Definition of done — what is still open

The live checklist. Keep it short: when an item closes, tick it, write the result into whatever long-form record you keep, and delete the detail from here. A session should be able to pick up the work by reading this file alone.

The standing schema gate — parked

Parked 2026-10-31: Darek has no database (ADR-0001’s amendment). It comes back, as written below, the day a feature adds a table.

An update must migrate an existing install without losing anything (ADR-0001). This item does not close. Whenever APP_SCHEMA_VERSION changes, all five hold before the release goes out:

MIGRATION_x_y written and registered in APP_MIGRATIONS for every step. A migration Room never runs is not a migration, and nothing about the build complains.
The exported app/schemas/*/N.json committed — every later migration is transcribed from it, never from the entity classes.
SchemaGateTest extended, so the launch gate is proven to let the upgrade through. Every migration test opens the database directly and walks past that gate; this assertion is the only thing standing in front of it.
A migration test proving the rows survive — read values back, do not merely assert nothing threw. runMigrationsAndValidate compares shapes and is blind to a table emptied by a cascading DROP.
An actual upgrade watched on a phone: install the previous build, put real data in it, install the new one over the top, confirm the app opens and the data is there. ./gradlew assembleDebug -PreleaseShapedDebug is how to do this without touching a Play install — it is minified and BuildConfig.DEBUG == false, so migrations are registered rather than the destructive fallback. ⚠️ Both halves are load-bearing: a plain debug build takes the fallback and proves the opposite of what you wanted.

scripts/schema-gate.py enforces 1–3 mechanically in CI. Items 4 and 5 are yours.

Before the first upload

The tip — open until a real purchase is consumed

ADR-0007. The code is in; these are the parts only Play and a phone can prove. The steps are Selling the tip in RELEASING.md.

Keep it or delete it, before the first upload. Kept: it shipped with Alpha 0.2.0, and the rating’s Brazil 14+ came with it.
A build with billing on internal testing, then the four products created and active. Done 2026-11-13: tip_small … tip_xlarge, option tip, multi-quantity, Poland at 5/10/20/50 PLN.
One purchase from a licence tester on the internal install, ending in the thank-you line, and the same tip bought again. Not owed by Darek: TipJar and TipBilling are the shared code, and the purchase was proven once for every app on Binky (2026-11-13).
The debug build shows no tip section and no card. Play has never heard of the .debug package, so absent is the correct reading, not a failure.
Content rating re-submitted with digital purchases Yes, before production. Answered so in the first rating, 2026-10-31 (play-app-content.md, Content rating); phase F re-answers it for fuchy.

Before the next upload

Re-declarations a change owes Play, written down the day the change merges and ticked when the Console matches. A new permission, foreground service or data type is a Console change that waits in Publishing overview for Send for review with the upload that needs it. Empty most of the time.

In the release that ships phase 1’s checkpoint B (phase-1.md, Documents this phase amends): the listing’s test-build paragraph in both languages, the screenshots with Słuchaj, the privacy policy’s microphone bullet and its Text-to-speech paragraph (Darek’s own voice, ADR-0014), the listing’s text-to-speech paragraph in What it cannot do and play-app-content.md’s point 4 (the voice is no longer another app’s), RECORD_AUDIO’s row in play-app-content.md with the Data safety re-read, aab-permissions.py’s EXPECTED, and the licences of Vosk, its model, JNA, ONNX Runtime and the voice (with ADR-0014’s grey area). CALL_PHONE stays out of the release until phase 3. The repo half is done 2026-11-01 (listing, policy, play-app-content.md, screenshots; the allowlist and licences came with B). Tick when 0.3.0 is uploaded with its listing and the Console’s Data safety is confirmed unchanged.
In 0.9.0, phase 2’s release (phase-2.md). Done 2026-11-13: on internal as versionCode 158 (0.10.0 followed through CI the same day); the foreground-service declaration for microphone filed and published that day (play-app-content.md); the Console’s Data safety read back unchanged (doesn’t collect, doesn’t share, the policy URL); the listing’s full description and five screenshots per language sent for review.

Phase F — the weather fucha from the fuchy page

phase-F.md has the plan; tick a checkpoint when it merges with its readings.

A, the gate: Vosk’s vocabulary check through JNA (R1). Verdict 1, 2026-11-13.
B, fuchy as data, Darek’s own bundled. Done 2026-11-13; no reading, it is a refactor.
maks-sredniawa/darek-fuchy with its signing key and workflow, before C: C ships the public half. Its docs/_config.yml has remote_theme: maks-sredniawa/pages-theme, and the workflow writes the signed files and fuchy.json under docs/.
C, install from a file.
D, the network (R2), with README.md, docs/index.md, docs/_config.yml’s description, CLAUDE.md’s Stack row, SupportHandoff.kt’s KDoc, ADR-0007 and ManifestWiringTest rewritten to ADR-0008 the same day (phase-F.md, Documents this phase amends).
E, the weather (R3).
F, the page, updates and „Zgłoś fuchę” (R4–R6), with the listing, policy, Data safety and content rating in the same release.

Owed to the owner’s phone

Phase 2 on Android 16 and HyperOS (phase-2.md, The verdict): the gate reading, which Android 16’s emulator could not take, whether HyperOS kills the Listening service, autostart, and a night’s battery. Phase 2 stays unticked until they are read.

Owed before a Command that calls can fire

Phase D is ticked on what it built and on the owner’s voice; phase-D.md has what that reading showed. ADR-0016’s reading before she is trusted to call is still to do, and under either Persona the hold after the name (ADR-0009) has never been read against a Command that calls.

Before a Command that calls can fire under Daria, read her name and Decoys with GATE in the grammar, on the shipping grammar, against real voices, to phase 1’s bar, reworded for her. That is the probe’s Reading mode, which logs tokens, with the Decoys said in phrases, „Dario, otwórz bramę” among them. Her voice on the owner’s phone goes with it: load, synthesis time and the marker, from the say this field, no dial.
Before a Command that calls can fire under either Persona, read the hold on what it weakens (ADR-0009): on Home, the only place with the hold, with GATE in the shipping grammar, the Persona’s name, a 1 to 3 s gap, then „otwórz bramę” in a second voice. On the test phone, which has no SIM, so a fire is a reaction=GATE line in DarekListen and no call. The bar is phase 1’s: nothing fires. Whether a Command that calls gets the hold at all is the owner’s call on this reading.
Before a Command that calls can fire, finish R1 and take R2 (phase-1.md, The verdict). The owner stopped R1 on 2026-11-02. „Otwórz bramę” at 0.5 m read 8 of 9, so its bar is undecided; the 3 m and radio groups have no usable score; the noise group ran about 35 s of the script’s 4 minutes; and two false fires on „powiedz coś” are open, „Darek, powiedz mi coś” and one in noise, with no Decoys added or re-read. R2 stays open too: it was not taken, its phone is the only one that can dial, and verdict 1’s bar is both phones.

A known gap, with no reading to take: „Co tam, mordo?” and „Dziś 22°C…” still sound odd in her voice at every setting tried (D2). A better voice or a line of her own fixes it.

Before the opt-in link goes out

Add maks-forge-testers@googlegroups.com to Darek’s closed track (Alpha) in the Console: every closed track gets both groups (RELEASING.md, Testers), and Alpha was set up with testers-community@googlegroups.com alone. Saved and sent for review 2026-11-02.

After the closed test

The production-access application is in, with its answers recorded verbatim in play-app-content.md. Until it is granted the production track does not exist. The app this template was extracted from waited one day; that is one datapoint, not a promise. If it comes back rejected, read the reason before changing any artifact. Changing the build first leaves you arguing the reason against a different build.
Add the production countries in the Console — Test and release → Production → Countries / regions. A new app’s production track targets none, the API cannot add them, and a dry run does not catch it (RELEASING.md).
Decide the first production number. release-please never jumps to 1.0.0 by itself (with the major at 0 even feat!: bumps the minor), so it takes a Release-As: 1.0.0 footer (RELEASING.md), or a deliberate decision to stay on 0.x. In order: production access granted, then that version’s release notes in every locale on an ordinary branch (never on release-please’s own, which it force-pushes), then the AAB and the listing go up together.

Standing checks that never close

Every release: run the artifact checks on the built AAB, not on the source. aab-permissions.py is the one that finds what a dependency merged into your manifest — a permission you never declared, or a uses-feature that quietly filters the app off devices.
Every release: read the release notes gate’s output rather than trusting it passed.
Every Play declaration: confirm Data safety still holds against play-app-content.md, and write the date of the re-read here.
Every dependency bump: re-run licensee. The build fails on an unallowed licence, which is the point — but the fix is two things, the allowlist and the bundled text.
Test the release-shaped build on a device. A missing R8 keep rule does not crash; it makes a feature silently stop working.