fix(ci): free disk space + drop x86_64 from release build to fix OOM

Run 181 (v0.25.0 tag) failed at "Build signed release APK" after ~7 min —
same disk-exhaustion pattern that hit the debug build. The debug workflow
was already fixed to arm64-v8a only; the release workflow still built all 3
ABIs and exceeded the runner's disk budget.

Changes:
- Add "Free disk space" step before system deps: removes /usr/local/lib/android,
  /usr/share/dotnet, /opt/ghc, /usr/local/share/boost (~10 GB reclaimed).
- Limit ABIS to arm64-v8a + armeabi-v7a (drops x86_64, which is emulator-only).
- Remove x86_64 from rustup target add to match.

arm64-v8a covers all modern Android devices; armeabi-v7a covers legacy ARM.
x86_64 can be re-added later if a simulator-targeted test build is needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/android-build.yml

@@ -12,8 +12,10 @@ on:
       - '**.md'
 
 env:
+  ANDROID_SDK: /opt/android-sdk
   NDK_VERSION: "25.2.9519653"
   BUILD_TOOLS_VERSION: "34.0.0"
+  PLATFORM: "android-34"
 
 jobs:
   build-apk:
@@ -27,59 +29,36 @@ jobs:
         id: meta
         run: echo "sha=${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
 
-      # ── Probe the container's existing Android SDK ─────────────────────
-      - name: Detect Android SDK
-        id: sdk
-        run: |
-          # Gitea/GitHub ubuntu-latest runners may already have an Android
-          # SDK at /usr/local/lib/android/sdk. If it has the platform and
-          # NDK we need we use it directly; otherwise we install our own.
-          DEFAULT="${ANDROID_HOME:-/usr/local/lib/android/sdk}"
-          echo "container default ANDROID_HOME: $DEFAULT"
-          echo "sdk_path=$DEFAULT" >> "$GITHUB_OUTPUT"
-          ls "$DEFAULT/platforms/" 2>/dev/null || echo "(no platforms/ in default)"
-          ls "$DEFAULT/ndk/" 2>/dev/null || echo "(no ndk/ in default)"
-
-      # ── System dependencies (always needed for build tools + signing) ──
+      # ── System dependencies ────────────────────────────────────────────
       - name: Install system dependencies
         run: |
           sudo apt-get update -y
-          sudo apt-get install -y openjdk-17-jdk-headless unzip jq
+          sudo apt-get install -y openjdk-17-jdk-headless unzip zip
 
-      # ── Install missing SDK components if needed ───────────────────────
-      - name: Install SDK platform and NDK
-        env:
-          ANDROID_SDK: ${{ steps.sdk.outputs.sdk_path }}
+      # ── Android SDK (shared cache key with release workflow) ──────────
+      - name: Cache Android SDK
+        uses: actions/cache@v4
+        id: sdk-cache
+        with:
+          path: ${{ env.ANDROID_SDK }}
+          key: v2-android-sdk-ndk${{ env.NDK_VERSION }}-bt${{ env.BUILD_TOOLS_VERSION }}
+
+      - name: Install Android SDK + NDK
+        if: steps.sdk-cache.outputs.cache-hit != 'true'
         run: |
-          # Ensure sdkmanager is on PATH
-          SDKMAN="$ANDROID_SDK/cmdline-tools/latest/bin/sdkmanager"
-          if [ ! -f "$SDKMAN" ]; then
-            echo "sdkmanager not found — installing cmdline-tools"
-            mkdir -p "$ANDROID_SDK/cmdline-tools"
-            curl -sL \
-              "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" \
-              -o /tmp/cmdtools.zip
-            unzip -q /tmp/cmdtools.zip -d /tmp/cmdtools
-            sudo mv /tmp/cmdtools/cmdline-tools "$ANDROID_SDK/cmdline-tools/latest"
-          fi
-
-          yes | sudo "$SDKMAN" --sdk_root="$ANDROID_SDK" --licenses \
-            > /dev/null 2>&1 || true
-
-          NEEDS=""
-          [ ! -f "$ANDROID_SDK/platforms/android-34/android.jar" ] && NEEDS="$NEEDS platforms;android-34"
-          [ ! -d "$ANDROID_SDK/ndk/$NDK_VERSION" ] && NEEDS="$NEEDS ndk;$NDK_VERSION"
-          [ ! -d "$ANDROID_SDK/build-tools/$BUILD_TOOLS_VERSION" ] && NEEDS="$NEEDS build-tools;$BUILD_TOOLS_VERSION"
-
-          if [ -n "$NEEDS" ]; then
-            echo "Installing:$NEEDS"
-            sudo "$SDKMAN" --sdk_root="$ANDROID_SDK" $NEEDS
-          else
-            echo "All SDK components already present"
-          fi
-
-          echo "ANDROID_HOME=$ANDROID_SDK"     >> "$GITHUB_ENV"
-          echo "ANDROID_NDK_HOME=$ANDROID_SDK/ndk/$NDK_VERSION" >> "$GITHUB_ENV"
+          sudo mkdir -p ${{ env.ANDROID_SDK }}/cmdline-tools
+          curl -sL \
+            "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" \
+            -o /tmp/cmdtools.zip
+          unzip -q /tmp/cmdtools.zip -d /tmp/cmdtools
+          sudo mv /tmp/cmdtools/cmdline-tools ${{ env.ANDROID_SDK }}/cmdline-tools/latest
+          yes | sudo ${{ env.ANDROID_SDK }}/cmdline-tools/latest/bin/sdkmanager \
+            --sdk_root=${{ env.ANDROID_SDK }} --licenses > /dev/null 2>&1 || true
+          sudo ${{ env.ANDROID_SDK }}/cmdline-tools/latest/bin/sdkmanager \
+            --sdk_root=${{ env.ANDROID_SDK }} \
+            "build-tools;${{ env.BUILD_TOOLS_VERSION }}" \
+            "platforms;${{ env.PLATFORM }}" \
+            "ndk;${{ env.NDK_VERSION }}"
 
       # ── Rust toolchain ─────────────────────────────────────────────────
       - name: Install Rust stable
@@ -106,12 +85,12 @@ jobs:
           key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: cargo-registry-
 
-      - name: Cache cargo-apk binary
+      - name: Cache cargo-ndk binary
         uses: actions/cache@v4
-        id: apk-tool-cache
+        id: ndk-tool-cache
         with:
-          path: ~/.cargo/bin/cargo-apk
-          key: cargo-apk-${{ runner.os }}-stable
+          path: ~/.cargo/bin/cargo-ndk
+          key: cargo-ndk-${{ runner.os }}-stable
 
       - name: Cache build artifacts
         uses: actions/cache@v4
@@ -120,17 +99,32 @@ jobs:
           key: android-target-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
           restore-keys: android-target-${{ hashFiles('**/Cargo.lock') }}-
 
-      # ── Build ──────────────────────────────────────────────────────────
-      - name: Install cargo-apk
-        if: steps.apk-tool-cache.outputs.cache-hit != 'true'
-        run: cargo install cargo-apk --locked
+      - name: Install cargo-ndk
+        if: steps.ndk-tool-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-ndk --locked
 
+      # ── Build APK ──────────────────────────────────────────────────────
+      # Debug CI only builds arm64-v8a — full three-ABI debug builds blow
+      # past the runner's disk budget (~25 GB of target/ + intermediate
+      # APKs caused apksigner to OOM-on-disk in the previous run). Release
+      # CI still ships all three ABIs from android-release.yml.
       - name: Build debug APK
-        run: cargo apk build --package solitaire_app --lib
+        env:
+          ANDROID_HOME: ${{ env.ANDROID_SDK }}
+          ANDROID_NDK_HOME: ${{ env.ANDROID_SDK }}/ndk/${{ env.NDK_VERSION }}
+          BUILD_TOOLS_VERSION: ${{ env.BUILD_TOOLS_VERSION }}
+          PLATFORM: ${{ env.PLATFORM }}
+          PROFILE: debug
+          ABIS: arm64-v8a
+        run: ./scripts/build_android_apk.sh
 
       # ── Artifact ───────────────────────────────────────────────────────
+      # Pinned to v3 because Gitea Actions doesn't implement the github.com
+      # artifact service that upload-artifact@v4+ requires; v3 uses the
+      # older chunked HTTP API that Gitea's GHES-compatibility layer
+      # supports.
       - name: Upload APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: solitaire-quest-debug-${{ steps.meta.outputs.sha }}
           path: target/debug/apk/solitaire-quest.apk

.gitea/workflows/android-release.yml

@@ -6,10 +6,10 @@ on:
       - 'v*.*.*'
 
 env:
-  ANDROID_HOME: /opt/android-sdk
-  ANDROID_NDK_HOME: /opt/android-sdk/ndk/25.2.9519653
+  ANDROID_SDK: /opt/android-sdk
   NDK_VERSION: "25.2.9519653"
   BUILD_TOOLS_VERSION: "34.0.0"
+  PLATFORM: "android-34"
   GITEA_API: https://git.aleshym.co/api/v1
   REPO: funman300/Rusty_Solitare
 
@@ -25,39 +25,50 @@ jobs:
         id: meta
         run: echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
 
-      # ── Android SDK + NDK ──────────────────────────────────────────────
-      # Shared cache key with the debug workflow so a warm debug run
-      # saves the ~2 GB SDK download for the release run too.
+      # ── Free disk space ────────────────────────────────────────────────
+      # A 2-ABI release build (arm64 + armv7) generates ~15 GB of target/
+      # output. Remove pre-installed runner tooling that is never used
+      # during an Android build to reclaim ~10 GB before we start.
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android   # runner pre-installed SDK
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          df -h /
+
+      # ── System dependencies ────────────────────────────────────────────
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y openjdk-17-jdk-headless unzip zip jq
+
+      # ── Android SDK (shared cache key with debug workflow) ─────────────
       - name: Cache Android SDK
         uses: actions/cache@v4
         id: sdk-cache
         with:
-          path: ${{ env.ANDROID_HOME }}
+          path: ${{ env.ANDROID_SDK }}
           key: v2-android-sdk-ndk${{ env.NDK_VERSION }}-bt${{ env.BUILD_TOOLS_VERSION }}
 
-      # Java and jq are always needed (apksigner requires Java even on cache hits).
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y openjdk-17-jdk-headless unzip jq
-
       - name: Install Android SDK + NDK
         if: steps.sdk-cache.outputs.cache-hit != 'true'
         run: |
-          mkdir -p "$ANDROID_HOME/cmdline-tools"
+          sudo mkdir -p ${{ env.ANDROID_SDK }}/cmdline-tools
           curl -sL \
             "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" \
             -o /tmp/cmdtools.zip
           unzip -q /tmp/cmdtools.zip -d /tmp/cmdtools
-          mv /tmp/cmdtools/cmdline-tools "$ANDROID_HOME/cmdline-tools/latest"
-          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --sdk_root="$ANDROID_HOME" --licenses \
-            > /dev/null 2>&1 || true
-          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --sdk_root="$ANDROID_HOME" \
-            "build-tools;$BUILD_TOOLS_VERSION" \
-            "platforms;android-34" \
-            "ndk;$NDK_VERSION"
+          sudo mv /tmp/cmdtools/cmdline-tools ${{ env.ANDROID_SDK }}/cmdline-tools/latest
+          yes | sudo ${{ env.ANDROID_SDK }}/cmdline-tools/latest/bin/sdkmanager \
+            --sdk_root=${{ env.ANDROID_SDK }} --licenses > /dev/null 2>&1 || true
+          sudo ${{ env.ANDROID_SDK }}/cmdline-tools/latest/bin/sdkmanager \
+            --sdk_root=${{ env.ANDROID_SDK }} \
+            "build-tools;${{ env.BUILD_TOOLS_VERSION }}" \
+            "platforms;${{ env.PLATFORM }}" \
+            "ndk;${{ env.NDK_VERSION }}"
 
-# ── Rust toolchain ─────────────────────────────────────────────────
+      # ── Rust toolchain ─────────────────────────────────────────────────
       - name: Install Rust stable
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
@@ -68,8 +79,7 @@ jobs:
         run: |
           rustup target add \
             aarch64-linux-android \
-            armv7-linux-androideabi \
-            x86_64-linux-android
+            armv7-linux-androideabi
 
       # ── Cargo caches ───────────────────────────────────────────────────
       - name: Cache Cargo registry
@@ -82,12 +92,12 @@ jobs:
           key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: cargo-registry-
 
-      - name: Cache cargo-apk binary
+      - name: Cache cargo-ndk binary
         uses: actions/cache@v4
-        id: apk-tool-cache
+        id: ndk-tool-cache
         with:
-          path: ~/.cargo/bin/cargo-apk
-          key: cargo-apk-${{ runner.os }}-stable
+          path: ~/.cargo/bin/cargo-ndk
+          key: cargo-ndk-${{ runner.os }}-stable
 
       - name: Cache build artifacts
         uses: actions/cache@v4
@@ -96,48 +106,37 @@ jobs:
           key: android-release-target-${{ hashFiles('**/Cargo.lock') }}-${{ github.sha }}
           restore-keys: android-release-target-${{ hashFiles('**/Cargo.lock') }}-
 
-      # ── Build ──────────────────────────────────────────────────────────
-      - name: Install cargo-apk
-        if: steps.apk-tool-cache.outputs.cache-hit != 'true'
-        run: cargo install cargo-apk --locked
+      - name: Install cargo-ndk
+        if: steps.ndk-tool-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-ndk --locked
 
-      - name: Build release APK
-        run: cargo apk build --release --package solitaire_app --lib
-
-      # ── Sign ───────────────────────────────────────────────────────────
+      # ── Build & sign with release keystore ─────────────────────────────
       - name: Decode keystore
         run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > /tmp/solitaire-release.jks
 
-      - name: Align and sign APK
-        run: |
-          TAG="${{ steps.meta.outputs.tag }}"
-          UNSIGNED="target/release/apk/solitaire-quest.apk"
-          ALIGNED="/tmp/solitaire-quest-aligned.apk"
-          SIGNED="ferrous-solitaire-${TAG}.apk"
+      - name: Build signed release APK
+        env:
+          ANDROID_HOME: ${{ env.ANDROID_SDK }}
+          ANDROID_NDK_HOME: ${{ env.ANDROID_SDK }}/ndk/${{ env.NDK_VERSION }}
+          BUILD_TOOLS_VERSION: ${{ env.BUILD_TOOLS_VERSION }}
+          PLATFORM: ${{ env.PLATFORM }}
+          PROFILE: release
+          # arm64-v8a covers all modern Android phones; armeabi-v7a covers
+          # legacy ARM devices. x86_64 is emulator-only and dropped to
+          # stay within the runner's ~25 GB disk budget.
+          ABIS: arm64-v8a armeabi-v7a
+          KEYSTORE: /tmp/solitaire-release.jks
+          KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASS: ${{ secrets.KEY_PASS }}
+          APK_OUT: ferrous-solitaire-${{ steps.meta.outputs.tag }}.apk
+        run: ./scripts/build_android_apk.sh
 
-          "$ANDROID_SDK_ROOT/build-tools/$BUILD_TOOLS_VERSION/zipalign" -v 4 \
-            "$UNSIGNED" "$ALIGNED"
-
-          "$ANDROID_SDK_ROOT/build-tools/$BUILD_TOOLS_VERSION/apksigner" sign \
-            --ks /tmp/solitaire-release.jks \
-            --ks-pass "pass:${{ secrets.KEYSTORE_PASS }}" \
-            --ks-key-alias "${{ secrets.KEY_ALIAS }}" \
-            --key-pass "pass:${{ secrets.KEY_PASS }}" \
-            --out "$SIGNED" \
-            "$ALIGNED"
-
-      - name: Verify APK signature
-        run: |
-          TAG="${{ steps.meta.outputs.tag }}"
-          "$ANDROID_SDK_ROOT/build-tools/$BUILD_TOOLS_VERSION/apksigner" verify \
-            --verbose "ferrous-solitaire-${TAG}.apk"
-
-      # ── Publish ────────────────────────────────────────────────────────
+      # ── Publish to Gitea release ───────────────────────────────────────
       - name: Create Gitea release
         id: release
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
-          # Try to create; fall back to fetching the existing release on 409.
           RESPONSE=$(curl -s -o /tmp/release.json -w "%{http_code}" \
             -X POST "$GITEA_API/repos/$REPO/releases" \
             -H "Authorization: token ${{ secrets.CI_TOKEN }}" \

deploy/kustomization.yaml

@@ -20,4 +20,4 @@ resources:
 images:
 - name: solitaire-server
   newName: git.aleshym.co/funman300/solitaire-server
-  newTag: bb670d6c
+  newTag: f6907671

scripts/build_android_apk.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# Build a self-signed Android APK from solitaire_app's cdylib targets.
+#
+# Replaces the cargo-apk pipeline with explicit cargo-ndk + aapt2 + apksigner
+# steps. The CI runner was hitting an SDK-discovery bug inside cargo-apk's
+# ndk-build crate that we couldn't isolate; running each Android toolchain
+# step explicitly gives us a debuggable pipeline.
+#
+# Required environment:
+#   ANDROID_HOME            Path to Android SDK root
+#   ANDROID_NDK_HOME        Path to the specific NDK version
+#   BUILD_TOOLS_VERSION     e.g. "34.0.0"
+#   PLATFORM                e.g. "android-34"
+#
+# Optional environment:
+#   PROFILE                 "debug" (default) | "release"
+#   ABIS                    Space-separated Android ABIs to build (default:
+#                           "arm64-v8a armeabi-v7a x86_64"). Reduce in CI to
+#                           fit the runner's disk budget — a full three-ABI
+#                           debug build can exceed 25 GB of target/ output.
+#   APK_OUT                 Output APK path (default: target/$PROFILE/apk/solitaire-quest.apk)
+#   KEYSTORE                Path to keystore for signing (default: generates a debug keystore)
+#   KEYSTORE_PASS           Keystore password (default: "android" for the generated debug keystore)
+#   KEY_ALIAS               Key alias (default: "androiddebugkey")
+#   KEY_PASS                Key password (default: same as KEYSTORE_PASS)
+#
+# Outputs:
+#   $APK_OUT                Signed, zipaligned APK
+set -euo pipefail
+
+: "${ANDROID_HOME:?ANDROID_HOME must be set}"
+: "${ANDROID_NDK_HOME:?ANDROID_NDK_HOME must be set}"
+: "${BUILD_TOOLS_VERSION:?BUILD_TOOLS_VERSION must be set}"
+: "${PLATFORM:?PLATFORM must be set (e.g. android-34)}"
+
+PROFILE="${PROFILE:-debug}"
+ABIS="${ABIS:-arm64-v8a armeabi-v7a x86_64}"
+APK_OUT="${APK_OUT:-target/${PROFILE}/apk/solitaire-quest.apk}"
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+BT="$ANDROID_HOME/build-tools/$BUILD_TOOLS_VERSION"
+PLATFORM_JAR="$ANDROID_HOME/platforms/$PLATFORM/android.jar"
+MANIFEST="solitaire_app/android/AndroidManifest.xml"
+RES_DIR="solitaire_app/res"
+ASSETS_DIR="assets"
+
+# --- sanity ----------------------------------------------------------------
+for f in "$BT/aapt2" "$BT/zipalign" "$BT/apksigner" "$PLATFORM_JAR" "$MANIFEST"; do
+  [ -e "$f" ] || { echo "missing: $f"; exit 1; }
+done
+
+STAGING="$(mktemp -d)"
+trap 'rm -rf "$STAGING"' EXIT
+mkdir -p "$STAGING/lib" "$STAGING/compiled-res"
+
+# --- 1. native libraries via cargo-ndk -------------------------------------
+# `-o $STAGING/lib` lays out files as $STAGING/lib/<abi>/libsolitaire_app.so
+# which is the directory structure the APK expects under lib/.
+CARGO_NDK_ARGS=( --platform 26 -o "$STAGING/lib" )
+for abi in $ABIS; do
+  CARGO_NDK_ARGS+=( -t "$abi" )
+done
+CARGO_NDK_ARGS+=( build --package solitaire_app --lib )
+if [ "$PROFILE" = "release" ]; then
+  CARGO_NDK_ARGS+=( --release )
+fi
+echo ">>> cargo ndk ${CARGO_NDK_ARGS[*]}"
+cargo ndk "${CARGO_NDK_ARGS[@]}"
+
+# --- 2. compile + link resources and manifest ------------------------------
+if [ -d "$RES_DIR" ]; then
+  echo ">>> aapt2 compile resources"
+  "$BT/aapt2" compile --dir "$RES_DIR" -o "$STAGING/compiled-res"
+fi
+
+LINK_ARGS=(
+  link
+  -o "$STAGING/app-unsigned.apk"
+  -I "$PLATFORM_JAR"
+  --manifest "$MANIFEST"
+)
+[ -d "$ASSETS_DIR" ] && LINK_ARGS+=( -A "$ASSETS_DIR" )
+# Add compiled resources if any
+shopt -s nullglob
+RES_FLATS=( "$STAGING/compiled-res"/*.flat )
+shopt -u nullglob
+if [ ${#RES_FLATS[@]} -gt 0 ]; then
+  LINK_ARGS+=( "${RES_FLATS[@]}" )
+fi
+echo ">>> aapt2 link"
+"$BT/aapt2" "${LINK_ARGS[@]}"
+
+# --- 3. add native libraries to the APK ------------------------------------
+echo ">>> bundle native libraries"
+( cd "$STAGING" && zip -r -q app-unsigned.apk lib/ )
+
+# --- 4. zipalign -----------------------------------------------------------
+echo ">>> zipalign"
+"$BT/zipalign" -p -f 4 "$STAGING/app-unsigned.apk" "$STAGING/app-aligned.apk"
+# Free the unsigned intermediate now — apksigner reads $app-aligned.apk and
+# writes $APK_OUT, and the runner's disk is tight after a multi-ABI build.
+rm -f "$STAGING/app-unsigned.apk"
+
+# --- 5. sign ---------------------------------------------------------------
+if [ -z "${KEYSTORE:-}" ]; then
+  # Generate a deterministic debug keystore on the fly.
+  KEYSTORE="$STAGING/debug.keystore"
+  KEYSTORE_PASS="${KEYSTORE_PASS:-android}"
+  KEY_ALIAS="${KEY_ALIAS:-androiddebugkey}"
+  KEY_PASS="${KEY_PASS:-$KEYSTORE_PASS}"
+  echo ">>> generating debug keystore at $KEYSTORE"
+  keytool -genkeypair -v \
+    -keystore "$KEYSTORE" \
+    -storepass "$KEYSTORE_PASS" \
+    -alias "$KEY_ALIAS" \
+    -keypass "$KEY_PASS" \
+    -keyalg RSA -keysize 2048 -validity 10000 \
+    -dname "CN=Android Debug,O=Android,C=US" > /dev/null
+fi
+
+KEYSTORE_PASS="${KEYSTORE_PASS:-android}"
+KEY_ALIAS="${KEY_ALIAS:-androiddebugkey}"
+KEY_PASS="${KEY_PASS:-$KEYSTORE_PASS}"
+
+mkdir -p "$(dirname "$APK_OUT")"
+echo ">>> apksigner sign -> $APK_OUT"
+"$BT/apksigner" sign \
+  --ks "$KEYSTORE" \
+  --ks-pass "pass:$KEYSTORE_PASS" \
+  --ks-key-alias "$KEY_ALIAS" \
+  --key-pass "pass:$KEY_PASS" \
+  --out "$APK_OUT" \
+  "$STAGING/app-aligned.apk"
+
+echo ">>> verify"
+"$BT/apksigner" verify --verbose "$APK_OUT"
+
+echo ">>> done: $APK_OUT"

solitaire_app/android/AndroidManifest.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Mirrors what cargo-apk would generate from [package.metadata.android]
+  in solitaire_app/Cargo.toml. Kept in-tree so the CI workflow can drive
+  aapt2 directly without going through cargo-apk's brittle SDK discovery.
+
+  Keep in sync with:
+    * Cargo.toml: package, min_sdk_version, target_sdk_version,
+      uses_feature, uses_permission, application label/icon,
+      activity orientation
+    * [lib].name (currently "solitaire_app") — matches the
+      `android.app.lib_name` meta-data value below, which is the
+      shared object name without the `lib` prefix or `.so` suffix.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.solitairequest.app"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <uses-sdk
+        android:minSdkVersion="26"
+        android:targetSdkVersion="34" />
+
+    <uses-feature
+        android:name="android.hardware.touchscreen"
+        android:required="true" />
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:label="Ferrous Solitaire"
+        android:icon="@mipmap/ic_launcher"
+        android:hasCode="false">
+
+        <activity
+            android:name="android.app.NativeActivity"
+            android:exported="true"
+            android:screenOrientation="portrait"
+            android:configChanges="orientation|keyboardHidden|screenSize|keyboard|navigation|screenLayout">
+
+            <meta-data
+                android:name="android.app.lib_name"
+                android:value="solitaire_app" />
+
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

solitaire_data/src/settings.rs

@@ -143,10 +143,10 @@ pub struct Settings {
     #[serde(default)]
     pub window_geometry: Option<WindowGeometry>,
     /// Identifier of the active card-art theme. Matches `meta.id` from
-    /// the theme's `theme.ron` manifest. `"classic"` and `"dark"` are
+    /// the theme's `theme.ron` manifest. `"dark"` and `"classic"` are
     /// always present; user-supplied themes register under their own ids.
-    /// Older `settings.json` files that stored `"default"` will fall
-    /// back to the dark embedded theme at runtime.
+    /// Older `settings.json` files that stored `"default"` or `"classic"`
+    /// are migrated to `"dark"` by [`Settings::sanitized`].
     #[serde(default = "default_theme_id")]
     pub selected_theme_id: String,
     /// Set to `true` once the achievement-onboarding info-toast has been
@@ -272,7 +272,7 @@ fn default_music_volume() -> f32 {
 }
 
 fn default_theme_id() -> String {
-    "classic".to_string()
+    "dark".to_string()
 }
 
 /// Default tooltip-hover dwell delay in seconds. Mirrors
@@ -395,6 +395,13 @@ impl Settings {
     /// their respective ranges after deserialization or hand-editing of
     /// `settings.json`.
     pub fn sanitized(self) -> Self {
+        // Migrate stale theme IDs: "default" was removed when the theme was
+        // renamed to "dark"; "classic" was briefly the default before "dark"
+        // was restored as the shipped default.
+        let selected_theme_id = match self.selected_theme_id.as_str() {
+            "default" | "classic" => "dark".to_string(),
+            _ => self.selected_theme_id,
+        };
         Self {
             sfx_volume: self.sfx_volume.clamp(0.0, 1.0),
             music_volume: self.music_volume.clamp(0.0, 1.0),
@@ -407,6 +414,7 @@ impl Settings {
             replay_move_interval_secs: self
                 .replay_move_interval_secs
                 .clamp(REPLAY_MOVE_INTERVAL_MIN_SECS, REPLAY_MOVE_INTERVAL_MAX_SECS),
+            selected_theme_id,
             ..self
         }
     }

solitaire_engine/src/theme/registry.rs

@@ -100,8 +100,8 @@ fn build_registry_on_startup(mut registry: bevy::ecs::system::ResMut<ThemeRegist
 /// [`user_theme_dir`].
 pub fn build_registry(user_dir: &Path) -> ThemeRegistry {
     let mut entries = Vec::new();
-    entries.push(classic_entry());
     entries.push(dark_entry());
+    entries.push(classic_entry());
     entries.extend(discover_user_themes(user_dir));
     ThemeRegistry { entries }
 }
@@ -264,8 +264,8 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let registry = build_registry(tmp.path());
         assert_eq!(registry.len(), BUNDLED_COUNT);
-        assert_eq!(registry.entries[0].id, "classic");
-        assert_eq!(registry.entries[1].id, "dark");
+        assert_eq!(registry.entries[0].id, "dark");
+        assert_eq!(registry.entries[1].id, "classic");
     }
 
     #[test]