Bump to 0.9.1 and record the toolchain update

Update project features and CI installs/templates to Godot 4.7.2, remove the
old version matrix, and cache the Godot binary and export templates with Gitea
Actions cache. Update release/docs/version references accordingly. Project
import and headless tests pass locally under 4.7.2.

.gitea/workflows/build.yml

@@ -7,6 +7,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+env:
+  GODOT_VERSION: "4.7.2"
+  GODOT_BIN: /usr/local/bin/godot
+
 jobs:
   checks:
     name: Import + headless tests
@@ -17,12 +21,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Godot 4.3
+      - name: Restore Godot binary cache
+        uses: actions/cache@v4
+        with:
+          path: /usr/local/bin/godot
+          key: godot-${{ runner.os }}-${{ env.GODOT_VERSION }}-v1
+
+      - name: Install Godot 4.7.2
         run: |
+          if [ -x /usr/local/bin/godot ]; then
+            godot --version
+            exit 0
+          fi
           curl -sL -o /tmp/godot.zip \
-            https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_linux.x86_64.zip
+            https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_linux.x86_64.zip
           unzip -qo /tmp/godot.zip -d /tmp/godot-bin
-          sudo install /tmp/godot-bin/Godot_v4.3-stable_linux.x86_64 /usr/local/bin/godot
+          sudo install /tmp/godot-bin/Godot_v4.7.2-stable_linux.x86_64 /usr/local/bin/godot
+          godot --version
 
       - name: Import project (build class cache)
         run: godot --headless --import
@@ -56,18 +71,38 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Godot 4.3 and export templates
+      - name: Restore Godot binary cache
+        uses: actions/cache@v4
+        with:
+          path: /usr/local/bin/godot
+          key: godot-${{ runner.os }}-${{ env.GODOT_VERSION }}-v1
+
+      - name: Restore export templates cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.local/share/godot/export_templates/4.7.2.stable
+          key: godot-templates-${{ runner.os }}-${{ env.GODOT_VERSION }}-v1
+
+      - name: Install Godot 4.7.2 and export templates
         run: |
-          curl -sL -o /tmp/godot.zip \
+          if [ ! -x /usr/local/bin/godot ]; then
-            https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_linux.x86_64.zip
+            curl -sL -o /tmp/godot.zip \
-          unzip -qo /tmp/godot.zip -d /tmp/godot-bin
+              https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_linux.x86_64.zip
-          sudo install /tmp/godot-bin/Godot_v4.3-stable_linux.x86_64 /usr/local/bin/godot
+            unzip -qo /tmp/godot.zip -d /tmp/godot-bin
+            sudo install /tmp/godot-bin/Godot_v4.7.2-stable_linux.x86_64 /usr/local/bin/godot
+          fi
+          godot --version
+          if [ -f "$HOME/.local/share/godot/export_templates/4.7.2.stable/linux_release.x86_64" ]; then
+            ls "$HOME/.local/share/godot/export_templates/4.7.2.stable" | head -5
+            exit 0
+          fi
           curl -sL -o /tmp/templates.tpz \
-            https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_export_templates.tpz
+            https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_export_templates.tpz
-          mkdir -p ~/.local/share/godot/export_templates/4.3.stable
+          rm -rf /tmp/tpl && mkdir -p /tmp/tpl
-          cd /tmp && rm -rf tpl && mkdir tpl && unzip -qo templates.tpz -d tpl
+          unzip -qo /tmp/templates.tpz -d /tmp/tpl
-          cp tpl/templates/* "$HOME/.local/share/godot/export_templates/4.3.stable/" 2>/dev/null || true
+          mkdir -p "$HOME/.local/share/godot/export_templates/4.7.2.stable"
-          ls "$HOME/.local/share/godot/export_templates/4.3.stable" | head -5
+          cp /tmp/tpl/templates/* "$HOME/.local/share/godot/export_templates/4.7.2.stable/"
+          ls "$HOME/.local/share/godot/export_templates/4.7.2.stable" | head -5
 
       - name: Import project
         run: godot --headless --import
@@ -114,7 +149,7 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         env:
           # An explicit repo secret wins. Without one, publish_release.sh reuses
-          # the local git extraheader that actions/checkout configures for the job
+          # the local git extraheader that actions/checkout configures on the job
           # (the runner's own credentials), so tag builds still publish.
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           VERSION: ${{ github.ref_name }}

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable user-facing changes to Gig Line. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions use
 Semantic Versioning.
 
+## [0.9.1] — 2026-11-02
+
+### Changed
+
+- Unified the project, local tooling and CI/release environment on Godot 4.7.2,
+  including matching export templates and project feature metadata.
+- Added Gitea Actions cache for the Godot binary and export templates to reduce
+  repeated download time.
+- Updated release and setup documentation for the 4.7.2 baseline.
+
 ## [0.9.0] — 2026-11-01
 
 ### Added

MEMORY.md

@@ -33,17 +33,17 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   `outfit_for`/`layer_for`/`hand_item_for` helpers. Blender = flatpak 5.2.0 LTS, sandbox cwd
   `/app/blender` → absolute paths for `--python`. CI stays offline (committed assets).
 
-- Engine: Godot 4.3 stable (official editor build, `~/.local/bin/godot`). The system's preinstalled `godot-runner` (4.7.2, Fedora) cannot load projects from arbitrary paths because it was compiled without path overrides; use the official editor binary instead.
+- Engine: Godot 4.7.2 stable (official editor build, `~/.local/bin/godot`). The system's preinstalled `godot-runner` cannot load projects from arbitrary paths because it was compiled without path overrides; use the official editor binary instead.
 - Language: GDScript. All cross-file references use explicit `preload()` constants (not `class_name` globals) so scripts compile in headless `--script` runs without the editor's class cache.
 - Test framework deviation: the project uses a custom minimal headless test runner (`src/test/test_runner.gd`) instead of GUT, because GUT needs the editor plugin. CI runs it with `--headless`.
 - Eventing: no autoload signal bus. `ShiftCoordinator` owns an `EventBus` instance (`src/core/event_bus.gd`) passed to subsystems; subsystems emit only when a bus is assigned. Autoloads at parse time are unreliable under `--script`.
-- Static signals are not available in Godot 4.3 GDScript ("Expected func or var after static") — do not use them.
+- Static signals are not available in Godot GDScript ("Expected func or var after static") — do not use them.
 - GDScript lambdas capture local variables **by value**; mutating a captured local inside a lambda does not affect the outer variable. Use member functions for accumulators in tests.
 - Shift length is the scenario's `shift_duration_s` (900 s in all three venues). Tests and the screenshot tool override elapsed time; they do not change the default.
 - RNG: NPC reactions and event scheduling are seedable for deterministic tests.
 
 - **Mouse look (v0.7.3):** guard look is handled in `GuardController._input()` (before GUI), not `_unhandled_input`; focus/click-back recaptures the cursor and the HUD is made mouse-transparent recursively. Regression tests cover yaw/pitch and HUD filters.
-- **v0.9.0 production pass:** CI/release baseline remains Godot 4.3; local dev is 4.7.2 with the version-adaptive light falloff. Audio settings are `master_volume`/`sfx_volume`/`ambience_volume`; accessibility has `reduce_motion` and `captions_enabled` (HUD log is the caption surface). Budget smoke is 24 NPCs (6.94 ms headless). Coat/dress stride is scaled to 0.76 to reduce hem clipping. Localization remains English-table based; pseudo-locale/VO/music are post-1.0.
+- **v0.9.0 production pass:** CI/release, local dev and project now use Godot 4.7.2; the version-adaptive light falloff remains for older editors. Audio settings are `master_volume`/`sfx_volume`/`ambience_volume`; accessibility has `reduce_motion` and `captions_enabled` (HUD log is the caption surface). Budget smoke is 24 NPCs (6.94 ms headless). Coat/dress stride is scaled to 0.76 to reduce hem clipping. Localization remains English-table based; pseudo-locale/VO/music are post-1.0.
 - **Radio submit fix (v0.8.1):** `RadioPanel.action_button` now connects `pressed` for normal reports; `button_down/up` remains exclusive to emergency hold-to-confirm. Regression test covers both modes.
 - **Campaign/v0.8.0:** `Campaign` owns Hollywood → Joke Shop → TV Studio progression. `campaign.json`, `shift_results.json`, `settings.json` and versioned `shift_state.json` persist separately; pause saves a checkpoint, review Continue advances, Settings resets with confirmation. Difficulty keys are `easy/normal/hard` (`ai_difficulty`); scripted QA bypasses tutorial unless `--tutorial` is passed. Help is searchable and generated from `InputBindings.REMAPPABLE`.
 - **Tutorial (0.8.0 work):** `docs/tutorial.md` is the eight-beat design; `src/game/tutorial.gd` is the pure state machine, `TutorialOverlay` is the non-blocking card, and `GameManager` wires it with a safe visitor, suppressed spawns, persisted completion/skip and Settings replay. Scripted test/capture runs bypass it unless `--tutorial` is passed; `smoke_tutorial.gd` covers completion/replay/skip.
@@ -58,13 +58,12 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   binaries + override into `gig-line-desktop-hq-<version>.zip`;
   `publish_release.sh` uploads it when present. A/B report:
   `docs/screens/realism/2026-11-01-forward-plus/` (entrance gap 1.568→1.187).
-- **Local Godot toolchain (2026-11-01):** `~/.local/bin/godot` is 4.7.2 stable;
+- **Godot toolchain (updated 2026-11-01):** local `~/.local/bin/godot`, CI and
-  4.3 stable is kept as `~/.local/bin/godot-4.3.stable`. Export templates for
+  `project.godot` now use Godot 4.7.2; 4.3 remains only as a local backup binary.
-  4.7.2 are installed under `~/.local/share/godot/export_templates/4.7.2.stable`
+  Export templates for 4.7.2 are installed under
-  (4.3 remains). The project and CI still pin 4.3 in `project.godot`/the Gitea
+  `~/.local/share/godot/export_templates/4.7.2.stable`. Godot 4.7 writes
-  workflow; 4.7.2 imports, runs the 231-test suite, session-shell smoke and a
+  `*.gd.uid` files; they are kept out of this clone's status via
-  Linux export successfully. Godot 4.7 writes `*.gd.uid` files; they are kept
+  `.git/info/exclude`. CI caches the binary/templates with Gitea Actions cache.
-  out of this clone's status via `.git/info/exclude` until the project upgrades.
 - **Blender invocation (v0.6.0):** `flatpak run org.blender.Blender --background --python
   /run/media/system/DATA/Documents/06-games/security-game/tools/npc_pipeline.py -- build`.
   The flatpak cannot read `/tmp`; use absolute repo paths. `assets/models/npc/.gdignore` is
@@ -145,7 +144,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   `npc_pipeline.py` + `asset_pipeline.py` and the confirmed-asset locations.
 
 - Repo: `/run/media/system/DATA/Documents/06-games/security-game` (also reachable at
-  `/var/home/zwitschi/Documents/06-games/security-game`). Godot: `~/.local/bin/godot` (4.3.stable).
+  `/var/home/zwitschi/Documents/06-games/security-game`). Godot: `~/.local/bin/godot` (4.7.2).
   Tests: `godot --headless --path . --script res://src/test/test_runner.gd` → **177/177**.
   Python tooling tests: `cd tools && python3 -m unittest test_asset_pipeline test_screen_designs test_model_pipeline` → **53**.
   Session shell smoke: `godot --headless --path . --script res://src/test/smoke_session_shell.gd` → exit 0.
@@ -194,7 +193,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   joke_shop 700 s / studio 700 s; `--stages=` subset) and swaps textures by the material's
   *original* albedo path. **Gotcha:** in the SceneTree script, do not overwrite `_phase` after
   `_begin_stage()` sets `done`, or the run loops forever between stage/shoot (`_queue` empty).
-  **Gotcha:** `elapsed_s = 620` is *Evening* (dusk), 700+ is Late. Godot 4.3
+  **Gotcha:** `elapsed_s = 620` is *Evening* (dusk), 700+ is Late. Godot 4.7
   `StandardMaterial3D` has no `fog_enabled`; the skyline is a `ShaderMaterial` with
   `render_mode unshaded, cull_disabled, fog_disabled` + `ALPHA_SCISSOR_THRESHOLD` so the
   panorama's own haze shows. Backdrop plane is 90 m tall with 2 UV repeats (~200×90 m per
@@ -577,8 +576,9 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Venue cycling: `V` switches Hollywood Blvd → The Joke Shop → TV Studio and restarts the shift.
 - Venue door-staff dialogue: `VenueScenario.door_staff_line(context, rng)` and GameManager logging
   (id/ticket/wand-check, refusal, prohibited-item) — Joke Shop flavor.
-- CI cache: `.gitea/workflows/build.yml` no longer uses `actions/cache` (the runner can't reach
+- CI cache: `.gitea/workflows/build.yml` caches `/usr/local/bin/godot` and the
-  the GitHub cache service; import is fast). `GODOT_SILENCE_ROOT_WARNING=1` set on jobs.
+  4.7.2 export templates with Gitea Actions cache. `GODOT_SILENCE_ROOT_WARNING=1`
+  is set on jobs.
   Logs live in `.gitea/logs/` after each run.
 - Visual polish (v0.2.0): phase lighting (GameManager.PHASE_LIGHTING + ProceduralSkyMaterial),
   street lamps + night mode in WorldBuilder.set_night_mode, marquee Label3D, crosswalk/planters/

PLAN.md

@@ -159,7 +159,7 @@ Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [AD
 
 ## Tech Stack
 
-- **Engine:** Godot 4.3 baseline (local dev verified with 4.7.2), GL Compatibility renderer (Web parity); optional Forward+ Desktop HQ build.
+- **Engine:** Godot 4.7.2, GL Compatibility renderer (Web parity); optional Forward+ Desktop HQ build.
 - **Language:** GDScript.
 - **Architecture:** venue-driven simulation; shared systems plus `Resource`-based scenario data.
 - **Navigation:** `NavigationRegion3D` / `NavigationAgent3D`.
@@ -172,7 +172,7 @@ Primary decisions: [ADR-0007](docs/adr/0007-locomotion-and-input-layers.md), [AD
 
 ## Versioning and Delivery
 
-`config/version` in `project.godot` is the single version source (currently `0.9.0`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/). See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.
+`config/version` in `project.godot` is the single version source (currently `0.9.1`). Releases are tagged `v<version>`; the CI pipeline builds and publishes the standard artifacts plus the optional Desktop HQ zip. Version bumps follow [Semantic Versioning](https://semver.org/). See [`docs/RELEASING.md`](docs/RELEASING.md) and [`README.md`](README.md) for commands.
 
 ## Design Direction
 

README.md

@@ -38,8 +38,9 @@ precision walk, the Joke Shop alley, the TV Studio arrival, and the prop lineup.
 > Downloads are public (no sign-in required) since the host's instance-wide
 > `REQUIRE_SIGNIN_VIEW` was disabled on 2026-10-31.
 >
-> **Latest: v0.9.0** — production-quality audio/accessibility settings, a
+> **Latest: v0.9.1** — unified Godot 4.7.2 CI/release environment with cached
-> 24-NPC performance baseline and the v0.8 tutorial/campaign/resume pass.
+> Godot binaries/templates, plus v0.9.0's production-quality and v0.8
+> tutorial/campaign/resume work.
 > Releases are built automatically when a `vX.Y.Z` tag is pushed
 > (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline
@@ -74,7 +75,7 @@ decisions are recorded as ADRs in [`docs/adr/`](docs/adr/).
 
 ## Tech Stack
 
-- **Engine:** Godot 4.3 baseline (local dev verified with 4.7.2) · **Language:** GDScript
+- **Engine:** Godot 4.7.2 · **Language:** GDScript
 - **NPCs:** Blender-authored skinned library (`assets/models/blender/`) with procedural fallbacks; lightweight FSMs on `NpcProfile`
 - **World:** procedural `WorldBuilder` + generated prop models
 - **Art:** v2 skyline/surface textures in `assets/textures/ai/game_ready/v2/picks/`; UI/scene art in `assets/images/`
@@ -118,11 +119,12 @@ Full setup, every run/test/smoke command, and the controls table are in
 
 ## Development Status
 
-v0.8.0 adds the first-shift tutorial, campaign shell, checkpoint resume,
+v0.9.0 adds the production-quality baseline: mixer/accessibility settings, a
-difficulty presets and an in-game Help overlay on top of the v0.7.x venue, gear,
+24-NPC performance budget and the unified Godot 4.7.2 toolchain, on
-judge and Desktop HQ work. See [`docs/development-status.md`](docs/development-status.md)
+top of v0.8's tutorial, campaign, checkpoint resume, difficulty and Help. See
-for the implemented list and [`TODO.md`](TODO.md) for the v1.0.0 roadmap. Manual
+[`docs/development-status.md`](docs/development-status.md) for the implemented
-verification uses the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
+list and [`TODO.md`](TODO.md) for the v1.0.0 roadmap. Manual verification uses
+the [`docs/smoke-checklist.md`](docs/smoke-checklist.md).
 
 ## Development Workflow
 

TODO.md

@@ -5,10 +5,11 @@ see `AGENTS.md` for the workflow and `MEMORY.md` for the decisions behind these
 
 ## Gap Analysis and v1.0.0 Roadmap
 
-Baseline: **v0.8.1** (2026-11-01). Three playable venues, tutorial/campaign/checkpoint resume,
+Baseline: **v0.9.0** (2026-11-01). Three playable venues, tutorial/campaign/checkpoint resume,
-difficulty/help, a complete escalation/access/radio loop, shift review, the Blender asset library,
+difficulty/help, audio/accessibility settings, a 24-NPC budget baseline, a complete
-249 headless + 94 Python tests, a clean screen-design judge and an optional Forward+ Desktop HQ
+escalation/access/radio loop, shift review, the Blender asset library, 250 headless + 94 Python
-build. This is a strong first-hour vertical slice, not yet a 1.0 product.
+tests, a clean screen-design judge and an optional Forward+ Desktop HQ build. This is a strong
+release-candidate foundation, not yet a 1.0 product.
 
 ### Documentation audit (completed 2026-11-01)
 
@@ -27,44 +28,281 @@ build. This is a strong first-hour vertical slice, not yet a 1.0 product.
       decisions (ADRs), status (`development-status.md`), roadmap (`TODO.md`), operations
       (tooling/release docs).
 
-### Gap register
+### Gap register (remaining to 1.0)
 
-| Area | Current baseline | Gap to 1.0 | Risk | Milestone |
+| Area | Current baseline | Remaining gap | Risk | Milestone |
 | --- | --- | --- | --- | --- |
-| First-hour experience | Venue menu and controls exist; no tutorial | No guided first shift, control coaching, objective recap or "what went wrong" debrief | New players bounce before the de-escalation loop lands | 0.8.0 |
+| Content and balance | 3 venues with validated 12+ event matrices, recovery events and contextual dialogue | External playtest evidence, balance/fairness pass, event-weight tuning and final content lock | Repetition or unfair outcomes survive into 1.0 | 0.9.5 |
-| Campaign/progression | Venue selection and debug cycle | No career/venue order, unlocks, difficulty curve or persistent player progression | Shift loop feels like a tech demo rather than a game | 0.8.0 |
+| Dialog/UI | Complete screens and panel art, but copy/button behavior has not had a dedicated audit | Terminology, button states, long-string layout and full screen coverage need a focused pass | Inconsistent UI undermines first-hour clarity | 0.9.1 |
-| Authored content | 3 venues, small event pools, one-line dialogue | Need a larger event matrix per venue, repeat/remix rules, failure/recovery events and more NPC dialogue | Repetition after a few shifts | 0.8.0 |
+| Animation/presentation | Procedural pose layers, portrait captures, reduced hem clipping | Final model/pose/facial readability and gear-fit acceptance before visual QA | Close-up jank reduces perceived quality | 0.9.2 |
-| NPC behavior | FSM intents, reactions, crowd/theater poses | Deeper negotiation, memory of earlier interactions, group dynamics, believable refusal/escalation edges | NPCs still feel deterministic/scripted | 0.8.0 |
+| Audio/accessibility | Procedural ambience/SFX, volume controls, captions/reduce-motion settings, searchable Help | Full accessibility/localization acceptance review, audio caption coverage and P0/P1 fixes | Public 1.0 cannot claim accessible play | 0.9.1 / 0.9.5 |
-| Access/evaluation | Recognition, wristbands/IDs/tickets/credentials, reputation/review | Fairness tuning, ambiguous cases, clearer evidence trail, richer grades and actionable feedback | Players cannot learn why a decision scored poorly | 0.8.0 |
+| Localization | English JSON table, validation and input-generated Help | Pseudo-locale/layout audit and translator workflow sign-off | Text expansion/clipping at release | 0.9.1 / 0.9.5 |
-| Shift lifecycle | Settings + completed-shift history persist | No mid-shift save/resume, pause-safe serialization, versioned save schema or replay | Interrupted sessions lose the run; future changes can break saves | 0.8.0 |
+| Performance/platform | 24-NPC headless budget (6.9 ms), Compatibility/Web/HQ paths | Target hardware matrix, Web/HQ manual profiling, frame-time/memory evidence | Platform-specific drops or startup failures | 0.9.4 / 0.9.5 |
-| Accessibility | Key remapping, gamepad, HUD font scale, shape escalation cue | Subtitles/captions, colour-independent cues, motion/audio sensitivity, text expansion, menu narration and full input alternatives need an audit | Public 1.0 cannot claim accessible play | 0.8.0–0.9.0 |
+| Save lifecycle | Settings/campaign/history/checkpoint files, atomic writes | Migration fixtures from 0.8/0.9, fresh-install/upgrade verification, rollback instructions | Player progress loss on upgrade | 0.9.5 |
-| Localization | English strings in `content/strings.en.json` | String extraction/coverage, pseudo-locale test, font fallback, text-length layout budgets and translator workflow | Text bugs and unsupported locales at release | 0.9.0 |
+| QA/CI | Headless suite, smokes, screenshot compare, optional judge | Full visual judge gate, release-candidate smoke matrix, final gallery and release dry run | Regressions escape the release gate | 0.9.4 / 0.9.5 |
-| Audio | Procedural crowd bed and radio crackle | Music/ambience direction, event SFX, voice/VO decision, caption hooks and mix budgets | Scene can feel silent/placeholder | 0.9.0 |
+| Release/legal | Unsigned desktop/macOS builds, Web/HQ packages | Signing/notarization decision, checksums, AI-asset provenance, credits, privacy/body-camera and rating review | Public release blocked by trust/policy | 0.9.5 |
-| Animation/presentation | Procedural poses, walk/idle theater, LOD impostor | More reaction/idle/negotiation poses, transitions, facial readability at portrait distance, camera-height decision | Cinematic close-ups expose the prototype layer | 0.9.0 |
+| Documentation | Architecture/ADR/status/roadmap ownership established | Final README/changelog/status/TODO/smoke-checklist sign-off and known-limitations page | Docs drift at launch | 0.9.4 / 0.9.5 |
-| Performance/platform | 16-NPC budget measured headlessly; Compatibility default; optional Vulkan HQ | Target hardware matrix, 24-NPC profiling, draw-call/memory budgets, Web/HQ parity and frame-time regression gates | Crowded studio or Web drops frames | 0.9.0 |
+| Post-launch | Stable 0.9 feature set | Live replay, more venues, VO/music, image-to-mesh props and seasonal content | Scope creep before launch | Post-1.0 |
-| Content tooling | ScenarioFactory/.tres export, Blender manifest, asset audits | Schema validation, previews, event authoring workflow, reproducible asset rebuild notes and contributor onboarding | Content expansion becomes expensive/error-prone | 0.8.0–0.9.0 |
+
-| QA/CI | Headless suite, smokes, screenshot compare, model-aware judge | End-to-end shift automation, full venue matrix, CI Godot-version strategy, manual judge budget and release checklist automation | Regressions escape or CI becomes non-reproducible | 0.9.0 |
+## Patch 0.9.1 — Dialog, button and UI polish
-| Release/legal | Tag-driven unsigned builds, Web zip, optional HQ | Signing/notarization, checksums, AI-asset provenance/licensing, credits, privacy/body-camera statement and storefront requirements | Public release blocked by trust/policy issues | 0.9.5 |
+
-| Documentation | Layered docs consolidated; drift was found | Keep changelog/status/roadmap/ADR links synchronized per release; add contributor architecture tour | Docs become stale again | Continuous |
+Goal: make every player-facing screen read consistently and pass the Python
+screen-design judge before any model/texture changes. No gameplay rules change.
+
+### Screen and terminology inventory
+
+- [ ] Inventory every screen/panel: start menu, venue menu, tutorial, HUD, pause,
+      settings, Help, inspection, wand, radio/emergency, wheel, shift review,
+      timeline and campaign/continue screens.
+- [ ] Record the canonical terms for admit/deny, allow/refuse, warning/blocking,
+      assistance/emergency, body camera, shift/review and campaign; remove synonyms
+      that mean the same action.
+- [ ] Audit all button labels for verb-first wording, capitalization, ordering,
+      destructive-action confirmation and consistent confirm/cancel placement.
+- [ ] List every hardcoded player-facing string and route it through
+      `content/strings.en.json`; add placeholder validation for new keys.
+- [ ] Review NPC/door-staff/radio/tutorial/help/review/campaign dialogue for
+      repetition, ambiguity, tone and localization length.
+
+### Button and panel behavior
+
+- [ ] Audit normal/hover/pressed/focus/disabled states on every button, including
+      tutorial skip, venue continue, settings apply/cancel/reset, judge/review,
+      radio send/emergency hold and Help close.
+- [ ] Verify keyboard-only and gamepad-only navigation: focus order, wrapping,
+      default focus, confirm/cancel behavior and no focus traps.
+- [ ] Verify every modal closes with Esc/right-click where documented, recaptures
+      the mouse, and does not leave the guard frozen or the menu visible.
+- [ ] Test buttons at minimum/maximum HUD font scale and with 1.5–2× longer
+      strings; fix clipping, overflow and overlapping layouts.
+- [ ] Test destructive/irreversible actions (campaign reset, tutorial replay,
+      emergency send) require the intended confirmation/hold and cannot double-fire.
+- [ ] Verify radio normal-send vs emergency hold, inspection/wand allow/deny,
+      review continue/retry/menu and Help search/filter behavior end to end.
+
+### Visual and judge verification
+
+- [ ] Update the affected UI art/reference mapping where copy or button order
+      changes; keep the no-overwrite image convention.
+- [ ] Capture a deterministic screenshot for every dialog/button state that has a
+      design reference; add missing capture stages or an explicit coverage gap.
+- [ ] Run `tools/check_screenshots.sh` and `python3 tools/screen_designs.py compare`;
+      fix all `bad` results.
+- [ ] Run `python3 tools/screen_designs.py judge` with `--model auto` (or a pinned
+      model); clear every `diff` and record accepted `review` verdicts.
+- [ ] Record the judge model, fallback order, spend and evidence in
+      `docs/screens/realism/` or the screen-design report.
+- [ ] Add a short UI copy/button checklist to `docs/smoke-checklist.md`.
+- [ ] Exit: all screens have consistent terminology and button behavior, long
+      strings/scale pass, and the Python compare/judge gate has no unexplained
+      diff.
+
+## Patch 0.9.2 — NPC model refinement
+
+Goal: make the eight character variants and their gear hold up in portraits and
+normal play without changing the `npc_base`/`Rig/Head` contract.
+
+### Model and rig audit
+
+- [ ] Render all eight variants from front, profile, back and portrait angles;
+      compare faces, hair, ears, hands, shoes, proportions and gear fit.
+- [ ] Audit head/face readability (brow, eyes, lips, nose, hairline) at portrait
+      distance; fix the highest-impact silhouette/face issues.
+- [ ] Audit gear fit and clipping: caps/beanie/hood/helmet/sunglasses, shoulder bag,
+      backpack, SCBA tank, lanyard, hand items and the new coat/dress stride.
+- [ ] Audit coat/dress/skirt hems during walk, blocking, sitting and turning; fix
+      remaining leg/hem intersections with weights, geometry or stride limits.
+- [ ] Re-check the frozen contract: mesh `npc_base`, bone names, five tint slots,
+      front direction, attach points, triangle/vertex budgets and grounding.
+- [ ] Rebuild affected GLBs, bake AO, run `godot --headless --path . --import`, and
+      run `blender_assets.py audit` plus fit/portrait checks.
+
+### Pose and animation polish
+
+- [ ] Review idle, walk, warning, blocking, recognition, refusal, phone, clipboard,
+      photo, film, sit and responder poses for pops or floating props.
+- [ ] Add/adjust short transitions for negotiation/reaction poses without breaking
+      the seeded pose helpers or head-turn behavior.
+- [ ] Verify LOD tiers and the impostor at 16/24-NPC distances; re-run the budget
+      smoke and record any triangle/draw-call changes.
+- [ ] Refresh the Blender review sheets and character portraits; keep per-asset
+      previews local if gitignored.
+
+### Verification
+
+- [ ] Add/update headless tests for any new pose/model contract behavior.
+- [ ] Capture the portrait and character gallery; compare against the design
+      references and run the Python judge.
+- [ ] Update `docs/blender-assets.md`, architecture/status and `MEMORY.md` with the
+      revised budgets, limitations and rebuild commands.
+- [ ] Exit: portrait/readability and gear fit pass, no obvious P0/P1 clipping remains,
+      and the 24-NPC budget/full test suite are green.
+
+## Patch 0.9.3 — Texture and material refinement
+
+Goal: improve close-range surface and character texture quality while keeping GL
+Compatibility/Web parity, deterministic assets and offline CI.
+
+### Environment textures and materials
+
+- [ ] Audit the v2 picks (brick, sidewalk pavers, dry/wet asphalt, awning canvas,
+      day/dusk/night skylines) at close range and in the entrance/street shots for
+      seams, tiling, scale, contrast and normal-map strength.
+- [ ] Refine brick mortar/wear, paver joints/stains, asphalt aggregate/wet response
+      and awning weave using the existing image/asset tooling; never overwrite a
+      pick, use `-vN` candidates and promote validated results.
+- [ ] Check UV scales and material roughness/metallic profiles; keep day/night
+      phase behavior and the wet-street transition intact.
+- [ ] Review distant skyline haze and foliage/planter surfaces against the concept
+      references; fix obvious flatness without regressing readability.
+
+### Character and prop textures
+
+- [ ] Audit NPC skin, cloth, pants, hair and gear albedo/normal/AO maps in portraits;
+      refine fabric weave, skin variation and fixed detail materials.
+- [ ] Re-bake AO where geometry changes; verify the 256² maps and material wiring.
+- [ ] Audit library props and UI/card/icon textures at their actual screen sizes;
+      remove blurry/oversized or unused textures where safe.
+- [ ] Run texture audits, import, and the full asset test suite; record texture memory
+      and triangle/draw-call impact.
+
+### Visual verification
+
+- [ ] Run `python3 tools/scene_concepts.py realism` for the affected stages with the
+      judge enabled; record metric gaps and model/spend.
+- [ ] Re-run `tools/check_screenshots.sh` and the screen-design judge; clear all
+      `diff` verdicts.
+- [ ] Capture before/after close-ups for brick, pavement, asphalt, character cloth
+      and skyline; document accepted trade-offs.
+- [ ] Update asset docs and the changelog/status with the promoted texture versions.
+
+## Patch 0.9.4 — Integration, performance and judge gate
+
+Goal: integrate the UI/model/texture patches, prove the combined build on the
+target paths and leave a clean release-candidate handoff.
+
+### Integration and asset rebuild
+
+- [ ] Rebuild all changed Blender/GLB/AO assets, re-import, and verify manifest/fit/
+      audit coverage.
+- [ ] Run the complete headless suite, Python tooling and smoke matrix; fix any
+      regression from the three polish patches.
+- [ ] Re-run the 24-NPC budget smoke and record frame time, mesh count and any
+      texture-memory change; check Web and Desktop HQ if available.
+- [ ] Verify save/campaign/tutorial behavior is unchanged by the visual/UI patches.
+
+### Visual gallery and judge gate
+
+- [ ] Recapture the full gallery, portraits, venue/realsim stages and Desktop HQ A/B
+      as needed; no stale screenshots in the release set.
+- [ ] Run `tools/check_screenshots.sh`, `screen_designs.py compare` and
+      `screen_designs.py judge` on the final captures.
+- [ ] Run the realism judge for the affected concepts with a pinned model; record
+      model, attempt count, spend and verdicts.
+- [ ] Review all `review` verdicts manually; convert unexplained layout/composition
+      mismatches into fixes or explicit known limitations.
+- [ ] Ensure generated realism folders remain gitignored/local-only and only the
+      durable report decisions/docs are committed.
+
+### Release-candidate handoff
+
+- [ ] Update README, architecture, development status, changelog and TODO with the
+      final patch-level results and any remaining gaps.
+- [ ] Tag/version or otherwise freeze `0.9.4` as the integration checkpoint before
+      the `0.9.5` release candidate.
+- [ ] Exit: combined build is functionally green, visually reviewed, performance
+      measured and ready for the 0.9.5 content-lock/playtest phase.
 
 ## Milestone 0.9.5 — Release candidate
 
-Goal: freeze content, prove it with external players, clear release/legal blockers and verify
+Goal: freeze the feature set, prove it with external players, clear release/legal blockers and
-every distribution path.
+verify every distribution path. This is the next shipped version before 1.0.
 
-- [ ] Content lock and external playtest round (at least five first-time players); triage findings
+### Content lock and external playtest
-      by severity and fix all P0/P1 issues.
+
-- [ ] Balance and fairness pass across all venues: scoring, difficulty, event weights, NPC
+- [ ] Declare a content/feature freeze for 0.9.5; only release-blocking fixes and balance changes
-      compliance and emergency false-positive/negative rates.
+      may land after the freeze.
-- [ ] Save migration test from 0.8/0.9 saves; verify settings, shift history and resume paths.
+- [ ] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
-- [ ] Release engineering: signed/notarized macOS where possible, checksums, Windows/Linux install
+      accessibility settings and checkpoint/resume enabled.
-      smoke tests, AppImage update, Web hosting verification and Desktop HQ Vulkan fallback.
+- [ ] Run at least five first-time-player sessions covering the tutorial and one full venue shift;
-- [ ] Legal/credits review: AI-assisted asset provenance, music/SFX licenses, privacy/body-camera
+      record where players get stuck, misunderstand evidence or choose disproportionate escalation.
-      language, age/content rating and storefront requirements.
+- [ ] Triage findings by severity (P0/P1/P2) and fix every P0/P1 onboarding/accessibility issue;
-- [ ] Documentation sign-off: architecture/ADR/status/TODO/changelog/README/smoke checklist all
+      keep the rest as explicit known limitations or post-1.0 items.
-      match the release candidate; capture final gallery and run compare + judge.
+- [ ] Re-run the affected tutorial/campaign smokes after each fix and capture a fresh first-hour
-- [ ] Exit: release candidate passes the manual smoke checklist on every target; no release-blocking
+      walkthrough for the release notes.
-      legal or platform issue remains.
+
+### Balance and fairness pass
+
+- [ ] Define measurable targets for routine compliance, access-decision accuracy, peaceful
+      resolution, justified emergency calls and false-positive/false-negative rates.
+- [ ] Run scripted venue sweeps across easy/normal/hard and all four phases; compare outcomes and
+      tune event weights, reaction tables, compliance and report strictness where targets fail.
+- [ ] Review emergency calls against actual danger: no routine behavior should make emergency the
+      dominant winning move, and genuine threats must remain answerable.
+- [ ] Verify the reputation grades, debrief explanations and campaign progression still communicate
+      the de-escalation-first design after tuning.
+- [ ] Record the balance evidence and any deliberate exceptions in `docs/development-status.md`
+      or `MEMORY.md`.
+
+### Save migration and session reliability
+
+- [ ] Add fixtures for a 0.8-era settings/campaign/history save and a 0.9.0 checkpoint; verify
+      migration/default-filling and a clean first launch with no files.
+- [ ] Test fresh install → tutorial → campaign → pause → quit → resume → review → next venue on
+      an isolated user-data directory.
+- [ ] Test corrupt JSON, partial temp files, missing optional fields and a failed atomic rename;
+      confirm fallback behavior never destroys a valid save.
+- [ ] Verify checkpoint resume after all three venues, after an incident, with NPCs at the door and
+      with flashlight/body-camera/door state set.
+- [ ] Document save locations, schema versions, reset behavior and rollback/export instructions in
+      `docs/getting-started.md` and the release notes.
+
+### Release engineering and distribution
+
+- [ ] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
+      artifact names, sizes and checksums.
+- [ ] Smoke-test fresh Linux portable/AppImage, Windows portable/installer, macOS unzip/launch,
+      Web static hosting and Desktop HQ Vulkan fallback on the target matrix.
+- [ ] Add a disk-space preflight and retention policy to the release/publish scripts so a full
+      Gitea host cannot leave a partially uploaded release.
+- [ ] Verify release metadata, tag/version consistency, asset counts and download links; retain
+      at least the latest 0.8/0.9 releases and document older-asset pruning.
+- [ ] Decide and document whether macOS signing/notarization is required for 0.9.5 or explicitly
+      remains a 1.0 blocker; record the quarantine instructions either way.
+
+### Legal, credits and platform policy
+
+- [ ] Audit AI-assisted asset provenance and licenses; record source/model usage and any
+      redistribution constraints for textures, characters, props and UI art.
+- [ ] Audit audio/SFX/music licensing (or confirm everything is procedural) and add a credits file.
+- [ ] Review body-camera/privacy language, mental-health-crisis representation, age/content rating
+      and storefront requirements; fix any release-blocking copy or content.
+- [ ] Add the player-facing credits, known limitations, accessibility statement and privacy note to
+      the release package/README.
+- [ ] Mark external legal/storefront approval as complete or explicitly block 1.0 on it.
+
+### Documentation and visual sign-off
+
+- [ ] Update `README.md`, `PLAN.md`, `docs/architecture.md`, ADRs, `docs/development-status.md`,
+      `docs/getting-started.md`, `docs/smoke-checklist.md`, `CHANGELOG.md` and this roadmap.
+- [ ] Regenerate the full screenshot gallery and realism baselines after content lock; run
+      `check_screenshots.sh` and the pinned vision judge, recording model/spend/verdicts.
+- [ ] Run the manual smoke checklist on every target and attach/link the release-candidate evidence.
+- [ ] Verify the tutorial/campaign/help text at maximum font scale and with the longest strings.
+- [ ] Remove or archive stale plans/notes and confirm no contradictory version/status claims remain.
+
+### Release-candidate QA and exit
+
+- [ ] Run the complete headless suite, Python tooling, tutorial/campaign/session/scenario smokes,
+      24-NPC budget smoke and release build from a clean checkout.
+- [ ] Run the manual QA matrix: fresh install, upgrade, offline launch, gamepad, accessibility
+      settings, pause/resume, all venues and Desktop HQ fallback.
+- [ ] Confirm no P0/P1 defects remain; P2 items must be documented as known limitations or
+      post-1.0 work.
+- [ ] Create the `v0.9.5` version bump, changelog entry and tag; build/publish the release and
+      verify all assets and download links.
+- [ ] Exit: the release candidate is content-locked, externally played, legally reviewed,
+      documented, reproducibly built, and approved as the final stepping stone to 1.0.0.
 
 ## Milestone 1.0.0 — Launch
 

docs/RELEASING.md

@@ -12,11 +12,11 @@ time you export, either:
   matching templates), or
 - Install them manually from the
   [Godot downloads](https://godotengine.org/download/) page by placing the
-  `Godot_v4.3-stable_export_templates.tpz` contents into
+  `Godot_v4.7.2-stable_export_templates.tpz` contents into
-  `~/.local/share/godot/export_templates/4.3.stable/`.
+  `~/.local/share/godot/export_templates/4.7.2.stable/`.
 
-The templates must match the editor binary you use locally. CI pins Godot 4.3;
+The templates must match the editor binary you use locally. CI and local
-the local development machine uses 4.7.2 with its matching templates. Verify with:
+development both use Godot 4.7.2 with its matching templates. Verify with:
 
 ```bash
 godot --headless --export-release "Linux" build/gig-line-smoke.x86_64
@@ -31,7 +31,7 @@ godot --headless --export-release "Linux" build/gig-line-smoke.x86_64
 
 The repository ships a Gitea Actions workflow (`.gitea/workflows/build.yml`):
 
-- Every push/PR runs the **checks** job: Godot 4.3 install, project import, and the
+- Every push/PR runs the **checks** job: Godot 4.7.2 install, project import, and the
   full headless test suite. This is the fast safety net.
 - **Tags (`v*`)** and **manual `workflow_dispatch`** runs additionally execute the
   **build** job: export templates install, import, `tools/build_releases.sh` for
@@ -63,10 +63,10 @@ setup, so do not rely on it.
 > artifacts. If CI publishing fails again, run
 > `./tools/publish_release.sh <version>` from a checkout with `~/.git-credentials`.
 
-> **No `actions/cache` for now:** the runner has no local actions-cache service, so
+> **Godot cache:** the workflow uses Gitea Actions cache for the Godot binary and the
-> `actions/cache` times out against GitHub's cache API. We dropped it (Godot import
+> 4.7.2 export templates. The first run still downloads them; subsequent runs restore
-> is only ~4s). If a host admin later enables Gitea `[cache.actions]` with a cache
+> from cache. If the host cache service is unavailable, remove the cache steps and
-> server, the step can be reintroduced.
+> let the install steps download fresh copies.
 
 > The workflow lives in `.gitea/workflows/` (Gitea's canonical path). The old
 > `.github/workflows/ci.yml` was removed to avoid double runs on hosts that scan

docs/architecture.md

@@ -25,7 +25,7 @@ This document follows the structure of the arc42 architecture documentation temp
 ## 2. Constraints
 
 - The first implementation should be small enough for a playable vertical slice.
-- The engine is Godot 4 with GDScript; a playable prototype vertical slice is implemented. CI pins Godot 4.3 while local development is verified with 4.7.2; the default renderer stays GL Compatibility for Web parity, with an optional Forward+ Desktop HQ build.
+- The engine is Godot 4.7.2 with GDScript; a playable prototype vertical slice is implemented. CI, local development and exported builds use 4.7.2; the default renderer stays GL Compatibility for Web parity, with an optional Forward+ Desktop HQ build.
 - Venue-specific policies must be configurable rather than hard-coded into individual NPCs.
 - The game must preserve the de-escalation-first design described in [`PLAN.md`](../PLAN.md).
 - The project uses the repository workflow described in [`AGENTS.md`](../AGENTS.md).
@@ -37,7 +37,7 @@ This document follows the structure of the arc42 architecture documentation temp
 - **MINOR** — new venues, NPC archetypes, systems, or features that are backward compatible.
 - **PATCH** — bug fixes and small polish that do not change behavior.
 
-The single source of truth for the version is `config/version` in `project.godot` (currently `0.9.0`). Each release is tagged in git as `v<version>` (e.g. `v0.6.0`). The `0.x` series is pre-1.0, so MINOR bumps may introduce breaking changes while the prototype is still stabilizing. `tools/build_releases.sh` and `tools/publish_release.sh` read the version from `project.godot`, so bumping it there is the only required step before a release. The full bump checklist lives in [`RELEASING.md`](RELEASING.md).
+The single source of truth for the version is `config/version` in `project.godot` (currently `0.9.1`). Each release is tagged in git as `v<version>` (e.g. `v0.6.0`). The `0.x` series is pre-1.0, so MINOR bumps may introduce breaking changes while the prototype is still stabilizing. `tools/build_releases.sh` and `tools/publish_release.sh` read the version from `project.godot`, so bumping it there is the only required step before a release. The full bump checklist lives in [`RELEASING.md`](RELEASING.md).
 
 ## 3. Context and Scope
 
@@ -180,7 +180,7 @@ reputation, crowd reaction and shift review read it rather than resolving gamepl
 
 ## 7. Deployment View
 
-The game is a single-player local client containing presentation, simulation, rules, content, and persistence for local settings and shift results. No online backend is required. A non-threaded Web export ships alongside the desktop builds and can be served from any static host without special headers. The default renderer is GL Compatibility; an optional Desktop HQ zip uses Forward+ with volumetric fog/SDFGI on Vulkan-capable desktops. CI pins Godot 4.3 while local development is verified with 4.7.2, so the light falloff path is version-adaptive until the baseline is unified.
+The game is a single-player local client containing presentation, simulation, rules, content, and persistence for local settings and shift results. No online backend is required. A non-threaded Web export ships alongside the desktop builds and can be served from any static host without special headers. The default renderer is GL Compatibility; an optional Desktop HQ zip uses Forward+ with volumetric fog/SDFGI on Vulkan-capable desktops. CI, local development and exported builds use Godot 4.7.2; the light-falloff code keeps a compatibility branch for older editors but the supported baseline is unified.
 
 Future options include external analytics, cloud saves, or replay sharing, but they are not part of the current architecture.
 
@@ -188,7 +188,7 @@ Future options include external analytics, cloud saves, or replay sharing, but t
 
 A continuous-integration pipeline keeps the headless test suite green on every change and publishes tagged releases.
 
-- **Workflow:** `.gitea/workflows/build.yml` runs on pushes, pull requests, tags, and manual dispatches. The `checks` job installs Godot 4.3, imports the project, and runs `res://src/test/test_runner.gd`; it fails on a non-zero exit code or any `SCRIPT ERROR` in the output.
+- **Workflow:** `.gitea/workflows/build.yml` runs on pushes, pull requests, tags, and manual dispatches. The `checks` job restores/caches Godot 4.7.2, imports the project, and runs `res://src/test/test_runner.gd`; it fails on a non-zero exit code or any `SCRIPT ERROR` in the output.
 - **Build job:** runs for tags and manual dispatches. It installs export templates, exports Linux/Windows/macOS and the non-threaded Web build, packages the NSIS installer, Linux AppImage and optional Desktop HQ zip, verifies the installer contents, and uploads the artifacts.
 - **Publish job:** tag builds call `tools/publish_release.sh` to create the Gitea release and upload the standard artifacts plus the optional Desktop HQ zip. The script uses `GITEA_TOKEN` when configured and otherwise reuses the runner's checkout extraheader credentials.
 - **Hosting:** the repository lives on Gitea (`https://git.allucanget.biz/zwitschi/security-game`). Export templates must match the pinned Godot version; macOS builds are unsigned and need quarantine guidance or notarization for wider distribution.
@@ -219,7 +219,7 @@ The release process is: bump the version, run the full test suite and `tools/che
 - **Asset provenance and AI usage:** AI-assisted images/concepts are development inputs only; validated outputs are committed, audited and loaded through the same runtime asset contracts. Generated content must not become an offline/CI dependency.
 - **Campaign and checkpoint state:** `Campaign` owns venue order/progression; settings, campaign, completed shift history and a versioned pause checkpoint are separate JSON documents. The checkpoint snapshots coordinator systems, scheduler RNG and NPC presentation/access state; it deliberately does not serialize the tutorial overlay or transient input state.
 - **Difficulty:** easy/normal/hard only scale spawn pacing, NPC compliance tolerance and report-credibility strictness; access/escalation rules and emergency rarity are invariant.
-- **Settings and accessibility:** volume/motion/caption settings persist through `settings.json`; Help is generated from the input-binding catalogue and the HUD log is the text caption surface. The supported engine matrix is explicit (CI/release 4.3, local 4.7.2) rather than an implicit version drift.
+- **Settings and accessibility:** volume/motion/caption settings persist through `settings.json`; Help is generated from the input-binding catalogue and the HUD log is the text caption surface. CI/release, local development and exported builds are unified on Godot 4.7.2.
 - **Documentation ownership:** `PLAN.md` owns design intent; `docs/gameplay.md` owns playable mechanics; `docs/architecture.md` owns system boundaries, data flow, constraints and cross-cutting decisions; ADRs own decision history; `docs/development-status.md` owns the implemented/gap list; `TODO.md` owns the roadmap; `MEMORY.md` owns gotchas and open questions. Specialized docs link to these rather than becoming competing sources of truth.
 
 ## 9. Architecture Decisions
@@ -264,7 +264,7 @@ Architecture decisions are recorded as ADRs:
 - Mental-health-crisis scenarios require careful writing, playtesting, and respectful presentation.
 - The choice of engine may affect navigation, crowd scale, tooling, and content authoring.
 - Reference mockups can outpace the runtime art style; compare/judge catch gross drift but not composition errors, so the staged gallery needs human review after large visual changes.
-- Godot version skew (CI 4.3 vs local 4.7.2) can change lighting, import sidecars and generated UIDs; a single supported version and a visual smoke matrix are required before 1.0.
+- Godot 4.7.2 is the unified CI/local/project baseline; future engine bumps still require import, visual and export smoke checks before changing that baseline.
 - Content volume and authoring tools are still thin; adding venues/events by editing the factory can become error-prone without schema validation and preview tooling.
 - Save data currently covers settings and shift history, not mid-shift resume; adding saves/replays requires a versioned schema and migration policy.
 - The optional judge and image-generation paths depend on an external key, model availability and budget; CI cannot make them a release gate, and keys must never be committed.

docs/development-status.md

@@ -2,7 +2,7 @@
 
 Implemented so far:
 
-- Godot 4.3 project scaffold, input map, procedural world builder
+- Godot 4.7.2 project scaffold, input map, procedural world builder (CI/local/release unified)
 - Venue-driven simulation core: `ShiftCoordinator`, `VenueScenario`, `EventScheduler`, `NPCController` + FSM, `AccessVerifier`, `EscalationManager`, `RadioSystem`, `IncidentRecorder`, `ReputationEvaluator`, `CrowdSystem`
 - Three authored scenarios (Hollywood Boulevard building, The Joke Shop, Late Night TV Studio) with access policies, NPC archetypes, and event pools
 - Headless unit tests: **250 passing** (access rules and venue-correct access loadout, escalation, radio cooldown/battery, NPC reaction determinism, door lock, flashlight perception, persistence round-trip, settings round-trip, input remaps, navmesh, step colliders, skyline alpha, scenario data, full-shift simulation, wand screening, responder dispatch, localization strings, focus cone, action wheel, session shell, PLAN verbs and incident recording, crowd presentation, emergency aftermath, body-camera timeline, NPC theater poses, audio, accessibility, authored scenario content, string formatting, `.tres` venue round-trip, surface materials and environment, focus ranking and outfit/gait helpers, generated prop models, web export preset, prop atlas material, player movement, NPC character layers/LOD/queue, input bindings)
@@ -41,7 +41,7 @@ Implemented so far:
 - Visual alignment: start/venue menu, pause, settings, shift review, radio, wand, inspection, timeline, HUD target chip/escalation bar, and radial menu now use or match their AI references in `assets/images/ui/`. The runtime art loader (`src/game/ui/art.gd`) falls back cleanly when a file is missing.
 - Realism adoption (post-v0.6.0): v2 per-phase skylines and surface tiles with normal maps, retuned sun/exposure/fog, wet asphalt, denser foliage, a visible additive flashlight beam, and refreshed staging captures. `tools/check_screenshots.sh` is the repeatable capture/compare gate; judge is clean of `diff` verdicts.
 - Input/reliability fixes: selecting a venue releases the start-menu input lock and recaptures the mouse; the body-camera overlay no longer covers the shift status. Mouse look now reads at `_input`, restores capture on window focus/click-back, and the HUD is mouse-transparent. Normal radio reports submit on click; emergency calls still require the hold-to-confirm path.
-- Production-quality pass (v0.9.0): mixer/accessibility settings, audio volume clamping, 24-NPC budget smoke, shortened coat/dress stride, and an explicit Godot 4.3-CI/4.7-local support matrix with documented upgrade/rollback requirements.
+- Production-quality pass (v0.9.0): mixer/accessibility settings, audio volume clamping, 24-NPC budget smoke, shortened coat/dress stride, and a unified Godot 4.7.2 CI/local support baseline with documented upgrade/rollback requirements.
 - Campaign and first-hour pass (v0.8.0): campaign progression, checkpoint resume, difficulty presets, a searchable Help overlay, recovery events, contextual dialogue, policy/debrief lines and tutorial/replay/skip. Scripted QA bypasses the tutorial unless `--tutorial` is passed.
 - Tutorial pass (0.8.0 work): the eight-beat first shift is wired through a non-blocking prompt overlay, a safe compliant visitor, real wheel/inspection/warning/radio panels, persisted completion/skip and a Settings replay action. Scripted tests/captures bypass it unless `--tutorial` is passed; `smoke_tutorial.gd` covers the full flow.
 - Vision judge (v0.7.2): discovers the cheapest current OpenRouter image+JSON model, reports the model/fallbacks used, and clears the full screen-design judge (13/13 match, 0 diff).

docs/getting-started.md

@@ -2,7 +2,7 @@
 
 ## Setup
 
-1. Download the Godot 4.3+ editor (official build) and put `godot` on your PATH. The supported policy is an explicit matrix: CI/release baseline 4.3, local development verified with 4.7.2. Engine upgrades require import, headless, screenshot and Desktop HQ smoke checks before changing the baseline.
+1. Download Godot **4.7.2** (official build) and put `godot` on your PATH. The project, local tooling and CI use the same version; engine upgrades require import, headless, screenshot and Desktop HQ smoke checks before changing the baseline.
 2. Open or run the project from this directory.
 
 ## Run and Test

docs/smoke-checklist.md

@@ -39,4 +39,4 @@
 37. The F debug overlay lists the next eligible events; recovery events and recently played scripted events behave as authored.
 38. Master/SFX/ambience volume settings clamp at 0/1 and persist; Reduce motion disables head bob; the captions toggle persists.
 39. The 24-NPC budget smoke stays inside its frame budget; coats/dresses do not show obvious leg clipping in a normal walk.
-40. Help remains readable with the largest HUD font scale, and the engine matrix (4.3 CI / 4.7.2 local) is used for verification.
+40. Help remains readable with the largest HUD font scale, and CI/local verification use the same Godot 4.7.2 baseline.

project.godot

@@ -12,9 +12,9 @@ config_version=5
 
 config/name="Gig Line"
 config/description="Workplace security simulation about observation, access verification, and proportionate escalation."
-config/version="0.9.0"
+config/version="0.9.1"
 run/main_scene="res://scenes/main.tscn"
-config/features=PackedStringArray("4.3", "GL Compatibility")
+config/features=PackedStringArray("4.7", "GL Compatibility")
 
 [autoload]
 

tools/build_releases.sh

@@ -2,7 +2,7 @@
 # Build distributable desktop executables with the Godot export pipeline.
 #
 # Requirements:
-#   - Godot 4.3 (or the version in project.godot `config/features`) on PATH,
+#   - Godot 4.7.2 (or the version in project.godot `config/features`) on PATH,
 #     with export templates installed (see docs/RELEASING.md).
 #   - Run from the repository root.
 #