• Fix Android crash on launch by having Client.Android drive its own MGCB pipeline (MonoGameContentReference) instead of leaning on a stale Client.Desktop bin folder; the old setup silently shipped APKs with zero XNBs whenever CI built Android on a clean checkout, blowing up on the first Content.Load. Also add a smoke test in build-android that fails the release if any of the four required XNBs (DefaultFont, MenuFont, Banner, Splash) are missing from the signed APK, so this regression class can’t sneak through again.
• GHA release: install ttf-mscorefonts-installer on the ubuntu-latest Android runner so MGCB’s FontDescriptionProcessor can find Arial; the first 1.4.2 dispatch failed at the font-build step because the runner ships fontless by default.

• GHA release: add gated Azure Trusted Signing for Client.Desktop.exe and the Windows Velopack Setup.exe; inert until the Resinhead identity validation lands (see docs/azure.md for the full setup walkthrough)
• GHA release: add signtool verify /pa steps after each Windows sign so timestamp flakes and cert chain issues blow up in the build job instead of the user’s SmartScreen dialog
• Bailed on Azure Trusted signing, it won’t work for Australians.
• GHA release: extend Velopack packaging to macOS; both osx-x64 and osx-arm64 pack on macos-latest (Apple Silicon handles Intel packaging fine and dodges the shrinking macos-13 runner pool), installers sync to S3 so Mac clients get auto-updates end-to-end, and the artifacts land on the GitHub Release alongside the existing tar.gz downloads. Apple signing/notarisation stays deferred, so first launch still needs right-click -> Open.
• GHA release: push the macOS Velopack Blight-osx-Portable.zip to itch.io’s osx-intel and osx-apple-silicon channels in place of the plain tar.gz; brings Mac itch users in line with Windows and Linux itch users on Velopack installs + in-game auto-updates. 1.4.1 shipped the mac Velopack stack to S3 and the GitHub Release but missed this one channel pair.

We tracked the gremlin down, drove it out, and the phone version walks again. If you’ve tried Blight on Android before and bounced off the doorstep, now’s the time to come back in.

Desktop is unchanged. Windows, Linux, and itch.io builds all still play nice. Mac should be fine too but we’ve not found a Mac to prove it.

A few quiet improvements have happened under the floorboards as well; nothing you’d notice unless you’re running your own server.

Come adventuring. The chickens are still furious.

• Facilitator: add --version, -v, --help, -h flags; reject unknown arguments with a clean error + exit 1; wrap server.Start so port-in-use prints a friendly message instead of a core dump
• GHA release: opt Node-based actions into Node 24 ahead of the June 2026 default switch, silencing the Node 20 deprecation warning on aws-actions/configure-aws-credentials@v5
• Retire ship.ps1; releases now dispatch via gh workflow run release.yml (README, CLAUDE.md, and docs updated to match)
• Fix Android crash on launch with AOT enabled; disable AndroidEnableMarshalMethods so the rewriter doesn’t mutate assemblies after AOT has seen them (dotnet/android#7389 class-init.c:2474 instance_size assertion)

Behind the scenes this is also the first release built and shipped entirely from GitHub Actions instead of my laptop. No user-visible difference, but it means patches can go out faster and from anywhere.

• Move Android keystore passwords out of Client.Android.csproj; build.ps1 now reads ANDROID_KEYSTORE_PASS from the environment
• Start of GitHub Actions release workflow; release.yml now publishes Client.Desktop for all four RIDs (win-x64, linux-x64, osx-x64, osx-arm64) plus the Facilitator (linux-x64) on workflow_dispatch
• GHA release: add package-archives job that produces per-RID blight-<rid>.tar.gz / .zip from the shared publish artifact; archives are Client.Desktop only (Facilitator is a server binary, deployed separately to Lightsail)
• GHA release: add package-velopack matrix job (win-x64 on windows-latest, linux-x64 on ubuntu-latest) that runs vpk pack against the shared publish artifact and uploads blight-velopack-<rid> artifacts
• GHA release: add build-android job (ubuntu-latest) that decodes ANDROID_KEYSTORE_B64, installs the Android workload, and publishes both signed AAB and APK as blight-android artifact
• Fix Android build on a clean checkout: lift GenerateScriptManifests to InitialTargets on the Client.Android project so the Lua manifest files exist before AndroidAsset resolution (previously BeforeTargets="Build" ran too late and only succeeded locally because stale manifest files were left over from a prior build)
• GHA release: add Phase 3 distribution jobs; distribute-s3 (OIDC role, no long-lived AWS keys), distribute-itch (butler push to all five itch.io channels), distribute-googleplay (curl-based Edits API upload + commit + verify, mirrors ship.ps1)
• GHA release: add deploy-facilitator job (SSH to Lightsail with LIGHTSAIL_SSH_KEY secret, scp + systemd restart) and release job (auto-tag v$VERSION, create GitHub Release, attach archives + Velopack installers + AAB/APK)
• GHA release: add dry_run workflow input (default true) gating all distribute/deploy/release jobs so initial dispatches validate build + package without touching live channels
• Reorder Create Game mode toggle so Quest comes before Horde, and default new games to Quest mode

• Fix pixel_quest.lua failing to load; rep() now accepts strings as well as tables, so drum grid patterns can be repeated

Mac and Linux now get a tarball, so we can set the binary as executable.

• Fix A* pathfinding issues, go around things not through them.
• Mac and Linux archives switched to tar.gz so the executable bit on the binary survives unpacking

• Try to fix ship.ps1 because claude keeps breaking it
• Use .Net 9 for Linux
• Missing quest files for desktop build

• Migrated all projects to .NET 9 (Shared, Simulation, BotClient, Facilitator, Desktop, Android)
• Enabled 16KB page alignment for all native libraries in the Android build
• Added Google Play upload verification step to ship script

• Re-up for mobile