Add body-camera timeline to the shift review

- New src/game/ui/event_timeline.gd flattens every recorded incident event (ADR-0005) into one time-ordered list and shows time, person, and a one-line summary. Step with Left/Right or the buttons; Esc returns to the review. No live 3D replay in this first version. - Shift review gains a "Body camera timeline" button that hands the review to the timeline; the review dim is hidden while it is open (stacked overlays made the screen nearly black) and restored on close. - ShiftCoordinator records started_at_ms so the review can stamp events as mm:ss. - 8 new string keys for the timeline UI and the review button. Tests/docs - Headless suite 113 -> 120 (test_event_timeline.gd), new smoke_timeline.gd that opens the timeline from the review, steps through every event, and closes back. - README, TODO section moved to DONE, MEMORY notes. Version 0.2.6.
Add emergency aftermath: evacuation, investigation, review copy
2026-10-31 21:02:25 +01:00 · 2026-10-31 20:59:06 +01:00 · 2026-10-31 20:55:10 +01:00 · 2026-10-31 20:29:50 +01:00 · 2026-10-31 20:21:54 +01:00 · 2026-10-31 20:19:22 +01:00
147 changed files with 7358 additions and 324 deletions
@@ -77,6 +77,31 @@ jobs:
          chmod +x tools/*.sh
          ./tools/build_releases.sh
      - name: Package Windows installer (NSIS)
        run: |
          sudo apt-get update && sudo apt-get install -y nsis p7zip-full
          VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
          # NOTE: on Linux, makensis uses -D defines (the /D form is Windows-only
          # and is rejected as a script path), and it resolves relative paths
          # against the script directory — pass absolute paths from the workspace.
          cp assets/textures/icon.ico packaging/windows/step-line.ico
          makensis \
            -DVERSION="$VERSION" \
            -DARTIFACT="$PWD/build/step-line-windows-$VERSION.exe" \
            -DICON="$PWD/packaging/windows/step-line.ico" \
            -DOUT="$PWD/build/step-line-setup-$VERSION.exe" \
            packaging/windows/step-line.nsi
      - name: Verify Windows installer contents
        run: |
          VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
          ls -la build/step-line-setup-$VERSION.exe
          7z l build/step-line-setup-$VERSION.exe | grep -E "step-line.exe|uninstall.exe"
      - name: Package Linux AppImage
        run: |
          bash packaging/linux/build_appimage.sh
      - name: Upload installers (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
@@ -1,3 +1,27 @@
 # Python
 __pycache__/
 *.py[cod]
 *.pyo
 *.pyd
 *.pycache
 *.pytest_cache
 *.mypy_cache
 *.coverage
 coverage.xml
 htmlcov/
 dist/
 build/
 eggs/
 *.egg-info/
 .tox/
 .nox/
 *.venv/
 venv/
 ENV/
 env/
 env.bak/
 venv.bak/
 # Godot 4
 .godot/
 *.import
@@ -18,3 +42,5 @@ user://
 # CI runner workflow logs (written into the checkout by the Gitea runner)
 .gitea/logs/
 build/
 .env
@@ -173,6 +173,76 @@ Completed task sections moved from `TODO.md`. Sections are moved only when every
 - [x] `config/version` → `0.2.0`; `build/` artifacts rebuilt and Linux binary smoke-tested.
 - [x] New world/lighting headless tests (56 total).
 ## Screenshot Refresh
 - [x] Regenerate and verify the six README screenshots from the current build.
 ## 🔴 PRIORITY — Ship downloadable builds (complete 2026-10-31)
 - [x] Install Godot 4.3 export templates locally.
 - [x] `./tools/build_releases.sh` produces Linux/Windows/macOS artifacts (0.2.0).
 - [x] Linux binary smoke-tested (headless, 0 script errors).
 - [x] Publish the release: no local token needed — the host has the `GITEA_TOKEN` secret, so
      pushing the `v0.2.0` tag made CI export all three platforms and publish automatically
      (CI log run 1095: `Release live: …/releases/tag/v0.2.0`, Job succeeded).
 - [x] Confirm links resolve: tag page and `/releases` return HTTP 200 publicly.
      Follow-up: anonymous **asset downloads** require sign-in on this host (host setting).
 - [x] CI packaging follow-up was already live (`.gitea/workflows/build.yml` on tags).
 ## 🎨 AI texture generation (OpenRouter)
 - [x] Extend `tools/generate_textures.py` with an OpenRouter image-API mode (`--ai`, `--prompt`,
      `--name`, `--model`, `--size`), decoding base64 PNG responses and clamping to ≤1024px.
 - [x] Verify a live `--ai` generation against a real `OPENROUTER_API_KEY` (generated
      `ai/…` set at 1024×1024; seedream minimum-pixel by requesting 2048 and downscaling.
 ## 🧹 Runtime hygiene + timeline/polish items
 - [x] RefCounted cycle cleanup: `FSM` now holds its owner via `WeakRef`; `ShiftCoordinator` is
      `RefCounted` (logic-only, no tree needs); persistence tests free the `Save` node.
      Test suite now exits with **zero** “resources still in use” warnings.
 - [x] Full-length shifts: the prototype now uses each scenario's `shift_duration_s` (900s ≈
      10-15 min per PLAN.md) instead of a hardcoded 300s test duration.
 - [x] Wand cooldown feel: a short `WAND_COOLDOWN_S` recharge between wand scans with a
      `wand.recharge` message (Open Polish item).
 ## 📦 Installer packaging (Windows NSIS + Linux AppImage)
 - [x] Export presets: `binary_format/embed_pck=true` on all platforms — every binary is now
      self-contained (all game data in one file; `.pck` no longer shipped).
 - [x] App icon: `assets/textures/icon.png` (1024) + multi-size `icon.ico`, copied to
      `packaging/windows/step-line.ico` and `packaging/linux/step-line.png` via the generator.
 - [x] NSIS script `packaging/windows/step-line.nsi` (installs `Step Line.exe`, uninstaller,
      shortcuts, registry entry; `makensis /DVERSION=… /DARTIFACT=…`).
 - [x] AppImage: `packaging/linux/step-line.desktop`, `AppRun`, appdata.xml, and
      `build_appimage.sh` (appimagetool, `APPIMAGE_EXTRACT_AND_RUN=1`).
 - [x] Local end-to-end: rebuilt embedded exports and produced `step-line-0.2.0-x86_64.AppImage`,
      ran it headless (0 script errors).
 - [x] CI: NSIS + AppImage steps added to `.gitea/workflows/build.yml` build job; publish glob
      already uploads `build/step-line-*<ver>*` (covers setup/AppImage names).
 - [x] CI run 1110 verified end-to-end (v0.2.1): NSIS installer `step-line-setup-0.2.1.exe`
      built, `7z l` shows `step-line.exe` + `uninstall.exe`, AppImage built (33.9 MB),
      release `v0.2.1` published, `Job succeeded`.
  - Gotchas fixed on the way: makensis needs `-D` defines (not `/D`) and absolute paths
    (it resolves relatives against the script dir); installed exe must be space-free
    (`step-line.exe`); icon.ico must use classic BMP entries (ImageMagick; PIL emits
    PNG-compressed ICOs NSIS rejects).
 ## 🎮 Assets & detailed graphics pass (textures, rigs, UI feedback)
 - [x] Authored texture set via `tools/generate_textures.py` (deterministic PIL): brick facade,
      seamless concrete, asphalt, awning, skyline, vignette, HUD icons, access-card art — all
      ≤1024px and power-of-two; imported under `assets/textures/`.
 - [x] Environment: textured facade + glass door, concrete sidewalk, asphalt street, striped
      awning with “STEP LINE”, generated skyline backdrop planes, soft sun shadows.
 - [x] NPCs: humanoid rig (torso/head/limbs) with archetype props (camera, delivery box, hat,
      sign, backpack), procedural walk bob, head-turns-toward-guard cue.
 - [x] UI/feedback: inspection artifact cards, mode icons (flashlight/door/wand), escalation
      vignette, body-camera overlay (corner brackets + REC + shift clock).
 - [x] Assets convention documented in README; `test_asset_textures_present_and_pow2` guards
      the pipeline (57 tests total).
 - [ ] (remaining, in TODO) crowd performance profiling and LOD/culling when the crowd grows.
 ## CI — cache timeout mitigation
 - [x] Remove `actions/cache@v4` from the checks job (runner cannot reach GitHub's cache
@@ -218,3 +288,209 @@ Completed task sections moved from `TODO.md`. Sections are moved only when every
 - [x] Add visual and audio feedback per escalation level (colors, tones, shake).
 - [x] Add audio for crowd ambience, radio responses, and confirmation prompts.
 - [x] Externalize dialogue and UI text for localization.
 ## Generalized Game Asset Tooling
 - [x] Reuse the OpenRouter image backend for role-aware arbitrary asset generation.
 - [x] Add exact-dimension image crop and aspect-preserving resize commands.
 - [x] Audit existing assets for role-specific dimensions, aspect, alpha, and tile seams;
      report projection/perspective checks for visual review.
 - [x] Add automated tests and document asset-pipeline usage.
 ## Generated Asset Integration
 - [x] Regenerate the AI asset set at role-specific aspect ratios and dimensions.
 - [x] Audit, process, and wire every generated asset into the game runtime.
 - [x] Add screenshot auditing and refresh the README screenshot gallery.
 ## Access artifacts actually match the venue
 Completed in the working tree (uncommitted with the control pass). Headless **74/74**.
 - [x] Build artifacts from the event (`override_access`, carried items) and the venue policy,
      not from `NpcType` alone. (`src/core/access_loadout.gd`; spawn signal is
      `(profile, intent, npc_id, event)`.)
 - [x] Joke Shop: valid ID+ticket, ID without ticket, expired/missing ID. Recognition does not
      auto-grant on every `AUTHORIZED_GUEST`.
 - [x] Wand venues roll `carried_items` per spawn (seeded); override can force a pocket.
 - [x] Studio counterfeit / follow-through events carry `override_access`.
 - [x] `AccessVerifier.verify(..., already_screened)` so a screened guest is not still denied.
 - [x] Joke Shop / Studio `sidewalk` and `steps_end` waypoints so film/photo intents do not walk
      to the entrance.
 - [x] Wand shortcut is `C`, not `W`. Tests: `src/test/tests/test_access_loadout.gd`.
 ## Player control, focus ring, and radial action menu
 Completed 2026-10-31 with ADR-0007–0010. Headless **77/77**, plus a windowed smoke
 (`src/test/smoke_focus_radial.gd`) that opens the wheel and saves screenshots.
 ### Locomotion
 - [x] Wand off `W` (now `C` + wheel). `A`/`D` allow/deny only while inspect/wand is open
      (they step the wheel while it is open). `Q` remains a closed-menu polite shortcut.
 - [x] Accel/decel on walk; gravity only when airborne; `floor_snap_length` 0.3.
 - [x] Mouse look only while captured and `not input_locked`. Freeze walk+look while radial /
      inspect / wand / radio / review is up. Recapture on close.
 - [x] `cancel` (Esc / RMB) closes the top modal first; with nothing open, Esc toggles mouse
      capture and RMB does nothing.
 ### Focus and head ring
 - [x] Focus cone in `src/game/npc_focus.gd` (~10 m, ~10°). Closest-to-forward wins; occlusion
      ray skips building hits. `Tab` still cycles 12 m.
 - [x] 8-frame miss grace so walk-bob does not drop focus.
 - [x] Billboarded torus on `Rig/Head`; gold idle, brighter while the radial is open; `Label3D`
      `display_name`. HUD target line uses the display name, not the node name.
 - [x] Screen-center crosshair.
 ### Radial HUD
 - [x] `src/game/ui/action_radial.gd`: LMB or `Space` opens when someone is focused. Opening
      click ignored for 120 ms. Slices: raise hand, point, head shake, polite, inspect, wand
      (grey if no wand), warning, block, radio assist. Emergency stays on `R`.
 - [x] Highlight by mouse angle, or `A`/`D` / arrows. Click slice or `Space` confirms. `Esc` /
      RMB closes with no action (no recorder event).
 - [x] Inspect / wand / radio slices close the wheel then open the existing panels. Freeze until
      that panel closes.
 - [x] Number keys `1`–`6` still work when the wheel is closed.
 ### NPC display
 - [x] Procedural rig: neck, shoes, hair cap from seed, two eye spheres. Props, height
      variation, walk bob, notice-head-turn kept. Collision capsule scaled to rig height.
      Named `Head` is the ring attach point. Group `npc`.
 ### Input, copy, tests
 - [x] Named input map: `action_menu` (Space/LMB), `confirm` (Space/Enter), `cancel`
      (Esc/RMB), `inspect` (E), `wand` (C). `GameManager` uses `is_action_pressed`.
 - [x] Windowed smoke: focus ring + name, wheel open/step/confirm/cancel
      (`src/test/smoke_focus_radial.gd`, exits non-zero on failure).
 - [x] README controls table, smoke checklist, test count, implemented/not-yet lists.
 ## Visual polish — Skyline backdrop transparency
 Found during the control smoke test; verified with PIL analysis.
 - [x] Regenerated `assets/textures/game_ready/skyline.png` with transparent background
      (commented out opaque border line 234 in `tools/generate_textures.py`).
 - [x] Integrated backdrop into `WorldBuilder` via `_build_skyline_backdrop()`: creates a
      PlaneMesh with T_SKYLINE texture at Vector3(-80, 12, -50) behind the building.
 - [x] PIL verification confirms RGBA mode with transparent pixels in bottom rows.
 ## Runtime boot and spawn fixes
 Found while running the windowed smoke; all verified with a boot run and regenerated
 screenshots.
 - [x] `GameManager` did not compile: `radial` was typed `CanvasLayer`, so
      `radial.is_open` / `confirm_selected()` made `:=` inference fail. Typed as
      `ActionRadial` (the parse error would have broken the whole main scene).
 - [x] Camera sat at the guard's feet: `Head` had no height offset, and the new gravity pulled
      the guard to the floor. `Head` is now at y=1.6, and the guard spawns on the landing.
 - [x] Guard spawned inside the building collider and fell through the world. Building volume
      moved back to z ∈ [-8, -4] so the door / awning / marquee sit on its front face; the
      guard spawns in front of the door facing the street.
 - [x] Steps rose away from the door; treads now rise toward the entrance.
 - [x] Event scheduler was polled every physics frame (~60 Hz), spawning >1200 NPCs in
      seconds. `ShiftCoordinator` now accumulates time and pulls once per simulated second;
      regression test in `test_scenarios.gd`.
 - [x] Live NPCs capped at `MAX_LIVE_NPCS` (16); routine traffic is dropped at the cap and a
      scripted event evicts the oldest unfocused NPC.
 - [x] Removed the skyline backdrop planes (opaque black texture). Tracked as a follow-up in
      `TODO.md`.
 - [x] README screenshots regenerated with the fixed eye height and entrance staging.
 ## World and presentation follow-ups (found during the control smoke)
 Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session_shell.gd` and the windowed focus/radial smoke both pass.
 - [x] The skyline backdrop was removed: `assets/textures/ai/game_ready/skyline.png` has an
      opaque black background, so the planes rendered as black slabs with window dots. Re-add
      the backdrop only with a transparent asset or a keyed shader.
 - [x] Guard settles ~0.5 m above the ground after spawning on the landing. Check the capsule
      offset and the spawn `y`, and verify eye height while walking the steps.
 - [x] Steps and the landing are visual-only (no collider). The guard walks through them; add
      simple step colliders or restage the landing so it does not intersect the walk path.
 - [x] Marquee text (`STEP LINE`) is tiny from the sidewalk. Scale the Label3D up.
 - [x] Focus ring and name tag are small at 2–3 m. Consider a larger torus / font after a
      real playtest.
 - [x] NPC crowd cap (`MAX_LIVE_NPCS`) silently drops routine traffic at 16. Add a short
      despawn/lifetime for ordinary guests so the entrance does not fill up with standers.
 ## Session shell
 Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session_shell.gd` and the windowed focus/radial smoke both pass.
 The game boots into a live 900 s shift. `Save` declares `settings.json` and never uses it.
 `V` cycles venues by restarting the shift.
 - [x] Startup menu: pick venue, start shift, quit. Keyboard + click. Replaces `V` as the
      player-facing path (`V` may stay as a debug bind).
 - [x] Pause overlay when `Esc` releases the mouse (or a dedicated pause key): resume, restart
      shift, settings, quit to menu.
 - [x] Settings: mouse look sensitivity, persist through `Save` / `settings.json`. Load on boot.
 - [x] Shift review "Run another shift" returns to the venue menu, not a silent restart of the
      same scenario.
 ## Documentation drift
 Completed 2026-10-31 (working tree).
 - [x] README controls table, smoke checklist, test count, and implemented/not-yet lists
      refreshed for the control pass (77 tests).
 - [x] `PLAN.md` Tech Stack / Planned Commands still say GUT and GitHub Actions; the project
      uses `src/test/test_runner.gd` and `.gitea/workflows/build.yml`.
 - [x] MEMORY: door_staff_lines log through `GameManager`; 300 s default removed.
 ## Remaining PLAN verbs (radial exists)
 Completed 2026-10-31 (working tree). Headless **98/98**; `src/test/smoke_plan_verbs.gd` exercises all five verbs.
 - [x] Eye contact as a Level 1 action (PLAN / glossary). Distinct from raise-hand. Add a
      radial slice if it ships.
 - [x] "I recognize this person" is a player decision recorded as evidence, not a pre-attached
      artifact on every staff/guest type. Staff still auto-recognize when `override_access` is
      empty (`AccessLoadout`).
 - [x] Formal warning can activate the body-camera / security-light flag (PLAN Level 2). Overlay
      is currently always on; toggling should write an incident event.
 - [x] Blocking stations the guard between the person and the door (PLAN Level 3). Today it only
      sends `apply_player_action(BLOCKING)`.
 - [x] "Request reason for entry" as a Level 3 ask, with a short NPC reply from `dialogue_lines`.
 ## Crowd presentation
 Completed 2026-10-31 (working tree). Headless **105/105**; `src/test/smoke_crowd.gd` verifies rubbernecking and panic clearing. A 16-NPC entrance measured ~1.2 ms/frame (824 fps, vsync off), so no LOD/culling was added at the current cap.
 `CrowdSystem` is a mood/attention float. PLAN wants people watching, gathering, and panicking.
 - [x] On `aggressive_behavior` / `emergency_responder`, nearby idle NPCs stop and face the
      incident (rubberneck). On `crowd_panic`, they move away from the door.
 - [x] Profile a busy entrance with textured materials and props; add LOD or culling for distant
      NPCs if frame time drops.
 ## Emergency aftermath
 Completed 2026-10-31 (working tree). Headless **113/113**; `src/test/smoke_emergency.gd` covers the unjustified-call investigation, the evacuation aftermath, and the review copy.
 Responder outcomes (`command` / `restraint` / `evacuation` / `arrest`) are log lines. PLAN also
 wants evacuation, a closed street, and an investigation when the call was unjustified.
 - [x] `evacuation` outcome actually clears the entrance (NPCs leave, door stays locked).
 - [x] Unjustified emergency (low danger, no weapon) writes an investigation note on the shift
      review and applies the existing false-report / reputation hit.
 - [x] Review copy names the responder outcome, not only battery and crowd %.
 ## Body-camera replay
 Completed 2026-10-31 (working tree). Headless **120/120**; `src/test/smoke_timeline.gd` opens the timeline from the review, steps through every event, and returns to the review.
 - [x] Shift review: a timeline of recorded incident events (ADR-0005 already stores them).
      Scrub or step through; no live 3D replay required in the first version.
@@ -10,17 +10,142 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Eventing: no autoload signal bus. `ShiftCoordinator` owns an `EventBus` instance (`src/core/event_bus.gd`) passed to subsystems; subsystems emit only when a bus is assigned. Autoloads at parse time are unreliable under `--script`.
 - Static signals are not available in Godot 4.3 GDScript ("Expected func or var after static") — do not use them.
 - GDScript lambdas capture local variables **by value**; mutating a captured local inside a lambda does not affect the outer variable. Use member functions for accumulators in tests.
- Prototype shift duration defaults to 300 s for testing; production targets 10-15 minutes per PLAN.md.
+- Shift length is the scenario's `shift_duration_s` (900 s in all three venues). Tests and the screenshot tool override elapsed time; they do not change the default.
 - RNG: NPC reactions and event scheduling are seedable for deterministic tests.
 ## Handoff (read this first)
 - Repo: `/run/media/system/DATA/Documents/06-games/security-game`. Godot: `~/.local/bin/godot` (4.3.stable).
  Tests: `godot --headless --path . --script res://src/test/test_runner.gd` → **88/88**.
  Session shell smoke: `godot --headless --path . --script res://src/test/smoke_session_shell.gd` → exit 0.
  Windowed control smoke: `godot --path . --script res://src/test/smoke_focus_radial.gd` → exit 0.
 - `main` is in sync with origin. **v0.2.2** tags the session-shell + world-follow-up commit;
  CI builds the portable binaries, NSIS installer, and AppImage on the tag push.
 - Next work: `TODO.md` NPC theater poses (sit/photo/perform), then audio and accessibility.
 - Do not re-open `override_access`. Do not bind wand to `W`. Do not remove the radio easter egg.
 ## Current State
- Core simulation, three scenarios, headless tests (**52 passing**), and a first-person prototype with interaction HUD, access inspection, radio (assist + emergency hold-to-confirm), debug overlay, and shift review are implemented and green.
+- Access artifacts: `src/core/access_loadout.gd` builds from event `override_access` + venue policy.
  Spawn signal is now `(profile, intent, npc_id, event)`. Recognition is not auto-attached to every
  guest. `AccessVerifier.verify(..., already_screened=false)` so Joke Shop scoring uses
  `controller.screened`. Joke Shop/Studio gained `sidewalk`/`steps_end` waypoints. Wand venues roll
  `carried_items` per spawn (seeded). Tests in `src/test/tests/test_access_loadout.gd`.
 - Wand shortcut is **`C`**, not `W` (`W` is walk). `radio_emergency` input map no longer includes W.
  `hud.controls` / `hud.screen_first` updated.
 - Control pass (in tree, uncommitted, smoke-tested): cone focus via `src/game/npc_focus.gd`,
  accel/decel, gravity only airborne, `input_locked` freeze, Esc no longer on the guard.
  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; torus head ring + `Label3D` name; `set_focus_visual`.
  `src/game/ui/action_radial.gd` doughnut (LMB/Space open, A/D/arrows, Space/click confirm, Esc/RMB
  cancel). Crosshair CanvasLayer. Emergency still `R` only. Number keys 1–6 when the wheel is closed.
 - Named input actions now exist and are used: `action_menu`, `confirm`, `cancel` (Esc + RMB),
  `inspect` (E), `wand` (C). The old unused `interact` action was removed.
 - Runtime fixes from the smoke: `Head` is +1.6 above the guard root (root sits on the floor); guard
  spawns in front of the door facing the street; building volume moved to z ∈ [-8,-4] so the door,
  awning, and marquee are visible; step treads rise toward the door; `ShiftCoordinator` pulls the
  event scheduler once per simulated second (was every physics frame → >1200 NPCs in seconds);
  `GameManager.MAX_LIVE_NPCS = 16` caps live avatars.
 - **Session shell (2026-10-31, uncommitted):** the game now boots into `StartMenu`
  (`src/game/ui/start_menu.gd`, layer 20) instead of a live shift. `GameManager._on_venue_selected()`
  builds the scenario and calls `_start_shift()`; `_shift_running` gates input and `_refresh_freeze()`.
  Esc with nothing open now pauses (`PauseOverlay`, layer 18) → resume / restart / settings /
  quit-to-menu. `SettingsPanel` (layer 22) writes `look_sensitivity` + `hud_font_scale` through
  `Save.save_settings()` → `user://settings.json`; `Save.load_settings()` merges over
  `Save.DEFAULT_SETTINGS` on boot and `GameManager._apply_settings()` pushes them into the guard/HUD.
  Shift review "Run another shift" now calls `_show_start_menu()` (not a silent restart). `V` stays a
  debug venue bind. Smoke: `src/test/smoke_session_shell.gd` (menu → shift → pause → settings → menu).
 - **World follow-ups closed (2026-10-31):** skyline backdrop restored with `T_SKYLINE`
  (`assets/textures/skyline.png`, regenerated RGBA with a transparent sky) and an
  `TRANSPARENCY_ALPHA_SCISSOR` unshaded material (`_skyline_mat`); steps + landing are a
  `StaticBody3D` with per-tread `BoxShape3D` colliders; marquee `font_size` 160 / outline 24; focus
  torus 0.26–0.34 + name tag 48px; `NpcAvatar.ephemeral`/`lifetime_s` despawns routine traffic
  (authored events stay). Guard spawn height verified on the landing (guard_y=0.84).
 - **PLAN verbs (2026-10-31, uncommitted):** the radial now has 12 slices
  (`Stop, Look, Point, No, Ask, Inspect, Wand, Warn, Block, Reason, Recognize, Radio`).
  `eye_contact` reuses the Level 1 reaction table via `_apply_interaction`. Recognition is a player
  decision: `NPCController.player_recognized` + `IncidentRecorder.add_access_evidence`, and
  `GameManager._artifacts_for()` prepends a `RECOGNITION` artifact only after the player declares
  it. The body camera is a real flag (`GameManager.body_camera_on`, `Hud.set_body_camera`), off by
  default, `B` toggles it, and a formal warning arms it and writes a `body_camera` incident event.
  Blocking also calls `_station_between()` to physically place the guard 0.9 m from the NPC toward
  the entrance. `_request_reason()` logs the NPC's seeded `dialogue_lines` pick.
 - **NPC navigation was dead (fixed 2026-10-31):** avatars never moved in the live game, for three
  stacked reasons. (1) `agent.target_position` was re-assigned every physics frame, which
  invalidates the path so `get_next_path_position()` keeps returning the current point — only set
  it when the target changes. (2) Nav path points sit on the navmesh plane (y=0) while bodies stand
  at y≈0.5, so a 3D "are we there" test always looked 0.5 m away and the horizontal direction was
  zero — compare horizontally. (3) `path[0]` is the old start point, so picking any point "far
  enough away" can pick the point behind you and oscillate — pick the first point that is
  **closer to the goal** than the current position. `_nav_try_frames`/`_move_direct` fallback is
  still there.
 - **Crowd reactions listen on the EventBus:** `CrowdSystem.apply_event()` emits
  `event_bus.crowd_changed`; its own `changed` signal is never emitted. `GameManager._connect_crowd()`
  therefore connects to `coordinator.event_bus.crowd_changed` (reconnect after every
  `coordinator.setup()`, which recreates both crowd and event bus).
 - **Crowd presentation:** `NpcAvatar.start_rubberneck(at)` (idle bystanders away from the door stop
  and face the incident for 12 s) and `start_flee(from)` (panic: walk away at 2.4 m/s, then free
  themselves). Someone `awaiting_interaction` within 3 m of the door is "engaged" and does not
  rubberneck. Use `position` (not `global_position`) for that distance check so it also works in
  headless tests outside the tree.
 - **Perf:** a busy 16-NPC entrance measured ~1.2 ms/frame (824 fps with vsync off, 800 samples),
  so LOD/culling is not warranted at `MAX_LIVE_NPCS = 16`. Re-measure before raising the cap.
 - **Incident recording was dead:** `IncidentRecorder.start_incident()` was never called, so every
  `add_event`/`add_access_evidence` silently no-opped and the review always showed 0 incidents.
  `_begin_incident()` now starts one per focused NPC (`has_open_incident()` guard), verbs call
  `_ensure_incident()`, and `ShiftCoordinator._finish_shift()` closes leftovers as `unresolved`
  before building the review.
 - **Body-camera timeline (2026-10-31):** `src/game/ui/event_timeline.gd` flattens
  `review.incidents.incidents[].events` into one time-ordered list (`flatten`), formats each row
  with `describe`, and steps with Left/Right or the buttons. `ShiftCoordinator.started_at_ms`
  gives the review an absolute start for mm:ss stamps. `GameManager._open_timeline` hides the
  review dim (two stacked overlays made the screen nearly black) and `_timeline_from_review`
  restores it on close. Smoke: `src/test/smoke_timeline.gd`.
 - **Radio dispatch was dead after the first shift:** `coordinator.setup()` builds a new
  `RadioSystem`, so the `responder_arrived` connection made in `_ready` was lost on every venue
  switch/restart (responders never resolved anything). `_connect_radio()` now re-wires it next to
  `_connect_crowd()` after every setup. Same class of bug as the crowd signal.
 - **Emergency aftermath:** `ShiftCoordinator.responder_outcomes` / `investigations` feed the review.
  `evacuation` (emergency call, low danger, no weapon) locks the door, makes every NPC flee, marks
  them `leave_requested`, and applies a `security_failure` hit. An emergency placed while
  `current_npc_truth` has no weapon and `danger_level <= 1` appends an investigation note, records
  `investigation_opened`, and applies `false_report` -6.
 - **Skyline backdrop (2026-10-31):** `PlaneMesh` defaults to a **horizontal** XZ plane — set
  `mesh.orientation = PlaneMesh.FACE_Z` or the "backdrop" renders as a band overhead. The skyline
  is now a ring of four 400x60 planes at 200 m (center y=30, so building bases meet the ground),
  `TEXTURE_FILTER` default, `TRANSPARENCY_ALPHA_SCISSOR` with threshold **0.5** (0.3 left faint
  mip dashes across the sky), unshaded with a lifted albedo (`Color(2.6,2.7,3.0)`) so it is not
  pure black. Ground is 500x500 so no sky gap shows under the buildings. The `skyline.png` import
  needs `mipmaps/generate=true`.
 - **Asset gotcha:** `assets/textures/game_ready/` is *not* imported (no `.import`). Use the
  imported `assets/textures/skyline.png` path. Untracked duplicate folder should not be referenced.
 - Host sign-in follow-up remains deferred. PLAN.md + ADRs 0007–0010 still describe the intended UX.
 - **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
  and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
 - NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines
  (never `/D`), resolves relative `-DICON`/`-DARTIFACT` against the **script directory** so CI
  passes `$PWD`-absolute paths; installed exe must be space-free (`step-line.exe`); ICO must be
  classic BMP entries (ImageMagick `icon:auto-resize=48,32,16`; PIL emits PNG-compressed ICOs NSIS
  cannot load).
 - appimagetool runs system `appstreamcli` if present (strict, exit 3 on warnings) — project
  metadata now passes `--pedantic`.
 - Distribution facts (verified via Gitea API + host creds): repo is **public**, account is
  admin; `v0.2.1` has all 5 assets; the installers were initially missing from the release
  because `publish_release.sh` uploaded only portables — now fixed (uploads installer +
  AppImage; falls back to `~/.git-credentials` when no `GITEA_TOKEN`).
 - Host sign-in: instance `[service] REQUIRE_SIGNIN_VIEW=true` blocks anonymous browse/download
  (not a repo/API setting). `~/.git-credentials` holds the Gitea creds (basic-auth usable);
  `.env` only holds `OPENROUTER_API_KEY`.
 - **Release v0.2.0 was LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
  and publish automatically (host has the `GITEA_TOKEN` secret). Tag page and `/releases` are
  public (HTTP 200). Caveat: anonymous **asset downloads** redirect to login on this host
  (host setting — tracked in TODO). Future releases = bump `config/version`, `git tag vX.Y.Z`,
  push. No local token needed.
 - Core simulation, three scenarios, v0.2.1 installers/AppImage, first-person prototype (inspect/wand/radio, shift review, Tab targeting, V venue cycle) are on local `main`. Tagged v0.2.1 was 57 tests; this working tree is **74/74**.
 - NPC avatars now walk to per-intent waypoints (`VenueScenario.waypoint_for_intent`): enter/trespass/deliver/arrive → entrance, photo/film/perform/wander/roam → sidewalk, sit → steps_end. `NpcAvatar.setup` takes an explicit `door_position`.
 - Returning-trespasser behavior: `NpcProfile.return_probability` (trespasser 0.6, mental-crisis 0.4, others 0). `NPCController._maybe_schedule_return()` moves a directed-away NPC to `LOITERING_DISTANT`; `tick_return(delta)` fires after 20-60s and transitions back to `APPROACH`. `NpcAvatar._advance_fsm` re-targets the door on return.
 - Perception pass: `NPCController.perceive_guard(distance)` returns `{noticed, band, reaction}` with bands `unaware` (>6m), `aware` (2-6m), `near` (<2m). Near + temperament ≥0.6 → ARGUE, else COMPLY. `GameManager._perception_pass()` feeds real guard distance each physics tick and logs first-time notice.
 - Responder dispatch: `RadioSystem` tracks `pending_calls` and decrements `arrival_delay_s` in `tick`; emits `responder_arrived` when a call's delay elapses. `RadioSystem.responder_outcome(call)` maps danger/weapons → command/restraint/evacuation/arrest. `GameManager._on_responder_arrived` spawns a `RESPONDER` avatar at the entrance and logs the outcome. HUD shows an emergency-radio cooldown label via `_update_radio_cooldown`.
- Wand screening (Joke Shop): `WandScreener` (new `src/core/wand_screener.gd`) classifies carried items as prohibited (`weapon/knife/gun/blade`) vs false-alarm (`keys/belt/phone/coins/watch/buckle`) vs clear. `NpcProfile.carried_items` holds guest items. `GameManager` binds `W` to `_toggle_wand_screening` and `A`/`D` to `decide_wand`; `decide_access` blocks admission at wand venues until `controller.screened` is true. `VenueScenario.door_staff_lines` holds venue-specific door-staff dialogue (Joke Shop has id/ticket/wand/refusal/prohibited lines).
+- Wand screening (Joke Shop): `WandScreener` classifies carried items as prohibited vs false-alarm vs clear. `NpcProfile.carried_items` is filled at spawn on wand venues. `GameManager` binds **`C`** to `_toggle_wand_screening` and `A`/`D` to `decide_wand` while inspect/wand is open. `decide_access` still blocks admission until `controller.screened` is true, and `verify` now takes that flag. Door-staff lines log through GameManager.
 - Design change (2026-10-31): the selectable dialogue tone-of-voice system was **removed**.
  `Rules.Tone`/`TONE_NAMES`, `NpcProfile.tone_modifiers`, and the tone param on
  `NPCController.roll_reaction/apply_player_action` no longer exist; `NpcProfile.dialogue_lines`
@@ -51,24 +176,95 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  street lamps + night mode in WorldBuilder.set_night_mode, marquee Label3D, crosswalk/planters/
  trees, NPC per-seed variation. capture_screenshots.gd shoots day + fast-forwarded LATE night
  (6 shots in docs/screenshots/). Version bumped to 0.2.0; binaries rebuilt.
 - Assets pipeline: `python3 tools/generate_textures.py` produces all authored PNGs under
  `assets/textures/` (≤1024px, pow2); regenerate after changing the script, then run
  `godot --headless --import` before tests. 57 headless tests guard the pipeline.
 - General image pipeline: `python3 tools/asset_pipeline.py` defaults to
  `openai/gpt-5-image-mini`, requests supported 1:1/3:2 sources, then fits each role's target.
  It provides crop, resize, tile edge blending, alpha-glyph recoloring, and role-aware audits.
  Screenshot auditing checks 1280x720 minimum, 16:9 aspect, and contrast; visual composition
  remains a manual check. Python tools require Pillow from `requirements-tools.txt`.
 - AI texture mode: `python3 tools/generate_textures.py --ai` generates textures via the
  OpenRouter image API (`POST https://openrouter.ai/api/v1/images`, model
  `bytedance-seed/seedream-4.5` by default, base64 PNG in `data[].b64_json`). Requires
  `OPENROUTER_API_KEY` (a gitignored `.env` in the repo root holds it locally; source it
  with `set -a && . ./.env && set +a`). `--prompt`/`--name`/`--model`/`--size` override the
  default batch. Output is downscaled to ≤1024px. NOTE: seedream rejects sizes below
  3,686,400 px (1920×1920), so the script requests `GEN_SIZE=2048` and downscales — do not
  lower `GEN_SIZE` below 1920. Verified end-to-end 2026-10-31 (3 textures generated).
  Legacy `--ai` remains on Seedream 4.5 and still ignores `background: transparent`; do not
  use it for alpha-dependent assets. Gemini 3.1 Flash Image advertised broad ratios but the
  current provider rejected authentication. The validated role-aware model is GPT-5 Image Mini.
 - Runtime assets: all 15 loaded world/HUD/card textures now live in
  `assets/textures/ai/game_ready/`; each passes role audit. Generated tile edges are blended,
  icon alpha masks are recolored white where needed, and the vignette uses the existing
  deterministic generator because the API returned an empty transparent image. The six
  `docs/screenshots/` captures were regenerated after wiring and pass screenshot audit.
 - Detailed graphics: textured facade/awning/skyline, humanoid NPC rigs + props + walk bob +
  attention head-turn, inspection artifact cards, mode icons, escalation vignette, body-cam
  overlay (REC + shift clock). Screenshot set regenerated (`docs/screenshots/`, day + night).
 - Polish: wand scan cooldown (`WAND_COOLDOWN_S` + `wand.recharge` message).
 - NOTE: collaborators occasionally add uncommitted work to this shared tree (e.g. the radio
  easter egg); check `git status` before committing and leave foreign changes untouched unless asked.
 - Screen-design references (`tools/screen_designs.py`, tests in `tools/test_screen_designs.py`):
  `generate` turns the screen descriptions in `docs/` (README captions, ADRs 0007–0010,
  PLAN, architecture) into reference images under `docs/screens/designs/` — `--draft`
  draws offline Pillow wireframes, `--ai` generates realistic 3D scenes / in-game UI via
  OpenRouter (default model `openai/gpt-5-image-mini`). Screens are tagged `scene` or
  `ui`; prompts get a shared art-direction suffix, and requests use a 3:2 landscape
  source cropped to 16:9 (not a square centre-crop). `compare` checks `docs/screenshots/*.png` for aspect/size/
  blank-frame and coarse layout/palette/detail drift. Drift distances are warnings, not
  failures: a mockup never matches a real render, so semantic composition is a follow-up
  vision-model judge (tracked in TODO).
 ## Known Issues / Notes
- RefCounted reference cycle: `NPCController` holds an `FSM` that holds a back-reference to its owner, so test suites report "resources still in use at exit". Benign (process exit), but worth breaking later (e.g. `WeakRef` or explicit `dispose()`).
+- Reference cycles are fixed: `FSM` holds its owner via `WeakRef`, `ShiftCoordinator` is
  `RefCounted`, and persistence tests free the `Save` node — the suite exits with no
  "resources still in use" warnings (was ~13). If a future subsystem introduces a cycle,
  repeat the WeakRef pattern.
 - Shift length: `GameManager` uses the scenario's `shift_duration_s` (900s ≈ 10-15 min);
  tests and the screenshot tool override elapsed time directly.
 - Headless (dummy renderer) logs "Parameter m is null" from `mesh_get_surface_count`; it does not occur with a real GL driver and does not affect logic.
 - Steps are visual-only (no collider) so NPCs can path to the entrance; the guard spawns on the landing so it never needs to climb.
 - Persistence tests write into the real `user://shift_results.json` (harmless local pollution of the demo history).
 - macOS export required `rendering/textures/vram_compression/import_etc2_astc=true` in `project.godot` (universal build demands ETC2 ASTC enabled).
- Joke Shop `door_staff_lines` authored but not yet surfaced in the prototype UI (tracked in TODO).
+- Joke Shop `door_staff_lines` are logged through `GameManager` (inspect / wand / refuse). They are not a separate dialogue UI.
 - Access loadout is implemented in the working tree (see Current State); do not re-fix `override_access` as if it were still unread.
 - `Save.SETTINGS_FILE` is declared and unused; no mouse-sensitivity or pause menu yet.
 - Headless suite is **77/77**; the windowed focus/radial smoke passes. Remaining visual follow-ups are at the top of `TODO.md`.
 - Typed spawn signal extra args: handlers must accept the 4th `event: Dictionary` or Godot will not call them (`test_shift_coordinator_runs_a_shift` failed until `_on_spawn` took four args).
 - GDScript inference trap that broke the main scene: a `var` typed as a base class
  (`radial: CanvasLayer`) exposes script members as `Variant`, so `var x := radial.is_open` is a
  parse error. Type it as the script type (`ActionRadial`) or annotate the local explicitly.
  `--check-only --script` cannot see the `Save` autoload; use a real boot (`--quit-after 180`) to
  verify a full-scene compile.
 - Do not snapshot right after changing a transform in the same frame: `capture_screenshots.gd`
  needs a state/frame gap or the capture uses the old camera orientation.
 - `EventScheduler` probabilities are per simulated second, not per call. Never poll it per frame.
 - Screenshot staging lives in `src/test/capture_screenshots.gd` (guard at z≈10.5 facing the door).
  `docs/screenshots/` copies are manual: copy from `user://screenshots/`.
 ## Open Questions
 - Add a vision-model (LLM) judge on top of the screen-design comparison: pixel and
  perceptual metrics cannot decide whether a screenshot's composition is correct.
 - Whether the responder avatar should be playable/controllable or purely scripted.
 - Localization target languages beyond English.
 - macOS notarization approach for broad distribution.
-## Plan vs TODO Gaps (evaluated 2026-10-31, all resolved)
+## Plan vs code (re-evaluated)
-All previously identified gaps are now implemented and covered by tests/smoke items: PROTESTER archetype, door lock/secure, flashlight, CALL_SOMEONE reaction, LATE phase fix, shift-result persistence, NavigationAgent3D movement, and JSON-backed localization. Remaining backlog lives in `TODO.md`.
+On local `main` (6 commits not on origin): v0.2.1 packages, ADRs 0007–0010, asset pipeline wired to
 `assets/textures/ai/game_ready/`, screenshots refreshed.
 Uncommitted: `AccessLoadout`, control pass (cone, ring, radial, NPC face, named input actions),
 and boot/spawn fixes. Headless 77/77; windowed smoke passes. Access-artifact and control-pass
 sections moved to `DONE.md`.
 Still in `TODO.md`: world follow-ups (guard float, step colliders, skyline asset, marquee size);
 session shell; leftover PLAN verbs; crowd rubberneck; emergency aftermath; body-cam replay;
 sit/photo/film poses; real crowd audio; Joke Shop/Studio extra events; PLAN.md says GUT/GitHub.
 <!-- b64: RWFzdGVyIGVnZzogYSByYXJlIHJhZGlvIHRyYW5zbWlzc2lvbiAiwr9Ew7NuZGUgZXN0w6EgbGEgbW90YT8iIGZpcmVzIHZpYSBHYW1lTWFuYWdlci5fbWF5YmVfcmFkaW9fZWFzdGVyX2VnZyAoMi41JSBjaGFuY2UgYWZ0ZXIgYSBzdWNjZXNzZnVsIHJhZGlvIGNhbGwpLiBTdHJpbmcga2V5IHJhZGlvLmVhc3Rlcl9lZ2cgaW4gY29udGVudC9zdHJpbmdzLmVuLmpzb24uIERvIG5vdCByZW1vdmUu -->
@@ -432,13 +432,15 @@ The venue-driven architecture maps onto Godot as follows:
 ## Testing
- Unit and scenario tests use the GUT (Godot Unit Test) framework.
+- Unit and scenario tests use a lightweight custom headless runner
  (`src/test/test_runner.gd`). GUT was evaluated but requires the editor plugin.
 - Tests run in headless mode so rules, access verification, escalation, and scoring can be verified without rendering or user input.
 ## Version Control and CI
 - Source is tracked with git.
- GitHub Actions runs headless Godot tests and, in later stages, exports desktop builds.
+- Gitea Actions (`.gitea/workflows/build.yml`) runs headless Godot tests on push/PR and exports
  Linux/Windows/macOS desktop builds plus the NSIS installer and AppImage on tags.
 ## Planned Commands
@@ -446,12 +448,148 @@ The following commands apply once the Godot project is scaffolded:
 - Open the editor: `godot --editor --path .`
 - Run the game: `godot --path .`
- Run tests headlessly via GUT.
+- Run tests headlessly: `godot --headless --path . res://src/test/test_runner.tscn`
 ## Export Targets
 Desktop is the first target: Windows, Linux, and macOS. Web export is a later option.
 ## Player Control, Focus, and Action Menu (next pass)
 The prototype already walks and looks in first person, but the control scheme fights itself and targeting is a hairline. This pass replaces that with three things that belong together: solid locomotion, a visible focus on a person, and a round action menu for what to do with them.
 Decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md) locomotion and input layers, [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md) cone focus and head ring, [ADR-0009](docs/adr/0009-radial-action-menu.md) radial action menu, [ADR-0010](docs/adr/0010-procedural-npc-presentation.md) procedural NPC presentation.
 ### What is wrong today
 - `W` is walk-forward in the input map and wand-screening in `GameManager._handle_key`. Walking at someone with a wand venue fires the wand.
 - `A` / `D` are strafe and also allow/deny during inspection.
 - `Q` is polite direction and is also bound as `cancel`.
 - Focus is an 8 m physics ray from the camera. Missing a capsule by a few pixels clears the target. There is no mark in the world that you have someone.
 - NPC bodies are colored capsules with props. They read as markers, not people.
 - Actions live on number keys `1`–`6` plus `Q` / `E` / `W` / `R`. That is a cheat-sheet, not a verb you pick while looking at a person.
 - `Esc` only toggles mouse capture. There is no "I changed my mind" for an action in progress.
 ### Movement and look
 Keep first-person WASD + mouse look. Fix the feel and stop stealing those keys.
 - Body yaw from mouse X, head pitch from mouse Y, pitch clamped (already `-80` to `80`).
 - Move relative to body yaw only (already). Add short acceleration / deceleration so starts and stops are not instant.
 - Gravity only when `not is_on_floor()`; `floor_snap_length` so the steps work.
 - Mouse look runs only while `MOUSE_MODE_CAPTURED` and no modal UI is open (radial, inspection, wand, radio, shift review).
 - Walk speed stays around 3.2 m/s. No sprint, no crouch in this pass.
 - While the radial is open: freeze look and WASD so `A` / `D` can cycle the menu. Recapture the mouse when the menu closes.
 - `Esc` with a modal open closes that modal and does nothing else. `Esc` with nothing open keeps the current capture/release toggle.
 Equipment stays on its own keys because it is not about a person: `G` flashlight, `L` door lock, `Tab` cycle nearby people, `V` venue (debug), `F` debug overlay. `R` stays the dedicated emergency radio (hold-to-confirm on the existing panel). Those do not go on the wheel.
 Wand leaves `W`. It is a slice on the wheel (greyed when the venue has no wand) and an optional extra key that is not WASD, suggested `C`.
 ### Focus area
 Replace the hairline ray as the primary picker.
 - A **focus cone** in front of the camera: people within about 10 m whose head projects inside a screen-space circle around the crosshair (about 90 px / 10 degrees).
 - If several heads sit in the circle, pick the one closest to the center, then the nearer one if tied.
 - The person must be in front (dot with camera forward > 0) and not fully occluded by the building. A short ray to the head is enough for occlusion.
 - `Tab` still cycles people inside 12 m as the aim-free path. Cycling sets the same focused person the cone would.
 - Clearing: look away until the head leaves the circle for a few frames (small grace so a bob does not drop them), or they walk out of range.
 ### Head ring
 When a person is in focus, draw a thin ring around their head.
 - Attach to the avatar `Head` node, sitting just above the skull, billboarded to the camera so it stays a circle on screen.
 - Slow spin is fine; no ping-pong scale spam.
 - Idle focus: pale gold, modest size. Radial open on that person: brighter, slightly larger.
 - Optional small name under the ring (`display_name` only, not the archetype cheat `Violent Threat` in the world). The existing HUD target line can keep the archetype for the prototype.
 - One ring at a time. Everyone else has none.
 Implementation sketch: `MeshInstance3D` torus or a thin unshaded ring mesh on the avatar, toggled from `GuardController` / `GameManager` when focus changes. Screen-space fallback (unproject head, draw a `Control` circle) is acceptable if the 3D torus z-fights on hats.
 ### Round action HUD
 A doughnut / pie menu centered on the screen, opened on the focused person.
 **Open**
 - Left mouse button, or `Space`, while someone is in focus and no other modal is open.
 - If nobody is in focus, log the existing "aim first" line and do not open.
 - The click that opens the menu must not also pick a slice.
 **While open**
 - Mouse becomes visible. Look and walk freeze.
 - Center of the doughnut shows the focused person's `display_name`.
 - Slices, clockwise from the top, de-escalation first:
  1. Raise hand (stop / wait)
  2. Point away
  3. Head shake
  4. Polite direction (old `Q`)
  5. Inspect access (old `E`)
  6. Wand (grey if the venue has no wand)
  7. Formal warning
  8. Block
  9. Radio assist
 - Emergency is **not** on the wheel (`R` only).
 - Highlight follows the mouse angle when the cursor is over the ring. `Left` / `Right` or `A` / `D` step the highlight. Wrap around.
 **Confirm**
 - Click a slice: that action runs, menu closes, mouse recaptured.
 - `Space` while a slice is highlighted: same.
 - Inspect or wand: close the wheel, then open the existing inspect / wand panel. Allow / deny on that panel stay `A` / `D` (walk is frozen only while the wheel is up; once the inspect panel is open, WASD can move again, so allow/deny on `A` / `D` remains a press handler and must ignore repeats / echo, which it already does). Safer: keep walk frozen for inspect/wand too, until the panel closes. Prefer freeze until the whole interaction ends.
 - Radio assist: close the wheel, open the existing radio panel.
 **Cancel**
 - `Esc` or right mouse button: hide the menu, no action, no recorder event, recapture mouse.
 - Focus and the head ring stay as they were.
 Number keys `1`–`6` may remain as shortcuts that skip the wheel so a smoke-test script still works. They must not fire while the wheel is open (the wheel owns `A` / `D` / `Space`). Document both in the README.
 ### NPC display
 Stay on the procedural capsule rig (no Mixamo / GLB dependency this pass). Make them read as people at conversation distance.
 - Neck between torso and head; shoes; simple hair cap (color from seed); two dark eye spheres on the face so a head has a front.
 - Keep archetype props (camera, box, hat, sign, bag). Keep height / brightness variation from the visual seed.
 - Collision capsule matches the scaled height so the focus ray / cone hits the body you see.
 - `Head` stays a named node other systems can find (`get_node("Rig/Head")`) for the ring and the cone.
 - Walk bob and the "look at the guard when noticed" cue stay.
 - Do not put the internal type name (`Trespasser`, `Violent Threat`) on the body. The player should judge from clothes, props, and behavior. The debug overlay (`F`) can still print the type.
 AI textures in `assets/textures/ai/` stay out of this pass unless a specific map (shirt, hair) is already the right size.
 ### Input map (target)
 | Action | Bind |
 | --- | --- |
 | Walk | WASD / arrows (arrows **do not** walk while the wheel is open; they step the highlight) |
 | Look | Mouse, captured |
 | Open / confirm action menu | LMB, `Space` |
 | Cancel menu | RMB, `Esc` |
 | Step highlight | `A` / `D`, left / right arrows |
 | Emergency radio | `R` |
 | Flashlight | `G` |
 | Door lock | `L` |
 | Cycle nearby people | `Tab` |
 | Wand shortcut | `C` (not `W`) |
 | Inspect shortcut | `E` still allowed when the wheel is closed |
 ### Files this pass is expected to touch
 - `src/game/guard_controller.gd` — cone focus, no look while modal, accel, floor snap.
 - `src/game/npc_avatar.gd` — face / hair / neck, head marker, ring toggle.
 - `src/game/ui/action_radial.gd` — new Control, `_draw` doughnut, slice pick.
 - `src/game/ui/hud.gd` — host the radial; stop teaching number-key verbs as the only path.
 - `src/game/game_manager.gd` — input routing, freeze flags, open/confirm/cancel.
 - `project.godot` — input map.
 - `src/core/strings.gd` — controls line, aim-first, no new tone-of-voice.
 - `src/test/tests/test_focus_and_radial.gd` — cone pick, wrap, cancel emits nothing, `W` is not wand.
 - README controls table and smoke checklist.
 ## Design Direction
 The game should feel like a tense workplace simulation with occasional crisis moments. The most satisfying outcome is not overpowering an NPC; it is recognizing the situation early and resolving it calmly.
@@ -20,16 +20,24 @@ The central design goal is simple:
 | Platform | Package |
 | --- | --- |
-| **Windows** | [`step-line-windows.exe`](https://git.allucanget.biz/zwitschi/security-game/releases) · 64-bit, no install needed |
+| **Windows — installer** | [`step-line-setup-<ver>.exe`](https://git.allucanget.biz/zwitschi/security-game/releases) · contains all game data, shortcuts + uninstaller |
-| **Linux** | [`step-line-linux.x86_64`](https://git.allucanget.biz/zwitschi/security-game/releases) · 64-bit, `chmod +x` and run |
+| **Windows — portable** | [`step-line-windows-<ver>.exe`](https://git.allucanget.biz/zwitschi/security-game/releases) · 64-bit, no install needed |
-| **macOS** | [`step-line-macos.zip`](https://git.allucanget.biz/zwitschi/security-game/releases) · unsigned build, quarantine note below |
+| **Linux — AppImage** | [`step-line-<ver>-x86_64.AppImage`](https://git.allucanget.biz/zwitschi/security-game/releases) · single file, `chmod +x` and run |
 | **Linux — portable** | [`step-line-linux-<ver>.x86_64`](https://git.allucanget.biz/zwitschi/security-game/releases) · 64-bit, `chmod +x` and run |
 | **macOS** | [`step-line-macos-<ver>.zip`](https://git.allucanget.biz/zwitschi/security-game/releases) · unsigned build, quarantine note below |
 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>
-> Releases are built automatically by Gitea Actions when a `vX.Y.Z` tag is
+> **Latest: v0.2.6** — body-camera timeline in the shift review, stepping through every recorded
-> pushed (see [`docs/RELEASING.md`](docs/RELEASING.md)). Manual builds are
+> incident event.
-> produced with `./tools/build_releases.sh`.
+> Releases are built automatically when a `vX.Y.Z` tag is pushed
-
+> (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline
 > (NSIS + appimagetool) and uploads with the portable binaries.
 >
 > Note: on this host, downloading release files currently requires sign-in;
 > the page and tag URLs are public.
 >
 > macOS builds are unsigned: right-click → Open, or clear the quarantine with
 > `xattr -dr com.apple.quarantine step-line-macos.zip`. Build instructions and
 > the release pipeline live in [`docs/RELEASING.md`](docs/RELEASING.md).
@@ -129,10 +137,82 @@ The architecture maps onto Godot 4 nodes, scenes, and custom resources as descri
 - **Navigation:** `NavigationRegion3D` and `NavigationAgent3D`
 - **NPC behavior:** Custom lightweight finite state machines driven by `NpcProfile` resources
 - **UI and audio:** Godot `Control` nodes, themes, audio buses, and `AudioStreamPlayer` nodes
 - **Art assets:** authored PNGs and the in-game generated set in `assets/textures/ai/game_ready/`; structural geometry stays procedural (`WorldBuilder`). The legacy `tools/generate_textures.py --ai` batch remains available.
 - **Asset tooling:** `tools/asset_pipeline.py` generates role-aware assets through OpenRouter and provides crop, resize, seamless-tile, and image-audit commands, including gameplay screenshot checks.
 - **Testing:** GUT (Godot Unit Test) in headless mode
- **Source control:** git with GitHub Actions for headless tests and later desktop exports
+- **Source control:** git on a Gitea host with Gitea Actions (`.gitea/workflows/build.yml`) for headless tests and desktop release builds
 - **Targets:** Windows, Linux, and macOS desktop first; web later
 ### Image Asset Tools
 Install the Pillow dependency used by the existing texture generator and the asset tools:
 ```bash
 python3 -m pip install -r requirements-tools.txt
 ```
 Generate a role-sized image (generation requires `OPENROUTER_API_KEY`):
 ```bash
 python3 tools/asset_pipeline.py generate --prompt "weathered red brick" --role tile --output assets/textures/brick_extra.png
 ```
 Generated images are resized to the selected role profile. Non-square requests use
 the validated `openai/gpt-5-image-mini` source ratio and crop to the final role dimensions.
 Transparent glyphs can be recolored while preserving their alpha mask with
 `--foreground '#ffffff'`.
 Crop uses the image center by default; `--x` and `--y` select an explicit crop origin. Resize defaults to aspect-preserving `contain`; use `--fit cover` to crop or `--fit stretch` to distort to the exact dimensions.
 ```bash
 python3 tools/asset_pipeline.py crop assets/textures/source.png assets/textures/crop.png --width 256 --height 128
 python3 tools/asset_pipeline.py resize assets/textures/source.png assets/images/backgrounds/scene.png --width 1920 --height 1080 --fit cover
 python3 tools/asset_pipeline.py seamless assets/textures/rough_tile.png assets/textures/tile.png
 ```
 Audit accepts image files or directories. `--role auto` infers common roles from paths and filenames; explicit roles include `tile`, `texture`, `icon`, `card`, `banner`, `backdrop`, `background`, `overlay`, `app_icon`, and `screenshot`.
 ```bash
 python3 tools/asset_pipeline.py audit assets/textures
 python3 tools/asset_pipeline.py audit assets/images/backgrounds --role background --json
 python3 -m unittest discover -s tools -p 'test_*.py'
 ```
 The audit classifies measurable fit issues as `good` or `bad` based on role-specific dimensions, aspect ratio, alpha requirements, and tile-edge continuity. It lists perspective/projection as a visual review item because image semantics cannot be judged reliably by these deterministic checks.
 ### Screen design references
 Screen mockups and screenshot comparison use `tools/screen_designs.py`. It turns the
 screen descriptions in `docs/` (README captions, ADRs 0007–0010, `PLAN.md`, and
 `architecture.md`) into reference images under `docs/screens/designs/`, then uses
 those images as the expected state to check the game's captures.
 Each screen is tagged `scene` (a realistic first-person 3D world view) or `ui`
 (an in-game panel overlaid on a softened scene), and the generator appends a
 shared art-direction suffix so the frames read as one coherent game. Requests use
 a 3:2 landscape source and crop to the 16:9 capture dimensions.
 ```bash
 # Deterministic wireframes (offline, no API key)
 python3 tools/screen_designs.py generate --draft
 # Realistic 3D scenes and in-game screen designs via OpenRouter
 # (requires OPENROUTER_API_KEY)
 python3 tools/screen_designs.py generate
 # Compare docs/screenshots/*.png against the designs
 python3 tools/screen_designs.py compare
 python3 tools/screen_designs.py compare --json
 ```
 `compare` flags gross drift: wrong aspect ratio, undersized frame, near-blank
 frame, and large layout/palette/detail distance. It is a regression gate, not a
 semantic judge — pixel and perceptual metrics cannot decide whether a frame's
 composition is *right*, so a vision-model pass is the documented follow-up (see
 `TODO.md`). Regenerate the designs after changing screen layout, then re-run
 `compare` after regenerating the game screenshots with
 `src/test/capture_screenshots.gd`.
 ### Setup
 1. Download the Godot 4.3 editor (official build) and put `godot` on your PATH.
@@ -155,6 +235,24 @@ godot --headless --path . --script res://src/test/test_runner.gd
 # Save a screenshot to user:// (windowed)
 godot --path . --script res://src/test/take_screenshot.gd
 # Windowed control smoke: focus ring + action wheel, saves PNGs, exits 1 on failure
 godot --path . --script res://src/test/smoke_focus_radial.gd
 # Session-shell smoke: menu → shift → pause → settings → menu (headless or windowed)
 godot --headless --path . --script res://src/test/smoke_session_shell.gd
 # PLAN-verb smoke: recognize, request reason, body camera, warning, blocking
 godot --headless --path . --script res://src/test/smoke_plan_verbs.gd
 # Crowd smoke: rubbernecking on aggression, panic clearing the entrance
 godot --headless --path . --script res://src/test/smoke_crowd.gd
 # Emergency smoke: unjustified call, investigation note, evacuation aftermath
 godot --headless --path . --script res://src/test/smoke_emergency.gd
 # Body-camera timeline smoke: review → timeline → step through → back to review
 godot --headless --path . --script res://src/test/smoke_timeline.gd
 ```
 The unit test runner is the project's own lightweight harness (no editor plugin required) so CI can run it without the editor.
@@ -164,19 +262,25 @@ The unit test runner is the project's own lightweight harness (no editor plugin
 | Input | Action |
 | --- | --- |
 | W/A/S/D + mouse | Move and look |
-| Esc | Release / capture mouse |
+| Space / left click | Action wheel for the focused person (Stop, Look, Point, No, Ask, Inspect, Wand, Warn, Block, Reason, Recognize, Radio) |
 | A / D or ←/→ | Step through the action wheel (while it is open) |
 | Space / left click | Confirm the highlighted action (while the wheel is open) |
 | Esc / right click | Close the top panel; Esc with nothing open pauses the shift (Esc again resumes) |
 | ← / → or ↑ / ↓ | Navigate the venue menu and the pause / settings panels |
 | Enter | Start the highlighted venue from the menu, or confirm in a panel |
 | 1 / 2 / 3 | Quick gestures without the wheel: raise hand, point, head shake (Level 1) |
 | Q | Polite direction (Level 1) |
 | 1 / 2 / 3 | Simple gestures: raise hand, point, head shake (Level 1) |
 | 4 | Formal warning (Level 2) |
 | 5 | Blocking and positioning (Level 3) |
 | 6 | Security assistance radio (Level 4) |
 | R | Emergency radio, hold on-screen button ~1.6s (Level 5) |
 | E | Inspect access artifacts / close inspection |
-| W | Handheld wand screening (wand venues only) |
+| C | Handheld wand screening (wand venues only) |
 | A / D | Allow / deny entry during inspection or wand check |
-| V | Cycle venue: Hollywood Blvd → The Joke Shop → TV Studio (restarts shift) |
+| V | Cycle venue (debug shortcut; restart via V restarts the current shift) |
 | Tab | Cycle target among nearby NPCs (aim-free alternative) |
 | G | Toggle flashlight (widens NPC perception at night) |
 | B | Toggle the body camera; a formal warning switches it on automatically |
 | L | Lock / unlock the restricted door (thwarts forced entry) |
 | F | Toggle debug overlay |
@@ -201,27 +305,58 @@ Implemented so far:
 - Godot 4.3 project scaffold, input map, procedural world builder
 - Venue-driven simulation core: `ShiftCoordinator`, `VenueScenario`, `EventScheduler`, `NPCController` + FSM, `AccessVerifier`, `EscalationManager`, `RadioSystem`, `IncidentRecorder`, `ReputationEvaluator`, `CrowdSystem`
 - Three authored scenarios (Hollywood Boulevard building, The Joke Shop, Late Night TV Studio) with access policies, NPC archetypes, and event pools
- Headless unit tests: **52 passing** (access rules, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, navmesh, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings)
+- Headless unit tests: **120 passing** (access rules and venue-correct access loadout, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, settings round-trip, navmesh, step colliders, skyline alpha, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings, focus cone, action wheel, session shell, PLAN verbs and incident recording, crowd presentation, emergency aftermath, body-camera timeline)
 - Simulation extras: protester archetype, CALL_SOMEONE reaction, door lock/secure mechanic (visual indicator), flashlight with night perception bonus, LATE shift phase reaching the violent-threat event
 - First-person prototype with interaction HUD, access inspection, wand screening, radio report form (incl. emergency hold-to-confirm), dispatched responder avatars, aim-free targeting, venue cycling between all three scenarios, color-coded escalation feedback, procedural audio cues, navigation-mesh NPC paths, JSON-backed localized strings, persisted shift history, debug overlay, and shift review
 - Control pass: focus cone on NPC heads with a billboarded gold ring and name, action wheel (LMB/Space) with de-escalation-first slices, mouse-look freeze while a panel is open, acceleration-based walking, and named input actions (`action_menu`, `confirm`, `cancel`, `inspect`, `wand`)
 - Session shell: venue start menu (keyboard + mouse), Esc pause overlay (resume / restart / settings / quit to menu), settings panel with mouse-look sensitivity and HUD font scale persisted to `user://settings.json`, and "Run another shift" returning to the venue menu
 - World presentation: skyline backdrop rendered with an alpha material, walkable step and landing colliders, larger marquee text, and larger focus ring / name tag
 - Routine traffic despawns after a while at its waypoint so the crowd cap no longer fills with idle standers
 - PLAN verbs: eye contact (distinct Level 1 cue), recognizing a person as a player decision recorded as access evidence, a body-camera flag that a formal warning arms (and `B` toggles), blocking that physically stations the guard between the person and the door, and a Level 3 request-reason ask answered from the NPC's `dialogue_lines`
 - Incidents are now actually opened on focus and closed at shift end, so player actions, access evidence, escalation levels, and unresolved interactions reach the review (previously every recorded event was dropped)
 - Crowd presentation: aggressive behavior and responder arrivals make idle bystanders stop and face the incident; panic sends people away from the door (and they leave the scene). A busy 16-NPC entrance measured ~1.2 ms/frame, so no LOD/culling was needed at the current cap
 - Distant skyline ring: four alpha-scissored planes at 200 m read as a hazy city on the horizon (the baked backdrop used to show as a black slab), with a larger ground plane so the buildings meet the street
 - Flashlight aims straight ahead and lights the person/door being checked instead of the ground in front of the guard
 - Emergency aftermath: the `evacuation` outcome locks the door and clears the entrance, an emergency call that the situation did not justify opens an investigation and applies the false-report hit, and the shift review names the responder outcome and any investigations
 - Body-camera timeline: the shift review opens a text timeline of every recorded incident event (time, person, action/outcome) that you step through with the arrow keys or buttons. No live 3D replay yet
 - Visual polish pass (v0.2.0): phase-based lighting (sun/sky/ambient per shift phase), street lamps with night-mode bulbs and omni lights, glowing marquee signage, crosswalk, planters and low-poly street trees, NPC height/brightness variety, denser routine traffic — day and late-night screenshot sets
 - Assets pass: authored textures in `assets/textures/` (brick facade, concrete, asphalt, awning, skyline, vignette, HUD icons, access-card art) generated by `tools/generate_textures.py`, soft sun shadows, humanoid NPC rigs with archetype props + procedural walk bob and attention head-turn, inspection artifact cards, escalation vignette, mode icons, and a body-camera overlay (REC + shift clock)
-Not yet implemented: body-camera replay timeline, full 10-15 minute shift lengths, venue selection startup menu, editor-based GUT integration, and RefCounted cycle cleanup (see `TODO.md`).
+Not yet implemented: live 3D body-camera replay, editor-based GUT integration, and crowd performance profiling/LOD (see `TODO.md`).
 ### Smoke Test Checklist
-1. `godot --path .` starts the game without script errors.
+1. `godot --path .` starts the game on the venue menu without script errors.
-2. The guard moves and looks around; the building, steps, and sidewalk are visible.
+2. Choosing a venue (click or ↑/↓ + Enter) starts that venue's shift and hides the menu.
-3. NPCs spawn and approach the entrance during the first minutes.
+3. The guard moves and looks around; the building, steps, and sidewalk are visible.
-4. Aiming at an NPC shows its archetype and intent in the HUD.
+4. The guard's camera sits at eye height and the guard stands on the landing, not inside the building.
-5. Pressing `Q` produces a reaction log entry and reputation feedback.
+5. Walking into the steps carries the guard up onto the landing (steps have colliders).
-6. `E` opens access inspection showing artifacts and policy result; `A`/`D` record a decision.
+6. The skyline backdrop shows silhouettes against the sky, not an opaque black slab.
-7. `6` opens the assistance form; submitting shows dispatch feedback.
+7. The `STEP LINE` marquee is readable from the sidewalk.
-8. `R` opens the emergency form; the button must be held ~1.6s or the call cancels.
+8. NPCs spawn and approach the entrance during the first minutes.
-9. `G` toggles the flashlight (indicator appears in the HUD); `L` toggles the door lock (indicator turns red when locked).
+9. Looking at an NPC inside the focus cone shows a gold head ring, the person's name, and the HUD target line.
-10. `F` toggles the debug overlay with NPC states and shift stats.
+10. `Space` or left click opens the action wheel; `A`/`D` highlight a slice, `Space` confirms it, `Esc`/right click cancels without a log entry.
-11. NPCs route around the building using the navigation mesh (no stuck-at-wall behavior during a smoke run).
+11. `E`/`C` open the inspection/wand panels from the wheel and freeze movement until they close; walking never fires the wand.
-12. When the shift timer reaches 0, the shift review screen shows grade, incident summary, and persisted shift history.
+12. Pressing `Q` produces a reaction log entry and reputation feedback.
 13. `E` opens access inspection showing venue-correct artifacts and policy result; `A`/`D` record a decision.
 14. `6` opens the assistance form; submitting shows dispatch feedback.
 15. `R` opens the emergency form; the button must be held ~1.6s or the call cancels.
 16. `G` toggles the flashlight (indicator appears in the HUD); `L` toggles the door lock (indicator turns red when locked).
 17. `F` toggles the debug overlay with NPC states and shift stats.
 18. The wheel's `Look` slice is eye contact (Level 1) and logs as its own action.
 19. `Reason` asks why the person is there and logs their `dialogue_lines` reply.
 20. `Recognize` records the guard's recognition as access evidence; pressing it twice says so.
 21. `Warn` turns the body camera on (REC overlay appears); `B` toggles it manually.
 22. `Block` moves the guard between the person and the door.
 23. The shift review reports the incident count, including interactions left unresolved.
 24. Escalating on someone (or a responder arriving) makes idle bystanders stop and face the incident.
 25. Repeated alarms panic the crowd and nearby people clear away from the door instead of standing around.
 26. `Esc` with nothing open pauses the shift; resume / restart / settings / quit-to-menu all work, and settings changes persist across a restart.
 27. NPCs route around the building using the navigation mesh (no stuck-at-wall behavior during a smoke run).
 28. An unjustified emergency call (calm person, no weapon) logs an investigation and costs reputation.
 29. After an evacuation outcome the door is locked and NPCs are leaving the entrance.
 30. The shift review's "Body camera timeline" button steps through the recorded events (Left/Right or the buttons) and Esc returns to the review.
 31. When the shift timer reaches 0, the shift review screen shows grade, incident summary, responder outcomes, investigations, and persisted shift history; "Run another shift" returns to the venue menu.
 ## Development Workflow
@@ -1,77 +1,69 @@
 # TODO
-## 🔧 CI — cache timeout mitigation (from .gitea/logs/ review)
+Godot 4.3 prototype. Release **v0.2.6** is tagged. Headless suite **120/120**, plus
 `smoke_session_shell.gd`, `smoke_plan_verbs.gd`, `smoke_crowd.gd`, `smoke_emergency.gd`,
 `smoke_timeline.gd`, and the windowed focus/radial smoke.
-`actions/cache@v4` times out against GitHub's cache service on this runner
+Host `REQUIRE_SIGNIN_VIEW` stays deferred.
 (`/twirp/github.actions.results.api.v1.CacheService/…` — the Gitea host has no
 local actions-cache configured). Restore/save retry for ~2 min per run. The
 checks job still passes; this is noise + risk of flaky timeouts.
- [x] Remove the `actions/cache@v4` step from `checks` in `.gitea/workflows/build.yml`
+## NPC theater
      (Godot import takes ~4s; caching .godot is not worth the timeout risk).
 - [x] Add `GODOT_SILENCE_ROOT_WARNING=1` to godot steps to quiet container-as-root noise.
 - [x] Push and confirm the next `.gitea/logs/` run has no `CacheService` timeouts (run 1090:
      0 cache lines — previously ~12; 54/54 tests, job succeeded).
 - [x] Optional (host admin): document in `docs/RELEASING.md` that `actions/cache` needs a
      Gitea `[cache.actions]` + cache server before it can be reintroduced.
-## 🔴 PRIORITY — Ship downloadable builds (so the README Downloads links work)
+Intents `sit` / `photo` / `film` / `perform` already pick waypoints. ADR-0010 rig (face/hair)
 is in the working tree. Bodies still idle-stand at those spots.
-Goal: users hitting the README **Downloads** section can actually download a playable version from
+- [ ] Sit pose at `steps_end`. Photo: brief raise of the influencer/tourist prop. Performer
-`https://git.allucanget.biz/zwitschi/security-game/releases`.
+      stays put and plays the hat/sign.
- [x] Install Godot 4.3 export templates locally (see `docs/RELEASING.md` step 1).
+## Audio
 - [x] Run `./tools/build_releases.sh` and confirm the three artifacts appear in `build/`.
 - [x] Smoke-test the Linux binary launches (`./build/step-line-linux-0.1.0.x86_64 --headless --quit-after 120` → 0 script errors).
 - [ ] Create a Gitea release `v0.1.0` (tag matching `config/version` in `project.godot`) — **needs `GITEA_TOKEN`**: `GITEA_TOKEN=... ./tools/publish_release.sh 0.1.0`.
 - [ ] Verify the README Downloads links resolve: visit the release page and download one artifact.
 - [x] (Local workflow) `tools/publish_release.sh` exists so future releases need only a `GITEA_TOKEN`.
-### Follow-ups once the first release is live
+`AudioFeedback` is sine beeps. DONE called that "crowd ambience"; it is not.
- [x] CI packaging: Gitea Actions workflow (`.gitea/workflows/build.yml`) builds and uploads artifacts on tags and dispatch.
+- [ ] Loop a low crowd bed that rises with `CrowdSystem.mood`.
 - [ ] Radio open/close crackle on the existing radio panel, still headless-safe (no-op without
      an audio server).
-## Future Systems (design-level backlog)
+## Accessibility
- [ ] Body-camera replay timeline in the shift review.
+- [ ] Escalation colors that still read in grayscale (shape or label, not hue alone).
- [ ] Long (10-15 minute) shift lengths and phase-based lighting (darkened evening / late phases).
+- [ ] HUD font scale in settings.
- [ ] Venue selection screen with a proper startup menu (keyboard cycling with `V` is implemented; a menu is the next iteration).
+
- [ ] IDE/editor-based GUT integration when a Godot editor workflow is introduced.
+## Scenario content still missing vs PLAN lists
- [ ] Reduce RefCounted reference cycles (NPCController <-> FSM) noted in `MEMORY.md`.
+
 - [ ] Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest
      refuses wand screening; late arrival during a performance.
 - [ ] Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival
      crowd spike (more rubberneckers, not only one `arrive` spawn).
 - [ ] Building: "activate body camera" and "request reason" once those verbs exist, used in
      at least one authored event.
 ## Distribution follow-up (host config, deferred)
 Verified via API+host credentials (2026-10-31):
 - [x] Repo is **public** (`private:false`) and account has admin rights.
 - [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
      AppImage).
 - [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
      anonymous browsing/downloads redirect to login. Host admin: `REQUIRE_SIGNIN_VIEW = false`
      under `[service]` in `app.ini`, restart Gitea. Alternative: mirror downloads.
 ## Open Polish
- [ ] Add a body/wand cooldown feel: wand screening currently has no reuse penalty; consider a short per-guest scan animation.
+- [ ] Keep `%` placeholders stable in `Strings.fmt` when adding keys (positional formatting).
 - [ ] Add an escape-to-circuit handling note: `signals` in `Strings.fmt` are positional; keep `%` placeholders stable when adding keys.
-## Detailed Graphics
+## Screen design references (QA tooling)
-The prototype is entirely procedural `BoxMesh` with flat `StandardMaterial3D` colors (see `src/game/world_builder.gd` and `src/game/npc_avatar.gd`). The items below upgrade it toward a finished look. **When a task needs a texture, sprite, decal, or reference image, use the integrated image-generation function to produce it** (e.g. seamless building facade, sidewalk concrete, asphalt, awning sign, wristband/ID inspection cards, HUD icons). Generated images go under `assets/` and are imported as Godot textures; keep them small (≤1024px) and power-of-two where possible.
+- [x] `tools/screen_designs.py generate` writes one reference design per screen
      (from the `docs/` descriptions) to `docs/screens/designs/`, with an offline
      `--draft` wireframe mode and an OpenRouter `--ai` mockup mode.
 - [x] `tools/screen_designs.py compare` checks `docs/screenshots/*.png` against the
      designs (aspect ratio, size, blank-frame, and layout/palette/detail drift).
 - [ ] Vision-model judge for semantic screenshot comparison. Pixel and perceptual
      metrics cannot decide whether a frame's composition is correct; a follow-up
      should send the capture + reference design to a vision model and ask whether
      they depict the same screen.
-### Environment
+## Tooling (when an editor workflow exists)
- [ ] Replace flat facade boxes with textured materials: brick/concrete facade, glass door, awning with a readable sign (generate facade + sign textures).
+- [ ] IDE/editor-based GUT integration. Until then the custom headless runner stays.
- [ ] Add a sidewalk concrete texture and street asphalt texture with a center-line decal (generate seamless textures).
+- [ ] Optional later: author venues as `.tres` resources instead of `ScenarioFactory` functions.
 - [ ] Add a sky: `ProceduralSkyMaterial` or a generated skybox, plus a sun with soft shadows (currently a bare `DirectionalLight3D` + flat ambient).
 - [ ] Add simple props for depth: bollards, a trash can, a street lamp, a planter near the entrance (generate or model low-poly props).
 - [ ] Add a night/evening lighting pass: dim ambient, warm street-lamp point lights, and a visible flashlight cone (ties into the existing `G` flashlight toggle).
 ### NPCs
 - [ ] Replace capsule bodies with a simple humanoid rig (head/torso/limbs) or a low-poly character mesh, keeping the archetype color coding as a fallback.
 - [ ] Add per-archetype visual identity: distinct silhouettes or accessories (e.g. camera for influencers, delivery box, performer prop) instead of color-only.
 - [ ] Add a simple walk/idle animation (procedural bob or imported animation) so NPCs don't glide.
 - [ ] Add a facing/attention cue: NPC head turns toward the guard when `perceive_guard` reports `aware`/`near`.
 ### UI and feedback
 - [ ] Replace text-only inspection with visual artifact cards: wristband/ID/ticket images showing color, pattern, date, and event marking (generate card art).
 - [ ] Add HUD icons for the tone picker, wand, flashlight, and door-lock states (generate small icons).
 - [ ] Add a subtle screen-space vignette or color grade per escalation level to reinforce the existing color-coded escalation label.
 - [ ] Add a body-camera frame overlay (corner timestamp + REC indicator) to sell the evidence/recording fantasy.
 ### Performance and pipeline
 - [ ] Set up an `assets/` import convention (textures, materials, meshes) and document it in `README.md`.
 - [ ] Profile the crowd: ensure textured materials and props don't hurt the target frame rate around a busy entrance.
 - [ ] Add LOD or culling for distant NPCs/props if the crowd grows.
@@ -1,12 +1,24 @@
 {
-  "hud.controls": "Q polite direction · 1-3 simple gestures · 4 warning · 5 block · 6 assist · R emergency · E inspect / close · W wand · A allow · D deny · V venue · G flashlight · L lock door · F debug",
+  "hud.controls": "LMB/Space wheel · A/D step · Space confirm · Esc cancel · R emergency · E inspect · C wand · Q polite · B camera · Tab cycle · G light · L lock · F debug",
  "radial.raise_hand": "Stop",
  "radial.eye_contact": "Look",
  "radial.point": "Point",
  "radial.head_shake": "No",
  "radial.polite": "Ask",
  "radial.inspect": "Inspect",
  "radial.wand": "Wand",
  "radial.warning": "Warn",
  "radial.block": "Block",
  "radial.reason": "Reason",
  "radial.recognize": "Recognize",
  "radial.radio": "Radio",
  "hud.escalation_prefix": "Escalation: %s",
  "hud.cooldown": "EMERGENCY RADIO COOLDOWN: %.0fs",
  "hud.aim_first": "Aim at someone first.",
  "hud.no_one_nearby": "No one nearby.",
  "hud.targeting": "Targeting %s (Tab to cycle).",
  "hud.no_wand": "No wand at this venue.",
-  "hud.screen_first": "Screen this guest with the wand (W) before admitting them.",
+  "hud.screen_first": "Screen this guest with the wand (C) before admitting them.",
  "access.granted": "Entry granted: %s",
  "access.denied": "Entry denied: %s",
  "access.policy_satisfied": "policy satisfied",
@@ -23,6 +35,9 @@
  "radio.emergency_dispatched": "Emergency responder dispatched.",
  "radio.easter_egg": "¿Dónde está la mota?",
  "responder.arrived": "Responder arrives and %ss the situation.",
  "responder.evacuated": "The entrance is cleared and the door is locked while the block is secured.",
  "investigation.unjustified": "Emergency call against %s reviewed: no weapon, low danger.",
  "investigation.started": "Your emergency call is flagged for investigation.",
  "react.comply": "%s complies and steps back.",
  "react.leave": "%s turns and leaves.",
  "react.argue": "%s argues with you.",
@@ -33,6 +48,15 @@
  "react.return_later": "%s leaves but may come back.",
  "react.call_someone": "%s calls someone for help.",
  "react.none": "No reaction (yet).",
  "bodycam.on": "Body camera on.",
  "bodycam.off": "Body camera off.",
  "bodycam.warning": "Formal warning recorded on the body camera.",
  "recognition.declared": "You tell %s you recognize them. Logged as evidence.",
  "recognition.already": "You have already recognized %s this shift.",
  "reason.ask": "You ask %s why they are here.",
  "reason.reply": "%s: \"%s\"",
  "reason.silent": "%s says nothing and looks away.",
  "station.blocking": "You step between %s and the door.",
  "perception.near": "%s notices you standing close.",
  "perception.aware": "%s notices you watching.",
  "door.locked": "The door is now locked.",
@@ -40,5 +64,17 @@
  "door.thwarted": "%s tries the locked door and fails.",
  "flashlight.on": "Flashlight on.",
  "flashlight.off": "Flashlight off.",
-  "hud.venue_switched": "Venue: %s"
+  "hud.venue_switched": "Venue: %s",
  "wand.recharge": "Wand scanner is recharging…",
  "review.responder": "Responder outcomes: %s",
  "review.investigations": "Investigations: %s",
  "review.none": "none",
  "timeline.title": "Body Camera Timeline",
  "timeline.position": "Event %d of %d",
  "timeline.empty": "No recorded events this shift.",
  "timeline.prev": "◀ Previous",
  "timeline.next": "Next ▶",
  "timeline.close": "Close",
  "timeline.hint": "Left/Right step through events · Esc closes · no live replay yet",
  "review.timeline_button": "Body camera timeline"
 }
@@ -57,12 +57,22 @@ godot --headless --path . --quit-after 120                        # boot smoke t
 ./tools/build_releases.sh
 ```
-Artifacts are written to `build/`:
+Artifacts are written to `build/` (all exports embed the PCK — single files):
 - `build/step-line-linux-<version>.x86_64`
 - `build/step-line-windows-<version>.exe`
 - `build/step-line-macos-<version>.zip`
 When run in CI (tags/dispatch), the build job also packages:
 - `build/step-line-setup-<version>.exe` — Windows installer (NSIS, incl. shortcuts +
  uninstaller; apt `nsis` on the runner)
 - `build/step-line-<version>-x86_64.AppImage` — Linux AppImage (`packaging/linux/build_appimage.sh`,
  appimagetool via `APPIMAGE_EXTRACT_AND_RUN`)
 Locally you can build the AppImage with `bash packaging/linux/build_appimage.sh <version>`;
 the NSIS installer requires `makensis` (covered by CI).
 > macOS builds are unsigned and will need `xattr -dr com.apple.quarantine`
 > guidance or notarization for production releases.
@@ -70,15 +80,22 @@ Artifacts are written to `build/`:
 The repository lives at `https://git.allucanget.biz/zwitschi/security-game`.
-Preferred path — use the helper script with a token:
+Preferred path — use the helper script. It needs either a token or the same
 credentials used by `git push` (it falls back to `~/.git-credentials`):
 ```bash
-GITEA_TOKEN=your_api_token ./tools/publish_release.sh 0.1.0
+GITEA_TOKEN=your_api_token ./tools/publish_release.sh 0.2.1
 # or simply: ./tools/publish_release.sh 0.2.1   (uses ~/.git-credentials)
 ```
-The script creates the release from `project.godot`'s `config/version`, uploads
+The script creates (or reuses) the release from `project.godot`'s
-all three `build/` artifacts, and prints the release URL. The token needs only
+`config/version`, uploads the three portable artifacts **plus** the NSIS
-`write:repository` scope on the Gitea host.
+installer and AppImage when present, and prints the release URL. If CI already
 published the release, re-running the script only adds missing assets.
 > **Host note**: the release is fully built by CI, but anonymous users can only
 > browse and download when the instance sets `[service] REQUIRE_SIGNIN_VIEW=false`
 > in `app.ini` (the repo itself is public). See the TODO for the exact steps.
 Manual alternative:
@@ -0,0 +1,42 @@
 # ADR-0007: Locomotion and input layers
 - **Status:** Accepted
 - **Date:** TBD
 ## Context
 The prototype is first-person: WASD walks, mouse looks, `Esc` toggles capture. Action keys were then bound on the same letters. `W` is walk-forward in the input map and wand screening in `GameManager._handle_key`. `A` / `D` strafe and also allow or deny during inspection. `Q` is polite direction and is also bound as `cancel`.
 A player who walks toward a guest on a wand venue therefore fires the wand. A player who strafes during an inspection can admit or refuse by accident. The mouse cannot click UI while it is captured, and `Esc` cannot mean both "release the mouse" and "I changed my mind."
 ## Decision
 Treat input as layers, only one of which owns a key at a time.
 1. **Locomotion** (default): WASD walk relative to body yaw, mouse look on the captured cursor, pitch clamped. Short acceleration and deceleration. Gravity only when airborne; snap to the floor so the steps work. Walk speed stays around 3.2 m/s. No sprint or crouch in this pass.
 2. **Modal UI** (radial, inspect, wand, radio, shift review): freeze walk and look. Recapture the mouse when the modal closes. `A` / `D` and arrows belong to the modal while it is open.
 3. **Equipment and global keys** stay off the person-verb set: `G` flashlight, `L` door lock, `Tab` cycle nearby people, `R` emergency radio, `F` debug, `V` venue (debug). Wand leaves `W`; the optional shortcut is `C`.
 `Esc` closes the top modal first and does nothing else. With no modal open it keeps the capture/release toggle.
 ## Consequences
 ### Positive
 - Walking cannot fire wand, inspect, or admission.
 - The mouse can click the action menu because capture is released while it is open.
 - Cancel has one meaning when a menu is up.
 - Locomotion stays first-person, which matches the body-camera framing.
 ### Negative
 - Freeze-while-modal means the player cannot sidestep during an inspect. That is accepted for this pass.
 - Power users lose `W` as wand. The wheel and `C` replace it.
 - The input map and `_unhandled_input` must agree, or the conflict returns.
 ## Alternatives considered
 - **Keep letter-key verbs on WASD:** Rejected because walk and wand already collide in the prototype.
 - **Third-person or click-to-move:** Rejected; the body-camera overlay and the "you are the guard" framing depend on first person.
 - **Hold-right-mouse-to-look, free cursor otherwise:** Rejected for this pass. Constant look is the default security-sim stance; the menu is the exception.
 - **Never freeze walk:** Rejected because `A` / `D` cannot both strafe and step a menu highlight.
@@ -0,0 +1,46 @@
 # ADR-0008: Cone focus and head ring
 - **Status:** Accepted
 - **Date:** TBD
 ## Context
 The prototype picks a person with an 8 m physics ray from the camera. The collider is a capsule. A few pixels off the body, or a bob during a walk, clears the target. The HUD then prints a name and hint, but nothing in the world shows who is selected. `Tab` already cycles people within 12 m as an aim-free path.
 The next pass needs the player to look at a person, know they have them, and only then open an action menu. A hairline ray is too brittle for that, and a HUD line is easy to miss in a crowd.
 ## Decision
 Focus is a **cone**, not a ray.
 - People within about 10 m whose **head** projects inside a screen-space circle around the crosshair (about 90 px / 10 degrees) are candidates.
 - If several heads sit in the circle, pick the one closest to the center; if tied, the nearer one.
 - The person must be in front of the camera. A short ray to the head skips people fully hidden by the building.
 - A few frames of grace keep walk-bob from dropping focus.
 - `Tab` still cycles people inside 12 m and sets the same focused person.
 When someone is in focus, draw a **thin ring** around their head, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Pale gold while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the ring. One ring at a time.
 The world must not show the internal type name (`Trespasser`, `Violent Threat`). The debug overlay (`F`) can still print it.
 ## Consequences
 ### Positive
 - Looking near a person is enough; the player does not have to pin a capsule.
 - The ring is visible in the scene, so the HUD is not the only focus cue.
 - `Tab` remains the accessibility path and shares the same focused person.
 - The action menu (ADR-0009) has a clear subject.
 ### Negative
 - Two heads in the same circle can steal focus; center-distance is a heuristic, not a lock-on.
 - Hats and protester signs can z-fight a 3D torus. A screen-space circle unprojected from the head is an allowed fallback.
 - Occlusion rays can fail on unusual geometry; grace frames hide some of that.
 ## Alternatives considered
 - **Keep the hairline ray:** Rejected because it drops people too easily and has no world mark.
 - **Sticky lock-on until cancelled:** Rejected because the job is to watch a crowd, not duel one person.
 - **Screen reticle only, no world ring:** Rejected; in a crowd the player needs a mark on the head, not only a HUD line.
 - **Click a person to select, then act:** Rejected for default play. The mouse is captured for look (ADR-0007). Click opens the action menu on whoever is already in the cone.
@@ -0,0 +1,60 @@
 # ADR-0009: Radial action menu
 - **Status:** Accepted
 - **Date:** TBD
 ## Context
 NPC verbs in the prototype live on `Q`, `E`, `W`, `1`–`6`, and `R`. That is a cheat sheet. It also collides with walk keys (ADR-0007). The design wants the player to look at a person (ADR-0008) and then choose the lowest useful action, not memorize a number row.
 Inspection, wand screening, and radio already have their own panels. Emergency radio already has a hold-to-confirm on `R` because a misclick is costly. Those panels should stay. What is missing is a single, visible way to pick the verb.
 ## Decision
 When someone is in focus, **left mouse button** or **Space** opens a round doughnut menu in the center of the screen. The click that opens it does not pick a slice. If nobody is in focus, do not open; keep the existing "aim first" log line.
 Slices, clockwise from the top, lowest escalation first:
 1. Raise hand (stop / wait)
 2. Point away
 3. Head shake
 4. Polite direction
 5. Inspect access
 6. Wand (grey if the venue has no wand)
 7. Formal warning
 8. Block
 9. Radio assist
 Emergency is **not** on the wheel. It stays on `R` with the existing hold-to-confirm panel.
 While the menu is open, walk and look freeze (ADR-0007) and the cursor is visible. Highlight follows the mouse angle over the ring, or steps with `A` / `D` or the left / right arrows, wrapping around. The center shows the focused person's `display_name`.
 **Confirm:** click a slice, or `Space` on the highlighted slice. The menu closes, the mouse is recaptured, and that action runs. Inspect, wand, and radio assist close the wheel and then open the existing panels. Walk and look stay frozen until that panel closes.
 **Cancel:** `Esc` or right mouse button. The menu hides. No action runs. No recorder event. Focus and the head ring stay. The mouse is recaptured.
 Number keys `1`–`6` may remain as shortcuts when the wheel is closed, so existing smoke tests still work. They must not fire while the wheel is open.
 ## Consequences
 ### Positive
 - The player sees the verbs in de-escalation order instead of recalling a number row.
 - Mouse and keyboard both work (click, or arrows / `A`/`D` then Space).
 - Cancel is explicit and leaves no incident noise.
 - Emergency cannot be picked by a bad slice click.
 - Inspect, wand, and radio keep the panels already tested.
 ### Negative
 - Nine slices is dense on a 1280×720 view. Labels must stay short.
 - Freeze-until-panel-closes stops the player sidestepping during an ID check.
 - Keeping `1`–`6` as hidden shortcuts can confuse if the README leads with them. Document the wheel first.
 ## Alternatives considered
 - **Hold-to-open, release-to-confirm (GTA / Destiny):** Rejected. The requested input is click or Space to open, then click or Space to confirm, with Esc / RMB to abort. That is a toggle, not a hold.
 - **Vertical list / command menu:** Rejected because a round layout around a focused person matches the head ring and reads faster in a crowd.
 - **One context-sensitive Use key:** Rejected; the game is about choosing among levels, not a single default verb.
 - **Emergency on the wheel:** Rejected because a misclick would dispatch armed response. ADR-0002 already keeps that path rare and confirmed.
 - **Drop number-key shortcuts immediately:** Deferred. They remain as a closed-menu fallback until the wheel is proven in play.
@@ -0,0 +1,53 @@
 # ADR-0010: Procedural NPC presentation
 - **Status:** Accepted
 - **Date:** TBD
 ## Context
 Avatars are `CharacterBody3D` capsules color-coded by `NpcType`, with a few props (camera, box, hat, sign, bag), height and brightness variation from a seed, a walk bob, and a head turn toward the guard when noticed. They work as markers. At conversation distance they do not read as people: no neck, no face direction, no shoes, no hair.
 The player is supposed to judge from clothes, props, and behavior, not from a label. The HUD currently prints the internal type (`Violent Threat`, `Trespasser`) next to the name. Putting that name on the body would make the judgment for them.
 A full Mixamo / GLB pipeline would also add animation imports, licenses, and a skeleton the rest of the sim does not need yet. AI textures in `assets/textures/ai/` are not sized or wired for clothing.
 ## Decision
 Keep the procedural capsule rig for this pass. Do not add skinned meshes or Mixamo.
 Make the body read as a person at conversation distance:
 - Neck between torso and head.
 - Shoes.
 - Hair cap whose color comes from the visual seed.
 - Two dark eye spheres so the head has a front.
 - Named `Head` node (`Rig/Head`) as the attach point for the focus ring (ADR-0008) and the focus cone.
 - Collision capsule scaled to the visible height so the cone hits the body the player sees.
 Keep archetype props, height / brightness variation, walk bob, and the notice head-turn.
 Do **not** put the internal type name on the body or as a world nametag. A focused `display_name` under the ring is allowed. The debug overlay (`F`) may still print type, intent, and FSM state. The HUD target line can keep the type during the prototype; removing it from the HUD is a later readability pass, not this one.
 AI clothing textures stay out unless a map is already the right size and is wired on purpose.
 ## Consequences
 ### Positive
 - People have a face direction the ring and the "noticed the guard" cue can use.
 - No new asset toolchain, licenses, or animation retargeting.
 - Head is a stable node other systems can find.
 - The player is not told `Violent Threat` by a floating label.
 ### Negative
 - Capsule people still look like a prototype at cinematic camera distance.
 - Hair and eyes are spheres; they will not survive a close-up trailer.
 - A later skinned-mesh pass will replace this rig and must keep the `Head` contract.
 ## Alternatives considered
 - **Skinned Mixamo / GLB characters now:** Rejected. Cost and pipeline exceed this pass; the sim only needs a readable body and a head node.
 - **Billboard sprites:** Rejected; first-person movement walks around people, and sprites fail at profile views.
 - **Keep colored capsules as-is:** Rejected; the head ring and cone need a real head, and capsules do not read as people at two metres.
 - **World labels with archetype names:** Rejected because they leak sim truth and skip observation.
@@ -152,6 +152,10 @@ Architecture decisions are recorded as ADRs:
 - [ADR-0004: Local single-player first](adr/0004-local-single-player-first.md)
 - [ADR-0005: Event-based incident recording](adr/0005-event-based-incident-recording.md)
 - [ADR-0006: Godot 4 with GDScript](adr/0006-godot-4-gdscript.md)
 - [ADR-0007: Locomotion and input layers](adr/0007-locomotion-and-input-layers.md)
 - [ADR-0008: Cone focus and head ring](adr/0008-cone-focus-and-head-ring.md)
 - [ADR-0009: Radial action menu](adr/0009-radial-action-menu.md)
 - [ADR-0010: Procedural NPC presentation](adr/0010-procedural-npc-presentation.md)
 ## 10. Quality Requirements
@@ -23,7 +23,7 @@ script_export_mode=2
 custom_template/debug=""
 custom_template/release=""
 debug/export_console_wrapper=1
-binary_format/embed_pck=false
+binary_format/embed_pck=true
 texture_format/s3tc_bptc=true
 texture_format/etc2_astc=false
 binary_format/architecture="x86_64"
@@ -54,7 +54,7 @@ script_export_mode=2
 custom_template/debug=""
 custom_template/release=""
 debug/export_console_wrapper=0
-binary_format/embed_pck=false
+binary_format/embed_pck=true
 texture_format/s3tc_bptc=true
 texture_format/etc2_astc=false
 codesign/enable=false
@@ -90,7 +90,7 @@ script_export_mode=2
 custom_template/debug=""
 custom_template/release=""
 debug/export_console_wrapper=0
-binary_format/embed_pck=false
+binary_format/embed_pck=true
 texture_format/s3tc_bptc=true
 texture_format/etc2_astc=true
 codesign/enable=false
@@ -0,0 +1,5 @@
 #!/bin/sh
 # AppImage entry point: launch the bundled game binary.
 SELF="$(readlink -f "$0")"
 HERE="$(dirname "$SELF")"
 exec "${HERE}/usr/bin/step-line" "$@"
@@ -0,0 +1,48 @@
 #!/usr/bin/env bash
 # Build a self-contained Step Line AppImage (all game data included).
 #
 # Prereqs: exported Linux binary in build/ (embed_pck=true), curl.
 # Usage:   bash packaging/linux/build_appimage.sh [version]
 # Output:  build/step-line-<version>-x86_64.AppImage
 set -euo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$HERE/../.." && pwd)"
 VERSION="${1:-$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' "$ROOT/project.godot")}"
 SRC_BIN="$ROOT/build/step-line-linux-${VERSION}.x86_64"
 if [[ ! -f "$SRC_BIN" ]]; then
  echo "error: missing $SRC_BIN — run ./tools/build_releases.sh first" >&2
  exit 1
 fi
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 APPDIR="$WORK/StepLine.AppDir"
 mkdir -p "$APPDIR/usr/bin"
 cp "$SRC_BIN" "$APPDIR/usr/bin/step-line"
 # The export embeds the PCK (embed_pck=true), so no extra data files are needed.
 cp "$HERE/step-line.desktop" "$APPDIR/step-line.desktop"
 cp "$HERE/AppRun" "$APPDIR/AppRun"
 chmod +x "$APPDIR/AppRun"
 cp "$HERE/step-line.png" "$APPDIR/step-line.png"
 # Desktop entry + metainfo in standard locations (AppStream validation requires
 # the metainfo filename to match the component id, and the .desktop discoverable).
 mkdir -p "$APPDIR/usr/share/applications" "$APPDIR/usr/share/metainfo"
 cp "$HERE/step-line.desktop" "$APPDIR/usr/share/applications/step-line.desktop"
 cp "$HERE/step-line.appdata.xml" "$APPDIR/usr/share/metainfo/net.stepline.game.appdata.xml"
 TOOL="${APPIMAGE_TOOL:-/tmp/appimagetool-x86_64.AppImage}"
 if [[ ! -f "$TOOL" ]]; then
  echo "==> Downloading appimagetool"
  curl -sL -o "$TOOL" \
    https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
  chmod +x "$TOOL"
 fi
 OUT="$ROOT/build/step-line-${VERSION}-x86_64.AppImage"
 echo "==> Building AppImage -> $OUT"
 # Extract-and-run avoids a FUSE dependency on the build host.
 APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" "$APPDIR" "$OUT"
 echo "AppImage ready: $(ls -la "$OUT" | awk '{print $5}') bytes"
@@ -0,0 +1,23 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <component type="desktop-application">
  <id>net.stepline.game</id>
  <name>Step Line</name>
  <summary>Workplace security simulation on Hollywood Boulevard</summary>
  <url type="homepage">https://git.allucanget.biz/zwitschi/security-game</url>
  <developer id="net.stepline"><name>Step Line Team</name></developer>
  <description>
    <p>
      Step Line is a workplace security simulation about observation, communication,
      access verification, and proportionate escalation. Guard the steps and entrance
      of venues around Hollywood Boulevard: direct tourists, verify wristbands and IDs,
      screen guests, and escalate only when you have to.
    </p>
  </description>
  <launchable type="desktop-id">step-line.desktop</launchable>
  <metadata_license>CC0-1.0</metadata_license>
  <project_license>MIT</project_license>
  <content_rating type="oars-1.1" />
  <releases>
    <release version="0.2.0" date="2026-10-31"/>
  </releases>
 </component>
@@ -0,0 +1,9 @@
 [Desktop Entry]
 Type=Application
 Name=Step Line
 Comment=Workplace security simulation on Hollywood Boulevard
 Exec=step-line
 Icon=step-line
 Terminal=false
 Categories=Game;Simulation;
 Keywords=security;simulation;hollywood;
@@ -0,0 +1,74 @@
 ; Step Line Windows installer (NSIS 3).
 ; Build from the repo root with the exported self-contained exe:
 ;   makensis /DVERSION=0.2.0 /DARTIFACT=build/step-line-windows-0.2.0.exe \
 ;            /DICON=packaging/windows/step-line.ico packaging/windows/step-line.nsi
 ; Outputs: build/step-line-setup-<VERSION>.exe
 !ifndef VERSION
  !define VERSION "0.0.0"
 !endif
 !ifndef ARTIFACT
  !error "ARTIFACT define required (path to exported windows exe)"
 !endif
 !ifndef ICON
  !define ICON "packaging\windows\step-line.ico"
 !endif
 ; The installed executable uses this clean name (no spaces — NSIS /oname tokens
 ; on whitespace, so a spaced name breaks the File directive).
 !define INSTALLED_EXE "step-line.exe"
 !ifndef OUT
  !define OUT "build\step-line-setup-${VERSION}.exe"
 !endif
 !define COMPANY "Step Line Project"
 !define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\Step Line"
 Unicode true
 ManifestDPIAware true
 Icon "${ICON}"
 UninstallIcon "${ICON}"
 Name "Step Line ${VERSION}"
 OutFile "${OUT}"
 InstallDir "$PROGRAMFILES64\Step Line"
 RequestExecutionLevel admin
 Page directory
 Page instfiles
 UninstPage uninstConfirm
 UninstPage instfiles
 Section "Install"
  SetOutPath "$INSTDIR"
  ; The self-contained executable contains ALL game data (embedded PCK).
  File "/oname=${INSTALLED_EXE}" "${ARTIFACT}"
  WriteUninstaller "$INSTDIR\uninstall.exe"
  ; Shortcuts
  CreateDirectory "$SMPROGRAMS\Step Line"
  CreateShortCut "$SMPROGRAMS\Step Line\Step Line.lnk" "$INSTDIR\${INSTALLED_EXE}"
  CreateShortCut "$SMPROGRAMS\Step Line\Uninstall.lnk" "$INSTDIR\uninstall.exe"
  CreateShortCut "$DESKTOP\Step Line.lnk" "$INSTDIR\${INSTALLED_EXE}"
  ; Registry (Add/Remove Programs)
  WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "Step Line"
  WriteRegStr HKLM "${UNINST_KEY}" "DisplayVersion" "${VERSION}"
  WriteRegStr HKLM "${UNINST_KEY}" "Publisher" "${COMPANY}"
  WriteRegStr HKLM "${UNINST_KEY}" "DisplayIcon" "$INSTDIR\${INSTALLED_EXE}"
  WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" '"$INSTDIR\uninstall.exe"'
  WriteRegDWORD HKLM "${UNINST_KEY}" "NoModify" 1
  WriteRegDWORD HKLM "${UNINST_KEY}" "NoRepair" 1
 SectionEnd
 Section "Uninstall"
  Delete "$INSTDIR\${INSTALLED_EXE}"
  Delete "$INSTDIR\uninstall.exe"
  RMDir "$INSTDIR"
  Delete "$SMPROGRAMS\Step Line\Step Line.lnk"
  Delete "$SMPROGRAMS\Step Line\Uninstall.lnk"
  RMDir "$SMPROGRAMS\Step Line"
  Delete "$DESKTOP\Step Line.lnk"
  DeleteRegKey HKLM "${UNINST_KEY}"
 SectionEnd
@@ -8,7 +8,7 @@ config_version=5
 config/name="Step Line"
 config/description="Workplace security simulation about observation, access verification, and proportionate escalation."
-config/version="0.2.0"
+config/version="0.2.6"
 run/main_scene="res://scenes/main.tscn"
 config/features=PackedStringArray("4.3", "GL Compatibility")
@@ -47,18 +47,6 @@ move_right={
 , Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":4194321,"key_label":0,"unicode":0,"location":0,"echo":false,"script":null)
 ]
 }
 interact={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":69,"key_label":0,"unicode":101,"location":0,"echo":false,"script":null)
 , Object(InputEventMouseButton,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"button_mask":0,"position":Vector2(0, 0),"global_position":Vector2(0, 0),"factor":1.0,"button_index":1,"canceled":false,"pressed":false,"double_click":false,"script":null)
 ]
 }
 cancel={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":81,"key_label":0,"unicode":113,"location":0,"echo":false,"script":null)
 , Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":4194305,"key_label":0,"unicode":0,"location":0,"echo":false,"script":null)
 ]
 }
 gesture_raise_hand={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":49,"key_label":0,"unicode":49,"location":0,"echo":false,"script":null)
@@ -91,8 +79,35 @@ radio_assist={
 }
 radio_emergency={
 "deadzone": 0.5,
-"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":87,"key_label":0,"unicode":87,"location":0,"echo":false,"script":null)
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":82,"key_label":0,"unicode":114,"location":0,"echo":false,"script":null)
-, Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":82,"key_label":0,"unicode":114,"location":0,"echo":false,"script":null)
+]
 }
 action_menu={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":32,"key_label":0,"unicode":32,"location":0,"echo":false,"script":null)
 , Object(InputEventMouseButton,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"button_mask":0,"position":Vector2(0, 0),"global_position":Vector2(0, 0),"factor":1.0,"button_index":1,"canceled":false,"pressed":false,"double_click":false,"script":null)
 ]
 }
 confirm={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":32,"key_label":0,"unicode":32,"location":0,"echo":false,"script":null)
 , Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":4194309,"key_label":0,"unicode":0,"location":0,"echo":false,"script":null)
 ]
 }
 cancel={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":4194305,"key_label":0,"unicode":0,"location":0,"echo":false,"script":null)
 , Object(InputEventMouseButton,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"button_mask":0,"position":Vector2(0, 0),"global_position":Vector2(0, 0),"factor":1.0,"button_index":2,"canceled":false,"pressed":false,"double_click":false,"script":null)
 ]
 }
 inspect={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":69,"key_label":0,"unicode":101,"location":0,"echo":false,"script":null)
 ]
 }
 wand={
 "deadzone": 0.5,
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":67,"key_label":0,"unicode":99,"location":0,"echo":false,"script":null)
 ]
 }
 print_debug={
@@ -0,0 +1 @@
 Pillow>=9.2
@@ -0,0 +1 @@
 appimagetool.png
@@ -0,0 +1,10 @@
 #! /bin/sh
 set -e
 this_dir="$(dirname -- "$(readlink -f -- "$0")")"
 # make appimagetool prefer the bundled mksquashfs
 export PATH="$this_dir"/usr/bin:"$PATH"
 exec "$this_dir"/usr/bin/appimagetool "$@"
@@ -0,0 +1 @@
 usr/share/applications/appimagetool.desktop
@@ -0,0 +1 @@
 usr/share/icons/hicolor/128x128/apps/appimagetool.png
@@ -0,0 +1,9 @@
 [Desktop Entry]
 Type=Application
 Name=appimagetool
 Exec=appimagetool
 Comment=Tool to generate AppImages from AppDirs
 Icon=appimagetool
 Categories=Development;
 Terminal=true
@@ -0,0 +1,31 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <component type="desktop">
  <id>appimagetool.desktop</id>
  <metadata_license>MIT</metadata_license>
  <project_license>MIT</project_license>
  <name>appimagetool</name>
  <summary>Create AppImage files</summary>
  <description>
    <p>
      appimagetool is a tool that lets you generate AppImage files. An AppImage
      is a self-running bundle that contains an application and everything
      it needs to run that cannot reasonably expected to be part of each target system.
    </p>
    <p>
      This can include libraries that are not commonly available on target systems,
      resources such as translations, icons, fonts, and other auxiliary files.
      appimagetool makes it easy to take an AppDir (e.g., generated by linuxdeployqt)
      and turn it into an AppImage.
    </p>
    <p>
      You can also embed update information so that your users can update the AppImage
      using binary delta updates with the AppImageUpdate tool.
      You can also sign the AppImage with GPG.
    </p>
  </description>
  <url type="homepage">https://github.com/AppImage/AppImageKit</url>
  <project_group>AppImage</project_group>
  <provides>
    <binary>appimagetool</binary>
  </provides>
 </component>
		`@@ -0,0 +1 @@`
							`usr/share/applications/appimagetool.desktop`
		`@@ -0,0 +1 @@`
							`usr/share/icons/hicolor/128x128/apps/appimagetool.png`