Enable anonymous downloads on the host and harden Strings.fmt

Host (applied with root@192.168.88.30) - [service] REQUIRE_SIGNIN_VIEW = false in /etc/gitea/app.ini (backup written alongside), Gitea restarted. Verified anonymously: repo page 200, API 200, and a release asset downloads at full size (50.8 MB AppImage). Localization safety (Open Polish) - Strings.placeholder_count() counts conversions and ignores %% escapes. - Strings.fmt() validates the count and fails safe (warns, returns the template) instead of raising an engine error when a key's placeholders drift. - Strings.validate() lints the table for a trailing %, unsupported conversions, and mixed positional/sequential placeholders. - Tests cover the counter, the fail-safe path, a clean table, and a formatting pass over every placeholder key with type-correct arguments. Docs - TODO: distribution, release-pipeline, and open-polish sections are complete and moved to DONE; the v0.2.4-v0.2.8 backfill is closed as superseded. - README/MEMORY updated. Version 0.2.14.
Author the missing scenario content from the PLAN lists
2026-10-31 22:02:24 +01:00 · 2026-10-31 21:55:24 +01:00 · 2026-10-31 21:51:41 +01:00 · 2026-10-31 21:46:09 +01:00 · 2026-10-31 21:39:15 +01:00 · 2026-10-31 21:38:12 +01:00
34 changed files with 888 additions and 133 deletions
@@ -113,6 +113,9 @@ jobs:
      - name: Publish Gitea release (tags only)
        if: startsWith(github.ref, 'refs/tags/')
        env:
+          # An explicit repo secret wins. Without one, publish_release.sh reuses
+          # the local git extraheader that actions/checkout configures for the job
+          # (the runner's own credentials), so tag builds still publish.
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          VERSION: ${{ github.ref_name }}
        run: |
@@ -319,7 +319,7 @@ Completed in the working tree (uncommitted with the control pass). Headless **74
      to the entrance.
 - [x] Wand shortcut is `C`, not `W`. Tests: `src/test/tests/test_access_loadout.gd`.

-## Player control, focus ring, and radial action menu
+## Player control, focus circle, and radial action menu

 Completed 2026-10-31 with ADR-0007–0010. Headless **77/77**, plus a windowed smoke
 (`src/test/smoke_focus_radial.gd`) that opens the wheel and saves screenshots.
@@ -334,13 +334,13 @@ Completed 2026-10-31 with ADR-0007–0010. Headless **77/77**, plus a windowed s
 - [x] `cancel` (Esc / RMB) closes the top modal first; with nothing open, Esc toggles mouse
      capture and RMB does nothing.

-### Focus and head ring
+### Focus and focus circle

 - [x] Focus cone in `src/game/npc_focus.gd` (~10 m, ~10°). Closest-to-forward wins; occlusion
      ray skips building hits. `Tab` still cycles 12 m.
 - [x] 8-frame miss grace so walk-bob does not drop focus.
- [x] Billboarded torus on `Rig/Head`; gold idle, brighter while the radial is open; `Label3D`
-      `display_name`. HUD target line uses the display name, not the node name.
+- [x] Billboarded blue circle in front of the face on `Rig/Head`; brighter while the radial is
+      open; `Label3D` `display_name`. HUD target line uses the display name, not the node name.
 - [x] Screen-center crosshair.

 ### Radial HUD
@@ -364,7 +364,7 @@ Completed 2026-10-31 with ADR-0007–0010. Headless **77/77**, plus a windowed s

 - [x] Named input map: `action_menu` (Space/LMB), `confirm` (Space/Enter), `cancel`
      (Esc/RMB), `inspect` (E), `wand` (C). `GameManager` uses `is_action_pressed`.
- [x] Windowed smoke: focus ring + name, wheel open/step/confirm/cancel
+- [x] Windowed smoke: focus circle + name, wheel open/step/confirm/cancel
      (`src/test/smoke_focus_radial.gd`, exits non-zero on failure).
 - [x] README controls table, smoke checklist, test count, implemented/not-yet lists.

@@ -405,7 +405,6 @@ screenshots.

 Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session_shell.gd` and the windowed focus/radial smoke both pass.

-
 - [x] The skyline backdrop was removed: `assets/textures/ai/game_ready/skyline.png` has an
      opaque black background, so the planes rendered as black slabs with window dots. Re-add
      the backdrop only with a transparent asset or a keyed shader.
@@ -414,7 +413,7 @@ Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session
 - [x] Steps and the landing are visual-only (no collider). The guard walks through them; add
      simple step colliders or restage the landing so it does not intersect the walk path.
 - [x] Marquee text (`STEP LINE`) is tiny from the sidewalk. Scale the Label3D up.
- [x] Focus ring and name tag are small at 2–3 m. Consider a larger torus / font after a
+- [x] Focus circle and name tag are small at 2–3 m. Consider a larger circle / font after a
      real playtest.
 - [x] NPC crowd cap (`MAX_LIVE_NPCS`) silently drops routine traffic at 16. Add a short
      despawn/lifetime for ordinary guests so the entrance does not fill up with standers.
@@ -423,7 +422,6 @@ Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session

 Completed 2026-10-31 (working tree). Headless **88/88**; `src/test/smoke_session_shell.gd` and the windowed focus/radial smoke both pass.

-
 The game boots into a live 900 s shift. `Save` declares `settings.json` and never uses it.
 `V` cycles venues by restarting the shift.

@@ -439,7 +437,6 @@ The game boots into a live 900 s shift. `Save` declares `settings.json` and neve

 Completed 2026-10-31 (working tree).

-
 - [x] README controls table, smoke checklist, test count, and implemented/not-yet lists
      refreshed for the control pass (77 tests).
 - [x] `PLAN.md` Tech Stack / Planned Commands still say GUT and GitHub Actions; the project
@@ -450,7 +447,6 @@ Completed 2026-10-31 (working tree).

 Completed 2026-10-31 (working tree). Headless **98/98**; `src/test/smoke_plan_verbs.gd` exercises all five verbs.

-
 - [x] Eye contact as a Level 1 action (PLAN / glossary). Distinct from raise-hand. Add a
      radial slice if it ships.
 - [x] "I recognize this person" is a player decision recorded as evidence, not a pre-attached
@@ -466,7 +462,6 @@ Completed 2026-10-31 (working tree). Headless **98/98**; `src/test/smoke_plan_ve

 Completed 2026-10-31 (working tree). Headless **105/105**; `src/test/smoke_crowd.gd` verifies rubbernecking and panic clearing. A 16-NPC entrance measured ~1.2 ms/frame (824 fps, vsync off), so no LOD/culling was added at the current cap.

-
 `CrowdSystem` is a mood/attention float. PLAN wants people watching, gathering, and panicking.

 - [x] On `aggressive_behavior` / `emergency_responder`, nearby idle NPCs stop and face the
@@ -478,7 +473,6 @@ Completed 2026-10-31 (working tree). Headless **105/105**; `src/test/smoke_crowd

 Completed 2026-10-31 (working tree). Headless **113/113**; `src/test/smoke_emergency.gd` covers the unjustified-call investigation, the evacuation aftermath, and the review copy.

-
 Responder outcomes (`command` / `restraint` / `evacuation` / `arrest`) are log lines. PLAN also
 wants evacuation, a closed street, and an investigation when the call was unjustified.

@@ -491,7 +485,6 @@ wants evacuation, a closed street, and an investigation when the call was unjust

 Completed 2026-10-31 (working tree). Headless **120/120**; `src/test/smoke_timeline.gd` opens the timeline from the review, steps through every event, and returns to the review.

-
 - [x] Shift review: a timeline of recorded incident events (ADR-0005 already stores them).
      Scrub or step through; no live 3D replay required in the first version.

@@ -499,7 +492,6 @@ Completed 2026-10-31 (working tree). Headless **120/120**; `src/test/smoke_timel

 Completed 2026-10-31 (working tree). Headless **127/127**; verified visually with a staged sit/photo/perform lineup.

-
 Intents `sit` / `photo` / `film` / `perform` already pick waypoints. ADR-0010 rig (face/hair)
 is in the working tree. Bodies still idle-stand at those spots.

@@ -510,9 +502,69 @@ is in the working tree. Bodies still idle-stand at those spots.

 Completed 2026-10-31 (working tree). Headless **134/134**; `src/test/smoke_audio.gd` checks the bed follows mood and the radio crackles, headless and windowed (real audio server).

-
 `AudioFeedback` is sine beeps. DONE called that "crowd ambience"; it is not.

 - [x] Loop a low crowd bed that rises with `CrowdSystem.mood`.
 - [x] Radio open/close crackle on the existing radio panel, still headless-safe (no-op without
      an audio server).
+
+## Accessibility
+
+Completed 2026-10-31 (working tree). Headless **139/139**; verified visually at 1.4x font scale with the shape meter showing.
+
+- [x] Escalation colors that still read in grayscale (shape or label, not hue alone).
+- [x] HUD font scale in settings.
+
+## Scenario content still missing vs PLAN lists
+
+Completed 2026-10-31 (working tree). Headless **149/149**; `src/test/smoke_scenario_content.gd` spawns the refusal event and the celebrity arrival through the real signal path.
+
+
+- [x] Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest
+      refuses wand screening; late arrival during a performance.
+- [x] Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival
+      crowd spike (more rubberneckers, not only one `arrive` spawn).
+- [x] Building: "activate body camera" and "request reason" once those verbs exist, used in
+      at least one authored event.
+
+## Distribution follow-up (host config)
+
+Completed 2026-10-31 (working tree). Headless **153/153**.
+
+
+Verified via API+host credentials (2026-10-31):
+
+- [x] Repo is **public** (`private:false`) and account has admin rights.
+- [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
+      AppImage).
+- [x] **Host setting applied**: `[service] REQUIRE_SIGNIN_VIEW = false` in `/etc/gitea/app.ini`
+      (backup written alongside), Gitea restarted. Verified anonymously: repo page 200, API 200,
+      and a release asset downloads with the full 50.8 MB AppImage.
+
+## Release pipeline follow-up
+
+Completed 2026-10-31 (working tree). Headless **153/153**.
+
+
+- [x] Fix `tools/publish_release.sh`: the `~/.git-credentials` branch never set `AUTH`,
+      so every tag build since v0.2.2 failed to publish.
+- [x] Add a `github.token` fallback in `.gitea/workflows/build.yml` (the repo has no
+      `GITEA_TOKEN` secret).
+- [x] Fall back to the checkout's git extraheader when no token/credentials exist (the
+      Gitea runner does not expose `github.token`).
+- [x] Uploads now fail loudly and the release is verified to carry every artifact
+      (a silent HTTP 4xx used to leave an empty release with a green job).
+- [x] Host disk expanded to 16G; v0.2.0 and v0.2.9 releases restored from the local artifacts.
+- [x] Host maintenance via `root@192.168.88.30`: apt cache cleaned and journald capped
+      (`SystemMaxUse=300M` in `/etc/systemd/journald.conf.d/99-size.conf`); ~7.6G free.
+- [x] Verified end to end: tagging v0.2.12 produced a release with all five artifacts
+      (AppImage, Linux, macOS, NSIS installer, Windows) from CI, with no repo secret.
+- [x] Backfill decision: v0.2.4–v0.2.8 stay superseded; their tags and source remain, and the
+      release page points at the current build. No rebuilds planned.
+
+## Open Polish
+
+Completed 2026-10-31 (working tree). Headless **153/153**.
+
+
+- [x] Keep `%` placeholders stable in `Strings.fmt` when adding keys (positional formatting).
@@ -21,8 +21,8 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  Windowed control smoke: `godot --path . --script res://src/test/smoke_focus_radial.gd` → exit 0.
 - `main` is in sync with origin. **v0.2.2** tags the session-shell + world-follow-up commit;
  CI builds the portable binaries, NSIS installer, and AppImage on the tag push.
- Next work: `TODO.md` accessibility (grayscale-safe escalation cues, HUD font scale in settings),
-  then scenario content gaps.
+- Next work: the two remaining TODO sections — the vision-model screenshot judge
+  (`tools/screen_designs.py`, OpenRouter key in `.env`) and editor tooling (GUT / `.tres` venues).
 - Do not re-open `override_access`. Do not bind wand to `W`. Do not remove the radio easter egg.

 ## Current State
@@ -36,7 +36,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  `hud.controls` / `hud.screen_first` updated.
 - Control pass (in tree, uncommitted, smoke-tested): cone focus via `src/game/npc_focus.gd`,
  accel/decel, gravity only airborne, `input_locked` freeze, Esc no longer on the guard.
-  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; torus head ring + `Label3D` name; `set_focus_visual`.
+  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; blue focus circle + `Label3D` name; `set_focus_visual`.
  `src/game/ui/action_radial.gd` doughnut (LMB/Space open, A/D/arrows, Space/click confirm, Esc/RMB
  cancel). Crosshair CanvasLayer. Emergency still `R` only. Number keys 1–6 when the wheel is closed.
 - Named input actions now exist and are used: `action_menu`, `confirm`, `cancel` (Esc + RMB),
@@ -59,7 +59,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  (`assets/textures/skyline.png`, regenerated RGBA with a transparent sky) and an
  `TRANSPARENCY_ALPHA_SCISSOR` unshaded material (`_skyline_mat`); steps + landing are a
  `StaticBody3D` with per-tread `BoxShape3D` colliders; marquee `font_size` 160 / outline 24; focus
-  torus 0.26–0.34 + name tag 48px; `NpcAvatar.ephemeral`/`lifetime_s` despawns routine traffic
+  circle (blue disc in front of the face) + name tag 48px; `NpcAvatar.ephemeral`/`lifetime_s` despawns routine traffic
  (authored events stay). Guard spawn height verified on the landing (guard_y=0.84).
 - **PLAN verbs (2026-10-31, uncommitted):** the radial now has 12 slices
  (`Stop, Look, Point, No, Ask, Inspect, Wand, Warn, Block, Reason, Recognize, Radio`).
@@ -95,6 +95,22 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  `_begin_incident()` now starts one per focused NPC (`has_open_incident()` guard), verbs call
  `_ensure_incident()`, and `ShiftCoordinator._finish_shift()` closes leftovers as `unresolved`
  before building the review.
+- **String formatting safety (2026-10-31):** `Strings.placeholder_count()` counts `%` specs
+  (ignoring `%%`), `fmt()` warns and returns the template when the arg count does not match
+  (instead of raising an engine error), and `validate()` lints the table for trailing `%`,
+  unsupported conversions, and mixed positional/sequential placeholders. Tests cover all three
+  plus a formatting pass over every placeholder key with type-correct dummy args.
+- **Authored scenario content (2026-10-31):** events can now carry `hint` (a string key logged
+  when the avatar spawns), `extra_spawns` (celebrity arrivals pull in tourists/influencers via
+  `_spawn_npc` with `kind: routine`), and `refuses_screening` (copied to
+  `NPCController.refuses_screening`; `_toggle_wand_screening` logs `wand.refused`, records a
+  `wand_refused` event, applies a small prop hit, and does not open the panel). `film_boundary`
+  is a new intent that maps to `steps_end` so the influencer stands past the posted line.
+- **Accessibility (2026-10-31):** escalation text is `"<name>  [###--] L3/5"` via
+  `Hud.escalation_meter(level)` (pure, tested) so the cue survives grayscale. HUD font scale uses
+  `add_theme_font_size_override` on the core labels (`set_font_scale`), **not** `Control.scale`,
+  which pushed the right-anchored clock label off-screen. Settings load before `_build_ui()`, so
+  `_ready()` re-applies player settings after the HUD exists.
 - **Audio (2026-10-31):** `AudioFeedback.start_crowd_bed()` builds a 4 s looping `AudioStreamWAV`
  (one-pole-filtered noise + 68/103 Hz drone, seeded) and `set_crowd_level(mood)` maps 0..1 to
  -34..-12 dB. `play_radio_open/close` push short filtered-noise bursts. All procedural; with a
@@ -130,7 +146,44 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
  needs `mipmaps/generate=true`.
 - **Asset gotcha:** `assets/textures/game_ready/` is *not* imported (no `.import`). Use the
  imported `assets/textures/skyline.png` path. Untracked duplicate folder should not be referenced.
- Host sign-in follow-up remains deferred. PLAN.md + ADRs 0007–0010 still describe the intended UX.
+- Host sign-in follow-up is **done**: `REQUIRE_SIGNIN_VIEW = false` in `/etc/gitea/app.ini`
+  (backup `app.ini.bak-*` alongside), Gitea restarted; anonymous repo page/API return 200 and
+  release assets download in full. Reverse by setting it back to `true` and restarting.
+- **Release publishing was broken since v0.2.2 (fixed 2026-10-31):** `publish_release.sh`
+  only built `AUTH` in the `GITEA_TOKEN` branch; the `~/.git-credentials` branch set `CRED`
+  and then used unbound `${AUTH[@]}` under `set -u`, so every API call failed and the tag
+  job ended "could not create or find release". The repo also has **no** `GITEA_TOKEN`
+  secret (`/actions/secrets` is empty) and the runner has no git credentials. Fixes: the
+  script sets `AUTH=(-u "$CRED")`; the workflow falls back to `github.token`
+  (`secrets.GITEA_TOKEN || github.token`) — but `github.token` is **not** provided by this
+  Gitea/act runner, so the env dump showed no token and the v0.2.10 tag build failed again.
+  Final fix: `publish_release.sh` falls back to the **local git extraheader** that
+  `actions/checkout` writes (`git config --local --get-regexp '^http\..*\.extraheader$'`),
+  which carries the runner's basic-auth credentials for the same server. Verified locally by
+  adding that extraheader and publishing v0.2.10 (all five artifacts). **v0.2.9 and v0.2.10
+  are published**; v0.2.4–v0.2.8 tags have no artifacts. Verify the CI path on the next tag.
+- **CI publishing verified (2026-10-31):** tagging v0.2.12 produced a release with all five
+  artifacts automatically (no repo secret), confirming the checkout-extraheader fallback.
+- **Host access (2026-10-31):** `root@192.168.88.30` now works from this workstation (key auth),
+  host name `gitea`, Gitea 28.2.0. Maintenance applied: `apt-get clean`, journald capped to
+  `SystemMaxUse=300M` (`/etc/systemd/journald.conf.d/99-size.conf`, journal ~133M), disk at
+  ~7.6G free of 16G.
+- **Host disk resolved (2026-10-31):** the Gitea VM root filesystem was expanded from 7.8G to
+  16G (`/dev/mapper/pve-vm--500--disk--0`, now ~7.8G free). The pruned **v0.2.0** and **v0.2.9**
+  releases were restored from the local `build/` artifacts and verified (4 and 5 assets).
+  `git.allucanget.biz` runs on this host as user `zwitschi`; root@192.168.88.30 is **not**
+  reachable from this workstation (publickey denied; password auth closes the banner), so host
+  maintenance must go through a `zwitschi` login with sudo.
+- **Host disk full (2026-10-31, historical):** the v0.2.11 tag build created release id 27 and logged the
+  uploads, but they failed with `HTTP 500 Attachments.Save: write … no space left on device`
+  (`/dev/mapper/pve-vm--500--disk--0`, 7.8G, 100%, 0 free). `git push` then failed too
+  ("unpacker error"). Unblocked by deleting the superseded **v0.2.0** and **v0.2.9** releases
+  via the API (~565 MB of assets), then publishing v0.2.11 locally with the fixed script
+  (verified 5 assets). Remaining ~150 MB is tight — the next release needs host cleanup on
+  192.168.88.30: `sudo journalctl --vacuum-size=100M` (journal 837 MB), `sudo apt-get clean`
+  (91 MB), clear `/var/lib/gitea/data/attachments/tmp`. SSH works as `zwitschi`; `sudo -n`
+  needs a password. **Releases now:** v0.2.11, v0.2.10, v0.2.1 (5 assets each); v0.2.0 and
+  v0.2.9 entries were pruned. PLAN.md + ADRs 0007–0010 still describe the intended UX.
 - **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
  and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
 - NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines
@@ -458,7 +458,7 @@ Desktop is the first target: Windows, Linux, and macOS. Web export is a later op

 The prototype already walks and looks in first person, but the control scheme fights itself and targeting is a hairline. This pass replaces that with three things that belong together: solid locomotion, a visible focus on a person, and a round action menu for what to do with them.

-Decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md) locomotion and input layers, [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md) cone focus and head ring, [ADR-0009](docs/adr/0009-radial-action-menu.md) radial action menu, [ADR-0010](docs/adr/0010-procedural-npc-presentation.md) procedural NPC presentation.
+Decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md) locomotion and input layers, [ADR-0008](docs/adr/0008-cone-focus-and-head-ring.md) cone focus and focus circle, [ADR-0009](docs/adr/0009-radial-action-menu.md) radial action menu, [ADR-0010](docs/adr/0010-procedural-npc-presentation.md) procedural NPC presentation.

 ### What is wrong today

@@ -496,17 +496,17 @@ Replace the hairline ray as the primary picker.
 - `Tab` still cycles people inside 12 m as the aim-free path. Cycling sets the same focused person the cone would.
 - Clearing: look away until the head leaves the circle for a few frames (small grace so a bob does not drop them), or they walk out of range.

-### Head ring
+### Focus circle

-When a person is in focus, draw a thin ring around their head.
+When a person is in focus, draw a blue, semi-transparent circle in front of their face.

- Attach to the avatar `Head` node, sitting just above the skull, billboarded to the camera so it stays a circle on screen.
+- Attach to the avatar `Head` node, just in front of the face, billboarded to the camera so it stays a circle on screen.
 - Slow spin is fine; no ping-pong scale spam.
- Idle focus: pale gold, modest size. Radial open on that person: brighter, slightly larger.
- Optional small name under the ring (`display_name` only, not the archetype cheat `Violent Threat` in the world). The existing HUD target line can keep the archetype for the prototype.
- One ring at a time. Everyone else has none.
+- Idle focus: blue, semi-transparent, modest size. Radial open on that person: brighter, slightly larger.
+- Optional small name under the circle (`display_name` only, not the archetype cheat `Violent Threat` in the world). The existing HUD target line can keep the archetype for the prototype.
+- One circle at a time. Everyone else has none.

-Implementation sketch: `MeshInstance3D` torus or a thin unshaded ring mesh on the avatar, toggled from `GuardController` / `GameManager` when focus changes. Screen-space fallback (unproject head, draw a `Control` circle) is acceptable if the 3D torus z-fights on hats.
+Implementation sketch: a thin unshaded `MeshInstance3D` circle (flat disc) in front of the face on the avatar, toggled from `GuardController` / `GameManager` when focus changes. Screen-space fallback (unproject head, draw a `Control` circle) is acceptable if the 3D circle z-fights on hats.

 ### Round action HUD

@@ -545,7 +545,7 @@ A doughnut / pie menu centered on the screen, opened on the focused person.
 **Cancel**

 - `Esc` or right mouse button: hide the menu, no action, no recorder event, recapture mouse.
- Focus and the head ring stay as they were.
+- Focus and the focus circle stay as they were.

 Number keys `1`–`6` may remain as shortcuts that skip the wheel so a smoke-test script still works. They must not fire while the wheel is open (the wheel owns `A` / `D` / `Space`). Document both in the README.

@@ -28,7 +28,10 @@ The central design goal is simple:

 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>

-> **Latest: v0.2.8** — procedural crowd ambience driven by crowd mood, and radio crackle.
+> Downloads are public (no sign-in required) since the host's instance-wide
+> `REQUIRE_SIGNIN_VIEW` was disabled on 2026-10-31.
+>
+> **Latest: v0.2.14** — string-formatting safety, plus public downloads (no sign-in) on the host.
 > Releases are built automatically when a `vX.Y.Z` tag is pushed
 > (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline
@@ -235,7 +238,7 @@ godot --headless --path . --script res://src/test/test_runner.gd
 # Save a screenshot to user:// (windowed)
 godot --path . --script res://src/test/take_screenshot.gd

-# Windowed control smoke: focus ring + action wheel, saves PNGs, exits 1 on failure
+# Windowed control smoke: focus circle + action wheel, saves PNGs, exits 1 on failure
 godot --path . --script res://src/test/smoke_focus_radial.gd

 # Session-shell smoke: menu → shift → pause → settings → menu (headless or windowed)
@@ -255,6 +258,9 @@ godot --headless --path . --script res://src/test/smoke_timeline.gd

 # Audio smoke: crowd bed follows mood, radio open/close crackle
 godot --headless --path . --script res://src/test/smoke_audio.gd
+
+# Scenario-content smoke: wand refusal, celebrity crowd spike
+godot --headless --path . --script res://src/test/smoke_scenario_content.gd
 ```

 The unit test runner is the project's own lightweight harness (no editor plugin required) so CI can run it without the editor.
@@ -307,12 +313,12 @@ Implemented so far:
 - Godot 4.3 project scaffold, input map, procedural world builder
 - Venue-driven simulation core: `ShiftCoordinator`, `VenueScenario`, `EventScheduler`, `NPCController` + FSM, `AccessVerifier`, `EscalationManager`, `RadioSystem`, `IncidentRecorder`, `ReputationEvaluator`, `CrowdSystem`
 - Three authored scenarios (Hollywood Boulevard building, The Joke Shop, Late Night TV Studio) with access policies, NPC archetypes, and event pools
- Headless unit tests: **134 passing** (access rules and venue-correct access loadout, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, settings round-trip, navmesh, step colliders, skyline alpha, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings, focus cone, action wheel, session shell, PLAN verbs and incident recording, crowd presentation, emergency aftermath, body-camera timeline, NPC theater poses, audio)
+- Headless unit tests: **153 passing** (access rules and venue-correct access loadout, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, settings round-trip, navmesh, step colliders, skyline alpha, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings, focus cone, action wheel, session shell, PLAN verbs and incident recording, crowd presentation, emergency aftermath, body-camera timeline, NPC theater poses, audio, accessibility, authored scenario content, string formatting)
 - Simulation extras: protester archetype, CALL_SOMEONE reaction, door lock/secure mechanic (visual indicator), flashlight with night perception bonus, LATE shift phase reaching the violent-threat event
 - First-person prototype with interaction HUD, access inspection, wand screening, radio report form (incl. emergency hold-to-confirm), dispatched responder avatars, aim-free targeting, venue cycling between all three scenarios, color-coded escalation feedback, procedural audio cues, navigation-mesh NPC paths, JSON-backed localized strings, persisted shift history, debug overlay, and shift review
- Control pass: focus cone on NPC heads with a billboarded gold ring and name, action wheel (LMB/Space) with de-escalation-first slices, mouse-look freeze while a panel is open, acceleration-based walking, and named input actions (`action_menu`, `confirm`, `cancel`, `inspect`, `wand`)
+- Control pass: focus cone on NPC heads with a billboarded blue circle in front of the face and name, action wheel (LMB/Space) with de-escalation-first slices, mouse-look freeze while a panel is open, acceleration-based walking, and named input actions (`action_menu`, `confirm`, `cancel`, `inspect`, `wand`)
 - Session shell: venue start menu (keyboard + mouse), Esc pause overlay (resume / restart / settings / quit to menu), settings panel with mouse-look sensitivity and HUD font scale persisted to `user://settings.json`, and "Run another shift" returning to the venue menu
- World presentation: skyline backdrop rendered with an alpha material, walkable step and landing colliders, larger marquee text, and larger focus ring / name tag
+- World presentation: skyline backdrop rendered with an alpha material, walkable step and landing colliders, larger marquee text, and larger focus circle / name tag
 - Routine traffic despawns after a while at its waypoint so the crowd cap no longer fills with idle standers
 - PLAN verbs: eye contact (distinct Level 1 cue), recognizing a person as a player decision recorded as access evidence, a body-camera flag that a formal warning arms (and `B` toggles), blocking that physically stations the guard between the person and the door, and a Level 3 request-reason ask answered from the NPC's `dialogue_lines`
 - Incidents are now actually opened on focus and closed at shift end, so player actions, access evidence, escalation levels, and unresolved interactions reach the review (previously every recorded event was dropped)
@@ -323,6 +329,9 @@ Implemented so far:
 - Body-camera timeline: the shift review opens a text timeline of every recorded incident event (time, person, action/outcome) that you step through with the arrow keys or buttons. No live 3D replay yet
 - NPC theater: seated guests sit on the steps with bent legs, influencers and tourists raise a camera prop while photographing, performers sway their sign, and filming visitors pan slowly — all once they reach their intent's waypoint
 - Audio: a looping procedural crowd bed (filtered murmur) whose volume follows `CrowdSystem.mood`, plus radio open/close crackle. All generated at runtime, no audio assets, and safe with a dummy audio server
+- Accessibility: the escalation cue shows a shape meter plus the numeric level (`Escalation: Blocking [###--] L3/5`) so it reads in grayscale, and the HUD font scale from settings is applied at boot by resizing fonts (not Control.scale, which broke the right-aligned layout)
+- Localization safety: `Strings.fmt` validates the placeholder count before formatting and fails safe (warns, returns the template) instead of raising an engine error, `Strings.placeholder_count` ignores `%%`, and `Strings.validate()` lints the table for trailing `%`, unsupported conversions, and mixed positional/sequential placeholders
+- Authored scenario content: Joke Shop reservation-without-ID, borrowed/mismatched ID, a guest who refuses the wand screen, and a late arrival during a performance; Studio filming-boundary repeats and a celebrity arrival that draws a small crowd; Building events that point the player at the body camera and request-reason verbs
 - Visual polish pass (v0.2.0): phase-based lighting (sun/sky/ambient per shift phase), street lamps with night-mode bulbs and omni lights, glowing marquee signage, crosswalk, planters and low-poly street trees, NPC height/brightness variety, denser routine traffic — day and late-night screenshot sets
 - Assets pass: authored textures in `assets/textures/` (brick facade, concrete, asphalt, awning, skyline, vignette, HUD icons, access-card art) generated by `tools/generate_textures.py`, soft sun shadows, humanoid NPC rigs with archetype props + procedural walk bob and attention head-turn, inspection artifact cards, escalation vignette, mode icons, and a body-camera overlay (REC + shift clock)

@@ -338,7 +347,7 @@ Not yet implemented: live 3D body-camera replay, editor-based GUT integration, a
 6. The skyline backdrop shows silhouettes against the sky, not an opaque black slab.
 7. The `STEP LINE` marquee is readable from the sidewalk.
 8. NPCs spawn and approach the entrance during the first minutes.
-9. Looking at an NPC inside the focus cone shows a gold head ring, the person's name, and the HUD target line.
+9. Looking at an NPC inside the focus cone shows a blue focus circle in front of the face, the person's name, and the HUD target line.
 10. `Space` or left click opens the action wheel; `A`/`D` highlight a slice, `Space` confirms it, `Esc`/right click cancels without a log entry.
 11. `E`/`C` open the inspection/wand panels from the wheel and freeze movement until they close; walking never fires the wand.
 12. Pressing `Q` produces a reaction log entry and reputation feedback.
@@ -360,7 +369,9 @@ Not yet implemented: live 3D body-camera replay, editor-based GUT integration, a
 28. An unjustified emergency call (calm person, no weapon) logs an investigation and costs reputation.
 29. After an evacuation outcome the door is locked and NPCs are leaving the entrance.
 30. The shift review's "Body camera timeline" button steps through the recorded events (Left/Right or the buttons) and Esc returns to the review.
-31. When the shift timer reaches 0, the shift review screen shows grade, incident summary, responder outcomes, investigations, and persisted shift history; "Run another shift" returns to the venue menu.
+31. The escalation label shows a `[###--] L3/5` shape meter as well as the level name, and stays readable in grayscale.
+32. Changing "HUD font scale" in Settings resizes the HUD text and persists across a restart.
+33. When the shift timer reaches 0, the shift review screen shows grade, incident summary, responder outcomes, investigations, and persisted shift history; "Run another shift" returns to the venue menu.

 ## Development Workflow

@@ -1,38 +1,8 @@
 # TODO

-Godot 4.3 prototype. Release **v0.2.8** is tagged. Headless suite **134/134**, plus the session,
-PLAN-verb, crowd, emergency, timeline, audio, and windowed focus/radial smokes.
-
-Host `REQUIRE_SIGNIN_VIEW` stays deferred.
-
-## Accessibility
-
- [ ] Escalation colors that still read in grayscale (shape or label, not hue alone).
- [ ] HUD font scale in settings.
-
-## Scenario content still missing vs PLAN lists
-
- [ ] Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest
-      refuses wand screening; late arrival during a performance.
- [ ] Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival
-      crowd spike (more rubberneckers, not only one `arrive` spawn).
- [ ] Building: "activate body camera" and "request reason" once those verbs exist, used in
-      at least one authored event.
-
-## Distribution follow-up (host config, deferred)
-
-Verified via API+host credentials (2026-10-31):
-
- [x] Repo is **public** (`private:false`) and account has admin rights.
- [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
-      AppImage).
- [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
-      anonymous browsing/downloads redirect to login. Host admin: `REQUIRE_SIGNIN_VIEW = false`
-      under `[service]` in `app.ini`, restart Gitea. Alternative: mirror downloads.
-
-## Open Polish
-
- [ ] Keep `%` placeholders stable in `Strings.fmt` when adding keys (positional formatting).
+Godot 4.3 prototype. Latest release **v0.2.14**. Headless suite **153/153**, plus the session,
+PLAN-verb, crowd, emergency, timeline, audio, scenario-content, and windowed focus/radial smokes.
+Anonymous downloads are enabled on the host.

 ## Screen design references (QA tooling)

@@ -56,6 +56,15 @@
  "reason.ask": "You ask %s why they are here.",
  "reason.reply": "%s: \"%s\"",
  "reason.silent": "%s says nothing and looks away.",
+  "hint.reservation_no_id": "On the reservation list but no ID — ask for ID, then check the list.",
+  "hint.borrowed_id": "The ID photo does not match the person. Verify before admitting.",
+  "hint.refuses_wand": "This guest refuses the wand screen. No screen, no entry.",
+  "hint.late_arrival": "Late arrival during the performance — check ID and ticket before opening the door.",
+  "hint.film_boundary": "Filming past the posted line. Ask their reason and point them back to the sidewalk.",
+  "hint.film_boundary_repeat": "Same crew again, still past the line. A formal warning is now reasonable.",
+  "hint.celebrity_arrival": "Celebrity arrival: the crowd is swelling. Keep the entrance clear.",
+  "hint.body_camera_reason": "They are filming the entrance. Ask their reason (Reason) and consider the body camera (B).",
+  "hint.ask_reason": "Unclear intent. Ask why they are here (Reason) before deciding anything else.",
  "station.blocking": "You step between %s and the door.",
  "perception.near": "%s notices you standing close.",
  "perception.aware": "%s notices you watching.",
@@ -37,8 +37,30 @@ The repository ships a Gitea Actions workflow (`.gitea/workflows/build.yml`):
  Linux/Windows/macOS, artifact upload, and — on tags — release publication via
  `tools/publish_release.sh`.

-For tag builds, set a repo secret named **`GITEA_TOKEN`** (write:repository scope).
-Without it the workflow still builds and tests, but the release publish step fails.
+`tools/publish_release.sh` picks the first available credential, in order:
+
+1. `GITEA_TOKEN` (repo secret, write:repository scope),
+2. `GITEA_AUTH_HEADER` (a ready-made `Authorization: ...` header),
+3. `~/.git-credentials` for the host,
+4. the **local git extraheader** that `actions/checkout` configures on the CI job.
+
+Option 4 is what makes tag builds publish without any repo secret: the runner
+already injects basic-auth credentials for the checkout, and the script reuses that
+header for the API (same server). `github.token` is *not* available in this Gitea
+setup, so do not rely on it.
+
+> **Disk space:** Gitea stores release assets under `/var/lib/gitea/data/attachments` on
+> the host root filesystem (7.8 GB here). When it is full, asset uploads fail with
+> `HTTP 500 … no space left on device` and even `git push` can fail with "unpacker error".
+> `publish_release.sh` now verifies the asset count and exits non-zero, so this is visible.
+>
+> **Incident (2026-10-31):** `tools/publish_release.sh` never set `AUTH` in its
+> `~/.git-credentials` branch, so every API call failed silently (`AUTH[@]` was
+> unbound under `set -u`). Combined with no `GITEA_TOKEN` secret on the repo, tag
+> builds from v0.2.2 to v0.2.8 produced installers but published nothing. The script
+> is fixed (`AUTH=(-u "$CRED")`) and v0.2.9 was published locally with all five
+> artifacts. If CI publishing fails again, run
+> `./tools/publish_release.sh <version>` from a checkout with `~/.git-credentials`.

 > **No `actions/cache` for now:** the runner has no local actions-cache service, so
 > `actions/cache` times out against GitHub's cache API. We dropped it (Godot import
@@ -1,4 +1,4 @@
-# ADR-0008: Cone focus and head ring
+# ADR-0008: Cone focus and focus circle

 - **Status:** Accepted
 - **Date:** TBD
@@ -19,7 +19,7 @@ Focus is a **cone**, not a ray.
 - A few frames of grace keep walk-bob from dropping focus.
 - `Tab` still cycles people inside 12 m and sets the same focused person.

-When someone is in focus, draw a **thin ring** around their head, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Pale gold while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the ring. One ring at a time.
+When someone is in focus, draw a **blue, semi-transparent circle in front of the face**, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Blue while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the circle. One circle at a time.

 The world must not show the internal type name (`Trespasser`, `Violent Threat`). The debug overlay (`F`) can still print it.

@@ -28,19 +28,19 @@ The world must not show the internal type name (`Trespasser`, `Violent Threat`).
 ### Positive

 - Looking near a person is enough; the player does not have to pin a capsule.
- The ring is visible in the scene, so the HUD is not the only focus cue.
+- The circle is visible in the scene, so the HUD is not the only focus cue.
 - `Tab` remains the accessibility path and shares the same focused person.
 - The action menu (ADR-0009) has a clear subject.

 ### Negative

 - Two heads in the same circle can steal focus; center-distance is a heuristic, not a lock-on.
- Hats and protester signs can z-fight a 3D torus. A screen-space circle unprojected from the head is an allowed fallback.
+- Hats and protester signs can z-fight a 3D circle. A screen-space circle unprojected from the head is an allowed fallback.
 - Occlusion rays can fail on unusual geometry; grace frames hide some of that.

 ## Alternatives considered

 - **Keep the hairline ray:** Rejected because it drops people too easily and has no world mark.
 - **Sticky lock-on until cancelled:** Rejected because the job is to watch a crowd, not duel one person.
- **Screen reticle only, no world ring:** Rejected; in a crowd the player needs a mark on the head, not only a HUD line.
+- **Screen reticle only, no world circle:** Rejected; in a crowd the player needs a mark on the face, not only a HUD line.
 - **Click a person to select, then act:** Rejected for default play. The mouse is captured for look (ADR-0007). Click opens the action menu on whoever is already in the cone.
@@ -31,7 +31,7 @@ While the menu is open, walk and look freeze (ADR-0007) and the cursor is visibl

 **Confirm:** click a slice, or `Space` on the highlighted slice. The menu closes, the mouse is recaptured, and that action runs. Inspect, wand, and radio assist close the wheel and then open the existing panels. Walk and look stay frozen until that panel closes.

-**Cancel:** `Esc` or right mouse button. The menu hides. No action runs. No recorder event. Focus and the head ring stay. The mouse is recaptured.
+**Cancel:** `Esc` or right mouse button. The menu hides. No action runs. No recorder event. Focus and the focus circle stay. The mouse is recaptured.

 Number keys `1`–`6` may remain as shortcuts when the wheel is closed, so existing smoke tests still work. They must not fire while the wheel is open.

@@ -54,7 +54,7 @@ Number keys `1`–`6` may remain as shortcuts when the wheel is closed, so exist
 ## Alternatives considered

 - **Hold-to-open, release-to-confirm (GTA / Destiny):** Rejected. The requested input is click or Space to open, then click or Space to confirm, with Esc / RMB to abort. That is a toggle, not a hold.
- **Vertical list / command menu:** Rejected because a round layout around a focused person matches the head ring and reads faster in a crowd.
+- **Vertical list / command menu:** Rejected because a round layout around a focused person matches the focus circle and reads faster in a crowd.
 - **One context-sensitive Use key:** Rejected; the game is about choosing among levels, not a single default verb.
 - **Emergency on the wheel:** Rejected because a misclick would dispatch armed response. ADR-0002 already keeps that path rare and confirmed.
 - **Drop number-key shortcuts immediately:** Deferred. They remain as a closed-menu fallback until the wheel is proven in play.
@@ -21,7 +21,7 @@ Make the body read as a person at conversation distance:
 - Shoes.
 - Hair cap whose color comes from the visual seed.
 - Two dark eye spheres so the head has a front.
- Named `Head` node (`Rig/Head`) as the attach point for the focus ring (ADR-0008) and the focus cone.
+- Named `Head` node (`Rig/Head`) as the attach point for the focus circle (ADR-0008) and the focus cone.
 - Collision capsule scaled to the visible height so the cone hits the body the player sees.

 Keep archetype props, height / brightness variation, walk bob, and the notice head-turn.
@@ -49,5 +49,5 @@ AI clothing textures stay out unless a map is already the right size and is wire

 - **Skinned Mixamo / GLB characters now:** Rejected. Cost and pipeline exceed this pass; the sim only needs a readable body and a head node.
 - **Billboard sprites:** Rejected; first-person movement walks around people, and sprites fail at profile views.
- **Keep colored capsules as-is:** Rejected; the head ring and cone need a real head, and capsules do not read as people at two metres.
+- **Keep colored capsules as-is:** Rejected; the focus circle and cone need a real head, and capsules do not read as people at two metres.
 - **World labels with archetype names:** Rejected because they leak sim truth and skip observation.
@@ -153,7 +153,7 @@ Architecture decisions are recorded as ADRs:
 - [ADR-0005: Event-based incident recording](adr/0005-event-based-incident-recording.md)
 - [ADR-0006: Godot 4 with GDScript](adr/0006-godot-4-gdscript.md)
 - [ADR-0007: Locomotion and input layers](adr/0007-locomotion-and-input-layers.md)
- [ADR-0008: Cone focus and head ring](adr/0008-cone-focus-and-head-ring.md)
+- [ADR-0008: Cone focus and focus circle](adr/0008-cone-focus-and-head-ring.md)
 - [ADR-0009: Radial action menu](adr/0009-radial-action-menu.md)
 - [ADR-0010: Procedural NPC presentation](adr/0010-procedural-npc-presentation.md)

@@ -8,7 +8,7 @@ config_version=5

 config/name="Step Line"
 config/description="Workplace security simulation about observation, access verification, and proportionate escalation."
-config/version="0.2.8"
+config/version="0.2.14"
 run/main_scene="res://scenes/main.tscn"
 config/features=PackedStringArray("4.3", "GL Compatibility")

@@ -343,6 +343,28 @@ static func hollywood_building() -> VenueScenario:
 		_building_routine("staff_entry", Rules.NpcType.AUTHORIZED_STAFF, "enter", Vector2(0, 600), 0.35),
 		_building_routine("guest_entry", Rules.NpcType.AUTHORIZED_GUEST, "enter", Vector2(0, 900), 0.25),
 		_building_routine("performer_show", Rules.NpcType.PERFORMER, "perform", Vector2(300, 800), 0.24),
+		{
+			"id": "building_filming_boundary",
+			"phase": Rules.Phase.MIDDAY,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.INFLUENCER,
+			"intent": "film",
+			"time_range_s": Vector2(300, 600),
+			"probability": 0.4,
+			"base_weight": 1.0,
+			"hint": "hint.body_camera_reason",
+		},
+		{
+			"id": "building_unclear_intent",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.CONFUSED_VISITOR,
+			"intent": "enter",
+			"time_range_s": Vector2(600, 780),
+			"probability": 0.4,
+			"base_weight": 1.0,
+			"hint": "hint.ask_reason",
+		},
 		_building_routine("influencer_film", Rules.NpcType.INFLUENCER, "film", Vector2(300, 900), 0.26),
 		_building_routine("intoxicated_wander", Rules.NpcType.INTOXICATED, "wander", Vector2(600, 900), 0.15),
 		_building_routine("trespass_test", Rules.NpcType.TRESPASSER, "trespass", Vector2(300, 900), 0.16),
@@ -437,6 +459,67 @@ static func joke_shop() -> VenueScenario:
 		_joke_guest("guest_no_ticket", false, true, Vector2(0, 900), 0.18),
 		_joke_guest("guest_expired_id", true, true, Vector2(0, 900), 0.12, {"id_status": Rules.ArtifactStatus.EXPIRED}),
 		_joke_guest("guest_no_id", true, false, Vector2(0, 900), 0.12),
+		{
+			"id": "joke_guest_reservation_no_id",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.AUTHORIZED_GUEST,
+			"intent": "enter",
+			"time_range_s": Vector2(620, 860),
+			"probability": 0.45,
+			"base_weight": 1.0,
+			"override_access": {
+				"has_guest_list": true, "guest_list_status": Rules.ArtifactStatus.VALID,
+				"has_id": false, "has_ticket": false,
+			},
+			"hint": "hint.reservation_no_id",
+		},
+		{
+			"id": "joke_borrowed_id",
+			"phase": Rules.Phase.MIDDAY,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.AUTHORIZED_GUEST,
+			"intent": "enter",
+			"time_range_s": Vector2(320, 700),
+			"probability": 0.4,
+			"base_weight": 1.0,
+			"override_access": {
+				"has_id": true, "id_status": Rules.ArtifactStatus.MISMATCHED,
+				"has_ticket": true, "ticket_status": Rules.ArtifactStatus.VALID,
+			},
+			"hint": "hint.borrowed_id",
+		},
+		{
+			"id": "joke_refuses_wand",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.AUTHORIZED_GUEST,
+			"intent": "enter",
+			"time_range_s": Vector2(650, 880),
+			"probability": 0.4,
+			"base_weight": 1.0,
+			"refuses_screening": true,
+			"override_access": {
+				"has_id": true, "id_status": Rules.ArtifactStatus.VALID,
+				"has_ticket": true, "ticket_status": Rules.ArtifactStatus.VALID,
+			},
+			"hint": "hint.refuses_wand",
+		},
+		{
+			"id": "joke_late_arrival",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.AUTHORIZED_GUEST,
+			"intent": "arrive",
+			"time_range_s": Vector2(700, 860),
+			"probability": 0.35,
+			"base_weight": 1.0,
+			"override_access": {
+				"has_id": true, "id_status": Rules.ArtifactStatus.VALID,
+				"has_ticket": true, "ticket_status": Rules.ArtifactStatus.VALID,
+			},
+			"hint": "hint.late_arrival",
+		},
 		_joke_staff_entry(Vector2(0, 900), 0.25),
 		_joke_routine("performer_show", Rules.NpcType.PERFORMER, "perform", Vector2(300, 800), 0.15),
 		_joke_routine("influencer_film", Rules.NpcType.INFLUENCER, "film", Vector2(300, 900), 0.15),
@@ -515,6 +598,45 @@ static func tv_studio() -> VenueScenario:
 			"base_weight": 1.0,
 			"override_access": {"wristband_status": Rules.ArtifactStatus.COUNTERFEIT, "credential_status": Rules.ArtifactStatus.COUNTERFEIT},
 		},
+		{
+			"id": "studio_film_boundary",
+			"phase": Rules.Phase.MIDDAY,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.INFLUENCER,
+			"intent": "film_boundary",
+			"time_range_s": Vector2(330, 560),
+			"probability": 0.5,
+			"base_weight": 1.0,
+			"hint": "hint.film_boundary",
+		},
+		{
+			"id": "studio_film_boundary_repeat",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.INFLUENCER,
+			"intent": "film_boundary",
+			"time_range_s": Vector2(640, 830),
+			"probability": 0.45,
+			"base_weight": 1.0,
+			"hint": "hint.film_boundary_repeat",
+		},
+		{
+			"id": "studio_celebrity_arrival",
+			"phase": Rules.Phase.EVENING,
+			"kind": "scripted",
+			"npc_type": Rules.NpcType.AUTHORIZED_GUEST,
+			"intent": "arrive",
+			"time_range_s": Vector2(620, 760),
+			"probability": 0.5,
+			"base_weight": 1.0,
+			"override_access": {"has_guest_list": true, "guest_list_status": Rules.ArtifactStatus.VALID},
+			"extra_spawns": [
+				{"npc_type": Rules.NpcType.TOURIST, "intent": "photo"},
+				{"npc_type": Rules.NpcType.TOURIST, "intent": "photo"},
+				{"npc_type": Rules.NpcType.INFLUENCER, "intent": "film"},
+			],
+			"hint": "hint.celebrity_arrival",
+		},
 		{
 			"id": "studio_follow_through",
 			"phase": Rules.Phase.EVENING,
@@ -587,6 +709,10 @@ static func _joke_routine(id: String, npc_type: int, intent: String, time_range:
 static func _studio_routine(id: String, npc_type: int, intent: String, time_range: Vector2, prob: float) -> Dictionary:
 	return _building_routine(id, npc_type, intent, time_range, prob)

+## Scripted film-boundary intent: the influencer stands past the posted line.
+static func _film_boundary_spot() -> String:
+	return "steps_end"
+
 static func _phase_for_range(time_range: Vector2, duration: float) -> int:
 	var start := time_range.x / duration
 	if start < 0.34:
@@ -34,6 +34,8 @@ var guard_noticed := false

 ## Whether this NPC has passed the handheld wand screening (The Joke Shop).
 var screened := false
+## Authored event flag: this person refuses the wand screen (Joke Shop).
+var refuses_screening := false
 ## Whether the guard has declared they recognize this person (a player decision
 ## recorded as evidence, PLAN.md: Authorized Access).
 var player_recognized := false
@@ -34,12 +34,69 @@ static func lookup(key: String) -> String:
 	_ensure_loaded()
 	return TABLE.get(key, key)

+## Number of `%` conversion placeholders in a template, ignoring `%%` escapes.
+static func placeholder_count(template: String) -> int:
+	var count := 0
+	var i := 0
+	while i < template.length():
+		if template[i] == "%":
+			if i + 1 < template.length() and template[i + 1] == "%":
+				i += 2
+				continue
+			count += 1
+		i += 1
+	return count
+
 ## Format a string by key with positional arguments.
+##
+## GDScript's `%` binds arguments by order, so a key whose placeholder count drifts
+## from its call site would push an engine error. Validate first and fail safe: log
+## a warning and return the raw template instead of crashing.
 static func fmt(key: String, args: Array) -> String:
 	var template := lookup(key)
 	if template == key:
 		return template
+	var needed := placeholder_count(template)
+	if needed != args.size():
+		push_warning("Strings.fmt(%s): template needs %d args, got %d" % [key, needed, args.size()])
+		return template
 	return template % args

+## Lint the loaded table for formatting hazards. Returns an array of problems.
+## Checks: trailing `%`, invalid conversions, and mixed positional (`%1$s`) and
+## sequential placeholders in one template.
+static func validate() -> Array[String]:
+	_ensure_loaded()
+	var problems: Array[String] = []
+	for key in TABLE.keys():
+		var template := str(TABLE[key])
+		var positional := template.contains("$")
+		var sequential := 0
+		var i := 0
+		while i < template.length():
+			if template[i] != "%":
+				i += 1
+				continue
+			if i + 1 >= template.length():
+				problems.append("%s: trailing %% escape" % key)
+				break
+			var next := template[i + 1]
+			if next == "%":
+				i += 2
+				continue
+			var j := i + 1
+			while j < template.length() and template[j] in "0123456789.$":
+				if template[j] == "$":
+					positional = true
+				j += 1
+			if j >= template.length() or not (template[j] in "sdfxXv"):
+				problems.append("%s: unsupported conversion near '%%%s'" % [key, template.substr(i + 1, 3)])
+			elif not positional:
+				sequential += 1
+			i = j + 1
+		if positional and sequential > 0:
+			problems.append("%s: mixes positional (%%1$s) and sequential (%%s) placeholders" % key)
+	return problems
+
 func _init() -> void:
 	push_error("Strings is a static utility class; use Strings.lookup / Strings.fmt.")
@@ -63,7 +63,9 @@ func _spot_for_intent(intent: String) -> String:
 			return "entrance"
 		"photo", "film", "perform", "wander", "roam":
 			return "sidewalk"
-		"sit":
+		"sit", "film_boundary":
+			# film_boundary: an influencer ignoring the posted filming line, so they
+			# stand at the steps instead of the permitted sidewalk spot.
 			return "steps_end"
 		_:
 			return "sidewalk"
@@ -141,6 +141,9 @@ func _ready() -> void:
 	_connect_crowd()

 	_build_ui()
+	# The HUD does not exist yet when settings are loaded, so push them again now
+	# that it does (otherwise the saved font scale is ignored until the next apply).
+	_apply_settings(player_settings)
 	_last_phase = -1
 	_apply_phase_lighting()
 	# Boot into the venue menu; the shift starts when the player picks a venue.
@@ -476,8 +479,19 @@ func _spawn_npc(profile: NpcProfile, intent: String, npc_id: String, event: Dict
 	# Authored events stay for the whole shift; routine traffic cycles out.
 	avatar.ephemeral = event.get("kind", "routine") == "routine"
 	avatar.lifetime_s = 45.0 + float((npc_counter * 17) % 60)
+	avatar.get_npc_controller().refuses_screening = bool(event.get("refuses_screening", false))
 	scene_root.add_child(avatar)
 	npcs.append(avatar)
+	# Authored events can point the player at the right verb (PLAN.md verbs).
+	if event.has("hint") and hud:
+		hud.log(Strings.lookup(str(event["hint"])))
+	# Celebrity arrivals draw extra bystanders, not just one avatar.
+	for extra in event.get("extra_spawns", []):
+		var extra_profile := selected_scenario.profile_for(extra.get("npc_type", Rules.NpcType.TOURIST))
+		if extra_profile == null or npcs.size() >= MAX_LIVE_NPCS:
+			continue
+		_spawn_npc(extra_profile, str(extra.get("intent", "photo")),
+			"%s_w%d" % [npc_id, npcs.size()], {"kind": "routine"})

 ## Drop references to freed avatars so the cap and Tab cycling stay accurate.
 func _purge_npcs() -> void:
@@ -1235,6 +1249,16 @@ func _toggle_wand_screening() -> void:
 	var controller: Object = _targeted_controller()
 	if controller == null:
 		return
+	if controller.refuses_screening:
+		# Authored event: this guest refuses the screen (Joke Shop content).
+		hud.set_wand_icon(false)
+		hud.log(Strings.fmt("wand.refused", [controller.profile.display_name if controller.profile else "The guest"]))
+		coordinator.recorder.add_event(controller.npc_id, {
+			"type": "wand_refused",
+			"outcome": "refused",
+		})
+		coordinator.reputation.apply("prop", -1.0, "guest refused screening")
+		return
 	var profile: Object = controller.profile
 	var items: Array = profile.carried_items if profile else []
 	var result: Dictionary = wand_screener.screen(items)
@@ -89,7 +89,7 @@ var _rig: Node3D = null
 var _head: Node3D = null
 var _bob_phase := 0.0
 var _guard_ref: Node3D = null
-var _ring: MeshInstance3D = null
+var _focus_circle: MeshInstance3D = null
 var _name_tag: Label3D = null
 ## Theater props and limbs for the idle poses (ADR-0010 rig).
 var _photo_prop: MeshInstance3D = null
@@ -136,26 +136,29 @@ func _build_body(npc_type: int) -> void:
 	_rig.add_child(_head)
 	_add_box_prop(_rig, Vector3(0.16, 0.08, 0.28), Vector3(-0.16, 0.05, 0.02), Color(0.12, 0.12, 0.14))
 	_add_box_prop(_rig, Vector3(0.16, 0.08, 0.28), Vector3(0.16, 0.05, 0.02), Color(0.12, 0.12, 0.14))
-	_build_focus_ring()
+	_build_focus_circle()
 	_add_props(npc_type)

-func _build_focus_ring() -> void:
-	_ring = MeshInstance3D.new()
-	_ring.name = "FocusRing"
-	var torus := TorusMesh.new()
-	torus.inner_radius = 0.26
-	torus.outer_radius = 0.34
-	torus.rings = 12
-	torus.ring_segments = 16
-	_ring.mesh = torus
+func _build_focus_circle() -> void:
+	_focus_circle = MeshInstance3D.new()
+	_focus_circle.name = "FocusCircle"
+	# Blue, semi-transparent disc floating in front of the face (ADR-0008).
+	# Billboarded so it always reads as a circle on screen.
+	var disc := CylinderMesh.new()
+	disc.top_radius = 0.15
+	disc.bottom_radius = 0.15
+	disc.height = 0.001
+	disc.radial_segments = 24
+	_focus_circle.mesh = disc
 	var mat := StandardMaterial3D.new()
 	mat.shading_mode = BaseMaterial3D.SHADING_MODE_UNSHADED
-	mat.albedo_color = Color(0.95, 0.82, 0.28, 0.9)
+	mat.albedo_color = Color(0.25, 0.55, 1.0, 0.45)
 	mat.transparency = BaseMaterial3D.TRANSPARENCY_ALPHA
-	_ring.material_override = mat
-	_ring.position = Vector3(0, 0.28, 0)
-	_ring.visible = false
-	_head.add_child(_ring)
+	mat.billboard_mode = BaseMaterial3D.BILLBOARD_ENABLED
+	_focus_circle.material_override = mat
+	_focus_circle.position = Vector3(0, 0, 0.30)
+	_focus_circle.visible = false
+	_head.add_child(_focus_circle)
 	_name_tag = Label3D.new()
 	_name_tag.name = "NameTag"
 	_name_tag.text = npc.profile.display_name if npc and npc.profile else ""
@@ -168,12 +171,12 @@ func _build_focus_ring() -> void:
 	_head.add_child(_name_tag)

 func set_focus_visual(focused: bool, menu_open: bool = false) -> void:
-	if _ring:
-		_ring.visible = focused
-		var mat := _ring.material_override as StandardMaterial3D
+	if _focus_circle:
+		_focus_circle.visible = focused
+		var mat := _focus_circle.material_override as StandardMaterial3D
 		if mat:
-			mat.albedo_color = Color(1.0, 0.92, 0.35, 1.0) if menu_open else Color(0.95, 0.82, 0.28, 0.85)
-		_ring.scale = Vector3.ONE * (1.15 if menu_open else 1.0)
+			mat.albedo_color = Color(0.35, 0.65, 1.0, 0.7) if menu_open else Color(0.25, 0.55, 1.0, 0.45)
+		_focus_circle.scale = Vector3.ONE * (1.15 if menu_open else 1.0)
 	if _name_tag:
 		_name_tag.visible = focused

@@ -394,10 +397,7 @@ func _animate(delta: float) -> void:
 		_bob_phase = 0.0
 		_rig.position.y = lerpf(_rig.position.y, 0.0, 0.2)
 		_rig.rotation.x = lerpf(_rig.rotation.x, 0.0, 0.2)
-	if _ring and _ring.visible:
-		var cam := get_viewport().get_camera_3d() if get_viewport() else null
-		if cam:
-			_ring.look_at(cam.global_position, Vector3.UP)
+	# The focus circle billboards via its material; no per-frame look_at needed.
 	# Attention cue: head turns toward the guard when awareness was raised.
 	if _head != null and npc.guard_noticed:
 		if _guard_ref == null or not is_instance_valid(_guard_ref):
@@ -49,6 +49,8 @@ var _debug_enabled := false
 var _log_lines: Array[String] = []
 var _cam_overlay: Control = null
 var _body_camera_on := false
+var _font_scale := 1.0
+var _base_font_sizes: Dictionary = {}

 func _init() -> void:
 	name = "HUD"
@@ -300,16 +302,20 @@ func is_body_camera_on() -> bool:
 	return _body_camera_on

 ## Scale the whole HUD text block (accessibility settings).
+## Resize HUD text by changing font sizes (not Control.scale, which overflows
+## anchored labels and breaks the right-aligned layout).
 func set_font_scale(scale: float) -> void:
 	var clamped := clampf(scale, 0.75, 1.75)
-	if top_label:
-		top_label.scale = Vector2(clamped, clamped)
-	if log_label:
-		log_label.scale = Vector2(clamped, clamped)
-	if target_label:
-		target_label.scale = Vector2(clamped, clamped)
-	if hint_label:
-		hint_label.scale = Vector2(clamped, clamped)
+	_font_scale = clamped
+	var scaled: Array[Label] = [top_label, log_label, target_label, hint_label,
+		time_label, mode_label, escalation_label, radio_cooldown_label, debug_label]
+	for label in scaled:
+		if label == null:
+			continue
+		if not _base_font_sizes.has(label):
+			_base_font_sizes[label] = label.get_theme_font_size("font_size")
+		var base: int = int(_base_font_sizes[label])
+		label.add_theme_font_size_override("font_size", maxi(8, int(round(float(base) * clamped))))

 func _make_icon(texture: Texture2D) -> TextureRect:
 	var tr := TextureRect.new()
@@ -353,9 +359,18 @@ func set_action_hint(text: String) -> void:

 ## Color-coded escalation feedback (PLAN.md: Polish and Accessibility).
 ## Green → yellow → orange → red as the escalation level rises.
+## Grayscale-safe escalation meter: filled/empty blocks plus the level number, so
+## the cue does not rely on hue alone (accessibility).
+static func escalation_meter(level: int) -> String:
+	var clamped := clampi(level, 0, 5)
+	var filled := ""
+	for i in 5:
+		filled += "#" if i < clamped else "-"
+	return "[%s] L%d/5" % [filled, clamped]
+
 func set_escalation(level: int) -> void:
 	var name: String = Rules.LEVEL_NAMES.get(level, "Observation")
-	escalation_label.text = Strings.fmt("hud.escalation_prefix", [name])
+	escalation_label.text = "%s  %s" % [Strings.fmt("hud.escalation_prefix", [name]), escalation_meter(level)]
 	var tint := Color(0.6, 0.9, 0.6)
 	match level:
 		Rules.Level.OBSERVATION, Rules.Level.SIMPLE_DETERRENCE:
@@ -1,5 +1,5 @@
 extends SceneTree
-## Windowed smoke helper for the ADR-0007–0010 control pass (focus ring + action
+## Windowed smoke helper for the ADR-0007–0010 control pass (focus circle + action
 ## wheel). Boots the real main scene, stages one NPC in front of the guard, opens
 ## the wheel, and saves two PNGs to user://screenshots/. Exits 1 if the focus or
 ## radial state did not come up, so it can be used as a smoke check.
@@ -76,7 +76,7 @@ func _advance() -> void:
 						(gm.guard.global_position as Vector3).y,
 						(gm.targeted_npc.global_position as Vector3).y,
 					])
-					_shoot("smoke-01-focus-ring.png")
+					_shoot("smoke-01-focus-circle.png")
 					gm.call("_open_radial")
 				state = 2
 				state_frames = 0
@@ -127,7 +127,7 @@ func _fail(message: String) -> void:

 func _finish() -> void:
 	if failures.is_empty():
-		print("SMOKE OK: focus ring + action wheel opened and cancelled")
+		print("SMOKE OK: focus circle + action wheel opened and cancelled")
 		quit(0)
 	else:
 		for message in failures:
@@ -0,0 +1,91 @@
+extends SceneTree
+## Scenario-content smoke: forces the authored Joke Shop refusal event and the
+## Studio celebrity arrival through the real spawn path, then checks the extra
+## bystanders, the hint log, and that a screening refusal is handled.
+##
+## Usage:
+##   godot --headless --path . --script res://src/test/smoke_scenario_content.gd
+
+const MAX_FRAMES := 900
+
+var frame := 0
+var gm: Node = null
+var started := false
+var step := 0
+var failures: Array[String] = []
+
+func _initialize() -> void:
+	root.size = Vector2i(1280, 720)
+	root.add_child(load("res://scenes/main.tscn").instantiate())
+
+func _process(_delta: float) -> bool:
+	frame += 1
+	if gm == null:
+		gm = root.find_child("GameManager", true, false)
+		return false
+	if not started:
+		gm.call("_on_venue_selected", "joke_shop")
+		started = true
+		return false
+	if frame > MAX_FRAMES:
+		_fail("timeout")
+		return true
+	if frame < 120:
+		return false
+	match step:
+		0:
+			# Force the refusal event through the normal spawn signal.
+			var event := _find_event(gm.selected_scenario.event_pool, "joke_refuses_wand")
+			_check(not event.is_empty(), "the refusal event exists in the Joke Shop pool")
+			var guest: Object = gm.selected_scenario.profile_for(int(event.get("npc_type", 0)))
+			gm.coordinator.npc_spawn_requested.emit(guest, "enter", "smoke_refuser", event)
+			_check(gm.npcs.size() > 0, "the refusing guest spawned")
+			gm.call("_on_guard_target", gm.npcs[gm.npcs.size() - 1])
+			var controller: Object = gm.npcs[gm.npcs.size() - 1].get_npc_controller()
+			_check(controller.refuses_screening, "the refusal flag reached the controller")
+			gm.call("_toggle_wand_screening")
+			_check(not gm.wand_open, "screening does not open for someone who refuses")
+			step = 1
+		1:
+			# Studio: celebrity arrival should bring extra bystanders.
+			gm.call("_on_venue_selected", "tv_studio")
+			step = 2
+		2:
+			if frame % 20 != 0:
+				return false
+			var event := _find_event(gm.selected_scenario.event_pool, "studio_celebrity_arrival")
+			var before: int = gm.npcs.size()
+			var guest: Object = gm.selected_scenario.profile_for(int(event.get("npc_type", 0)))
+			gm.coordinator.npc_spawn_requested.emit(guest, "arrive", "smoke_celeb", event)
+			var added: int = gm.npcs.size() - before
+			_check(added >= 4, "celebrity arrival spawns the guest plus bystanders (%d)" % added)
+			step = 3
+		3:
+			_finish()
+			return true
+	return false
+
+func _find_event(pool: Array, id: String) -> Dictionary:
+	for event in pool:
+		if str((event as Dictionary).get("id", "")) == id:
+			return event
+	return {}
+
+func _check(condition: bool, message: String) -> void:
+	if condition:
+		print("ok: " + message)
+	else:
+		_fail(message)
+
+func _fail(message: String) -> void:
+	failures.append(message)
+	_finish()
+
+func _finish() -> void:
+	if failures.is_empty():
+		print("SMOKE OK: authored scenario content")
+		quit(0)
+	else:
+		for message in failures:
+			printerr("SMOKE FAIL: " + message)
+		quit(1)
@@ -0,0 +1,64 @@
+extends RefCounted
+## Accessibility: escalation cues that survive grayscale (shape + level, not hue
+## alone) and the HUD font scale from settings.
+
+const Hud := preload("res://src/game/ui/hud.gd")
+const Rules := preload("res://src/core/rules.gd")
+
+func test_meter_shape_and_level() -> bool:
+	var a := TestUtils.check_eq(Hud.escalation_meter(0), "[-----] L0/5", "calm shows an empty meter")
+	var b := TestUtils.check_eq(Hud.escalation_meter(3), "[###--] L3/5", "three filled blocks at blocking")
+	var c := TestUtils.check_eq(Hud.escalation_meter(5), "[#####] L5/5", "emergency fills the meter")
+	var d := TestUtils.check_eq(Hud.escalation_meter(99), "[#####] L5/5", "levels clamp at 5")
+	var e := TestUtils.check_eq(Hud.escalation_meter(-2), "[-----] L0/5", "levels clamp at 0")
+	return a and b and c and d and e
+
+func test_meter_is_not_hue_only() -> bool:
+	## Every level must differ in shape/text, independent of colour.
+	var seen: Array[String] = []
+	for level in 6:
+		var meter: String = Hud.escalation_meter(level)
+		if seen.has(meter):
+			return TestUtils.fail("levels %d and %d share a meter" % [level, seen.find(meter)])
+		seen.append(meter)
+	return TestUtils.check(seen.size() == 6, "all six levels have distinct meters")
+
+func test_escalation_label_includes_meter_and_name() -> bool:
+	var hud: Node = Hud.new()
+	hud.set_escalation(Rules.Level.FORMAL_WARNING)
+	var text: String = hud.escalation_label.text
+	var a := TestUtils.check(text.contains("Formal Warning"), "label names the level")
+	var b := TestUtils.check(text.contains("[##---]"), "label shows the shape meter")
+	var c := TestUtils.check(text.contains("L2/5"), "label shows the numeric level")
+	hud.free()
+	return a and b and c
+
+func test_font_scale_applies_to_core_labels() -> bool:
+	var hud: Node = Hud.new()
+	var base_top: int = hud.top_label.get_theme_font_size("font_size")
+	var base_log: int = hud.log_label.get_theme_font_size("font_size")
+	var base_esc: int = hud.escalation_label.get_theme_font_size("font_size")
+	var base_mode: int = hud.mode_label.get_theme_font_size("font_size")
+	hud.set_font_scale(1.4)
+	var a := TestUtils.check(hud.top_label.get_theme_font_size("font_size") > base_top, "top label grows")
+	var b := TestUtils.check(hud.log_label.get_theme_font_size("font_size") > base_log, "log grows")
+	var c := TestUtils.check(hud.escalation_label.get_theme_font_size("font_size") > base_esc, "escalation label grows")
+	var d := TestUtils.check(hud.mode_label.get_theme_font_size("font_size") > base_mode, "mode label grows")
+	# Scaling is by font size, not Control.scale, so anchored labels keep layout.
+	var e := TestUtils.check(is_equal_approx(hud.top_label.scale.x, 1.0), "labels are not Control-scaled")
+	hud.set_font_scale(9.0)
+	var capped: int = hud.top_label.get_theme_font_size("font_size")
+	var f := TestUtils.check(capped <= int(round(float(base_top) * 1.75)) + 1, "scale clamps at 1.75")
+	hud.free()
+	return a and b and c and d and e and f
+
+func test_settings_font_scale_is_applied_after_ui_exists() -> bool:
+	## The HUD is created after settings load, so the manager must re-apply.
+	var src := FileAccess.get_file_as_string("res://src/game/game_manager.gd")
+	var a := TestUtils.check(src.contains("_apply_settings(player_settings)"), "settings are applied on boot")
+	var build_idx := src.find("_build_ui()")
+	var apply_idx := src.find("_apply_settings(player_settings)", build_idx)
+	var b := TestUtils.check(apply_idx > build_idx, "the second apply happens after the HUD is built")
+	var c := TestUtils.check(src.contains("hud.set_font_scale(float(settings.get("),
+		"settings drive the HUD font scale")
+	return a and b and c
@@ -0,0 +1,143 @@
+extends RefCounted
+## Authored scenario content added to match the PLAN lists: Joke Shop access
+## edge cases, Studio filming boundaries and celebrity crowd spikes, and Building
+## events that point at the body-camera / request-reason verbs.
+
+const Factory := preload("res://src/content/scenario_factory.gd")
+const Rules := preload("res://src/core/rules.gd")
+const Strings := preload("res://src/core/strings.gd")
+const AccessLoadout := preload("res://src/core/access_loadout.gd")
+const AccessVerifier := preload("res://src/core/access_verifier.gd")
+const NpcProfile := preload("res://src/core/npc_profile.gd")
+
+func _events(scenario_id: String) -> Array:
+	var scenario: Resource
+	match scenario_id:
+		"joke_shop":
+			scenario = Factory.joke_shop()
+		"tv_studio":
+			scenario = Factory.tv_studio()
+		_:
+			scenario = Factory.hollywood_building()
+	return scenario.event_pool
+
+func _event(scenario_id: String, id: String) -> Dictionary:
+	for event in _events(scenario_id):
+		if str(event.get("id", "")) == id:
+			return event
+	return {}
+
+func test_joke_shop_has_the_missing_edge_cases() -> bool:
+	var a := TestUtils.check(not _event("joke_shop", "joke_guest_reservation_no_id").is_empty(),
+		"reservation list without ID exists")
+	var b := TestUtils.check(not _event("joke_shop", "joke_borrowed_id").is_empty(),
+		"borrowed/mismatched ID exists")
+	var c := TestUtils.check(not _event("joke_shop", "joke_refuses_wand").is_empty(),
+		"guest who refuses the wand exists")
+	var d := TestUtils.check(not _event("joke_shop", "joke_late_arrival").is_empty(),
+		"late arrival during the performance exists")
+	return a and b and c and d
+
+func test_reservation_without_id_is_denied() -> bool:
+	var event := _event("joke_shop", "joke_guest_reservation_no_id")
+	var profile := _guest_profile()
+	var artifacts := AccessLoadout.build(profile, Factory.joke_shop().access_policy, event.get("override_access", {}))
+	var verifier := AccessVerifier.new()
+	var result: Dictionary = verifier.verify(artifacts, Factory.joke_shop().access_policy, false)
+	var a := TestUtils.check(not result.get("granted", true), "a reservation without ID is not admitted")
+	var b := TestUtils.check(not (result.get("issues", []) as Array).is_empty(), "the denial names the missing artifact")
+	return a and b
+
+func test_borrowed_id_is_mismatched() -> bool:
+	var event := _event("joke_shop", "joke_borrowed_id")
+	var profile := _guest_profile()
+	var artifacts := AccessLoadout.build(profile, Factory.joke_shop().access_policy, event.get("override_access", {}))
+	var found_mismatch := false
+	for artifact in artifacts:
+		if artifact.kind == Rules.AccessKind.ID and artifact.status == Rules.ArtifactStatus.MISMATCHED:
+			found_mismatch = true
+	var verifier := AccessVerifier.new()
+	var result: Dictionary = verifier.verify(artifacts, Factory.joke_shop().access_policy, false)
+	var a := TestUtils.check(found_mismatch, "the ID is flagged mismatched")
+	var b := TestUtils.check(not result.get("granted", true), "a mismatched ID is not admitted")
+	return a and b
+
+func test_refuses_wand_event_sets_the_flag() -> bool:
+	var event := _event("joke_shop", "joke_refuses_wand")
+	var ok := TestUtils.check(bool(event.get("refuses_screening", false)), "the event marks the refusal")
+	var src := FileAccess.get_file_as_string("res://src/game/game_manager.gd")
+	var wired := TestUtils.check(src.contains("refuses_screening = bool(event.get("),
+		"the spawn copies the flag onto the controller")
+	var handled := TestUtils.check(src.contains("if controller.refuses_screening:"),
+		"the wand screen handles a refusal")
+	return ok and wired and handled
+
+func test_studio_filming_boundary_repeats() -> bool:
+	var first := _event("tv_studio", "studio_film_boundary")
+	var repeat := _event("tv_studio", "studio_film_boundary_repeat")
+	var a := TestUtils.check(not first.is_empty(), "first boundary event exists")
+	var b := TestUtils.check(not repeat.is_empty(), "repeat boundary event exists")
+	var c := TestUtils.check_eq(str(first.get("intent", "")), "film_boundary", "first uses the boundary intent")
+	var d := TestUtils.check_eq(str(repeat.get("intent", "")), "film_boundary", "repeat uses the boundary intent")
+	var e := TestUtils.check(int(repeat.get("time_range_s", Vector2.ZERO).x) > int(first.get("time_range_s", Vector2.ZERO).x),
+		"the repeat happens later in the shift")
+	return a and b and c and d and e
+
+func test_film_boundary_stands_at_the_steps() -> bool:
+	var scenario := Factory.tv_studio()
+	var spot: Vector3 = scenario.waypoint_for_intent("film_boundary")
+	var sidewalk: Vector3 = scenario.waypoint_for_intent("film")
+	var a := TestUtils.check(spot != sidewalk, "the boundary spot differs from the permitted sidewalk spot")
+	var b := TestUtils.check_eq(spot, scenario._location_or_default("steps_end", Vector3.ZERO),
+		"the influencer stands at the steps, past the line")
+	return a and b
+
+func test_celebrity_arrival_spawns_a_crowd() -> bool:
+	var event := _event("tv_studio", "studio_celebrity_arrival")
+	var extras: Array = event.get("extra_spawns", [])
+	var a := TestUtils.check(extras.size() >= 3, "celebrity arrival adds several bystanders")
+	var types: Array = []
+	for extra in extras:
+		types.append(int((extra as Dictionary).get("npc_type", -1)))
+	var b := TestUtils.check(types.has(Rules.NpcType.TOURIST), "tourists gather")
+	var c := TestUtils.check(types.has(Rules.NpcType.INFLUENCER), "an influencer films it")
+	var src := FileAccess.get_file_as_string("res://src/game/game_manager.gd")
+	var d := TestUtils.check(src.contains('event.get("extra_spawns", [])'), "the spawner honours extra_spawns")
+	return a and b and c and d
+
+func test_building_events_point_at_the_new_verbs() -> bool:
+	var camera_event := _event("hollywood_building", "building_filming_boundary")
+	var reason_event := _event("hollywood_building", "building_unclear_intent")
+	var a := TestUtils.check(str(camera_event.get("hint", "")).contains("body"), "an event hints at the body camera")
+	var b := TestUtils.check(str(reason_event.get("hint", "")).contains("reason"), "an event hints at requesting a reason")
+	var src := FileAccess.get_file_as_string("res://src/game/game_manager.gd")
+	var c := TestUtils.check(src.contains('if event.has("hint")'), "spawning logs the authored hint")
+	return a and b and c
+
+func test_every_authored_hint_resolves() -> bool:
+	var missing: Array[String] = []
+	for scenario in [Factory.hollywood_building(), Factory.joke_shop(), Factory.tv_studio()]:
+		for event in scenario.event_pool:
+			var key := str((event as Dictionary).get("hint", ""))
+			if key != "" and Strings.lookup(key) == key:
+				missing.append(key)
+	return TestUtils.check(missing.is_empty(), "all authored hints have strings (missing: %s)" % str(missing))
+
+func test_new_events_have_unique_ids() -> bool:
+	# Event ids only need to be unique within a venue.
+	var problems: Array[String] = []
+	for scenario in [Factory.hollywood_building(), Factory.joke_shop(), Factory.tv_studio()]:
+		var seen := {}
+		for event in scenario.event_pool:
+			var id := str((event as Dictionary).get("id", ""))
+			if seen.has(id):
+				problems.append("%s:%s" % [scenario.id, id])
+			seen[id] = true
+	return TestUtils.check(problems.is_empty(), "event ids are unique per venue (dupes: %s)" % str(problems))
+
+func _guest_profile() -> NpcProfile:
+	var p := NpcProfile.new()
+	p.id = "guest"
+	p.display_name = "Guest"
+	p.npc_type = Rules.NpcType.AUTHORIZED_GUEST
+	return p
@@ -23,6 +23,70 @@ func test_strings_json_backed_all_resolve() -> bool:
 			return TestUtils.fail("key %s resolves to itself — table entry missing" % key)
 	return true

+func test_placeholder_count() -> bool:
+	var a := TestUtils.check_eq(Strings.placeholder_count("no args"), 0, "plain text has no placeholders")
+	var b := TestUtils.check_eq(Strings.placeholder_count("%s complies"), 1, "one %s")
+	var c := TestUtils.check_eq(Strings.placeholder_count("%s: \"%s\""), 2, "two %s")
+	var d := TestUtils.check_eq(Strings.placeholder_count("100%% sure"), 0, "%% is an escape, not an argument")
+	var e := TestUtils.check_eq(Strings.placeholder_count("%.0f%% mood"), 1, "float plus percent sign")
+	return a and b and c and d and e
+
+func test_fmt_fails_safe_on_arg_mismatch() -> bool:
+	## A drifting placeholder count must not raise an engine error at runtime.
+	var result: String = Strings.fmt("react.comply", [])
+	var a := TestUtils.check_eq(result, Strings.lookup("react.comply"), "wrong arg count returns the raw template")
+	var extra: String = Strings.fmt("react.comply", ["A", "B"])
+	var b := TestUtils.check_eq(extra, Strings.lookup("react.comply"), "too many args also fails safe")
+	return a and b
+
+func test_table_validates_cleanly() -> bool:
+	var problems: Array = Strings.validate()
+	if not problems.is_empty():
+		return TestUtils.fail("string table format problems: %s" % str(problems))
+	return true
+
+func test_every_placeholder_key_formats() -> bool:
+	## Feed each template one dummy arg per placeholder, with a type that matches
+	## the conversion (%s text, %d int, %f float). Nothing may be left unformatted.
+	var problems: Array[String] = []
+	for key in Strings.TABLE.keys():
+		var template: String = str(Strings.TABLE[key])
+		var specs: Array[String] = _specifiers(template)
+		if specs.is_empty():
+			continue
+		var args := []
+		for spec in specs:
+			var conv: String = spec.substr(spec.length() - 1)
+			if conv == "d" or conv == "x" or conv == "X":
+				args.append(7)
+			elif conv == "f":
+				args.append(1.5)
+			else:
+				args.append("x")
+		var out: String = Strings.fmt(key, args)
+		if out == template:
+			problems.append("%s did not format (%s)" % [key, str(specs)])
+	return TestUtils.check(problems.is_empty(), "all placeholder keys format (problems: %s)" % str(problems))
+
+func _specifiers(template: String) -> Array[String]:
+	var out: Array[String] = []
+	var i := 0
+	while i < template.length():
+		if template[i] != "%":
+			i += 1
+			continue
+		if i + 1 < template.length() and template[i + 1] == "%":
+			i += 2
+			continue
+		var j := i + 1
+		while j < template.length() and template[j] in "0123456789.$":
+			j += 1
+		if j < template.length():
+			out.append(template.substr(i, j - i + 1))
+			j += 1
+		i = j
+	return out
+
 func test_strings_cover_ui_keys() -> bool:
 	## Every key referenced by the HUD and game manager must exist.
 	var required := [
@@ -16,8 +16,17 @@ HOST="${HOST:-https://git.allucanget.biz}"
 VERSION="${1:-$(grep -oP 'config/version="\K[^"]+' project.godot)}"
 TAG="v$VERSION"

+# AUTH is a curl argument list. Populated by the first available method:
+#   1. GITEA_TOKEN            explicit token (repo secret in CI)
+#   2. GITEA_AUTH_HEADER      a ready-made "Authorization: ..." header
+#   3. ~/.git-credentials     basic auth for HOST
+#   4. the checkout's git extraheader (Gitea Actions runners inject one for the
+#      job; this is what makes tag builds publish without any repo secret)
+AUTH=()
 if [[ -n "${GITEA_TOKEN:-}" ]]; then
-  AUTH=("Authorization: token $GITEA_TOKEN")
+  AUTH=(-H "Authorization: token $GITEA_TOKEN")
+elif [[ -n "${GITEA_AUTH_HEADER:-}" ]]; then
+  AUTH=(-H "$GITEA_AUTH_HEADER")
 elif [[ -f "$HOME/.git-credentials" ]]; then
  CRED="$(python3 -c "
 import os
@@ -28,8 +37,23 @@ for l in open(os.path.expanduser('~/.git-credentials')):
    echo "error: no credentials for $HOST in ~/.git-credentials" >&2
    exit 1
  fi
-else
-  echo "error: set GITEA_TOKEN or provide ~/.git-credentials" >&2
+  # curl basic auth. (Previously only CRED was set, so ${AUTH[@]} was unbound
+  # under `set -u` and every API call failed silently.)
+  AUTH=(-u "$CRED")
+fi
+
+if [[ ${#AUTH[@]} -eq 0 ]]; then
+  # Gitea Actions: actions/checkout configures a local extraheader with the
+  # runner's credentials. Reuse it for the API (the same server, so the header is
+  # valid for $HOST too).
+  GIT_HEADER="$(git config --local --get-regexp '^http\..*\.extraheader$' 2>/dev/null | head -n1 | cut -d' ' -f2- || true)"
+  if [[ -n "${GIT_HEADER:-}" ]]; then
+    AUTH=(-H "$GIT_HEADER")
+  fi
+fi
+
+if [[ ${#AUTH[@]} -eq 0 ]]; then
+  echo "error: no credentials. Set GITEA_TOKEN, GITEA_AUTH_HEADER, or provide ~/.git-credentials." >&2
  exit 1
 fi

@@ -75,8 +99,31 @@ for f in "${all_artifacts[@]}"; do
    exit 1
  fi
  echo "==> Uploading $(basename "$f")"
-  curl -s -X POST "$API/$RELEASE_ID/assets" "${AUTH[@]}" -F "attachment=@$f" >/dev/null
+  # Fail loudly: a silent 4xx here used to leave a release with no artifacts while
+  # the job still reported success.
+  code="$(curl -sS -o /tmp/release-upload.json -w '%{http_code}' --retry 2 \
+    -X POST "$API/$RELEASE_ID/assets" "${AUTH[@]}" -F "attachment=@$f" || true)"
+  if [[ "$code" != "201" && "$code" != "200" ]]; then
+    echo "error: upload of $(basename "$f") failed with HTTP $code" >&2
+    cat /tmp/release-upload.json >&2 || true
+    echo "" >&2
+    exit 1
+  fi
 done

+# Verify the release actually carries the artifacts we just sent.
+have="$(curl -sS "${AUTH[@]}" "$API/$RELEASE_ID" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print(0); raise SystemExit
+print(len(d.get('assets', [])))" 2>/dev/null || echo 0)"
+if [[ "${have:-0}" -lt "${#all_artifacts[@]}" ]]; then
+  echo "error: release has $have assets, expected ${#all_artifacts[@]}" >&2
+  exit 1
+fi
+echo "Verified $have artifacts on the release"
+
 echo ""
 echo "Release live: $HOST/$REPO/releases/tag/$TAG"
@@ -105,20 +105,20 @@ SCREENS = [
        "name": "targeting_npc",
        "kind": "scene",
        "title": "Targeting an NPC",
-        "source": "README screenshot 02 · ADR-0008 cone focus + head ring",
+        "source": "README screenshot 02 · ADR-0008 cone focus + focus circle",
        "ref": "02-targeting-npc.png",
-        "description": "An approaching NPC is in the focus cone: a thin pale-gold "
-                       "ring billboards around their head, a display name under "
-                       "the ring, and the HUD shows a target line with the "
-                       "interaction hint.",
+        "description": "An approaching NPC is in the focus cone: a blue "
+                       "semi-transparent circle in front of their face, a display "
+                       "name under the circle, and the HUD shows a target line "
+                       "with the interaction hint.",
        "prompt": (
            "Realistic 3D first-person game scene: a friendly pedestrian "
-            "standing on a city sidewalk, a thin pale-gold ring floating around "
-            "their head as a game selection marker, a small name label under the "
-            "ring, minimal HUD target text at the bottom, daytime"),
+            "standing on a city sidewalk, a blue semi-transparent circle in front "
+            "of their face as a game selection marker, a small name label under "
+            "the circle, minimal HUD target text at the bottom, daytime"),
        "regions": [
            (0.35, 0.15, 0.65, 0.60, "NPC in focus"),
-            (0.44, 0.10, 0.56, 0.16, "head ring"),
+            (0.44, 0.10, 0.56, 0.16, "face circle"),
            (0.05, 0.85, 0.95, 0.95, "HUD: name + hint"),
        ],
    },
Author	SHA1	Message	Date
zwitschi	74f14014b2	Enable anonymous downloads on the host and harden Strings.fmt Full build / Import + headless tests (push) Successful in 33s Details Full build / Full desktop build + optional release (push) Successful in 3m31s Details Host (applied with root@192.168.88.30) - [service] REQUIRE_SIGNIN_VIEW = false in /etc/gitea/app.ini (backup written alongside), Gitea restarted. Verified anonymously: repo page 200, API 200, and a release asset downloads at full size (50.8 MB AppImage). Localization safety (Open Polish) - Strings.placeholder_count() counts conversions and ignores %% escapes. - Strings.fmt() validates the count and fails safe (warns, returns the template) instead of raising an engine error when a key's placeholders drift. - Strings.validate() lints the table for a trailing %, unsupported conversions, and mixed positional/sequential placeholders. - Tests cover the counter, the fail-safe path, a clean table, and a formatting pass over every placeholder key with type-correct arguments. Docs - TODO: distribution, release-pipeline, and open-polish sections are complete and moved to DONE; the v0.2.4-v0.2.8 backfill is closed as superseded. - README/MEMORY updated. Version 0.2.14.	2026-10-31 22:02:24 +01:00
zwitschi	a2a0ded527	Author the missing scenario content from the PLAN lists Full build / Full desktop build + optional release (push) Successful in 3m26s Details Full build / Import + headless tests (push) Successful in 35s Details Joke Shop - Reservation list without ID (guest list valid, ID missing) — denied. - Borrowed/mismatched ID (ID valid but mismatched) — denied. - Guest who refuses the wand screen: new `refuses_screening` event flag, copied onto NPCController, handled in _toggle_wand_screening (logs wand.refused, records a wand_refused event, small prop hit, panel stays closed). - Late arrival during the performance (ID + ticket, "arrive" intent). Studio - Filming-boundary event and a later repeat, both using the new `film_boundary` intent which maps to `steps_end` so the influencer stands past the posted line. - Celebrity arrival now pulls in a small crowd via a new `extra_spawns` event field (two tourists + an influencer), spawned through the normal path. Building - Filming-boundary event whose hint points at the body camera and request-reason verbs, plus an unclear-intent event that hints at asking for a reason. Engine support - Events may carry `hint` (string key logged on spawn), `extra_spawns`, and `refuses_screening`; 9 new localized hint strings. Tests/docs - Headless suite 139 -> 149 (test_scenario_content.gd) and a new smoke_scenario_content.gd that spawns the refusal and celebrity events through the real signal path. - README, TODO section moved to DONE, MEMORY. Version 0.2.13.	2026-10-31 21:55:24 +01:00
zwitschi	922a990c7a	Record verified CI publishing and host maintenance Full build / Import + headless tests (push) Successful in 24s Details Full build / Full desktop build + optional release (push) Skipped Details - v0.2.12 was tagged and CI produced the release with all five artifacts by itself, confirming the checkout-credential fallback end to end. - Host maintenance through root@192.168.88.30: apt cache cleaned and journald capped at 300M (journal ~133M now), ~7.6G free of 16G. - TODO release-pipeline section is fully closed; MEMORY records the host state.	2026-10-31 21:51:41 +01:00
zwitschi	f0cec192a7	Restore pruned releases and verify CI publishing with v0.2.12 Full build / Full desktop build + optional release (push) Successful in 3m29s Details Full build / Import + headless tests (push) Successful in 32s Details - Host root filesystem was expanded from 7.8G to 16G (~7.8G free), so the disk blocker is gone. - Re-published v0.2.0 (4 artifacts) and v0.2.9 (5 artifacts) from the local build/ outputs; both releases verify. - Root SSH from the workstation is not available (publickey denied, password auth closes the banner); the host is administered via the zwitschi login. - Version 0.2.12 exists to verify the tag pipeline end to end: the workflow should create the release via the checkout-credential fallback and upload all five artifacts.	2026-10-31 21:46:09 +01:00
zwitschi	2dba562c52	Publish v0.2.11 and document the host disk limit Full build / Import + headless tests (push) Successful in 26s Details Full build / Full desktop build + optional release (push) Skipped Details - Pruned the superseded v0.2.0 and v0.2.9 releases through the API (~565 MB of assets) after the host root filesystem hit 100%, which blocked release uploads (HTTP 500 "no space left on device") and even git push ("unpacker error"). - Published v0.2.11 locally with the fixed script: all five artifacts verified on the release (Linux/Windows/macOS ports, NSIS installer, AppImage). - TODO records the remaining ~150 MB headroom and the exact host cleanup commands; MEMORY and RELEASING describe the disk failure mode and the pruning.	2026-10-31 21:39:15 +01:00
zwitschi	afd086ba11	Fail loudly when release uploads do not land Full build / Import + headless tests (push) Successful in 35s Details Full build / Full desktop build + optional release (push) Skipped Details Follow-up to the publishing fix: CI created the v0.2.11 release and logged each upload, but the assets never arrived, so the job looked successful while the release was empty. The host root filesystem is full (7.8G, 100%), and Gitea answered HTTP 500 "Attachments.Save: no space left on device". - publish_release.sh now checks the HTTP status of every asset upload and prints the response body on failure, then verifies the release reports as many assets as were sent. Empty releases can no longer pass silently. - Deleted the empty v0.2.11 release so the "latest" release (v0.2.10) still has all five artifacts; the tag itself remains. - TODO/MEMORY record the host disk blocker with concrete cleanup commands and note that v0.2.11 artifacts are built locally in build/ for upload once space exists.	2026-10-31 21:38:12 +01:00
zwitschi	b4d189c325	Publish releases with the runner's checkout credentials Full build / Import + headless tests (push) Successful in 36s Details Full build / Full desktop build + optional release (push) Successful in 3m37s Details The v0.2.10 tag build still failed to publish: its env dump showed no token at all, because this Gitea/act runner does not provide `github.token`, and the repo has no GITEA_TOKEN secret. publish_release.sh now resolves credentials in order: GITEA_TOKEN, GITEA_AUTH_HEADER, ~/.git-credentials, then the local git extraheader that actions/checkout writes for the job. That header carries the runner's basic-auth credentials for the same server, so tag builds publish with no repo secret. Verified by adding the extraheader locally and publishing v0.2.10 (all five artifacts: Linux/Windows/macOS ports, NSIS installer, AppImage), then removing it. Docs: RELEASING describes the four credential sources and warns that github.token is not available here; MEMORY records both failed attempts and the final fix; TODO keeps the "verify on the next tag" follow-up. Version 0.2.11.	2026-10-31 21:30:24 +01:00
zwitschi	6684d36739	Fix release publishing and add a CI token fallback Full build / Import + headless tests (push) Successful in 26s Details Full build / Full desktop build + optional release (push) Failing after 3m58s Details Tag builds since v0.2.2 built all artifacts but never published a release: - tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under `set -u`, so every API call failed and the job ended "could not create or find release". It now sets AUTH=(-u "$CRED"). - The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the workflow now falls back to the built-in workflow token: GITEA_TOKEN: ${{ secrets.GITEA_TOKEN \|\| github.token }}. v0.2.9 was then built and published locally with all five artifacts (portable Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest. Docs - docs/RELEASING.md records the incident and the local-publish fallback. - TODO gains a release-pipeline follow-up (verify CI on the next tag). - MEMORY notes the root cause, the missing secret, and which releases exist. - Version 0.2.10.	2026-10-31 21:23:09 +01:00
zwitschi	3f4ac7e9aa	Add accessibility pass: escalation meter and working HUD font scale Full build / Import + headless tests (push) Successful in 33s Details Full build / Full desktop build + optional release (push) Failing after 3m31s Details - Escalation cue now includes a shape meter and numeric level ("Escalation: Blocking [###--] L3/5") in addition to the colour and name, so it reads in grayscale. Hud.escalation_meter(level) is pure and tested. - HUD font scale from settings actually works: set_font_scale() resizes fonts via theme overrides instead of Control.scale, which pushed the right-anchored clock label off-screen. It now covers the top, log, target, hint, time, mode, escalation, cooldown, and debug labels. - Settings load before the HUD exists, so _ready() re-applies player settings after _build_ui(); previously a saved font scale was ignored until the next apply. Tests/docs - Headless suite 134 -> 139 (test_accessibility.gd). - Verified visually at 1.4x scale: no overflow, meter readable. - README, TODO section moved to DONE, MEMORY. Version 0.2.9.	2026-10-31 21:17:42 +01:00