review · High priority

VRC.LOL Native Android App

Test the native VRC.LOL phone and tablet companion without wrapping the whole website. The release candidate provides anonymous Minecraft server status and Java/Bedrock public profile lookup, native 128-pixel player-head previews with labelled copy actions for primary and Floodgate identifiers, an explicit no-network Offline mode with timestamped app-private LRU storage for a user-selected 1–500 profiles and their validated image sidecars, native recent-profile reopening and live cached-content size, six bundled League guide summaries, explicit live-guide browser fallbacks, bounded deep links, responsive layouts, complete 156-resource English (United Kingdom), German, Spanish and French catalogues with key/placeholder/error-mapping CI enforcement, confirm-before-clear privacy controls, strict allowlisted HTTPS networking, repository CI and a documented Play release path. Canonical deep-link parsing now rejects user-info, nonstandard ports, fragments, HTTPS queries, duplicate or unknown custom parameters, invalid player identifiers and unknown guide slugs before navigation; the accepted HTTPS paths remain exactly the documented public route set. Device review caught the public /head route substituting the same generic image for Java and Bedrock: Android rejects that response, versions the affected sidecars, and only after the VRC public-profile/privacy gate recovers Java from Mojang's signed profile and content-addressed texture with native legacy-skin rendering. The client also handles the route's newer 404 response through that same verified recovery path, while refusing fallback for rate limits, server failures and ordinary network errors. Bedrock honours VRC.LOL's source boundary: LocalDB profiles use only the exact bounded VRC.LOL /skin PNG, GeyserAPI profiles may use the pinned record when its response signature, texture ID, exact Minecraft texture URL and downloaded content hash agree, and Default remains explicitly unavailable. Stale v1/v2 image sidecars are removed so an unrelated previously cached fallback cannot survive the correction. A responsive Community card uses the owner-controlled /discord redirect, opens only the exact public ticket panel for support and links back to this roadmap; these are external actions and provide no Discord account or bot access. Thirty-seven JVM tests, lint, the minified release bundle and all twenty-eight instrumentation tests pass; a Blackview WAVE 8 on Android 15 also passed installation, cold launch, production status/profile/image requests, native deep links, timestamped cached-profile and saved-image recovery, the corrected Notch Java head, the correct green LocalDB Bedrock head for MrCraigTunstall, and regressions for legacy opaque-black hat layers, Bedrock texture-record validation, stale-sidecar cleanup, responsive Events retry and out-of-order cache protection. Riot credentials, private research, Companion access/download routes, Discord operations, staff panels and operational diagnostics remain excluded. A second tester and physical tablet are welcome; publishing, trademarks, Data safety declarations, signing custody and Play account decisions remain owner-controlled. Native Explore adds cached active and upcoming free-to-keep PC offers from the bounded anonymous /free-games/feed contract, local claim times, validated VRC.LOL event-detail links, public Events discovery, and explicit calendar/RSS fallbacks. Home now presents the existing public Go status contract as accessible native cards with a local checked time, player capacity, server version, response time, MOTD, and copy-address actions. Profile edition cards keep the full username on one line at the Blackview's enlarged text setting, use compact edition/model hierarchy, and group complete monospace identifiers with labelled copy actions. The shared shell now has one restrained 10–32 dp shape scale, 20 dp dark content cards, compact cyan/violet icon tiles, zero-elevation navigation, shorter page introductions and responsive 16 dp phone / 40 dp tablet gutters. External commands translate the public League action language into native controls with dark tinted surfaces, thin accent outlines, strong hierarchy and accessible touch targets. Open Events now follows the website's compact command-action behavior with a full-width squared gold control on phones, responsive compact sizing on tablets, and a trailing action arrow. The Free Games calendar is grouped with the Free Games page and RSS controls instead of being mislabeled as an Events calendar feed; longer action help may use two lines at enlarged text sizes. Every primary and secondary action follows a responsive hierarchy across status, lookup, sharing, guides, policies, cache settings, errors, Events, and Free Games. Twenty-two connected tests cover the refined Events commands alongside the existing adaptive and accessibility contracts; the established full suite passes at 1.5× text on both a 1080×2400 phone viewport and a 1600×2560, 240 dpi tablet viewport, and passed again after the Events action refinement. The tablet run verifies the navigation rail, wider gutters, inline command groups and adaptive Settings clearance, while physical Blackview evidence remains recorded separately. Review-only Play materials now include the repository-derived 512-pixel icon, four current phone captures, four genuine 9:16 tablet captures, a 1,024×500 opaque feature-graphic draft without words or third-party marks, and complete English, German, Spanish and French listing-copy drafts with automated required-file and character-limit checks. None has been uploaded and owner, legal and native-speaker approval remains required. Event sign-in, creation, RSVPs, Discord webhooks, provider checkout, and the non-authoritative /v1/events shadow canary remain outside the app. Live, verified-Java-head, LocalDB Bedrock, generic-image rejection, offline image, saved-feed, status-detail, and enlarged-text states were reviewed on the physical phone. A new owner-independent milestone adds a bounded anonymous Go /events/feed candidate backed by the homepage's reviewed atomic locale repository, not by an Android database connection. Android accepts only English, German, Spanish or French, scans at most 32 candidates, retains at most eight canonical query-free VRC.LOL event details, caps the cached response at 256 KiB, shows the saved time offline, and keeps creation, identity, RSVP, permissions and operations fields out of the contract. The app catalogues now contain 121 matching resources, twenty JVM tests pass, and the expanded API 37 emulator suite passes all twenty-one tests including successful-read-only Events caching and clear-data removal. Public routing of this new feed remains an explicit server configuration and verification gate before any Play upload. Android build inputs are now fail-closed as well: the Gradle 9.4.1 distribution is pinned to its official SHA-256, a checked-in strict verification catalogue covers all resolved plugin, library, lint, test, debug and release artifacts, CI rejects missing integrity files, and a documented review workflow is required for intentional dependency changes. An ordinary post-generation verification run passed the JVM tests, lint, debug APK and minified unsigned release AAB without bypassing the catalogue. Settings now reports the live combined size of cached profiles, player-head sidecars, server status, Community Events and Free Games payloads. The value updates after successful saves, trimming and clearing; the Offline explanation in all four declared languages now names every saved feed it can show. A cache-generation fence rejects late writes from requests that were already running when the user cleared data. Twenty-two repository and Compose instrumentation tests verify positive usage after a save, zero after clear, the in-flight response race, and visible accessible presentation. Dynamic native states now expose polite TalkBack live regions for loading, retryable errors, explicit Offline mode, timestamped saved-data fallbacks, refreshed service summaries, player lookup results, Events and Free Games. Every announcement also remains visible on screen, decorative icons stay silent, and action labels and touch targets remain explicit. The four declared language catalogues each contain 122 matching resources, including localized loading text; connected semantics assertions cover status, lookup and Offline mode. Local-data deletion now has explicit clearing, confirmed-success and honest-failure states in every declared language. The UI leaves its counters untouched when repository deletion fails, reaches zero only after confirmed success, disables duplicate clear requests while work is active, and announces the result politely to TalkBack. The four catalogues now contain 125 matching resources, and the 23-test emulator suite covers cancellation, confirmation, visible success, its live-region semantics and oversized legacy-status rejection. Release verification now inspects the actual minified AAB rather than relying on source searches: six public route and client-identity markers must be present, while fourteen private Companion/operations routes, credential names, database/webhook strings and WebView class markers must be absent. The typed Gradle task is configuration-cache compatible and is the CI release-bundle gate. Live release preflight identified that the public edge still treats /events/feed as a human event-detail slug and returns HTML 404. The repository now reserves the exact GET/HEAD path for the bounded Go JSON handler through a composable Caddy fragment, four-language loopback rehearsal, reversible confirmation-gated manager, main-host health assertions and a Windows public-contract preflight. POST and every other Events route stay on OLS/PHP; no route has been activated without server-owner approval. Native networking now requires application/json on every successful public JSON read and replaces the former shared one-megabyte ceiling with route-specific streaming limits: 128 KiB for profile and status, 256 KiB for Events and 512 KiB for Free Games. Error bodies are independently capped at 8 KiB, so HTML edge mistakes and oversized payloads fail before parsing or local storage. User-visible failures are now locale-safe typed reasons rather than stored English or server-provided text. Invalid input, missing or unavailable profiles, status, Events, Free Games, player imagery, network failure, rate limiting and Offline no-cache states resolve through the current English, German, Spanish or French resources when rendered. All four catalogues contain 143 matching resources; CI requires a unique resource mapping for every error, and the 24-test emulator suite verifies that untrusted server wording becomes the reviewed reason while preserving retry timing. Release handoff now generates a secret-free JSON evidence manifest from the actual minified AAB and R8 mapping after the packaged boundary scan. It records version, exact Git revision and dirty state, signing mode, sizes and independently checkable SHA-256 hashes. Final mode fails unless the tree is clean, owner signing is configured, the reviewed tester result is PASS and the owner has selected the allowlisted Play halt-and-supersede rollback; free-form names, emails and operational notes are rejected. CI produces only clearly labelled unsigned-verification evidence and archives the matching mapping with its short-lived review artifacts. Play App Links handoff is now prepared without inventing a certificate or server path: a local generator canonicalises only a valid 32-byte Play App Signing SHA-256 fingerprint, emits the exact lol.vrc.app delegation into ignored build output, refuses paths outside the Android project and never deploys. An independent verifier checks local or live UTF-8 JSON with a 64 KiB bound and exact package/relation/namespace/fingerprint matching; live mode pins the public VRC.LOL HTTPS path, disables redirects and requires HTTP 200 application/json. The live endpoint still correctly fails closed with 404 until the owner enrols in Play signing and an authorised server operator publishes the reviewed statement. A new JVM drift gate parses the source Android manifest and proves its four auto-verified HTTPS filters use the exact VIEW/BROWSABLE shape, VRC.LOL host, reviewed exact paths and compatibility player prefix declared by the native parser contract. Unexpected data attributes, route additions and parser/manifest mismatches now fail CI; the broader OS-level player prefix remains narrowed in-app to one valid identifier. The suite now contains twenty-three JVM tests, and all twenty-four connected tests pass at both the 1080x2400 phone profile and 1600x2560 / 240 dpi tablet viewport with 1.5x text. Release privacy evidence now audits the final dependency-merged manifest as well as app source. It allows normal INTERNET plus AndroidX Core's app-signature-only compatibility permission, exactly one exported MainActivity with six reviewed launcher/link filters, a non-exported Startup provider and the Profile Installer receiver only behind the platform signature-level DUMP permission. Extra permissions, services, aliases, direct app metadata, package queries, hardware requirements, instrumentation, backup, cleartext, debug/test flags, widened exports and altered link filters fail; six deliberate mutations prove the negative boundary. The referenced privacy resources are now evidence too: two new JVM tests require a cleartext-disabled system-CA-only network policy and full SharedPreferences exclusion from encrypted cloud backup and device transfer, while rejecting six widening mutations. A release task proves the packaged XML is byte-identical to reviewed source; profile and head files remain in Android's no-backup directory. The suite now contains twenty-five JVM tests, and evidence schema 3 records packaged-content, merged-manifest and packaged-privacy-resource checks. A live policy audit found the global VRC.LOL /privacy and /terms routes returning 404; the existing Player and League policies remain service-specific and are not presented as Android-wide coverage. The repository now has an explicitly unapproved Android privacy-policy draft, a field-by-field Play Data safety draft and a machine-readable inventory covering eight app flow families and thirteen owner/legal decisions. Two new JVM contracts bind those drafts to the reviewed permissions, routes, third-party hosts, local cache and release holds, bringing the suite to twenty-seven tests. Nothing has been published or submitted. A fail-closed Android policy preflight now pins the candidate /android/privacy HTTPS page, refuses redirects, non-HTML, non-UTF-8, oversized or still-draft content, and requires the approved contact, effective date, package identity and reviewed Minecraft, connection-metadata, provider, cache, deletion, retention and children topics. CI proves the tool with a valid synthetic page and rejects placeholder, missing-flow, wrong-route and oversized mutations; it does not claim the absent live policy is ready. Release-evidence schema 4 records the pinned Android policy URL and only an allowlisted preflight state. Ordinary unsigned CI evidence remains owner-input-required; final evidence now fails unless the approved live policy preflight is explicitly PASS alongside owner signing, clean source, reviewed tester PASS and the approved Play rollback code. A 1 September production preflight narrowed the remaining Events deployment gap: Caddy and vrc-web are healthy, but the running older /usr/local/bin/vrc-web returns 404 for the direct localhost feed, so edge activation alone cannot work. A hash-checked inactive staging attempt stopped on that origin check and removed every installed candidate automatically; the public route remained disabled. The rehearsal's standalone Caddy validation now explicitly selects the caddyfile adapter. A reviewed Go binary deployment with service rollback is required before the already confirmation-gated public route activation. The pre-deployment full Go gate exposed and fixed a Windows CRLF portability defect in homepage structured-data replacement: every rendered JSON-LD range now preserves the newline convention of the exact source range, and Events boundary detection accepts either consistent LF or CRLF. A table-driven regression proves all ten replacements retain the reviewed CRLF snapshot byte-for-byte, while the complete Go service suite passes. A hash-pinned localhost-only candidate harness is prepared before any Go binary replacement. It runs the candidate as www-data on a fixed private port, requires the reviewed snapshot paths and healthy production origin, validates four bounded locale feeds plus invalid query/method rejection, requires byte-identical homepage output for all four app locales, and always terminates the candidate. It cannot install, restart, reload Caddy or expose a route; uploading internal code and production replacement remain separate owner approvals. External browser handoffs are now fail-closed too: only reviewed exact VRC.LOL pages, canonical one-segment valid player identifiers, canonical event slugs and the exact Discord ticket destination may leave the native app. Explicit ports, user-info, queries, fragments, encoded or nested paths, unknown pages and private admin, staff or operations routes are rejected; there remains no embedded WebView. The complete 24-test instrumentation suite then passed on the physical Blackview WAVE 8 running Android 15 with zero failures and zero skips. This extends real-device evidence to the later Events, cache visibility, clear-race, legacy-cache and typed-error cases without claiming the owner-reviewed Play tester result. Settings now provides a localized App and support card with copyable app version/build and Android release/API details for tester tickets. It explicitly excludes accounts, usernames, device identifiers and cached content. Large-text reachability passed both the isolated test and the complete 25-test Blackview suite with zero failures or skips. Beginner setup now includes a read-only Windows environment doctor for Android Studio, bundled JDK 17+, SDK Platform, Build and Platform Tools 37, the optional API 37 Google APIs emulator, wrapper and dependency integrity, ADB authorisation and an optional JVM test run. It understands the API preview's android-37.0 package name and passed the strict device/emulator/Gradle path on the prepared workstation without installing, changing or uploading anything. The Play release worksheet now names the complete VRC.LOL and conditional Mojang/Geyser network routes, optional head cache, full Offline content set, exact external-navigation allowlist and local non-identifying support clipboard. A new drift contract binds those facts to the repository. An authoritative release-facts contract now also recomputes the current test and localization counts from source and binds their current documentation, bringing the JVM suite to twenty-nine tests. The complete twenty-five-test suite also passed on the physical Blackview in its short 1612-by-720 landscape orientation. That run exposed and fixed a navigation-rail reachability defect: below 480 dp height the decorative header now collapses, all four destinations retain single-line labels, Settings stays reachable and its content scrolls normally. The real-device layout was visually reviewed and the handset's original automatic-rotation settings were restored after testing. Beginner custom-link instructions now use the explicit installed debug activity instead of a package-only ADB form that this Blackview correctly refused to resolve. Status, Notch player, Vision guide and Free Games examples were each exercised successfully on the physical handset, and the release-facts contract keeps the exact four commands present. A guarded one-command Windows helper now builds, installs and cold-launches the debug app for beginners. It refuses missing, unauthorised or ambiguous devices, limits smoke destinations to Status, Notch, Vision or Free Games, requires Android's successful launch result, and performs no release signing, upload, server change or unrelated device operation; the Blackview passed the complete helper path. A four-locale physical pass at the Blackview's 720-pixel portrait width and 1.15 font scale covered Home, Lookup, Explore and Settings. It caught Spanish splitting VRC.LOL, German truncating Explore and orphaning the last Offline-Modus letter, and French hiding the Events destination. Compact reviewed translations now keep each label intact, JVM assertions preserve all four decisions, the corrected screens were recaptured, and the handset was returned to automatic device language. A physical 200-percent text pass then exposed the narrow phone's four bottom labels collapsing into ellipses. At 1.8 times font scale and above the bar now uses four unclipped icons while page headings retain visible destination context; an actual handset accessibility-tree dump confirmed complete Home, Lookup, Explore and Settings spoken labels. Normal and 1.5-times layouts retain visible labels, the phone's original font scale was restored after capture, and the complete twenty-five-test Blackview suite passed again without failures or skips. The same physical 200-percent setting was verified in an authoritative 1612-by-720 landscape window: the compact short-height rail kept all four complete visible labels and accessibility nodes. Window Manager state was checked before accepting the capture, and font scale, automatic rotation and user rotation were restored and re-read afterward. Official Google Play requirements were rechecked on 1 September 2026: this new personal account needs at least 12 continuously opted-in closed testers for 14 days before applying for production access, and the app's API 37 target exceeds the API 36 phone submission minimum effective 31 August. On 4 September the owner reported that Google approved developer identity verification; this removes only the account-identity wait and does not imply app review, production access, policy, signing or publication approval. All refreshable native presentation and offline persistence are now explicitly latest-request-wins: submitting or typing a newer identifier, clearing the form or local data, or changing Offline mode invalidates older profile and head work, while repeated Status, Events and Free Games refreshes accept and persist only their newest result. Profiles are sequenced per normalized identifier so different players remain independently cacheable. Successful offline clearing also invalidates pre-clear saved-feed reads. Thirty JVM tests and all twenty-eight physical Blackview tests pass, including a controlled out-of-order cache regression. Verified Java head recovery now requires Mojang's session endpoint to return bounded JSON and accepts only a textures property carrying a non-empty signature from the unsigned=false response before following the already canonical, content-addressed texture URL. The existing physical texture-boundary regression rejects an unsigned Java property and accepts the signed canonical form without widening fallback beyond a missing or known-generic VRC.LOL head. Native parsing now remains bounded after transport limits: Status scans 32 candidates and retains at most 16 unique non-empty service IDs, Events retains eight unique canonical details, and each Free Games section retains twenty unique offers with ten games each. Code-point-safe visible-field limits, fixed app-owned edition labels, numeric clamps and a three-value Bedrock skin-source allowlist prevent duplicate Compose keys, pathological card counts and oversized public strings without widening any network route. The configurable 1–500 Offline profile cache now also has a visible 128 MiB aggregate safeguard covering its atomic index, bounded profile JSON and validated Java/Bedrock head previews. Newest profiles are retained first when either the selected count or storage ceiling is reached; oversized, duplicate, missing and query/file-mismatched index entries are rejected. All four 155-resource catalogues explain the limit, and the twenty-seventh physical-device regression exercises newest-first storage eviction. Claimed Explore deep links now land on their exact native section after passing the existing strict parser: Events positions the Community Events card, Free Games positions its native feed heading, and the custom Guides command positions the bundled guide catalogue after feed layout settles. Manual rail or bottom-bar navigation clears stale anchors and guide highlights. The twenty-eighth Blackview regression drives all three links through MainActivity and proves their tagged native headings are actually visible without adding a WebView or widening any route. TalkBack now encounters the Offline setting exactly once: the full labelled row owns the Switch role, toggle state and action, while its nested Material switch is a visual-only indicator with cleared semantics. The existing physical Offline regression asserts the authoritative role and Off-to-On state change and proves the child exports neither toggle nor click behavior, removing a duplicate focus stop without changing appearance or permissions. Player-image validation now bounds decoded dimensions before Android bitmap allocation as well as bounding downloaded bytes: public and cached heads must declare exactly 128 by 128 pixels, while raw Minecraft skins must be supported 64-based legacy, standard or power-of-two HD layouts no larger than 1024 by 1024. The renderer safely downsamples HD face and hat regions, cache sidecars move to v4 with v1 through v3 discarded, and the unchanged 28-test physical Blackview suite covers both a legacy 64 by 32 skin and a 128 by 128 custom skin. A fresh read-only contract check reconfirmed that MrCraigTunstall's authoritative LocalDB custom skin remains a supported 64 by 64 PNG. Player-head loading tiles now expose localized polite live-region descriptions and unavailable placeholders expose localized image descriptions in all four catalogues, so TalkBack receives a meaningful state while Java or Bedrock artwork resolves. The visual loading, success and fallback behavior and network boundaries are unchanged. Offline feed durability now matches the app's visible promise: bounded Status, Events and Free Games payload plus timestamp pairs are synchronously committed on the repository IO dispatcher before a successful refresh returns. Read-time validation removes both halves of oversized, empty or malformed legacy pairs, preventing unusable data from lingering in Settings' cached-content total. The existing physical regression covers all three invalid shapes without increasing the 28-test suite, and both its focused run and the complete Blackview suite pass. Accessibility now has an enforceable colour boundary as well as semantic, touch-target and enlarged-text coverage. One app-owned palette replaces scattered literals, and the existing release-facts JVM contract calculates relative luminance for thirteen real text and background pairs spanning base surfaces, brand accents, live status, event rows, League-style commands and compact web actions. Every pair must remain at or above 4.5 to 1. All 31 JVM and 28 Blackview tests pass, and fresh physical Free Games plus Community Events review at 1.15 times text retains complete navigation and readable action hierarchy. Current tablet evidence now exercises the complete 28-test connected suite on Android 17/API 37 at 1600 by 2560, 240 dpi and 1.5 times text with zero failures or skips. Real-APK review confirms the native navigation rail, Events and Free Games actions, current and upcoming offer cards, retry state and guide transition remain reachable without horizontal clipping, after which every temporary display override was reset. The Windows setup doctor now distinguishes a downloaded system image from a usable AVD by requiring a listed configuration wired to the exact API 37 Google APIs package with system image, ramdisk and kernel present; an isolated empty AVD home correctly fails this gate. After USB debugging was reauthorised on 4 September, the committed APK installed and cold-launched on the Blackview, and the complete 28-test physical suite passed again in 51 seconds with no failures or skips. The normal debug app was restored and reopened afterward. A simultaneous public status-contract read returned HTTP 200 JSON with all four services marked offline, exactly matching the native zero-of-four presentation rather than indicating a client failure. The public-service privacy audit also tightened the Go lookup limiter: raw client addresses are process-memory-only rate-limit keys, and a dedicated 60-second janitor now removes buckets older than two minutes instead of relying on an incidental stats or capacity path. Private diagnostics remain masked. The reviewed main-host Caddy candidate strips identifying request fields before bounded 14-day logging, but actual production proxy/log deployment and retention still require owner/operator confirmation before Data Safety or privacy-policy approval. Android lint cleanup removed the actionable modifier, plurals-candidate, unused-resource and durable-cache warnings while leaving optional KTX modernization and dependency-version notices visible. The exact rebuilt APK passed all 28 Blackview tests again, and a fresh Free Games review confirmed stable icon sizing, readable offer wrapping, a reachable action and complete bottom navigation. The owner selected English (United Kingdom) as the default Google Play listing language, so prepared metadata and artwork now live under en-GB while German, Spanish and French remain optional localisations. A thirty-first JVM test parses the actual PNG headers and enforces the reviewed 512-pixel RGBA icon, opaque 1,024-by-500 feature graphic, four 1,080-by-2,400 phone screenshots, four 1,440-by-2,560 tablet screenshots, 8-bit colour modes and icon size ceiling. Three fully opaque screenshots that still carried unused alpha channels were losslessly rewritten as documented 24-bit RGB files and verified pixel-identical. No listing content or artwork has been uploaded. Android's per-app language declaration now uses the exact en-GB tag as well, so supported devices present English (United Kingdom) rather than leaving the release language generic. The release-facts JVM contract parses the locale XML and requires it to match the four machine-readable supported locale tags exactly. The rebuilt app's real Android 15 language screen visibly offered English (United Kingdom), German, Spanish and French. After explicit owner approval, Google Play created the VRC.LOL app entry for package lol.vrc.app as an App, Free, with English (United Kingdom) as the default language and assigned Console app ID 4972898791504105398. Automatic protection remains active for Play artifacts; Play Integrity API integration and store-listing device checks remain off. No bundle, listing copy, artwork, tester list, test release or production submission has been uploaded or published, and the final Play signing fingerprint remains an owner-controlled release gate. With explicit owner approval, five Play App content declarations are now saved: no restricted access, no ads, not a government app, no financial features and no health features. Play reports five actioned declarations and five still needing attention. The changes remain in Publishing overview and have not been sent for review; the unresolved privacy, Data safety, content-rating, audience and advertising-ID work remains owner-controlled. Play now also records no Advertising ID and a 13-and-over target audience spanning 13–15, 16–17 and 18 and over. The merged release manifest and dependency audit support the Advertising ID answer, and under-13 groups remain excluded. Play reports seven actioned declarations and three needing attention; content rating, Data safety and a live Android privacy-policy URL remain unfinished and nothing has been sent for review. The owner then specifically approved the IARC contact transmission and the completed All Other App Types questionnaire. IARC generated PEGI 3, ESRB Everyone 10+, USK 12+, Brazil All ages and 3+ regional ratings after the app disclosed online content and possible non-primary textual violence references. Play now reports eight actioned declarations and two needing attention. A conservative Data safety working draft is saved without submission; its per-category retention and sharing answers and the missing live Android privacy policy remain release gates. The app itself has not been sent for review. Another live 720-by-1612 Blackview review tightened the Home and Explore introductions plus the Events, Free Games and League section summaries across all four app languages. A JVM localisation boundary keeps those five high-visibility strings at 85 code points or fewer per locale; existing account, browser, store and Offline notices remain explicit. Fresh captures show useful content earlier without clipping, and the rebuilt app passed all 28 physical tests. Older Play screenshots remain review-only composition drafts and must be recaptured after the public Events feed is live and verified. The same narrow-phone capture exposed the Community Events error message squeezed beside its retry action. Below 360 dp of available card width it now stacks a full-width 48 dp retry button beneath the readable message; tablets retain the compact inline action. The shared breakpoint has a JVM regression and does not alter the feed, route, or privacy boundary. A clean 1600-by-2560 API 37 AVD capture at 240 dpi and 1.5-times text verified the actual wide branch, surrounding actions and guides without clipping; first-boot captures containing Android System UI or Pixel Launcher dialogs were discarded, the viewport was reset, and the emulator was stopped. With explicit owner approval, the Android-wide privacy policy is now a native Go page at /android/privacy with VRC.LOL as controller, the approved public contact, ages 13 and over, an email request process, the exact app and provider flows, and a maximum 14-day retained-security-log promise. Production Caddy verification confirms sensitive request fields are removed and query values redacted; the live HTTPS page passes the fail-closed policy preflight. Android Settings links to that exact page through the reviewed external-browser allowlist in all four complete 155-resource catalogues. Play Data safety remains an unsubmitted working draft and no app release has been uploaded or published. The exact public /events/feed GET/HEAD route is now active through its reversible Caddy manager. Four-language rehearsal, live server checks and the independent external Android contract verifier pass HTTP 200 JSON, public caching, bounded payload/event counts, reviewed fields and canonical base or locale-prefixed detail URLs. The Android client now accepts only those supported locale-prefixed event links in addition to the base Events path; queries, fragments, credentials, nonstandard ports, nested paths and unsupported locales remain rejected. POST and every other Events route retain their existing native handlers. Android App Links have now completed their device-level gate as well. The strict live Digital Asset Links verifier passes against the actual Play App Signing certificate, Android was explicitly asked to refresh the package association after publication, and the Play-installed Blackview now reports vrc.lol as verified for lol.vrc.app. This records association of the HTTPS domain to the signed app without widening its native deep-link parser or URL allowlist. A fresh live-feed review on the narrow 720-by-1612 Blackview then replaced the Events row's compressed, ellipsised metadata sentence with separate local-date, category and location lines. The beginner device helper can now cold-launch the exact native Events destination, before/after captures are retained, and the post-change JVM, lint, debug-build and complete twenty-eight-test physical suite all pass. The Play-sized 1080-by-2400 phone and 1440-by-2560 ten-inch Explore drafts were then recaptured from the real current APK with the live Events feed: both show all four upcoming events, and the tablet also shows active/upcoming Free Games plus the responsive navigation rail. The captures are opaque RGB PNGs with recorded API, viewport and content provenance, and the automated Play metadata contract passes. They remain owner-review drafts and have not been uploaded. To keep the beginner workflow safe on ordinary PCs, the setup doctor now reports active emulator concurrency and explicitly warns when more than one virtual device is running. The guide recommends one emulator at a time for high-resolution tablet work while allowing the physical phone to remain connected. The read-only doctor passes with no emulator running and the authorised Blackview attached. The next source candidate is now 0.1.1 version code 2, with matching UK English, German, Spanish and French internal-test notes covering the restored Events feed, readable event metadata, safe localized detail links and verified App Links. The metadata contract derives the required changelog from the Gradle version instead of hard-coding the first release. A bounded no-emulator build passed unit tests, lint, debug assembly, minified AAB public/private marker checks, merged-manifest checks and packaged privacy-resource verification. It remains an unsigned verification artifact and has not been uploaded. After a fresh action-time confirmation, the completed conservative Play Data safety declaration was saved with Name, User IDs, App interactions and In-app search history disclosed as optional collected/shared data, encrypted transport, no app account, and the approved deletion-request URL. Play App content now reports that every declaration is actioned. Publishing overview still labels all changes as not submitted for review; no review request, bundle upload, test release or publication occurred. With owner authorisation, a dedicated 4,096-bit RSA upload key was created outside Git with a Windows-DPAPI-protected credential record and a second local encrypted-keystore copy. The signed 0.1.0 version-code-1 candidate at revision 69bccb4 passed unit tests, lint, signing validation, release-boundary checks and independent evidence verification; its AAB SHA-256 is 26260f86b4d4398a605439f0f118fe208d896fcf83b0a1360fdf9c1a45c36be0. Play accepted it into an Internal testing draft as API 24+, target SDK 37 with its ReTrace mapping attached. The draft has not advanced to preview or rollout, its tester result remains BLOCKED, and a closed-test clock cannot start until at least twelve consenting Google-account testers are supplied and opt in continuously for fourteen days. The owner-approved internal rollout is now active for version 0.1.0 code 1 on the private one-account VRC.LOL Android Internal Testers list. Play labels it Not reviewed under the temporary name lol.vrc.app (unreviewed); it is not public and no closed, open or production release exists. More consenting internal testers can be added without rebuilding, but Internal testing does not satisfy or start the separate twelve-person, fourteen-day Closed-test production-access requirement. A second explicitly supplied tester was added without exposing either address in Git or public roadmap content. The owner joined and installed the genuine Play-delivered build on the Android 15 Blackview; ADB verifies package lol.vrc.app version 0.1.0 code 1, installer com.android.vending, APK signing v3 and the distinct Play signing certificate. The canonical Digital Asset Links statement generated from that real certificate passes the strict local verifier; public assetlinks deployment remains pending. The exact Digital Asset Links statement is now served by the native Go origin at /.well-known/assetlinks.json from production binary SHA-256 66b36dd005ae6c27db368f3305237b6bcb5b07e03519ccef684d05bca31f0286 with a named rollback copy. Strict live verification passes HTTP, content-type, no-redirect, JSON, size, package, relation and Play-fingerprint checks. The Blackview's Google verifier still reports cached/custom code 1024 immediately after publication, so device-level verified status remains an explicit propagation recheck rather than a completed claim. Android's subsequent association refresh completed that device gate: the Play-installed Blackview now reports vrc.lol as verified. The 0.1.1 source candidate also replaces misleading midnight times for exact same-day all-day Events with localized labels in all four complete 155-resource catalogues. Timed, cross-day and offset-mismatched values retain their normal local timestamp. Thirty-six JVM tests now cover this strict distinction; no emulator, signing, upload or publication was used for the correction. The native Explore experience now includes an offline-capable Void Resonance Podcasts and replays card backed only by exact public GET /live/rss.xml. A hardened 256 KiB RSS parser keeps at most twelve titles, summaries, publication values and canonical VRC.LOL episode links; it discards GUIDs, database IDs, enclosure/media/artwork URLs, clips, account/chat/viewer state, recording paths and creator controls. Playback and the full archive remain explicit external handoffs, all four 155-resource catalogues are aligned, and thirty-six JVM tests cover the new parser boundary. The revised privacy-policy text and podcast milestone are live on the public Go service and roadmap. A focused Android 15 Blackview capture caught the new gold archive command clipping at enlarged text; the localized visible labels were shortened without weakening their full accessibility hints, and a second capture shows the complete card. The existing VoidMod DiscordGo bot then published a mention-free four-embed update with four screenshots in the public announcements channel, transparently distinguishing active Internal testing from the separate twelve-tester, fourteen-day Closed-test production gate and directing volunteers to the private ticket flow. The complete physical-device gate was then rerun on the Android 15 Blackview and passed all twenty-eight tests with zero failures and zero skips. The existing Explore external-action regression now scrolls to the native Podcasts card and verifies its visible, clickable archive control plus the complete accessibility label, while the established profile, head-image, Events, Free Games, Offline, cache, responsive-layout and deep-link coverage remains green. Explore now provides one visible, accessible Refresh all action for its three existing bounded public feeds, translated across all four complete 156-resource catalogues. All thirty-six JVM tests, lint and all twenty-eight physical Blackview tests pass. The same real-phone review detected that an unrelated full-site deployment had replaced the public Events handler with HTML 404; the exact GET/HEAD edge now uses a dedicated systemd-managed, loopback-only Go origin with no database or Discord secrets. Four-language rehearsal, public-contract verification and a fresh Blackview hierarchy confirm the schedule is healthy again, while writes and all other Events routes remain outside the Android service. The updated 0.1.1 version-code-2 candidate was then built with the owner-controlled upload key from clean revision 7e421cb and archived outside Git with its schema-4 evidence and R8 mapping. Its upload certificate exactly matches the already accepted 0.1.0 candidate; the AAB hash is 51bd3ba651229c20b8f80c45fd59f64b3ccdb90e65909715d8d5f960f5cce3fe. Evidence remains deliberately non-final with tester, policy-preflight and rollback approvals unrecorded, and no upload or rollout occurred. The app's user-facing data controls now accurately name the bounded Podcasts snapshot everywhere it matters: the Explore introduction, Offline-mode explanation, local-data summary and clear-data confirmation in all four app languages, plus all four review-only Play descriptions. New JVM contracts prevent that disclosure from disappearing, and the updated app passed unit tests, lint, the minified release boundary and all twenty-eight tests on the Android 15 Blackview without an emulator. The currently Play-installed 0.1.0 remains untouched; these changes have not been uploaded or published. The same clean f3a0281 revision is now the current owner-signed 0.1.1 version-code-2 candidate. Its independently verified AAB SHA-256 is eb0dfc33a85576f8d5ff0576559804571a42d5545bbc96f88b47bae6a25268fb, its upload certificate matches the accepted 0.1.0 key, and its schema-4 evidence remains deliberately non-final pending the closed-test result, action-time policy preflight and rollback approval. It supersedes the earlier local 7e421cb archive; no 0.1.1 bundle has been uploaded or rolled out. Tester recruitment remains in the public announcements channel, while the similarly numbered server-updates channel stays reserved for server work. The existing private support panel was re-audited with all three controls and support-role access healthy. Its two-minute DiscordGo monitor now also performs a redacted authenticated Discord identity check, closing the live-process-but-invalid-token blind spot without adding another bot, exposing credentials, or moving ticket operations into Android. A fresh real-Blackview Play screenshot review replaced the stale phone set with the current 0.1.1 interface, including Podcasts, Refresh all, localized all-day Events and complete Offline storage wording. Copyable identifiers now reserve their full row beneath the label and copy action; canonical UUIDs use balanced standard groups only on narrow panels instead of leaving a lone character on another line. Thirty-seven JVM tests cover the new formatting rule, and the four 1080-by-2400 review drafts remain unuploaded pending owner approval. Clean revision 06607b9 is now the current owner-signed 0.1.1 version-code-2 candidate. Its independently verified AAB SHA-256 is 6c1bec28a655d848336cbfe981537b850f83499190191035d6099f28585c38e4, its upload certificate still matches the accepted 0.1.0 key, and its schema-4 evidence remains deliberately non-final pending the closed-test result, action-time policy preflight and rollback approval. It supersedes the local f3a0281 archive; no 0.1.1 bundle or refreshed screenshot has been uploaded or rolled out. The four 1440-by-2560 tablet listing drafts were refreshed from the coexisting current 0.1.1-debug package on the Android 15 Blackview at a temporary 240 dpi, normal-text viewport. They now show the current identifier layout, Refresh all, localized all-day Events and Podcasts disclosure. The Play package stayed installed separately, the phone display was restored immediately, and the recorded provenance explicitly treats these as responsive-layout drafts rather than physical-tablet evidence. Original-resolution review then caught the expanded navigation-rail branch drawing destination headings beneath status icons because it bypassed the phone Scaffold's window insets. Destination content now observes Android safe drawing insets inside the edge-to-edge navy surface, protecting status bars, navigation bars and display cutouts without double-insetting the rail. A source regression, all thirty-seven JVM tests, lint, assembly and all twenty-eight physical Blackview tests at the 960 dp-wide, 1.5-times-text viewport pass. Clean-state real-Blackview recaptures replaced all four phone and four tablet drafts so every page starts intentionally rather than at a remembered scroll position. The Play package remained separate and all display overrides were restored. Clean revision acc1696 is now the current owner-signed 0.1.1 version-code-2 candidate. Its independently verified AAB SHA-256 is 7c407c8c3fffe0f03fd7dc51fe42127cceec97754a9cd23f2146a73f6a1c50b5, its upload certificate still matches the accepted 0.1.0 key, and its schema-4 evidence remains deliberately non-final pending the closed-test result, action-time policy preflight and rollback approval. It supersedes the local 06607b9 archive; no 0.1.1 bundle or refreshed screenshot has been uploaded or rolled out. An action-time policy preflight then caught an unrelated full-site deployment returning HTML 404 for the approved Android privacy URL. The approved bytes remained healthy on the secret-free Android public-read sidecar, so a separately rehearsed and automatically reversible exact-path Caddy fragment now makes /android/privacy independent of full-site renderer deployments. External policy verification passes again; query strings fail closed, writes return method-not-allowed, neighbouring routes stay outside the boundary, and the four-language Events contract remains healthy. A credential-free five-minute systemd monitor now runs both Android public-edge managers in read-only verify mode. It checks the approved privacy bytes and fail-closed method/path behavior together with all four bounded Events locales, records failures in the service state and journal, and cannot activate, roll back, restart, post to Discord or access a database. Home service cards are now denser without becoming less accessible: ordinary phone layouts keep the service identity and status in one row, 200-percent text and genuinely narrow content stack safely, repeated offline MOTD text is removed, and every copy-address action retains its 48 dp touch target. Thirty-eight JVM tests cover the responsive breakpoint while the network, Offline, privacy and copy boundaries remain unchanged.