TASK-076: version 0.2.5, published as the release build

The release build type is signed with the key the published builds have had,
so it installs over them.

Agent: main (opus)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/build.gradle.kts

@@ -16,14 +16,17 @@ android {
         targetSdk = 36
         // Raised for every build published to the download page (TASK-066), or the app will not
         // see it as newer.
-        versionCode = 6
-        versionName = "0.2.4"
+        versionCode = 7
+        versionName = "0.2.5"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
 
     buildTypes {
         release {
+            // The published build (TASK-076). It carries this PC's debug key, as every build
+            // published before it did, so it installs over them as an update.
+            signingConfig = signingConfigs.getByName("debug")
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),

docs/development-log.md

@@ -1750,3 +1750,21 @@ This is the append-only implementation and handoff record shared by Codex and Cl
   to build. It is now released 40 ms before the push ends, where the screen has under 2% of
   its way left, so the list is there as the screen stops.
 
+## 2026-10-12 (continued) — TASK-076: 0.2.5 published, as the release build
+
+- Request: the product owner asked for the work so far to be published as a new version, and
+  for the release build to be the one published.
+- What changed: version 0.2.5 (versionCode 7) with TASK-069's motion and TASK-075's fixes. The
+  release build type is signed with this PC's debug key, the key every published build has
+  had, so `assembleRelease` gives an APK that installs over them. Source pushed to `main`;
+  `UBGitea.apk` and `version.json` on the `apk` branch replaced.
+- Why the release build: measured on the product owner's device, the same code's first frame
+  of a move was 52–72 ms as the debug build and 21–29 ms as the release build.
+- Checks and results: the five required checks and `assembleRelease` pass; lint 0 errors. The
+  release APK's signing certificate is the debug APK's. Installed over 0.2.4 on the product
+  owner's device as an update, it starts signed in and opens a repository. The APK downloaded
+  from the `apk` branch has the same SHA-256 as the one built here.
+- Caution: R8 is still off (TASK-016) and no baseline profile is included; both were explained
+  to the product owner, who put them off. The in-app update from 0.2.4 is used for the first
+  time by this version and was not watched on a device.
+

tasks/070-update-from-gitea.md

@@ -48,7 +48,8 @@ repository being public was the product owner's choice in TASK-067.
 
 ## Publishing a build from now on
 
-1. Raise `versionCode` and `versionName` in `app/build.gradle.kts`, then `assembleDebug`.
+1. Raise `versionCode` and `versionName` in `app/build.gradle.kts`, then `assembleRelease`
+   (the release build since 0.2.5, TASK-076; `assembleDebug` before that).
 2. On the `apk` branch, replace `UBGitea.apk` and set `version.json` to the same version.
 3. Push the `apk` branch.
 

tasks/076-publish-0.2.5.md

@@ -0,0 +1,47 @@
+# TASK-076: Publish 0.2.5 to the team's Gitea, as the release build
+
+Status: done
+Owner: Claude
+Reviewer: human product owner
+
+## Request
+
+The product owner asked for the work so far (TASK-069's motion, TASK-075's small fixes) to be
+published as a new version, and for the release build to be the one published (2026-10-12).
+
+## Writable paths
+
+- `app/build.gradle.kts`
+- `tasks/076-publish-0.2.5.md`
+- `tasks/070-update-from-gitea.md`
+- `docs/development-log.md`
+
+## Acceptance criteria
+
+- [x] Version 0.2.5, versionCode 7.
+- [x] `assembleRelease` gives an installable APK signed with the key the published builds have
+  had, so it installs over them.
+- [x] The source is on `main` of the team's repository.
+- [x] `UBGitea.apk` and `version.json` on the `apk` branch are 0.2.5, and the downloaded APK is
+  byte-identical to the one built here.
+
+## Security and privacy
+
+The APK is now the release build: not debuggable, and the debug-only request logging is off. It
+is still signed with this PC's debug key and still not shrunk (R8 stays on hold under TASK-016).
+No secret is in it or in the push.
+
+## Required checks
+
+```text
+./gradlew compileDebugKotlin compileDebugUnitTestKotlin testDebugUnitTest assembleDebug lintDebug
+./gradlew assembleRelease
+```
+
+## Evidence
+
+See the development log entry for TASK-076.
+
+## Review findings
+
+None.