asset counts and download links; retain
+      at least the latest 0.8/0.9 releases and document older-asset pruning.
+- [ ] Decide and document whether macOS signing/notarization is required for 0.9.5 or explicitly
+      remains a 1.0 blocker; record the quarantine instructions either way.
+
+### Legal, credits and platform policy
+
+- [ ] Audit AI-assisted asset provenance and licenses; record source/model usage and any
+      redistribution constraints for textures, characters, props and UI art.
+- [ ] Audit audio/SFX/music licensing (or confirm everything is procedural) and add a credits file.
+- [ ] Review body-camera/privacy language, mental-health-crisis representation, age/content rating
+      and storefront requirements; fix any release-blocking copy or content.
+- [ ] Add the player-facing credits, known limitations, accessibility statement and privacy note to
+      the release package/README.
+- [ ] Mark external legal/storefront approval as complete or explicitly block 1.0 on it.
+
+### Documentation and visual sign-off
+
+- [ ] Update `README.md`, `PLAN.md`, `docs/architecture.md`, ADRs, `docs/development-status.md`,
+      `docs/getting-started.md`, `docs/smoke-checklist.md`, `CHANGELOG.md` and this roadmap.
+- [ ] Regenerate the full screenshot gallery and realism baselines after content lock; run
+      `check_screenshots.sh` and the pinned vision judge, recording model/spend/verdicts.
+- [ ] Run the manual smoke checklist on every target and attach/link the release-candidate evidence.
+- [ ] Verify the tutorial/campaign/help text at maximum font scale and with the longest strings.
+- [ ] Remove or archive stale plans/notes and confirm no contradictory version/status claims remain.
+
+### Release-candidate QA and exit
+
+- [ ] Run the complete headless suite, Python tooling, tutorial/campaign/session/scenario smokes,
+      24-NPC budget smoke and release build from a clean checkout.
+- [ ] Run the manual QA matrix: fresh install, upgrade, offline launch, gamepad, accessibility
+      settings, pause/resume, all venues and Desktop HQ fallback.
+- [ ] Confirm no P0/P1 defects remain; P2 items must be documented as known limitations or
+      post-1.0 work.
+- [ ] Create the `v0.9.5` version bump, changelog entry and tag; build/publish the release and
+      verify all assets and download links.
+- [ ] Exit: the release candidate is content-locked, externally played, legally reviewed,
+      documented, reproducibly built, and approved as the final stepping stone to 1.0.0.
 
 ## Milestone 1.0.0 — Launch