ci(release): replace Python heredoc with printf for signing config injection

The Python heredoc had TOML section lines at column 0 inside a YAML
literal block, which YAML interprets as terminating the block (parse
error, instant workflow failure). printf keeps all lines at proper
indentation within the run block while avoiding sed escaping issues
with special characters in passwords.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,168 @@
+name: Release
+
+# Triggered by pushing a version tag, e.g. `git tag v0.22.0 && git push origin v0.22.0`.
+# Builds a Linux x86_64 tarball and a signed Android APK, then publishes
+# both as assets on a GitHub Release. Obtainium can track this repo's
+# releases and download the APK automatically.
+#
+# Required repository secrets (Settings → Secrets and variables → Actions):
+#   ANDROID_KEYSTORE_BASE64      base64-encoded .jks file (see README for gen command)
+#   ANDROID_KEYSTORE_PASSWORD    password used with -storepass when creating the keystore
+#   ANDROID_KEY_ALIAS            alias used with -alias when creating the keystore
+#   ANDROID_KEY_PASSWORD         password used with -keypass when creating the keystore
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write   # gh release create needs write access
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+
+# ---------------------------------------------------------------------------
+# Job 1: Linux x86_64 binary + assets tarball
+# ---------------------------------------------------------------------------
+jobs:
+  build-linux:
+    name: Build · Linux x86_64
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install system deps
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends \
+            libasound2-dev libudev-dev libwayland-dev libxkbcommon-dev
+
+      - name: Cache cargo registry + build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: linux-release-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: linux-release-
+
+      - name: Build release binary
+        run: cargo build --release -p solitaire_app
+
+      - name: Package tarball
+        run: |
+          mkdir solitaire-quest
+          cp target/release/solitaire_app solitaire-quest/
+          cp -r assets solitaire-quest/
+          tar -czf solitaire-quest-linux-x86_64.tar.gz solitaire-quest
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux
+          path: solitaire-quest-linux-x86_64.tar.gz
+
+# ---------------------------------------------------------------------------
+# Job 2: Android APK (multi-arch) — release-built and signed via cargo-apk
+# ---------------------------------------------------------------------------
+  build-android:
+    name: Build · Android APK
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable + Android targets
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android
+
+      - name: Expose NDK root to cargo-apk
+        # ANDROID_NDK_LATEST_HOME is set by the GitHub-hosted runner.
+        # cargo-apk reads ANDROID_NDK_ROOT; write it to GITHUB_ENV so
+        # all subsequent steps in this job inherit it.
+        run: echo "ANDROID_NDK_ROOT=$ANDROID_NDK_LATEST_HOME" >> $GITHUB_ENV
+
+      - name: Cache cargo registry + cargo-apk binary + build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ~/.cargo/bin
+            target
+          key: android-release-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: android-release-
+
+      - name: Install cargo-apk
+        # --locked: use the dependency versions cargo-apk was tested with.
+        # cargo install is a no-op when the cached binary is already current.
+        run: cargo install --locked cargo-apk
+
+      - name: Inject release signing config
+        # cargo-apk --release requires [package.metadata.android.signing.release]
+        # in solitaire_app/Cargo.toml. Appended at CI time so secrets never
+        # live in the repo. printf keeps every line inside the YAML run block,
+        # avoiding the YAML parse error a heredoc with column-0 content causes.
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > release.keystore
+          {
+            printf '\n[package.metadata.android.signing.release]\n'
+            printf 'path = "%s"\n'             "${GITHUB_WORKSPACE}/release.keystore"
+            printf 'keystore_password = "%s"\n' "$ANDROID_KEYSTORE_PASSWORD"
+            printf 'key_alias = "%s"\n'        "$ANDROID_KEY_ALIAS"
+            printf 'key_password = "%s"\n'     "$ANDROID_KEY_PASSWORD"
+          } >> solitaire_app/Cargo.toml
+
+      - name: Build and sign APK (release profile)
+        run: cargo apk build -p solitaire_app --release
+
+      - name: Stage APK for upload
+        run: |
+          cp target/release/apk/solitaire-quest.apk \
+             "solitaire-quest-${{ github.ref_name }}.apk"
+          rm release.keystore
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: android
+          path: solitaire-quest-${{ github.ref_name }}.apk
+
+# ---------------------------------------------------------------------------
+# Job 3: Create the GitHub Release once both builds succeed
+# ---------------------------------------------------------------------------
+  release:
+    name: Publish GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build-linux, build-android]
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: linux
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: android
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --repo "${{ github.repository }}" \
+            --title "Solitaire Quest ${{ github.ref_name }}" \
+            --generate-notes \
+            "solitaire-quest-linux-x86_64.tar.gz" \
+            "solitaire-quest-${{ github.ref_name }}.apk"

.gitignore

@@ -7,3 +7,6 @@
 *.tmp
 data/
 .claude/
+
+# IDE project files
+.idea/

CHANGELOG.md

@@ -6,8 +6,980 @@ project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-No threads in flight. v0.21.0 cut on 2026-05-08; CHANGELOG accumulates
-the next cycle here.
+## [0.22.0] — 2026-05-08
+
+Adds difficulty-tier game selection, Android JNI bridges for keystore and
+clipboard, Play-by-Seed dialog, and double-tap auto-move on touch screens.
+Also closes the Prev/Next replay-selector spawn-site item carried since v0.19.0.
+
+### Added
+
+- **Difficulty-tier game mode** (this release).
+  `DifficultyLevel` enum (`Easy / Medium / Hard / Expert / Grandmaster /
+  Random`) added to `solitaire_core::game_state` alongside a new
+  `GameMode::Difficulty(DifficultyLevel)` variant. Five pre-verified seed
+  catalogs (40 seeds each, 200 total) are generated by the new
+  `gen_difficulty_seeds` binary in `solitaire_assetgen`; each catalog
+  contains seeds proven winnable at progressively larger solver budgets
+  (1 K → 200 K moves). `DifficultyPlugin` resolves `StartDifficultyRequestEvent`
+  → catalog seed → `NewGameRequestEvent`; the `Random` tier uses a
+  system-time seed and intentionally bypasses the winnable-only filter.
+  The home overlay gains an expandable `▶ Difficulty` section between the
+  Draw Mode row and the mode-card grid; the last-played tier is persisted
+  in `Settings::last_difficulty` and pre-expands/highlights on re-open.
+  Difficulty wins pool into Classic stats (no separate buckets).
+- **Prev/Next replay selector in the Stats overlay** (`a449f60`).
+  `ReplayPrevButton`, `ReplayNextButton`, `ReplaySelectorCaption`, and
+  `ReplaySelectorDetail` nodes now spawn inside `spawn_stats_screen`
+  as a flex row of two bordered chips flanking a `"Replay N / M"`
+  caption, with a detail line below showing the selected replay's
+  duration + date and an optional `"· Shareable"` badge. Both chips
+  carry `ModalButton(Secondary)` so the existing `repaint_modal_buttons`
+  paint loop gives them hover/press feedback at zero extra cost.
+  `repaint_replay_selector_detail` is wired into the existing
+  `.chain()` alongside `handle_replay_selector_buttons` and
+  `repaint_replay_selector_caption`. The click handler and repaint
+  systems have been registered (and dormant) since v0.19.0; this
+  commit is purely the missing spawn site.
+- **6 new selector unit tests** (`a449f60`). Covers: spawn-site
+  presence (Prev, Next, Caption, Detail all spawn with the screen),
+  caption initial text ("Replay 1 / 1"), detail initial text
+  ("{dur} win on {date}"), Shareable badge when `share_url` is set,
+  empty-history "No replays" caption, and ordinal wrapping.
+  `make_test_replay(time_seconds, share_url)` helper encapsulates
+  `Replay::new(...)` + `chrono::NaiveDate`.
+
+### Fixed
+
+- **`const { assert!() }` for dim-layer z-order test** (`a449f60`).
+  Converted `assert!(Z_REPLAY_DIM < Z_REPLAY_OVERLAY, …)` in
+  `replay_overlay` tests to `const { assert!(…) }` to satisfy
+  `clippy::assertions_on_constants` (constant-fold at compile time
+  rather than a runtime no-op).
+
+### Added (post-cut, same pending release)
+
+- **Double-tap auto-move on touch screens** (`395a322`).
+  `handle_double_tap` fires `MoveRequestEvent` (single card to
+  foundation/tableau, or a whole face-up stack via
+  `best_tableau_destination_for_stack`) when two `TouchPhase::Ended`
+  events on the same card arrive within `DOUBLE_TAP_WINDOW` (0.5 s,
+  slightly wider than the mouse `DOUBLE_CLICK_WINDOW` to account for
+  touch latency). If no legal destination exists, fires
+  `MoveRejectedEvent` (audio + visual rejection feedback).  The system
+  is inserted into the touch drag chain immediately before
+  `touch_end_drag` so `DragState.active_touch_id` and `committed` are
+  still readable; the tap timestamp is tracked in a `Local<HashMap<u32,
+  f32>>` keyed by card ID.
+- **Play-by-Seed dialog** (`0cb1587`).
+  `PlayBySeedPlugin` adds a numeric-input modal that accepts a decimal
+  seed, runs a solver preview in the background (debounced 500 ms via
+  `AsyncComputeTaskPool`), and shows a win/no-win verdict before
+  dealing.  A new `HomeMode::PlayBySeed` card in the home overlay fires
+  `StartPlayBySeedRequestEvent`; the handler in `PlayBySeedPlugin`
+  spawns the dialog.  Digit, Backspace, Enter (confirm), and Escape
+  (cancel) are handled via `ButtonInput<KeyCode>`.  Five unit tests
+  cover spawn, digit append, buffer read, confirm, and cancel paths.
+- **75 new challenge seeds** (`2062bd0`).
+  New `gen_seeds` binary in `solitaire_assetgen` brute-searches seeds
+  in the `0xCAFEBABE…` namespace and filters for hands solvable in
+  ≤250 moves via the core solver.  The 75 confirmed-win seeds are
+  appended to `CHALLENGE_SEEDS` in `solitaire_data::challenge`.
+
+### Fixed (post-cut, same pending release)
+
+- **Gate `handle_fullscreen` to non-Android** (`45436d0`).
+  F11 fullscreen toggle makes no sense on Android (the OS owns window
+  sizing); the fn and its `MonitorSelection`/`WindowMode` imports are
+  now `#[cfg(not(target_os = "android"))]`-gated.  The `add_systems`
+  call is extracted as a separate statement so `#[cfg]` can annotate it
+  (attributes cannot appear mid-chain in Rust).
+- **Android APK launch: export `android_main`** (`202a64d`).
+  `NativeActivity` dlopen-s `libsolitaire_app.so` and calls
+  `android_main` as its entry point. Without the symbol the app
+  crashed immediately with `UnsatisfiedLinkError`. The new function
+  sets `bevy::android::ANDROID_APP` (required by `WinitPlugin`) then
+  delegates to `run()` — equivalent to what `#[bevy_main]` would
+  generate, but usable on an arbitrary entry point name.
+- **Android APK launch: gate `resize_constraints` to non-Android**
+  (`202a64d`). On Android `max_width/max_height` default to `0.0`;
+  Bevy's clamp panicked with `min=800 > max=0`.
+- **Android APK launch: gate `apply_smart_default_window_size` to
+  non-Android** (`202a64d`). The system calls `.clamp(800.0,
+  logical_w)` which panics when the emulator reports zero window
+  dimensions during early Android lifecycle events. The OS controls
+  window size on Android; the system is irrelevant there.
+- **Ignore `.idea/` IDE project files** (`16242e6`). Android Studio
+  created `.idea/` when the project was opened during APK
+  verification; added to `.gitignore` and removed the accidentally-
+  committed files.
+
+### Android verification result
+
+APK boots on `x86_64-linux-android` in a Pixel_7 AVD (Android 14 /
+API 34, SwiftShader Vulkan). App runs for 2+ minutes without crashing.
+Bevy renderer initialises, splash screen loads. This is the first
+confirmed end-to-end device run.
+
+### Stats
+
+- Tests: **1300+ passing** / 0 failing
+- Clippy: clean
+- Crates touched: `solitaire_core` (game_state), `solitaire_data`
+  (settings, stats, difficulty_seeds, challenge), `solitaire_engine`
+  (events, difficulty_plugin, home_plugin, hud_plugin, win_summary_plugin,
+  input_plugin, play_by_seed_plugin, lib), `solitaire_app` (lib.rs),
+  `solitaire_assetgen` (gen_difficulty_seeds + gen_seeds binaries)
+
+## [0.21.8] — 2026-05-08
+
+Patch release for replay-overlay polish. Through-line:
+**notch-label centering + WIN MOVE HC legibility + HC system extension**.
+All three items were "optional polish" flagged in the v0.21.7 handoff;
+all three ship in two commits.
+
+### Added
+
+- **`STATE_SUCCESS_HC` constant** (`c50eaf8`). Brighter lime
+  (`#c8e862`, L≈0.73) in `ui_theme` for use wherever the
+  standard `STATE_SUCCESS` (`#acc267`, L≈0.51) needs extra
+  luminance under HC mode. Sits above the bumped notch ticks
+  (`BORDER_SUBTLE_HC` gray, L≈0.60) so a WIN MOVE marker at
+  this colour is unambiguous.
+- **`HighContrastBackground::with_hc(default, hc)` constructor**
+  (`c50eaf8`). Extends `HighContrastBackground` with an
+  `hc_color: Color` field (default = `BORDER_SUBTLE_HC` via
+  `with_default()`). `update_high_contrast_backgrounds` now
+  reads `marker.hc_color` instead of the hardcoded constant —
+  backwards-compatible; all existing `with_default()` usages
+  continue to bump to gray.
+- **WIN MOVE scrub-bar marker HC bump** (`c50eaf8`). Marker
+  now carries `HighContrastBackground::with_hc(STATE_SUCCESS,
+  STATE_SUCCESS_HC)` so the lime stays lime under HC (brighter
+  lime rather than gray). Pin test locks both the default and
+  HC colour fields on the spawned entity.
+
+### Fixed
+
+- **Scrub-bar notch-label centering** (`b44d277`). Middle
+  three labels ("25%", "50%", "75%") previously had their
+  left edge at the notch; now their text centre coincides
+  with the notch tick. Implemented using the CSS
+  `translateX(-50%)` pattern for Bevy 0.18 UI: a fixed
+  `SCRUB_LABEL_CENTER_WIDTH = 36 px` container with
+  `margin.left = -18 px` is placed at `left: Percent(pct)`,
+  and `Justify::Center` centres the text within it. Endpoint
+  labels ("0%", "100%") keep their flush-left / flush-right
+  anchoring. `with_default()` remains one-argument.
+
+### Stats
+
+- Tests: 1276 passing / 0 failing (engine: 831)
+- Clippy: clean
+- Crates touched: `solitaire_engine` (replay_overlay.rs,
+  ui_theme.rs, settings_plugin.rs)
+
+## [0.21.7] — 2026-05-08
+
+Patch release closing the last major B-2 sub-piece. Through-line:
+**mini-tableau preview dim layer**. The mockup's "Game Peek Band at
+50 % opacity" is now implemented as a full-screen UI scrim that darkens
+the card world during replay so the chrome (banner + move-log panel)
+reads clearly against the scene.
+
+### Added
+
+- **Full-screen tableau dim layer** (`da3e542`). Spawns a
+  `ReplayTableauDimLayer` UI node (100 % × 100 %, 50 % opacity
+  black) at `Z_REPLAY_DIM = Z_REPLAY_OVERLAY − 1 = 54` whenever
+  a replay starts; despawned alongside the banner and move-log
+  panel when the replay ends. Bevy's UI/world compositor means
+  no changes to `card_plugin` are needed — UI nodes always
+  render above world-space sprites regardless of `Transform.z`.
+  The dim layer carries no `Interaction` component (purely
+  visual; pointer events pass through). Adds `Z_REPLAY_DIM`
+  and `TABLEAU_DIM_ALPHA` constants plus two new tests:
+  lifecycle (spawn/despawn mirrors the floating-chip pattern)
+  and z-ordering invariant (`Z_REPLAY_DIM < Z_REPLAY_OVERLAY`
+  pinned). 1275 tests pass / 0 failing.
+
+### Stats
+
+- Tests: 1275 passing / 0 failing
+- Clippy: clean
+- Crates touched: `solitaire_engine` (replay_overlay.rs)
+
+## [0.21.6] — 2026-05-08
+
+Patch release for the post-v0.21.5 work. Through-line:
+**Move Log panel + scrub-UX polish**. v0.21.5 closed out the
+keyboard-accelerator surface (Space / Esc / ← / →) and the
+keybind footer; v0.21.6 builds on that with two parallel
+threads — accessibility + scrub-on-hold polish for the v0.21.5
+surfaces, plus a brand-new Move Log panel anchored to the
+viewport's bottom edge that gives players a 5-row recent-and-
+upcoming move history alongside the existing top-edge banner.
+
+The Move Log panel is the first replay-overlay surface that
+*isn't* attached to the banner — it lives at a separate screen
+anchor (bottom: 0) with its own spawn/despawn lifecycle.
+Establishes the pattern for "multi-anchor replay UI" that the
+remaining B-2 sub-piece (mini-tableau preview) will inherit.
+
+### Added
+
+- **HC-mode coverage for the scrub track + quarter-mark notch
+  ticks** (`d3cb1a5`). Adds parallel primitive
+  `HighContrastBackground` to `ui_theme` and a paint system
+  `update_high_contrast_backgrounds` in `settings_plugin` that
+  mirrors the existing border-marker pattern but targets
+  `BackgroundColor` instead of `BorderColor`. Tags the 1 px
+  scrub track Node and all five quarter-mark notch ticks so
+  they bump from `BORDER_SUBTLE` (`#505050`) →
+  `BORDER_SUBTLE_HC` (`#a0a0a0`) under HC mode. Scrub fill
+  (`ACCENT_PRIMARY`) and WIN MOVE marker (`STATE_SUCCESS`)
+  don't get the marker — accent and state colours are already
+  saturated and don't need an HC luminance variant.
+- **Continuous scrub on key-held arrow keys** (`2e25476`).
+  Holding ← or → triggers continuous step at 100 ms cadence
+  (10 steps/sec) — matches the mockup's `[← →] scrub`
+  terminology while keeping single-press = single-step
+  semantics. Per-key accumulators in a new
+  `ReplayScrubKeyHold` resource; `just_pressed` events bypass
+  the accumulator and fire immediately. Release resets to 0
+  so the next fresh press fires immediately rather than at
+  half-interval.
+- **Move Log panel** (`d6f32d3` + `140251b` + `e7345ae` +
+  `4437a1a`). New bottom-edge UI panel showing a 5-row window
+  onto recent + upcoming moves: 2 prev rows above the active
+  row + active row highlighted in `ACCENT_PRIMARY` + 2 next
+  rows below. Header reads `▌ MOVE LOG · N/M` (or
+  `▌ MOVE LOG · COMPLETE` when finished). Active row carries
+  a `▶` focus prefix and `TEXT_PRIMARY_HC` text colour for
+  legible contrast against the brick-red highlight. Prev /
+  next rows render in `TEXT_SECONDARY` so the active row
+  stays the focal point.
+  - Sibling-of-banner pattern (separate root entity anchored
+    at viewport bottom, not a banner child) — same
+    spawn/despawn lifecycle as `ReplayFloatingProgressChip`,
+    different screen anchor.
+  - Five pure helpers handle the formatting:
+    `format_pile`, `format_move_body`,
+    `format_move_log_header`, `format_kth_recent_row` (active
+    + prev), `format_kth_next_row` (next). 1-indexed display
+    numbers throughout (`Foundation(2)` reads as "foundation
+    3" rather than the enum's 0-index).
+  - Panel grows from 56 → 84 → 112 px across the four
+    move-log commits. `MOVE_LOG_PREV_ROWS` and
+    `MOVE_LOG_NEXT_ROWS` constants (both = 2) parameterise
+    the row count; `format_kth_recent_row` and
+    `format_kth_next_row` return empty for out-of-range k so
+    panels gracefully under-fill at the start (cursor=1) and
+    end (cursor=N-1) of a replay.
+  - HC marker on the panel's top border so the 1 px edge
+    bumps under HC mode (same pattern as the keybind footer).
+
+### Changed
+
+- **`react_to_state_change` despawns the Move Log panel** on
+  `Playing → Inactive` alongside the banner root and floating
+  progress chip. Third query in the same defer-and-despawn
+  cycle.
+- **Move Log panel height grew 56 → 84 → 112 px** across the
+  prev-rows and next-rows commits. The panel is sized to fit
+  the chosen row count + header + padding; tunable via the
+  `MOVE_LOG_PANEL_HEIGHT` const.
+- **`format_active_move_row` now prefixes the `▶` focus
+  marker** (`e7345ae`). Wraps `format_kth_recent_row(state, 1)`
+  and prepends the prefix when the body is non-empty. Empty
+  case still returns empty — cursor=0 doesn't paint a stray
+  `▶` on an otherwise-empty row.
+
+### Documentation
+
+- `SESSION_HANDOFF.md` refreshed twice this cycle — once
+  recording the HC paint + continuous-scrub polish, then
+  again as the Move Log arc shipped commit-by-commit. The
+  Resume menu's B option now traces the full arc:
+  notches → labels → footer → ESC → HC → arrow keys →
+  HC paint → continuous scrub → move log.
+
+### Stats
+
+- **1273 passing tests / 0 failing** across the workspace
+  (net +23 from v0.21.5's 1250 baseline):
+  - 2 from `d3cb1a5` (HC marker on track + notches).
+  - 2 from `2e25476` (continuous-scrub repeat-while-held +
+    release-resets-accumulator).
+  - 8 from `d6f32d3` (move-log panel init + 5 helpers + 3
+    spawn / lifecycle scenarios).
+  - 4 from `140251b` (prev rows: helper k coverage + spawn
+    cardinality + spawn texts + repaint on cursor advance).
+  - 3 from `e7345ae` (active row highlight: wrapper bg +
+    text colour + focus prefix + cursor=0 stays empty).
+  - 4 from `4437a1a` (next rows: helper k coverage + spawn
+    cardinality + spawn texts + under-fill at replay end).
+- Clippy clean across the workspace.
+
+## [0.21.5] — 2026-05-08
+
+Patch release for the post-v0.21.4 work. One through-line:
+**replay-overlay scrubbing affordances + accessibility**. v0.21.4
+shipped pause / resume / step + the WIN MOVE marker as the first
+*scrubbing-shaped* additions to the replay overlay; v0.21.5
+fills out the rest of the scrubbing UX so the player has both
+visual anchor points (notches + labels) and a complete keyboard
+control surface (Space / Esc / ← / →) for navigating a paused
+replay.
+
+Two of the six commits in this cycle are layout-changing — they
+grow the banner height from 60 px → 76 px → 92 px to make room
+for the notch labels and keybind footer. Banner geometry was
+fixed for every prior B-2 commit; this release establishes the
+"grow the container, add a flex-column child" pattern that the
+remaining B-2 sub-pieces (move-log scroller, mini-tableau
+preview) will inherit when they land.
+
+### Added
+
+- **Quarter-mark scrub-bar notches** (`fe68861`). Five 1 px
+  vertical ticks at 0 / 25 / 50 / 75 / 100 % give the player
+  visual anchor points without needing to mentally bisect the
+  bar. Pure helper `scrub_notch_positions()` returns the fixed
+  array; spawn loop sits next to the WIN MOVE marker spawn so
+  the lifecycles match. Notches paint in `BORDER_SUBTLE` (same
+  as the unfilled track) and rely on extending past the 1 px
+  track (5 px tall, anchored 2 px above the track top) for
+  visibility — same trick the WIN MOVE marker uses. Spawned
+  *after* the WIN MOVE marker so a notch and the marker
+  landing on the same percentage paint the marker on top.
+- **Percentage labels under each notch** (`d322abf`). Five
+  `0%` / `25%` / `50%` / `75%` / `100%` labels in a new 16 px
+  row beneath the 1 px scrub track give the player explicit
+  quarter-mark readouts. Banner grew from 60 → 76 px to
+  accommodate the row — first **layout-changing** commit in
+  the B-2 arc. Pure helper `scrub_notch_labels()` returns the
+  fixed array, paired index-for-index with
+  `scrub_notch_positions()`. Spawn loop applies an "endpoints
+  flush, middle three percent-anchored" positioning pattern:
+  leftmost label gets `left: 0`, rightmost gets `right: 0`,
+  middle three anchor at `left: Val::Percent(p)` since Bevy
+  0.18 UI lacks a clean CSS-style `translate-x: -50%`
+  centering primitive. Label colour is `TEXT_SECONDARY`
+  rather than the mockup's `BORDER_SUBTLE` (the latter would
+  match the notches but is too low-contrast against
+  `BG_ELEVATED_HI` to read at 12 px).
+- **Keybind-hint footer** (`1873b3f`). Vim-style mode line on
+  the left (`▌ NORMAL │ replay`) plus a keybind hint on the
+  right at the bottom edge of the banner. Banner grew from
+  76 → 92 px to fit the 16 px footer row. Surfaces every
+  wired keyboard accelerator visually so CLAUDE.md §3.3's
+  UI-first contract holds for keyboard accelerators too. The
+  footer lists *only* keybinds that are actually wired —
+  the only-wired-keybinds discipline means each release
+  cycle's hint string is a precise honest contract with the
+  player. Two pure helpers (`keybind_footer_mode_text`,
+  `keybind_footer_hint_text`) keep the static text testable.
+  1 px top border in `BORDER_SUBTLE` separates the footer
+  from the labels row.
+- **ESC keyboard accelerator for replay-stop** (`90e24d9`).
+  New `handle_stop_keyboard` system parallels
+  `handle_pause_keyboard` in shape — fires only when state
+  is `Playing`, calls `stop_replay_playback`. Cross-plugin
+  coordination via `pause_plugin::toggle_pause`: added a
+  fourth defer-if check
+  (`replay_state.is_some_and(|s| s.is_playing())`) right
+  after the existing `other_modal_scrims` check so ESC
+  during active replay belongs to the replay overlay, not
+  the pause modal.
+- **HC-mode coverage for the keybind-footer top border**
+  (`23902cd`).
+  `HighContrastBorder::with_default(BORDER_SUBTLE)` marker
+  on the footer's border-carrying Node so the existing
+  `apply_high_contrast_borders` system bumps the 1 px top
+  border from `#505050` → `#a0a0a0` when
+  `Settings::high_contrast_mode` is on. Without the marker
+  the footer reads as floating loose under HC because the
+  border that anchors it to the labels row is
+  near-invisible.
+- **← / → keyboard accelerators for paused stepping**
+  (`e5c4f51`). New `step_backwards_replay_playback` in
+  `replay_playback.rs` decrements the cursor and dispatches
+  `UndoRequestEvent`; the game's `handle_undo` reads it
+  next frame to reverse its most-recent move. Hooks the
+  existing undo system rather than replaying-forward-from-
+  zero — every replay-applied move pushes to the undo stack
+  the same way a player move would, so undo is the right
+  reversal primitive. Both arrow keys are paused-only via
+  the same destructure-gate pattern the forward step uses.
+  The mockup labels these `[← →] scrub`; single-move step
+  is the closest behaviour shippable today, so the footer
+  hint reads `[← →] step` — only-wired-keybinds discipline.
+
+### Changed
+
+- **Banner height grew 60 → 76 → 92 px** across two
+  layout-changing commits (`d322abf` then `1873b3f`). Top
+  row's `flex_grow: 1.0` still consumes 59 px so the
+  existing content (label / progress chip / buttons) has
+  the same vertical space; the new rows (16 px labels +
+  16 px footer) extend the banner downward into the
+  gameplay area. Banner geometry is now mutable — every
+  prior B-2 commit fit inside fixed 60 px space.
+- **Keybind-footer hint text grew alongside the wirings**:
+  `[SPACE] pause/resume` →
+  `[SPACE] pause/resume · [ESC] stop` →
+  `[SPACE] pause/resume · [ESC] stop · [← →] step`.
+- **`pause_plugin::toggle_pause` now defers when a replay
+  is active** (`90e24d9`). Adds a fourth defer-if check to
+  the existing modal-stack pattern.
+- **`ReplayOverlayPlugin` registers
+  `add_message::<UndoRequestEvent>()`** (`e5c4f51`).
+  Defensive registration so the plugin runs cleanly under
+  `MinimalPlugins` without `GamePlugin` attached.
+
+### Documentation
+
+- `SESSION_HANDOFF.md` refreshed five times this cycle.
+  The B option in the Resume menu now traces the full arc:
+  notches → labels → footer → ESC → HC → arrow keys.
+- The pre-existing `daily_challenge` warning test that
+  fails when wall-clock UTC is within 30 minutes of
+  midnight is documented in this cycle's handoff. Same
+  shape as the earlier `winnable_seed_search` flake —
+  time-dependent, deterministically passes outside the
+  trigger window.
+
+### Stats
+
+- **1250 total tests / 1249 passing / 1 pre-existing
+  time-dependent flake** across the workspace (net +22 from
+  v0.21.4's 1228 baseline):
+  - 4 from `fe68861` (scrub-notch coverage)
+  - 4 from `d322abf` (notch-label coverage)
+  - 4 from `1873b3f` (keybind-footer coverage)
+  - 3 from `90e24d9` (ESC-accelerator coverage)
+  - 1 from `23902cd` (HC-marker coverage)
+  - 6 from `e5c4f51` (arrow-keyboard coverage)
+- **Pre-existing flake**:
+  `daily_challenge_plugin::tests::check_system_fires_warning_event_only_once_per_day`
+  fails when wall-clock UTC is within 30 minutes of
+  midnight. Verified pre-existing by stash-and-retest
+  before each commit. Will pass deterministically outside
+  the trigger window. Not introduced by this release.
+- Clippy clean across the workspace.
+
+## [0.21.4] — 2026-05-08
+
+Patch release for the post-v0.21.3 work. One through-line:
+**replay-scrubbing accessibility**. The replay overlay used to be
+pure-passive — the player started a replay, watched it execute,
+and waited for it to end. v0.21.4 adds the scaffolding for
+*navigating within* a replay: a WIN MOVE marker on the scrub bar
+so the player can see at a glance where the winning move sits,
+and pause / resume / step controls so they can stop on any move
+and inspect the board.
+
+The work is also the first three commits on the B-2 replay
+screen-takeover redesign arc. The remaining pieces (screen-
+takeover layout, move-log scroller, mini-tableau preview) are
+deferred to a future cycle because they need a layout reflow
+that the existing banner-only overlay can't carry.
+
+### Added
+
+- **`Replay::win_move_index: Option<usize>` data field**
+  (`ab857bb`). Additive optional field on the persisted
+  `Replay` shape. `#[serde(default)]` keeps older
+  `latest_replay.json` / `replays.json` files loadable without
+  bumping `REPLAY_SCHEMA_VERSION` — this is purely additive.
+  Populated at the live recording site
+  (`game_plugin::handle_game_won`) via a new builder-style
+  setter `Replay::with_win_move_index`. For fresh recordings
+  the value is always `Some(moves.len() - 1)` because recording
+  freezes on win, but storing it explicitly lets the playback
+  UI read the WIN MOVE position directly without re-deriving
+  on every render.
+- **WIN MOVE scrub-bar marker** (`52befa6`). New
+  `ReplayOverlayWinMoveMarker` component spawned as a sibling
+  to `ReplayOverlayScrubFill` under the 1px scrub track,
+  absolute-positioned at `replay.win_move_index / total %` of
+  the bar. Painted in `STATE_SUCCESS` (green) so the marker
+  reads as "this is where the win lives." Pure helper
+  `win_move_marker_pct` returns `None` for any state where the
+  marker shouldn't draw (Inactive, Completed, replay missing
+  the field, empty move list); percentage clamps to `[0, 100]`
+  defensively. Spawn-time only — the position never changes
+  during a single playback because the underlying `Replay` is
+  immutable while `Playing`.
+- **Pause / Resume / Step playback controls** (`fbe48ac`). New
+  `paused: bool` field on `ReplayPlaybackState::Playing`.
+  `tick_replay_playback` skips the `secs_to_next` decrement
+  entirely while paused so cursor and timer freeze together;
+  resuming starts the next move from a full interval. New
+  public API: `toggle_pause_replay_playback` and
+  `step_replay_playback` (the latter hard-gated to `Playing {
+  paused: true }` via the destructure pattern itself, so
+  manual stepping can't race the tick loop). On-screen Pause
+  and Step buttons sit alongside the existing Stop button;
+  `Space` keyboard accelerator toggles pause / resume.
+- **`Replay::with_win_move_index` builder** (`ab857bb`).
+  Chainable setter so the recording site can write
+  `Replay::new(...).with_win_move_index(idx)`. Keeps
+  `Replay::new`'s signature stable across the 13+ existing
+  test-fixture call sites that don't care about the field.
+
+### Changed
+
+- **`Replay::new` writes `win_move_index: None`** (`ab857bb`).
+  Existing canonical constructor stays signature-compatible
+  with all existing callers. The field is opt-in via the
+  builder.
+- **`game_plugin::handle_game_won` populates the new field**
+  (`ab857bb`). The recording site computes
+  `recording.moves.len().checked_sub(1)` as the win-move
+  index. `checked_sub` rather than direct subtraction guards
+  the unreachable empty-recording branch (which is also
+  guarded earlier in the function).
+- **`tick_replay_playback` honors the new `paused` flag**
+  (`fbe48ac`). Skipping the timer decrement is the only
+  behavior change; the loop body and Completed-detection are
+  unchanged. Stepping fires moves directly via
+  `step_replay_playback`, bypassing the tick path entirely.
+- **Pause / Resume button label is reactive** (`fbe48ac`).
+  `update_pause_button_label` walks `Children` from the
+  marked button to its inner `Text` and repaints the label
+  whenever `ReplayPlaybackState` changes. Pure helper
+  `pause_button_label` covers all four state arms (running,
+  paused, inactive, completed).
+- **25 existing `Playing { ... }` construction sites gained
+  `paused: false`** (`fbe48ac`). Mechanical edit across
+  `replay_overlay`, `achievement_plugin`, and
+  `replay_playback` tests to satisfy the new field
+  requirement. No behavioral change.
+
+### Documentation
+
+- `SESSION_HANDOFF.md` refreshed three times this cycle —
+  once after each post-cut feature commit. The B-2 entry in
+  the Visual-identity follow-ups list now points at the
+  remaining sub-pieces (screen-takeover layout, move-log
+  scroller, mini-tableau preview) as a single multi-session
+  arc rather than three independent ones, since they share a
+  layout-reflow prerequisite.
+
+### Stats
+
+- **1228 passing tests / 0 failing** across the workspace
+  (net +21 from v0.21.3's 1207 baseline):
+  - 5 from `ab857bb`'s `win_move_index` coverage: default
+    constructor, builder set / set-None, on-disk round-trip,
+    legacy-JSON-loads-with-None backward-compat. The last
+    test pins the no-schema-bump claim — if a future refactor
+    drops the `#[serde(default)]`, that test catches it.
+  - 8 from `52befa6`'s WIN MOVE marker: pure-helper truth
+    table (Inactive / Completed / no-field / correct-position
+    / clamp) + spawn-presence-with-field /
+    spawn-absence-without / despawn-with-overlay observables.
+  - 8 from `fbe48ac`'s playback controls: label truth table,
+    label repaint on state change, click-toggles-paused,
+    step advances cursor by exactly one with paused
+    preserved, step-while-running no-op, Space toggles
+    paused.
+- Zero clippy warnings under `cargo clippy --workspace
+  --all-targets -- -D warnings`.
+- `cargo test --workspace` clean.
+
+## [0.21.3] — 2026-05-08
+
+Patch release for the post-v0.21.2 work. One through-line:
+**accessibility arc closure**. v0.21.2 explicitly carved out
+"dynamic-paint sites" (HUD action buttons, modal buttons, radial
+menu rim) on the assumption that their existing paint cycles would
+race the central `update_high_contrast_borders` system. v0.21.3
+walks the actual code, finds the carve-out was over-cautious, and
+closes it. Bonus: the first real consumer of `ToastVariant::Warning`
+also lands here, making the `ToastVariant` enum fully load-bearing
+(every variant has at least one driver).
+
+### Added
+
+- **`WarningToastEvent(String)` — first `ToastVariant::Warning`
+  consumer** (`279e23d`). Generic carrier message that any system
+  can fire to spawn a 4 s amber-bordered fire-and-forget toast.
+  Mirrors the v0.21.2 `MoveRejectedEvent` → `Error` toast wiring:
+  domain message crosses the plugin boundary, the animation
+  plugin's `handle_warning_toast` system reads it and spawns. Not
+  queued (Warning is alert-shaped, not info-shaped — should never
+  block on a queue).
+- **Daily-challenge-expiry warning** (`279e23d`). First in-engine
+  driver of `WarningToastEvent`. New
+  `daily_challenge_plugin::check_daily_expiry_warning` system
+  fires at most once per `DailyChallengeResource::date` when the
+  player is within 30 min of UTC midnight reset and today's
+  challenge isn't yet complete. Suppression decided by a pure
+  helper (`compute_expiry_warning_minutes`) covering: already-
+  completed-today, already-shown-for-this-date, outside the
+  threshold window, post-midnight rollover. Pure-helper-plus-
+  thin-system shape because `Utc::now()` can't be pinned without
+  injecting a clock resource — overkill for one consumer.
+- **`radial_rim_outline` pure helper** (`c153363`). Decision
+  logic for the radial-menu rim outline colour. Resting outlines
+  always carry `BORDER_SUBTLE`; focused outlines carry
+  `BORDER_STRONG` normally and `BORDER_SUBTLE_HC` under HC. Naive
+  marker substitution would invert the focused-vs-resting
+  hierarchy because `BORDER_SUBTLE_HC` (`#a0a0a0`) is *lighter*
+  than `BORDER_STRONG` (`#505050`); folding the choice in here
+  keeps the focused rim more visible under HC, not less.
+
+### Changed
+
+- **HC marker pattern extended to HUD action buttons + modal
+  buttons** (`c153363`). Re-reading the code revealed both sites'
+  paint systems (`paint_action_buttons`, `paint_modal_buttons`)
+  only mutate `BackgroundColor` — `BorderColor` is set once at
+  spawn and never touched. So the existing
+  `HighContrastBorder::with_default(BORDER_SUBTLE)` marker
+  pattern works cleanly for both, no race. v0.21.2's carve-out
+  comment was based on assumed-but-not-actual race risk; this
+  cycle treats it as the doc-vs-implementation drift pattern in
+  the wild and verifies before trusting.
+- **Radial menu rim folds HC into per-frame respawn**
+  (`c153363`). The rim is the only true dynamic-painter of the
+  three carved-out sites — `radial_redraw_overlay` despawns and
+  respawns all rim sprites every frame the radial is `Active`.
+  The `HighContrastBorder` marker can't apply (entities don't
+  persist across frames) so HC is read directly in the system
+  via `Option<Res<SettingsResource>>` and routed through
+  `radial_rim_outline`. The `Option<Res<...>>` shape preserves
+  test compatibility under `MinimalPlugins`.
+- **Animation plugin registers `WarningToastEvent`** (`279e23d`).
+  Joins `InfoToastEvent`, `MoveRejectedEvent` etc. in
+  `AnimationPlugin::build`. Daily-challenge plugin also
+  registers it (idempotent) so the message exists when running
+  the daily plugin under `MinimalPlugins` without the animation
+  plugin attached.
+
+### Documentation
+
+- `SESSION_HANDOFF.md` refreshed twice this cycle — once after
+  the Toast Warning wiring (menu trimmed 5 → 4 options), and
+  again after the HC dynamic-paint rollout (menu trimmed 4 → 3,
+  with all remaining options now flagged as multi-session). The
+  `High-contrast accessibility mode` entry in the Visual-identity
+  follow-ups list is updated to reflect that no "un-tagged
+  because race-risk" surfaces remain.
+
+### Stats
+
+- **1207 passing tests / 0 failing** across the workspace
+  (net +12 from v0.21.2's 1195 baseline):
+  - 7 tests for `compute_expiry_warning_minutes` (`279e23d`)
+    covering each suppression rule + the inclusive boundary at
+    exactly 30 min remaining.
+  - 1 in-Bevy test (`check_system_fires_warning_event_only_once_per_day`)
+    pinning `DailyExpiryWarningShown`'s once-per-date
+    suppression and the symmetric "already-completed-today"
+    suppression.
+  - 4 truth-table tests for `radial_rim_outline` (`c153363`):
+    focused × HC. The "resting stays subtle under HC" test
+    explicitly documents *why* — it's the hierarchy-preservation
+    invariant a future refactor might be tempted to break.
+- Zero clippy warnings under `cargo clippy --workspace
+  --all-targets -- -D warnings`.
+- `cargo test --workspace` clean.
+
+## [0.21.2] — 2026-05-08
+
+Patch release for the post-v0.21.1 polish work. Three through-
+lines: **accessibility extensions** (reduce-motion gating for
+splash animations, full HC chrome rollout across 8 surfaces),
+**replay polish** (floating MOVE chip above the focused card
+during playback), and the **first real consumer of
+`ToastVariant::Error`** (invalid-move feedback as the third leg
+of the existing audio + visual rejection-feedback stool).
+
+The accessibility extensions close two threads v0.21.1 left
+explicitly open: reduce-motion was previously gated only on card
+slide_secs, and HC borders had `BORDER_SUBTLE_HC` defined but no
+consumers. v0.21.2 finishes both — non-essential motion in the
+splash boot screen now respects reduce-motion, and every static-
+border chrome surface (modal scaffold, tooltip, help / stats /
+home / settings panels) boosts to the HC variant under high-
+contrast mode. Dynamic-paint sites (HUD action buttons, modal
+buttons, radial menu rim) intentionally stay un-tagged because
+their existing paint cycles would race the HC system; they
+remain open for a future iteration that needs a different shape.
+
+### Added
+
+- **`sync_pile_marker_visibility` system precursor was v0.21.1's;
+  this cycle adds**: `update_high_contrast_borders` system in
+  `settings_plugin` (`c9af1ea`). Walks all entities tagged with
+  `HighContrastBorder` each Update tick, swaps `BorderColor` to
+  `BORDER_SUBTLE_HC` when high-contrast mode is on. Compares
+  current colour and only mutates when different so Bevy's
+  change-detection doesn't trigger repaints every frame. New
+  `HighContrastBorder { default_color: Color }` component carries
+  the off-state colour at each tagged site so the system can
+  revert correctly.
+- **HC chrome rollout — 8 tagged surfaces** (`c9af1ea` modal
+  scaffold; `d87761d` tooltip + onboarding key chips + help
+  panel key chips + stats panel cells; `ec804d5` home Level/XP/
+  Score row + home mode-selector buttons + home mode-hotkey
+  chips + 4 settings panel surfaces). Each tagging is one line
+  on the spawn tuple. The marker-component architecture pays
+  back proportionally to the number of consumers — the per-
+  commit cost dropped from ~75 lines (foundation + first
+  surface) to ~13 lines (4 surfaces) to ~9 lines (7 surfaces).
+- **Floating MOVE chip during replay** (`2fb2d63`). New
+  `ReplayFloatingProgressChip` marker on a `Text2d` entity
+  rendered in 2D world space above the destination pile of the
+  most-recently-applied move. Sibling of the banner overlay (not
+  a child) because it lives in world-space coordinates, not the
+  UI tree. Lifecycle matches the banner: `spawn_overlay` spawns
+  the chip alongside the banner when a replay starts;
+  `react_to_state_change` despawns it when the replay ends.
+  World-space placement (rather than UI-space + camera projection)
+  uses the same `LayoutResource` pile coordinates that drive
+  every other piece of pile geometry — stays correctly positioned
+  through window resizes for free. Hidden when cursor=0 (no
+  moves applied yet) or when the last applied move was a
+  `StockClick` (no destination pile to follow).
+- **`handle_move_rejected_toast` system + first real
+  `ToastVariant::Error` consumer** (`68d50b5`). When
+  `MoveRejectedEvent` fires (illegal placement attempt), spawns
+  a 2-second pink-bordered "Invalid move" toast. Joins the
+  existing `card_invalid.wav` (audio cue) and destination-pile
+  shake (visual cue) as the accessibility-focused readable text
+  channel — covers deaf players (no audio reliance) and
+  reduce-motion players (no shake reliance) with a persistent
+  ~2 s text cue. Drops the `#[allow(dead_code)]` from
+  `ToastVariant::Error` and updates its doc to point at the new
+  consumer.
+
+### Changed
+
+- **Splash scanline overlay skipped under reduce-motion**
+  (`ed152e2`). `spawn_splash` reads `Settings::reduce_motion_mode`
+  and skips the scanline texture / overlay node entirely when
+  on. Without the scanlines the boot screen still reads as
+  terminal-themed (foreground content, borders, palette swatches
+  unchanged); the scanlines are decorative.
+- **Splash cursor pulse held under reduce-motion** (`ed152e2`).
+  `pulse_splash_cursor` reads `Settings::reduce_motion_mode` and
+  skips the per-frame sine-pulse multiplier when on — the cursor
+  still fades in / out with the global splash alpha (essential
+  timing) but doesn't blink. Spec calls out non-essential motion
+  as the reduce-motion target; the global fade is essential
+  (otherwise the splash would hard-cut on/off, which is
+  jarring), and the cursor blink is decorative.
+- **`AnimationPlugin::build` registers
+  `MoveRejectedEvent`** (`68d50b5`). Bevy's `add_message` is
+  idempotent, so the duplicate registration with
+  `feedback_anim_plugin` (which already registered the message)
+  coexists cleanly. Required for the new
+  `handle_move_rejected_toast` system to run under
+  MinimalPlugins (tests).
+
+### Documentation
+
+- `docs/ui-mockups/design-system.md` and `SESSION_HANDOFF.md`
+  refreshed in lockstep with the rollouts. The handoff's
+  Resume-prompt menu trimmed twice this cycle as Options A and F
+  closed in v0.21.1, then this commit cycle's accessibility
+  extensions implicitly closed the "future scope" footnotes
+  v0.21.1 left on F's documentation.
+
+### Stats
+
+- **1195 passing tests / 0 failing** across the workspace
+  (net +3 from v0.21.1's 1192 baseline). New tests added by
+  this cycle:
+  - `splash_skips_scanline_overlay_under_reduce_motion`
+    (`ed152e2`) pins the reduce-motion gate on the splash
+    scanline overlay. Discovered an asset-fixture bootstrapping
+    detail along the way: under `MinimalPlugins`,
+    `Assets<Image>` isn't auto-inserted; the test had to add
+    `bevy::asset::AssetPlugin::default()` and
+    `init_asset::<bevy::image::Image>()`. Pattern flagged for
+    future asset-using tests.
+  - `floating_chip_spawns_and_despawns_with_overlay`
+    (`2fb2d63`) pins the floating MOVE chip's lifecycle:
+    absent on Inactive, exactly one on Playing, absent again
+    on return to Inactive.
+  - `move_rejected_event_spawns_error_toast` (`68d50b5`) pins
+    the new toast wiring: firing a `MoveRejectedEvent` spawns
+    exactly one `ToastOverlay` on the next tick.
+- Zero clippy warnings under `cargo clippy --workspace
+  --all-targets -- -D warnings`.
+- `cargo test --workspace` clean.
+
+## [0.21.1] — 2026-05-08
+
+Patch release for the post-v0.21.0 work — closes Resume-prompt
+Options A (app icon) and F (high-contrast + reduce-motion
+accessibility modes), plus a card-visual iteration cycle that
+moved through three states: the v0.21.0 Terminal pink/gray, a
+brief 4-colour-deck experiment (hearts pink, diamonds gold,
+clubs lime, spades gray), and a reversion to traditional 2-colour
+"Microsoft Solitaire on dark mode" pairing (saturated red +
+near-white). Two visible bugs surfaced and were fixed during
+the iteration: the suit-coloured border produced anti-aliasing
+artifacts at rounded card corners (border dropped entirely),
+and the pile-marker sprite bleed-through created visible "gray
+L" shapes where cards sat on markers (markers now hide when
+occupied — the documented but previously-not-enforced "remain
+visible only where a pile is empty" invariant).
+
+### Added
+
+- **Desktop window icon** (`3eb3a26`). Runtime `Window::icon`
+  wired via `WinitWindows`; embedded 256 px PNG decoded on
+  startup via `tiny_skia` and handed to winit. Plus a 9-size
+  PNG hierarchy at `assets/icon/icon_<size>.png` covering
+  Linux hicolor (16/24/32/48/64/128/256/512), Windows `.ico`
+  targets (16/32/48/256), and macOS `.icns` targets
+  (16/32/64/128/256/512/1024). All sizes generated from a
+  shared `icon_svg` builder (Terminal `▌RS` mark on dark
+  `#151515` with brick-red accent) by a new
+  `icon_generator` example. Pin test `icon_svg_pin` guards
+  rasterised RGBA bytes against `usvg`/`resvg` drift. Two
+  new `solitaire_app` deps target-gated to non-Android:
+  direct `winit = "0.30"` (for `Icon` construction —
+  `bevy_winit` 0.18 doesn't re-export it) and direct
+  `tiny-skia` (for PNG → RGBA decode). Android draws its
+  launcher icon from the APK manifest, so neither dep is
+  needed there.
+- **`Settings::high_contrast_mode` flag** (`c5787c6`). Boosts
+  card text colours: hearts/diamonds → `RED_SUIT_COLOUR_HC`
+  (`#ff6868`), clubs/spades → `TEXT_PRIMARY_HC` (`#f5f5f5`).
+  Composes with `color_blind_mode`: CBM lime wins over HC red
+  on red suits when both are on; HC still applies to dark
+  suits independent of CBM. Six new tests pin the truth
+  table.
+- **`Settings::reduce_motion_mode` flag** (`c5787c6`). Forces
+  `effective_slide_secs` to `0.0` regardless of the
+  `AnimSpeed` selection, making cards snap instantly to their
+  target. Two new tests pin the gate behaviour and the
+  fall-through to `anim_speed_to_secs` when off. Future
+  scope: gate splash scanline / cursor pulse / warning-chip
+  pulse on the same flag.
+- **Settings UI toggle rows** (`07e0357`). Two new rows in
+  the Settings panel under Cosmetic (alongside Color-blind):
+  "High Contrast" and "Reduce Motion". `tab-walk` order
+  visits all three accessibility flags in one vertical run.
+  Same shape as the existing `ColorBlindText` toggle scaffold
+  with marker components, label updaters, click handlers,
+  and disambiguator chains.
+- **`sync_pile_marker_visibility` system** (`4d48cad`).
+  Implements the module-level doc invariant in `table_plugin`
+  ("pile markers ... remain visible only where a pile is
+  empty") that was previously declared but not enforced.
+  Hides the pile-marker sprite for any pile that has a card
+  on top, shows it for empty piles. Closes the "gray L
+  corners" artifact where the marker's translucent fill bled
+  through the rounded card corners.
+
+### Changed
+
+- **Card-face suit colours** (`62b61cc` → `ddb6540`). Started
+  the cycle at v0.21.0's Terminal pink (`#fb9fb1`) / gray
+  (`#d0d0d0`), briefly experimented with a 4-colour deck
+  (`62b61cc` — hearts pink, diamonds gold, clubs lime, spades
+  gray) for faster suit recognition by hue alone, then
+  reverted to traditional 2-colour pairing at the player's
+  request (`ddb6540`). Final state: `RED_SUIT_COLOUR =
+  #e35353` (saturated red, replacing the v0.21.0 pink) and
+  `BLACK_SUIT_COLOUR = #e8e8e8` (near-white, brighter than
+  the v0.21.0 `#d0d0d0` foreground gray so the dark suits
+  read as a chromatic-neutral counterpart to the saturated
+  red rather than as "the same gray as body text"). Reads
+  like Microsoft Solitaire on dark mode. `RED_SUIT_COLOUR_HC`
+  rebumped to `#ff6868` (brighter saturated red) so HC stays
+  more chromatic than the new default red rather than the
+  previous pinker boost. The 4-colour experiment's commit
+  history is preserved in the log; net delta vs. v0.21.0 is
+  the new red + new near-white.
+- **Card-face border dropped** (`dd97021`). The earlier 1 px
+  suit-coloured stroke on the card body produced
+  anti-aliasing artifacts at the rounded corners (the colored
+  stroke faded through gray pixels into the play surface).
+  Cards now have no border — body fill alone defines the
+  shape against the play surface; the 5-unit brightness gap
+  between `#1a1a1a` body and `#151515` surface is enough to
+  read as a card edge without an explicit stroke.
+  `design-system.md` § Game Cards line 225 updated in
+  lockstep.
+- **Settings UI accessibility row count** (`07e0357`). Three
+  toggles in Cosmetic now: Color-blind, High Contrast,
+  Reduce Motion. Existing query-disambiguator chains in
+  `handle_settings_buttons` extended with `Without<HighContrastText>`
+  and `Without<ReduceMotionText>` so the new components
+  don't ambiguate the existing mutations.
+
+### Fixed
+
+- **Bevy 0.18 system-param validation panic on icon startup**
+  (`716a025`). `NonSend<WinitWindows>` failed validation on
+  the first few frames before winit's `Resumed` event populated
+  the resource. Bevy 0.18's stricter validation panics rather
+  than skips when a non-send resource is absent; the error
+  message itself spelled out the fix ("wrap the parameter in
+  `Option<T>` and handle `None` when it happens"). Wraps
+  `winit_windows` as `Option<NonSend<WinitWindows>>` and
+  early-returns on `None`.
+- **"Gray L corners" on cards** (`4d48cad`). Two artifacts
+  were producing similar-looking grey at card corners: the
+  SVG stroke fading through gray pixels (closed by `dd97021`)
+  and the pile-marker sprite bleeding through the rounded
+  cutouts (closed by `4d48cad`). Right test target, wrong
+  visible-artifact target on the first attempt — the pin
+  test correctly drifted 52 face hashes, but the visible
+  gray came from a different layer. Two layers, two fixes;
+  the second closed the player-visible complaint.
+
+### Documentation
+
+- `docs/ui-mockups/design-system.md` § Suit Colors retitled
+  through three states (Terminal 2-color → "Four-color
+  deck" → final "Two-color traditional pairing"). Final
+  table records the saturated red + near-white. § Game Cards
+  border spec changed from "1px solid in suit color" to
+  "Border: none" with the artifact-rationale audit trail.
+  CBM section text updated through each colour-scheme
+  iteration.
+- `SESSION_HANDOFF.md` refreshed twice this cycle (`0c1cc40`
+  + `31139ae`) — the first reset the post-v0.21.0 narrative
+  ("no threads in flight"), the second recorded Options A +
+  F closures and trimmed the Resume-prompt menu.
+- New module-level doc strings on the new constants
+  (`RED_SUIT_COLOUR_HC`, `TEXT_PRIMARY_HC`, `BORDER_SUBTLE_HC`,
+  `RED_SUIT_COLOUR_CBM` semantic shift) record the
+  composability rules between CBM and HC and the "what to
+  use this for" rationale.
+
+### Stats
+
+- **1192 passing tests / 0 failing** across the workspace
+  (net +8 from v0.21.0's 1184 baseline). New tests added by
+  this release:
+  - `card_face_svg_pin` integration test rebaselined three
+    times during the suit-colour iteration; final hashes
+    pin the saturated-red + near-white + no-border state.
+  - 4 high-contrast text_colour tests + 2 reduce-motion
+    `effective_slide_secs` tests in `card_plugin` /
+    `animation_plugin` (from `c5787c6`).
+  - 1 `icon_svg_pin` integration test guarding the icon
+    rasterisation pipeline (from `48b28d2` — actually
+    landed in v0.21.0's accounting but worth noting for the
+    cycle).
+  - 1 `pile_markers_hide_when_pile_is_occupied` test pinning
+    the new visibility-by-occupancy invariant (from
+    `4d48cad`).
+- Zero clippy warnings under `cargo clippy --workspace
+  --all-targets -- -D warnings`.
+- `cargo test --workspace` clean.
 
 ## [0.21.0] — 2026-05-08
 

Cargo.lock

@@ -6957,6 +6957,8 @@ dependencies = [
  "keyring",
  "solitaire_data",
  "solitaire_engine",
+ "tiny-skia 0.12.0",
+ "winit",
 ]
 
 [[package]]
@@ -6965,6 +6967,8 @@ version = "0.1.0"
 dependencies = [
  "ab_glyph",
  "png 0.17.16",
+ "solitaire_core",
+ "solitaire_data",
 ]
 
 [[package]]
@@ -6984,6 +6988,7 @@ dependencies = [
  "axum",
  "chrono",
  "dirs",
+ "jni 0.21.1",
  "jsonwebtoken",
  "keyring-core",
  "reqwest",
@@ -7007,6 +7012,7 @@ dependencies = [
  "bevy",
  "chrono",
  "dirs",
+ "jni 0.21.1",
  "kira",
  "resvg",
  "ron",

Cargo.toml

@@ -31,6 +31,7 @@ keyring     = "4"
 keyring-core = "1"
 reqwest     = { version = "0.13", features = ["json", "rustls", "rustls-native-certs"], default-features = false }
 arboard     = { version = "3", default-features = false }
+jni         = { version = "0.21", default-features = false }
 
 solitaire_core   = { path = "solitaire_core" }
 solitaire_sync   = { path = "solitaire_sync" }

SESSION_HANDOFF.md

@@ -1,521 +1,189 @@
 # Solitaire Quest — Session Handoff
 
-**Last updated:** 2026-05-08 — v0.20.0 cut and tagged at `41a009a`,
-all post-cut commits pushed to origin (HEAD = `dd101b3`), working
-tree clean.
-The cut itself shipped two through-lines: a full **Terminal visual-
-identity port** (token system, modal scaffold, gameplay-feedback,
-toasts, table / card chrome, splash cursor) and the **Android
-persistence shim** that closes the `dirs::data_dir() = None` pitfall
-flagged in CLAUDE.md §10. Since the cut, the post-tag work split
-into two arcs: (1) splash boot-screen port + replay-overlay
-banner enrichments + desktop-adaptation spec — closing Resume-prompt
-Options B and C (see "Since the v0.20.0 cut" entries below); and
-(2) **the card-face artwork regeneration arc — Option D, closed
-2026-05-08** — full Terminal cards rendering on every face, plus
-three follow-up fixes that surfaced during sign-off (default-theme
-SVG override, table backgrounds, top-bar overlap), plus a
-glyph-orientation tweak (no 180° inverted-corner rotation).
+**Last updated:** 2026-05-08 — **v0.21.8 tagged at `c50eaf8`**;
+nine post-cut commits on master. Push pending.
+
+v0.21.8 closes the last optional polish items in the B-2
+replay screen-takeover arc: **notch-label centering** (middle
+three scrub-bar labels now centred on their notch ticks via the
+CSS `translateX(-50%)` pattern for Bevy 0.18 UI) and **WIN
+MOVE HC legibility** (lime stays lime under HC mode via the
+extended `HighContrastBackground::with_hc` constructor and a
+new `STATE_SUCCESS_HC` brighter-lime constant). The replay
+overlay arc is now fully closed with no known open items.
+
+Full v0.21.8 detail lives in `CHANGELOG.md` § [0.21.8]. This
+file from here on focuses on what's *open* post-cut and how to
+resume.
 
 ## Status at pause
 
-- **HEAD locally:** see `git rev-parse HEAD`. Most recent narrative
-  entry below names the latest substantive commit; this status line
-  intentionally avoids hard-coding the SHA so a docs-only edit
-  doesn't immediately stale the handoff.
-- **HEAD on origin:** matches local. All post-cut commits pushed
-  through `dd101b3`. Decide whether to roll the post-tag work
-  into v0.20.1 / v0.21.0-candidates the next time a release is cut.
-- **Working tree:** clean. No WIP outstanding.
+- **HEAD locally:** `f281425` (Android Keystore JNI).
+  Docs ride on top; push pending.
+- **HEAD on origin:** `395a322` (double-tap commit — last pushed).
+- **Working tree:** clean (docs uncommitted). No WIP outstanding.
 - **`artwork/` directory:** still untracked. Intentional.
 - **Build:** `cargo clippy --workspace --all-targets -- -D warnings`
   clean.
-- **Tests:** **1184 passing / 0 failing** across the workspace.
-  Net delta from the 1180 baseline: splash polish added two
-  (`build_scanline_image_has_expected_2x2_rgba_bytes`,
-  `scanline_overlay_spawns_and_fades_with_splash`); the
-  card-face migration added one (`card_face_svg_pin` integration
-  test) and consolidated two (`face_colour` CBM tests folded
-  into `text_colour` CBM tests, net −2 then +1 from pin);
-  call it +4 net.
-- **Tags on origin:** `v0.9.0` through `v0.20.0`. v0.20.0 is on
-  `41a009a`.
+- **Tests:** **1292 passing / 0 failing** across the workspace.
+- **Tags on origin:** `v0.9.0` through `v0.21.8`.
+- **Android:** APK verified booting on Pixel_7 AVD (Android 14,
+  x86_64). All desktop-only systems (handle_fullscreen) now gated.
+  See Phase Android punch list for remaining work.
 
-## Since the v0.20.0 cut (un-pushed)
+## Since the v0.21.8 cut
 
-### `39b8496` `docs(ui): add Terminal desktop-adaptation spec`
+Seven commits since the v0.21.8 tag:
+- `a449f60` — Stats Prev/Next selector spawn site
+- `202a64d` — Android launch fixes (android_main, resize_constraints,
+  apply_smart_default_window_size) — **closes APK launch verification**
+- `16242e6` — Ignore .idea/ IDE files
+- `395a322` — double-tap auto-move for touch input
+- `0cb1587` — Play-by-Seed dialog + HomeMode card
+- `2062bd0` — 75 new challenge seeds + gen_seeds binary
+- `45436d0` — gate handle_fullscreen to non-Android
+- `2c822ba` — JNI clipboard bridge for Android Stats share-link
+- `f281425` — Android Keystore AES-GCM token storage via JNI
 
-`docs/ui-mockups/desktop-adaptation.md` — 283 lines covering
-viewport assumptions, seven universal adaptation rules, and per-
-screen geometry rules for the priority surfaces (Game Table, Win
-Summary, Settings, Help, Pause, Home, Splash, Stats, and the
-modal-pattern screens Profile / Achievements / Theme Picker /
-Daily Challenge). Closes the spec gap — 23 of 24 mockups were
-mobile-only, but the v0.20.0 token-port pass was already layout-
-agnostic so nothing shipped broken. The spec matters for *next*
-ports.
+CHANGELOG + SESSION_HANDOFF docs ride on top; push pending.
 
-**Why rules > visual mockups for this gap:** Stitch's
-`generate_variants` API timed out on the layout-only adaptation
-prompt (server-side flake, not a prompt-shape issue — confirmed
-by polling `list_screens` with no new variant landing). A markdown
-rules file applies to every screen including the 9 missing-plugin
-surfaces (splash, challenge, time-attack, weekly-goals,
-leaderboard, sync, level-up, replay-overlay, radial-menu) that
-aren't in the Stitch project at all. It's also referenceable from
-code comments and commit messages without loading an image.
-
-### `cacb19c` `feat(engine): port the splash to the Terminal boot-screen treatment`
-
-Implements the full mockup-spec splash from
-`docs/ui-mockups/splash-mobile.html` plus the desktop adaptation
-rules:
-
-- **Header**: cursor block (96 px `▌`), wordmark ("Solitaire
-  Quest"), 192 px divider, "TERMINAL EDITION" subtitle.
-- **Boot log**: three ✓ check rows (`assets loaded`,
-  `theme: terminal`, `progress restored`) + a `▌ ready_` line.
-  Capped at 480 px width on desktop (else 70 % viewport).
-- **Progress bar**: 1 px track (`BORDER_SUBTLE`) with a 100 %-
-  width cyan (`ACCENT_PRIMARY`) fill + `DONE · 247 ASSETS`
-  caption. Capped at 720 px on desktop (else 80 %).
-- **Footer**: `BASE16-EIGHTIES` label, eight palette swatches
-  (12 × 12 px each — one per named token in the design system),
-  version line.
-
-**Refactored the alpha-fade scaffold** from per-marker queries
-(`SplashTitle` / `SplashSubtitle` / `SplashCursor`) to a single
-`SplashFadable { base_color: Color }` + `SplashFadableBg`
-variant. ~15 fadable elements share one global query each;
-adding more is one component-attach, not three new query types.
-
-**Skipped, with rationale captured in the commit:**
-- Scanline overlay (needs a tiled-pattern asset or custom shader).
-  *Open in "Visual-identity follow-ups" below.*
-- Pulsing cursor on the "ready_" line (would fight the global
-  fade timeline). *Open in "Visual-identity follow-ups" below.*
-- "RUSTY SOLITAIRE" wordmark from the mockup (the actual product
-  is "Solitaire Quest"; the mockup leaked the repo name). *Closed
-  — the in-engine wordmark stays "Solitaire Quest".*
-
-### `c84d9f4` `feat(engine): scrub fill bar + per-frame updater for replay overlay`
-
-Closes the WIP described in the prior handoff. Adds the 1 px cyan
-scrub bar called for in `docs/ui-mockups/replay-overlay-mobile.html`:
-a track in `BORDER_SUBTLE` spans the bottom edge of the banner and
-the cyan `ACCENT_PRIMARY` fill mirrors `cursor / total` via a new
-`ReplayOverlayScrubFill` component + `update_scrub_fill` system.
-The pure `scrub_pct` helper is shared between the spawn path
-(initial fill width) and the per-frame updater so the first paint
-already reflects state instead of popping `0 → cursor` on the
-first tick — same shape as the existing `format_progress` /
-`update_progress_text` split. Two new tests cover the four corners
-of `scrub_pct` and an end-to-end drive of `ReplayPlaybackState`
-asserting `Node.width` on the unique scrub-fill entity. Same
-change-detection guard as the text updaters, so an idle replay
-leaves the node untouched.
-
-Header text treatment (closed by `6204db8` immediately below),
-move-log scroll, MOVE chip, and WIN MOVE callout from the same
-mockup are still open — separate commits.
-
-### `6204db8` `feat(engine): port replay banner label to ▌ cursor-block treatment`
-
-Aligns the replay overlay's headline with the splash boot-screen
-idiom landed in `cacb19c`: `Replay` → `▌ replay` and
-`Replay complete` → `▌ replay complete`. The cursor block (`▌`,
-U+258C) prefixed to a lowercased label reads as a Terminal output
-line rather than a generic UI title, tightening the family
-resemblance between the two top-level overlay surfaces. Pure
-text-content change; no behavioural shift, no new components, no
-new systems.
-
-**Mockup deviation (intentional):** the source mockup string in
-`docs/ui-mockups/replay-overlay-mobile.html` is `▌replay.tsx`. The
-`.tsx` is a prototyping leak — Stitch renders in React, so the
-mockup author reached for a familiar filename — and was dropped
-for the in-engine version since the codebase is Rust. The `▌` +
-lowercase pattern is what reads as a Terminal-output-line; the
-extension is incidental. (Same shape as the "RUSTY SOLITAIRE"
-wordmark deviation noted under `cacb19c` — the mockup leaked the
-repo name; the actual product is "Solitaire Quest".)
-
-### `54005d5` `feat(engine): add GAME #YYYY-DDD caption beneath the replay headline`
-
-Adds the right-anchored game-identifier piece of the replay-overlay
-mockup, adapted to live *under* the existing "▌ replay" headline as
-a `TYPE_CAPTION` (11 px) / `TEXT_SECONDARY` subtitle. Format is
-`GAME #{year}-{ordinal:03}` (e.g. `GAME #2026-122` for a replay
-recorded 2026-05-02) — year + chrono ordinal gives a compact,
-monotonically-increasing identifier matching the mockup's
-`GAME #2024-127` motif. New `ReplayOverlayGameCaption` marker, new
-pure helper `format_game_caption(state) -> Option<String>` (None
-for Inactive / Completed since the replay is consumed in those
-branches; spawn-time fall-through to empty string).
-
-**Layout impact:** `BANNER_HEIGHT` bumped 48 → 60 px so the new
-left column (headline + 2 px gap + caption ≈ 39 px content) fits
-under the scrub bar with room to spare. +12 px banner mass is the
-deliberate cost of the new content; no other plugin observes
-`BANNER_HEIGHT` so the change is local.
-
-Two new tests (1180 → 1182): `format_game_caption_covers_state_corners`
-pins the three branches plus the zero-pad-to-3-digits invariant
-for early-January ordinals; `overlay_game_caption_shows_replay_date`
-drives `ReplayPlaybackState` end-to-end.
-
-### `e080b49` `feat(engine): restyle replay progress text as Terminal MOVE chip`
-
-Closes the centre-text half of the replay-overlay enrichments. The
-plain "Move N of M" text becomes a 1px `ACCENT_PRIMARY`-bordered
-chip containing "MOVE N/M" — uppercase + slash separator reads as
-a Terminal output line and matches the floating-chip motif in
-`docs/ui-mockups/replay-overlay-mobile.html`. The chip lives
-in-banner rather than floating above the focused card (the
-screen-takeover treatment that requires plumbing cursor → card
-identity remains deferred).
-
-**Implementation note:** `BorderColor` in Bevy 0.18 is a per-side
-struct, not a tuple — `BorderColor::all(ACCENT_PRIMARY)` is the
-correct constructor. Worth pinning for next time we touch a
-border-painted UI surface. The `ReplayOverlayProgressText` marker
-stays on the inner Text rather than the new chip Node so
-`update_progress_text` keeps repainting unchanged — a deliberate
-"markers belong on the entity that updates change" choice.
-
-Test count unchanged (1182); `overlay_progress_text_reflects_cursor`
-swapped its assertion from "Move 5 of 10" to "MOVE 5/10".
-
-This pair (`54005d5` + `e080b49`) closes Option C from the
-SESSION_HANDOFF Resume prompt's banner-local enrichments. Floating-
-chip-above-focused-card and the full screen-takeover redesign
-remain — both data-layer or cross-plugin and intentionally still
-open.
-
-### `29136d8` `feat(engine): add pulsing trailing cursor to splash "▌ ready_" line`
-
-Closes the cursor-pulse half of the splash polish arc deferred in
-`cacb19c`. The "▌ ready_" line now ends with a 6×12 px cyan Node
-that pulses on a 1 s sine cadence, multiplied with the global
-splash fade timeline so the cursor never reaches full alpha while
-the rest of the splash is still fading in.
-
-**The "multiply, don't override" pattern.** Two systems write the
-same `BackgroundColor` per frame: `advance_splash` writes the
-global-fade alpha, `pulse_splash_cursor` overwrites with
-`global_alpha × pulse_factor`. Both derive from `SplashAge` on the
-root, so the writes are commensurate — the second one isn't
-"fighting" the first, just refining it. This is the cleanest fix
-for the "fight the global fade timeline" warning the original
-`cacb19c` skip note flagged.
-
-**Defensive division guard.** `cursor_pulse_factor(age, period, min)`
-short-circuits to `1.0` when `period <= 0.0` so a future
-misconfiguration produces a steady cursor rather than NaN
-propagation (NaN in alpha = invisible UI, hard to debug). Worth
-mirroring on every trig/division helper, not just this one.
-
-One new test (1182 → 1183): `cursor_pulse_factor_corners` pins the
-peak (factor = 1 at age = period / 4), trough (factor = min at age =
-period × 3 / 4), and the zero/negative-period guard.
-
-### `a27cf5a` `feat(engine): add tiled scanline overlay to splash`
-
-Closes the scanline half of the splash polish arc. A fullscreen
-`ImageNode` tiles a runtime-generated 2×2 RGBA8 texture over the
-splash content — top row transparent, bottom row `#1a1a1a` at
-~30 % alpha — producing the 1 px-pitch horizontal scanline pattern
-called for in `docs/ui-mockups/splash-mobile.html`.
-
-**Texture-α × tint-α composite for fade integration.** The 30 %
-alpha is baked into the texture pixels, not the `ImageNode.color`
-tint. `advance_splash`'s new third query writes
-`(1, 1, 1, global_alpha)` into the tint each tick; the GPU
-multiplies texture-α by tint-α, so the visible composite is
-`0.3 × global_alpha`. Cleaner than building a "multiplicative
-fadable" abstraction in the ECS — the GPU already does this
-multiplication for free.
-
-**Bevy 0.18 API surprises (worth pinning):**
-- `RenderAssetUsages` re-exports under `bevy::asset::`, not
-  `bevy::render::render_asset::`. Type name unchanged; module
-  path moved.
-- `TextureFormat::pixel_size()` returns `Result<usize, _>` rather
-  than the bare `usize` you'd expect for a static format query.
-  Annoying enough that the `debug_assert_eq!` against the buffer
-  length just hard-codes the `2 × 2 × 4 = 16` literal.
-
-Headless test fixture now also `init_resource::<Assets<Image>>()`
-since `MinimalPlugins` doesn't pull `AssetPlugin` — same pattern
-`settings_plugin::tests` already used. Without it, the
-`Option<ResMut<Assets<Image>>>` parameter on `spawn_splash` would
-fall through and the scanline overlay would silently skip,
-defeating the new tests.
-
-Two new tests (1183 → 1185):
-`build_scanline_image_has_expected_2x2_rgba_bytes` locks the
-texture pixels literally so a future tweak can't drift the
-appearance silently; `scanline_overlay_spawns_and_fades_with_splash`
-asserts spawn placement under `SplashRoot` and the new
-fade-images branch's correctness end-to-end.
-
-This pair (`29136d8` + `a27cf5a`) closes Option B from the
-SESSION_HANDOFF Resume prompt — both splash polish pieces now
-shipped.
-
-### `5623368`…`dd101b3` — Option D card-face migration arc
-
-Closed 2026-05-08 across nine commits. The full Terminal card
-artwork now renders end-to-end. Detail breakdown lives in the
-"Visual-identity follow-ups" punch-list entry below; the short
-version:
-
-- Migration plan + pipeline tooling: `5623368` (plan doc),
-  `3a4bb63` (single-card PoC proving the `usvg`/`resvg` pipeline
-  at per-card grain), `babe5cc` (full
-  `solitaire_engine/examples/card_face_generator.rs` example
-  emitting 52 faces + 5 backs into `assets/cards/`), `48b28d2`
-  (the `card_face_svg_pin` integration test pinning rasteriser
-  output via inline FNV-1a hashing of raw RGBA8 bytes — the
-  pin's bootstrap pattern, "empty `EXPECTED` → run → paste",
-  is the maintenance interface for future intentional changes).
-- Lockstep step 4+5: `e8bf9d7`. New PNG bytes + the 5
-  `card_plugin` constants (`CARD_FACE_COLOUR`,
-  `RED_SUIT_COLOUR`, `BLACK_SUIT_COLOUR`,
-  `CARD_FACE_COLOUR_RED_CBM` → `RED_SUIT_COLOUR_CBM`,
-  `card_back_colour`) + signature shifts in one commit.
-  `face_colour` deleted — Terminal face is uniformly
-  `CARD_FACE_COLOUR` regardless of CBM, so the function
-  collapsed to a constant. `text_colour` gained a
-  `color_blind: bool` parameter (red→cyan suit-glyph swap when
-  CBM is on). Four `face_colour` CBM tests folded into two
-  `text_colour` CBM tests in lockstep.
-- Three follow-ups that surfaced during sign-off, all from the
-  same "fallback path the migration walked past" pattern:
-  `a14200a` regenerated the embedded **default-theme SVGs** at
-  `solitaire_engine/assets/themes/default/*.svg`; those bytes
-  `include_bytes!()`-embed into the binary and override
-  `assets/cards/*.png` at startup, so the PNG migration alone
-  didn't change what production rendered. `8719f77`
-  regenerated `assets/backgrounds/bg_*.png` to flat Terminal
-  near-black (5 solid-colour PNGs via a new
-  `solitaire_engine/examples/background_generator.rs` example).
-  `ae84dc1` cleared the **top-bar overlap** at portrait/narrow
-  window widths by swapping the action-button row's hardcoded
-  `font_size: 16.0` to `TYPE_BODY` (a typography-migration
-  miss) and stepping horizontal padding from `VAL_SPACE_3`
-  to `VAL_SPACE_2`.
-- Glyph-rendering fix: `af414b6`. The bundled `FiraMono`
-  doesn't carry usable U+2660-2666 glyphs at the requested
-  size — `usvg` was silently substituting tiny "tofu" marks.
-  Switched suit glyphs from `<text>` elements to inline SVG
-  `<path>` elements via a new `suit_path_d` helper. Path-based
-  rendering bypasses the font system entirely; same bytes on
-  every machine, no fontdb dependency, no substitution risk.
-  Same path data renders correctly whether filled (♥ ♠) or
-  outlined (♦ ♣ — the always-on color-blind glyph
-  differentiation).
-- Glyph-orientation tweak: `dd101b3`. Removed the 180° rotation
-  from the bottom-right large suit glyph at user request. Both
-  glyphs now render upright. `design-system.md` § Game Cards
-  line 220 updated in lockstep — the deliberate deviation from
-  the traditional inverted-corner-indicator convention is
-  documented in the spec, not just the code.
-
-The pin test fired exactly twice during this arc (once for the
-text→path switch, once for the unrotation) and rebaselined
-cleanly each time via the empty-then-paste pattern. The 5
-`back_*` hashes stayed identical across both rebaselines —
-secondary signal that the FNV-1a fingerprinting is purely
-deterministic on rasteriser output.
-
-This arc closes Option D from the SESSION_HANDOFF Resume prompt
-and effectively completes the Terminal visual-identity port —
-only the toast warning/error variant slots remain wired-but-
-unused.
-
-## What shipped in v0.20.0 (frozen at `41a009a`)
-
-### Terminal visual-identity port
-
-Top-down stack — every commit downstream of the token system
-reads from it, so swapping the palette is now a one-file edit:
-
-- **`ui_theme` token system** (`0d477ac`). base16-eighties
-  palette, 5-rung type scale, 7-rung 4-multiple spacing scale,
-  3-step radius, 14-rung z-index hierarchy, full motion budget,
-  4 invariant-pinning unit tests. Card-shadow alphas pinned to 0
-  (Terminal achieves depth via 1px borders + tonal layering).
-- **Modal scaffold already on tokens** — `ui_modal` was ported
-  in the same commit's wake; three stale "loud yellow" /
-  "magenta secondary" doc comments fixed.
-- **Gameplay feedback → semantic state tokens** (`ceec4fc`).
-  Selection / valid-drop tints route through `ACCENT_PRIMARY` /
-  `STATE_WARNING` / `STATE_SUCCESS`.
-- **Toasts** (`a137607`). New `ToastVariant` enum
-  (Info / Warning / Error / Celebration); opaque `BG_ELEVATED`
-  + 1px accent border + bottom-anchor. All ten call sites pass
-  their semantic variant.
-- **`table_plugin` chrome** (`651f406`).
-  `PILE_MARKER_DEFAULT_COLOUR` promoted; `cursor_plugin` imports
-  it, replacing a "kept in sync" doc comment with a compile-
-  enforced invariant. `HINT_PILE_HIGHLIGHT_COLOUR` →
-  `STATE_WARNING`.
-- **`card_plugin` chrome** (`d752870`). Drag-elevation shadow
-  routes through `CARD_SHADOW_*` tokens. `RIGHT_CLICK_HIGHLIGHT_COLOUR`
-  → `STATE_SUCCESS`. Stock recycle "↺" text → `TEXT_PRIMARY @ 0.7α`.
-  Card-face / suit / card-back palette intentionally NOT migrated
-  (artwork dependency — see open-list item below).
-- **Splash cursor** (`cdcadda`). The signature `▌` cyan glyph
-  (96 px) added above the wordmark, matching the spec.
-  *Subsequently expanded post-cut by `cacb19c` into the full
-  boot-screen treatment.*
-- **Hint-source / dest pairing** (`9891ae4`). `input_plugin`'s
-  source-card tint now matches the destination pile's
-  `STATE_WARNING`.
-- **Design system + 24-mockup library** (`fa7f98a`).
-  `docs/ui-mockups/design-system.md` + 24 Stitch mockups (HTML +
-  PNG) covering every screen plus 9 missing-plugin surfaces.
-- **`card_shadow_params` test aligned** (`1d1543e`). Drag-vs-
-  idle shadow assertion loosened to `>=` to accept the Terminal
-  "no shadow" intent without losing the regression-guard.
-
-### Android persistence
-
-- **`solitaire_data::data_dir` shim** (`4b51e50`). New
-  `solitaire_data::platform::data_dir()` falls through to
-  `dirs::data_dir()` on desktop and returns the per-app sandbox
-  at `/data/data/com.solitairequest.app/files` on Android — no
-  JNI needed (package id pinned in `[package.metadata.android]`).
-  Six `solitaire_data` callsites + `solitaire_engine/assets/user_dir.rs`
-  migrated. Settings, stats, achievements, replays, game-state,
-  time-attack sessions, and user themes now persist on Android.
-
-### Inherited from earlier in the cycle (pre-session)
-
-- Android build target + APK (`fb8b2ac`), runbook (`59424a3`),
-  F3 FPS overlay (`690e1d2`), Smart Window Size opt-out
-  (`e1b8766`), Shareable badge (`9b065e5`), Help cheat-sheet
-  M/P/Enter rows (`35516d3`), `pull_failure_sets_error_status`
-  flake fix (`67c150b`).
+Open next-step menu:
+1. **Phase 8 (sync)** — the biggest open arc. Local storage
+   scaffolding, self-hosted Axum server, GPGS stub.
+2. **Android follow-ups** — JNI ClipboardManager, Android Keystore,
+   GPGS. Launch verification and double-tap both closed; these
+   are the remaining Phase Android items.
+3. **Move Log auto-scroll** — only relevant if the panel
+   row count grows beyond the current 5-row fixed window.
 
 ## Open punch list
 
 ### Phase Android (build + persistence shipped; runtime gaps remain)
 
-- **APK launch verification on AVD / device.** `adb install` then
-  `adb logcat` against the `bevy_test` AVD or an x86_64 device.
-  The build works and persistence is wired, but no end-to-end
-  device run has been logged. Shakes out runtime bugs the build +
-  unit tests can't catch.
-- **JNI ClipboardManager bridge.** Replaces the Android stub for
-  the Stats "Copy share link" toast. `arboard` doesn't ship an
-  Android backend; small custom JNI call.
-- **Android Keystore for credentials.** `keyring` is target-gated
-  to a stub returning `KeychainUnavailable`; replace with Android
-  Keystore via JNI when sync auth ships on mobile.
-- **Google Play Games (gpgs) integration.** Listed as a
-  Phase-Android target since Phase 1; now unblocked by the build
-  target.
+- *APK launch verification — closed 2026-05-08 by `202a64d`.*
+  Three fixes shipped: `android_main` export (missing NativeActivity
+  entry point), `resize_constraints` gated to non-Android (max=0
+  panic), `apply_smart_default_window_size` gated to non-Android
+  (clamp panic on zero-dimension window event). Verified booting on
+  Pixel_7 AVD (Android 14, x86_64, SwiftShader Vulkan), 2+ min
+  runtime without crash. B0004 ECS hierarchy warnings remain
+  (non-fatal; entity parent/child component mismatch); investigate
+  if they surface gameplay bugs.
+- *Double-tap auto-move — closed 2026-05-08 by `395a322`.*
+  `handle_double_tap` fires `MoveRequestEvent` on two rapid
+  `TouchPhase::Ended` events within 0.5 s. Prefers foundation;
+  falls back to tableau stack move. Fires `MoveRejectedEvent` when
+  no legal destination exists. System runs before `touch_end_drag`
+  in the chain so drag state is readable.
+- *F11 fullscreen gate — closed 2026-05-08 by `45436d0`.*
+  `handle_fullscreen` and its `MonitorSelection`/`WindowMode`
+  imports are `#[cfg(not(target_os = "android"))]`-gated. The
+  `add_systems` call is a separate statement (not mid-chain).
+- *JNI ClipboardManager bridge — closed 2026-05-08 by `2c822ba`.*
+  `android_clipboard::set_text(url)` calls `ClipboardManager` via
+  JNI. Stats share-link button now writes to the clipboard with a
+  "Copied: {url}" toast; falls back to "Share link: {url}" on JNI
+  error. Requires AVD functional test (see verification steps in
+  the approved plan).
+- *Android Keystore for credentials — closed 2026-05-08 by `f281425`.*
+  `android_keystore` module: AES-256/GCM/NoPadding device-bound key,
+  tokens serialised to JSON and stored atomically at
+  `{data_dir}/auth_tokens.bin` as `[12-byte IV][ciphertext+tag]`.
+  `auth_tokens.rs` Android stubs now delegate to it. Key
+  invalidation (biometric reset) → `TokenError::KeychainUnavailable`.
+  Requires AVD functional test before Phase 8 sync goes live on
+  Android.
 - **Cosmetic `cargo apk build --lib` workaround.** Post-sign
   panic doesn't affect the APK on disk but produces noisy stderr.
   Either upstream a cargo-apk fix or document `--lib` as
   canonical in the runbook.
 
-### Visual-identity follow-ups (opened by v0.20.0's port)
+### Visual-identity follow-ups (post-v0.21.0)
 
-- *Card-face / suit / card-back artwork regeneration — closed
-  2026-05-08 by the commit chain `5623368` → `dd101b3`.* The
-  Terminal spec called for dark `#1a1a1a` cards with light suit
-  pips (pink for hearts/diamonds, foreground gray for spades/
-  clubs). Closed across nine commits over two arcs:
-  - **Plan + tooling (`5623368`–`48b28d2`):** migration plan
-    doc, single-card PoC, full `card_face_generator` example
-    (52 faces + 5 backs into `assets/cards/`), and the
-    `card_face_svg_pin` integration test pinning rasteriser
-    output via FNV-1a so future `usvg`/`resvg` upgrades surface
-    as test failures rather than silent visual drift.
-  - **Lockstep step 4+5 (`e8bf9d7`):** PNGs + the 5 `card_plugin`
-    constants + signature shifts in one commit.
-    `CARD_FACE_COLOUR_RED_CBM` renamed to `RED_SUIT_COLOUR_CBM`
-    and repurposed from a face-tint to a suit-glyph swap (the
-    Terminal face is uniform `CARD_FACE_COLOUR` regardless of
-    CBM; CBM only swaps red suits to cyan in the glyph itself).
-    `face_colour` deleted, `text_colour` gained a `color_blind`
-    parameter.
-  - **Three follow-ups that surfaced during sign-off:**
-    `a14200a` regenerated the **default-theme SVGs** at
-    `solitaire_engine/assets/themes/default/*.svg` — those
-    `include_bytes!()`-embed into the binary and override
-    `assets/cards/*.png` at runtime, so the PNG migration alone
-    didn't change what production rendered. `8719f77`
-    regenerated `assets/backgrounds/bg_*.png` to flat Terminal
-    near-black (5 solid-colour PNGs via a new
-    `background_generator` example). `ae84dc1` cleared the
-    **top-bar overlap** at portrait/narrow window widths by
-    swapping the action-button row's hardcoded `font_size: 16.0`
-    to `TYPE_BODY` and stepping horizontal padding from
-    `VAL_SPACE_3` to `VAL_SPACE_2`.
-  - **Glyph-rendering fix (`af414b6`):** suit glyphs render as
-    inline SVG paths (not `<text>`) because the bundled
-    `FiraMono` doesn't carry usable U+2660-2666 at the
-    requested size — `usvg` was silently substituting tiny
-    "tofu" marks. Path-based rendering bypasses the font system
-    entirely; same bytes on every machine. The pin test
-    rebaselined cleanly via the empty-then-paste pattern.
-  - **Glyph-orientation tweak (`dd101b3`):** removed the 180°
-    rotation from the bottom-right large suit glyph at user
-    request — both glyphs now render in the same upright
-    orientation. `design-system.md` § Game Cards line 220
-    updated in lockstep to document the deliberate deviation
-    from the traditional inverted-corner-indicator convention.
-- *Splash boot-loader scanline overlay — closed by `a27cf5a`.*
-  Runtime-generated 2 × 2 RGBA8 texture tiled via
-  `NodeImageMode::Tiled`; per-pixel alpha × tint alpha gives
-  multiplicative fade integration without new abstractions.
-- *Splash cursor pulse — closed by `29136d8`.* Trailing 6 × 12 px
-  cyan Node, sine-pulsed, multiplied with the global splash fade
-  (the "multiply, don't override" pattern that resolves the
-  original `cacb19c` skip-rationale).
-- **Replay-overlay enrichments beyond the scrub bar.** Banner-local
-  pieces of the mockup (`docs/ui-mockups/replay-overlay-mobile.html`)
-  all shipped: scrub bar (`c84d9f4`), `▌ replay` cursor-block label
-  (`6204db8`), `GAME #YYYY-DDD` caption (`54005d5`), `MOVE N/M`
-  chip restyle (`e080b49`). What's still open are the cross-plugin
-  / data-layer pieces: a `MOVE N/M` chip *floating above the
-  focused card* during playback (would need to thread the cursor
-  through to the card layer — `update_progress_text` writes the
-  banner chip but the card-position lookup belongs in `card_plugin`).
-  The full mockup's screen-takeover treatment — mini-tableau
-  preview, playback controls, move-log scroll, WIN MOVE marker on
-  the scrub bar — is a multi-session redesign with
-  data-layer impact (move-log scroller; the WIN MOVE marker
-  needs a `win_move_index` field on `Replay` that doesn't yet
-  exist). Banner-overlay behaviour is intentionally preserved
-  for now.
-- **Toast Warning / Error variants.** The `ToastVariant` enum
-  has slots for `Warning` (gold) and `Error` (pink) but no
-  in-engine event uses them yet. Wire when a warning- or error-
-  flavoured toast event materialises.
+The visual-identity arc is effectively complete: token system,
+chrome migration, splash boot screen, replay-overlay banner,
+card-face artwork (both rendering paths), and the `ACCENT_PRIMARY`
+palette refresh all shipped in v0.20.0 + v0.21.0. What stays open:
+
+- *Replay-overlay screen-takeover redesign — closed 2026-05-08
+  across 13 commits (v0.21.4–v0.21.7).* The full mockup
+  (`docs/ui-mockups/replay-overlay-mobile.html`) has shipped:
+  banner chrome (v0.21.0), floating MOVE chip (v0.21.2), WIN
+  MOVE scrub-bar marker (post-v0.21.3), playback controls /
+  Space accelerator (post-v0.21.3), scrub notches + labels +
+  keybind footer + ESC / ← / → accelerators + HC border
+  (v0.21.5), Move Log panel + HC scrub track + continuous
+  scrub (v0.21.6), and full-screen 50 % opacity dim layer
+  (v0.21.7). Every major B-2 sub-piece is now closed. The
+  only remaining items are minor polish: notch-label centering
+  and WIN MOVE HC contrast bump (see Open next-step menu).*
+- *Floating `MOVE N/M` chip above the focused card during
+  playback — closed 2026-05-08 by `2fb2d63`.* World-space
+  `Text2d` entity sibling to the banner overlay; uses the same
+  `LayoutResource` pile coordinates so it survives window
+  resizes without UI/camera math.
+- *Toast Warning variant wiring — closed 2026-05-08 by `279e23d`.*
+  Daily-challenge-expiry toast fires once per `daily.date` when
+  within 30 min of UTC midnight reset and today is incomplete.
+  `ToastVariant` is now fully load-bearing (every variant has at
+  least one real driver). Future Warning drivers can either reuse
+  the generic `WarningToastEvent(String)` carrier or add their
+  own domain message + `animation_plugin` handler.
+- *Toast Error variant wiring — closed 2026-05-08 by `68d50b5`.*
+  `MoveRejectedEvent` now fires a 2-second pink-bordered
+  "Invalid move" toast as the third leg of the
+  audio + visual + text rejection-feedback stool.
+- *High-contrast accessibility mode — closed 2026-05-08 by
+  `c5787c6` + `07e0357` (engine + UI) + v0.21.2's HC chrome
+  rollout (`c9af1ea` + `d87761d` + `ec804d5`) + post-cut
+  dynamic-paint rollout (`c153363`).* Card text rendering plus
+  8 static-border chrome surfaces (modal scaffold, tooltip,
+  onboarding key chips, help panel key chips, stats panel
+  cells, home Level/XP/Score row, home mode buttons, home
+  mode-hotkey chips, 4 settings panel surfaces) all boost
+  borders to `BORDER_SUBTLE_HC` under HC via the
+  `HighContrastBorder` marker. The previously-carved-out
+  dynamic-paint sites are now also covered: HUD action buttons
+  and modal buttons take the same marker (their paint cycles
+  only mutate `BackgroundColor`, so no race); the radial menu
+  rim folds HC into its per-frame spawn via
+  `radial_rim_outline` so the focused rim boosts to
+  `BORDER_SUBTLE_HC` under HC (preserving focused-vs-resting
+  hierarchy that naive marker substitution would invert).
+- *Reduced-motion mode — closed 2026-05-08 by `c5787c6` +
+  v0.21.2's `ed152e2`.* `effective_slide_secs` forces 0 on
+  card animations; `pulse_splash_cursor` skips the per-frame
+  pulse multiplier; `spawn_splash` skips the scanline overlay
+  entirely. Future scope: gate any future card-lift z-bump
+  animation, warning-chip pulse (when one materialises).
 
 ### Carried forward from v0.19.0
 
-- **App icon round.** `Window::icon` not yet wired; no
-  `.icns` / `.ico` / Linux hicolor PNG hierarchy. The 11-size
-  icon export the v0.19 handoff referenced is *not* currently
-  in `artwork/` (current `artwork/` holds the reverted Rusty
-  Pixel card PNGs and is intentionally untracked); icon-export
-  needs to be re-run before this item can be picked up.
-  Half-day task once the PNGs are back in place. No cert
-  dependency.
+- *App icon round — closed 2026-05-08 by `3eb3a26` + `716a025`.*
+  Runtime `Window::icon` wired (Linux/macOS/Windows); 9-size
+  PNG hierarchy at `assets/icon/icon_<size>.png` covers Linux
+  hicolor + downstream `.icns`/`.ico` packaging needs. The
+  `.ico` and `.icns` bundle-format files themselves are *not*
+  generated — both would need new crate deps (`ico` and
+  `icns` respectively) and only matter at app-bundle time
+  (cargo-bundle / packaging), not at `cargo run`. Open if the
+  project later ships as a packaged macOS / Windows app.
 
 ### Other small candidates
 
-- **Prev/Next selector chips spawn site.** v0.19.0's `9b065e5`
-  noted Prev/Next markers exist in `stats_plugin` but no spawn
-  site renders them today — the Shareable badge therefore lands
-  on the single-replay caption. If/when Prev/Next is plumbed,
-  the badge will need to follow.
+- *Play-by-Seed dialog — closed 2026-05-08 by `0cb1587`.*
+  `PlayBySeedPlugin` adds a numeric-input modal with async solver
+  preview (debounced 500 ms). `HomeMode::PlayBySeed` card fires
+  `StartPlayBySeedRequestEvent`. 5 unit tests. 75 new verified-win
+  seeds (`2062bd0`) expand `CHALLENGE_SEEDS` via the new
+  `solitaire_assetgen::gen_seeds` binary.
+- *Prev/Next selector chips spawn site — closed 2026-05-08 by
+  `a449f60`.* `ReplayPrevButton` / `ReplayNextButton` /
+  `ReplaySelectorCaption` / `ReplaySelectorDetail` now spawn in
+  `spawn_stats_screen` as a compact chip row above the Watch
+  Replay action. The Shareable badge is in the detail line.
+  The click handler and repaint systems were already live since
+  v0.19.0; this was purely the missing spawn site.
 - **Toast queue / immediate unification.** The two toast paths
   (`spawn_queued_toast` for `InfoToastEvent` queue; `spawn_toast`
   for fire-and-forget) now share visual treatment but remain
@@ -568,10 +236,9 @@ reads from it, so swapping the palette is now a one-file edit:
 ### Canonical remote
 
 `github.com/funman300/Rusty_Solitaire` is the canonical repo.
-Always push there. **Local master has unpushed post-cut commits**
-— run `git log --oneline origin/master..HEAD` for the live list;
-`git push` is the next durability step (or roll the post-cut
-commits into v0.20.1).
+Always push there. As of v0.21.0 origin matches local; the next
+push happens when post-cut work accumulates and is ready to roll
+into a v0.21.1 / v0.22.0 cut.
 
 ### Design direction (Terminal — base16-eighties)
 
@@ -579,35 +246,42 @@ commits into v0.20.1).
   monospaced-forward typography (JetBrains Mono / FiraMono), tight
   16 px edge margins, 8 px card radius.
 - **Palette:** near-black surface ramp (`#151515` / `#202020` /
-  `#2a2a2a` / `#353535`), cyan primary CTA (`#6fc2ef`), lime
+  `#2a2a2a` / `#353535`), brick-red primary CTA (`#a54242` —
+  swapped from cyan `#6fc2ef` in v0.21.0 commit `a292a7e`), lime
   success (`#acc267`), gold warning (`#ddb26f`), pink error /
   suit-red (`#fb9fb1`), lavender celebration (`#e1a3ee`), teal
   info (`#12cfc0`).
 - **Two-color suits.** Red = `#fb9fb1`, black = `#d0d0d0`.
   Outlined glyphs for diamonds & clubs are *always on*; the
-  Settings "color-blind mode" toggle only swaps red → cyan.
+  Settings "color-blind mode" toggle swaps red → lime `#acc267`
+  (was red → cyan pre-v0.21.0; lime is the next-best non-red
+  base16-eighties accent now that the primary itself is red).
+- **Card glyphs render upright in both corners** — no 180°
+  inverted-corner-indicator rotation. Single-orientation
+  digital play doesn't benefit from the traditional flip-
+  readback convention. `design-system.md` § Game Cards
+  documents this deliberate deviation.
 
 ## Resume prompt
 
 ```
 You are a senior Rust + Bevy developer working on Solitaire Quest.
 Working directory: <Rusty_Solitaire clone path on this machine>.
-Branch: master. v0.20.0 is tagged at 41a009a; the post-cut work
-through dd101b3 is pushed to origin (Options B, C, D all closed).
-Run `git log --oneline 41a009a..HEAD` to see what landed since the
-tag — substantives: desktop-adaptation spec, splash boot-screen
-port, replay-overlay banner enrichments, and the full card-face
-artwork arc (52 faces + 5 backs as Terminal SVG-rasterised PNGs,
-default-theme SVGs in lockstep, table backgrounds flattened,
-top-bar layout fix, glyph orientation upright).
+Branch: master. v0.21.8 is tagged at c50eaf8 (cut 2026-05-08,
+replay-overlay polish). Seven post-cut commits are on master (see
+"Since the v0.21.8 cut" above); push of the last four pending.
+v0.21.7 stays at da3e542, v0.21.6 at f63db76, v0.21.5 at a2432df,
+v0.21.4 at 23ff62c, v0.21.3 at 3d92a91, v0.21.2 at f23df3b,
+v0.21.1 at daa655a, v0.21.0 at 04f9bf9.
+Working tree: uncommitted CHANGELOG + SESSION_HANDOFF docs; push
+pending. See CHANGELOG.md § [0.21.9] for full detail.
 
-State: HEAD locally — see `git rev-parse HEAD`. Working tree is
-clean. All workspace tests pass (~1180+; check with
-`cargo test --workspace`), clippy clean.
+State: HEAD locally — see `git rev-parse HEAD`. Workspace
+tests: 1292 passing / 0 failing. Clippy clean.
 
 READ FIRST (in order, before doing anything):
   1. SESSION_HANDOFF.md  — this file
-  2. CHANGELOG.md        — [0.20.0] section is the most recent cut
+  2. CHANGELOG.md        — [0.21.9] section has the pending-cut items
   3. CLAUDE.md           — unified-3.0 rule set
   4. CLAUDE_SPEC.md      — formal architecture spec
   5. ARCHITECTURE.md     — crate responsibilities + data flow
@@ -622,38 +296,17 @@ READ FIRST (in order, before doing anything):
                            fresh machine)
 
 DECISION TO ASK THE PLAYER FIRST:
-  A. Push the post-cut commits to origin. Either as-is on master
-     or rolled into a v0.20.1 cut (CHANGELOG entry + tag).
-     Mechanical, but local master diverges from origin until done.
-  B. *Closed by `29136d8` + `a27cf5a`.* Both splash polish
-     pieces shipped (cursor pulse + scanline overlay). No further
-     splash work pending unless a new mockup detail surfaces.
-  C. *Closed by `54005d5` + `e080b49`.* Banner-local replay-overlay
-     pieces all shipped (scrub bar, ▌ label, GAME caption, MOVE
-     chip). Remaining are cross-plugin (floating MOVE chip above
-     the focused card — needs cursor → card-position plumbing) or
-     multi-session (full screen-takeover redesign — move-log
-     scroll, mini tableau, WIN MOVE marker, data-layer impact).
-     Either belongs in its own decision tree the next time replay
-     work surfaces.
-  D. *Closed 2026-05-08 by `5623368`…`dd101b3`.* The full
-     card-face / suit / card-back / default-theme / table-
-     background / top-bar / glyph-orientation arc landed across
-     nine commits. Terminal cards rendering on every face (dark
-     `#1a1a1a` background, pink/gray suit glyphs as inline SVG
-     paths, scanline-pattern cyan-accent backs); both rendering
-     paths (`assets/cards/*.png` and the bundled-default theme
-     SVGs at `solitaire_engine/assets/themes/default/*.svg`) in
-     lockstep; pin test (`card_face_svg_pin`) guards against
-     future rasteriser drift. Visual-identity arc effectively
-     complete — only the toast warning/error variant slots
-     remain wired-but-unused.
-  E. App icon round — re-run artwork/Icon Export.html (the
-     export PNGs are not currently in `artwork/`), then wire
-     Window::icon + generate .icns / .ico. Half-day task. No
-     cert dependency.
-  F. APK launch verification on AVD / device + the JNI bridges
-     it would shake out (ClipboardManager, Keystore).
+  A. Android follow-ups — JNI ClipboardManager bridge (arboard
+     has no Android backend), Android Keystore (blocked on Phase 8).
+     Launch verification + double-tap are closed.
+  B. Phase 8 (sync) — local storage scaffolding, self-hosted
+     Axum server, `SolitaireServerClient` impl. The biggest open
+     arc by scope; rolls up Android dependencies (Keystore,
+     ClipboardManager).
+  C. Play-by-Seed polish — the dialog is functional but has no
+     visual preview of the solver verdict in the UI yet; the
+     HomeMode card is wired but the dialog spawn site and verdict
+     display could use a second pass.
 
 WORKFLOW NOTES:
   - Use the system git config (already correct).
@@ -663,6 +316,23 @@ WORKFLOW NOTES:
   - Every commit must pass build / clippy / test before pushing.
   - Push to GitHub (origin) — gh auth setup-git wired on
     primary dev box; verify on laptop before first push.
+  - Token-port pattern: when migrating tokens, walk every
+    concrete artifact downstream of the token (PNG textures,
+    embedded SVGs, hardcoded literals, comment color names),
+    not just the token name. v0.21.0 surfaced three "the
+    migration walked past this" follow-ups that all matched
+    this shape — codified here so future similar work can
+    pattern-match instead of rediscovering.
+  - Doc-vs-implementation drift pattern: v0.21.1's pile-marker
+    visibility fix (`4d48cad`) implemented an invariant that
+    had been declared in a module doc comment but was never
+    enforced in code. When future work touches a module with
+    a "this does X" doc comment, verify the code actually does
+    X and add a test if not. Two layers, two checks.
 
-OPEN AT THE START: ask which of A–F. Don't pick unilaterally.
+OPEN AT THE START: ask which of A–C. Don't pick unilaterally.
+Note: every remaining option is multi-session by nature (A is
+gated on Android tooling; B and C are explicitly multi-session
+arcs). A fresh session is a better fit for any of them than the
+tail of a long working stretch.
 ```

docs/ui-mockups/design-system.md

@@ -137,18 +137,23 @@ The palette is base16-eighties — a 16-slot terminal palette where indices 00
 
 ## Suit Colors
 
-**Two-color traditional mapping**, with mandatory color-blind support:
+**Two-color traditional pairing**, with mandatory color-blind
+support. Saturated red for hearts + diamonds, near-white for clubs
++ spades — the "Microsoft Solitaire on dark mode" feel of a real
+playing-card deck. (A brief 4-color-deck experiment shipped between
+v0.21.0 and the next post-cut commit; reverted to traditional
+2-color at the player's request.)
 
 | Suit | Default | Color-blind mode | Glyph differentiation |
 |---|---|---|---|
-| Hearts | `#fb9fb1` (pink) | `#acc267` (lime) | Solid filled glyph |
-| Diamonds | `#fb9fb1` (pink) | `#acc267` (lime) | **Outlined glyph (1.5px stroke)** |
-| Spades | `#d0d0d0` (foreground) | `#d0d0d0` | Solid filled glyph |
-| Clubs | `#d0d0d0` (foreground) | `#d0d0d0` | **Outlined glyph (1.5px stroke)** |
+| Hearts | `#e35353` (saturated red) | `#acc267` (lime) | Solid filled glyph |
+| Diamonds | `#e35353` (saturated red) | `#acc267` (lime) | **Outlined glyph (1.5px stroke)** |
+| Spades | `#e8e8e8` (near-white) | `#e8e8e8` (unchanged) | Solid filled glyph |
+| Clubs | `#e8e8e8` (near-white) | `#e8e8e8` (unchanged) | **Outlined glyph (1.5px stroke)** |
 
 The outlined-glyph treatment is the **primary** differentiation mechanism. Color is supplementary. This means a player viewing the game on a monochrome display, or with severe red-green deficiency, can still distinguish all four suits without context. This is a hard requirement, not an optional setting.
 
-The "color-blind mode" toggle in Settings only swaps red→lime; it does not turn the outlined glyphs on or off, because outlined glyphs are always on. (Was red→cyan before the 2026-05-08 primary-accent swap; CBM moved to lime to stay hue-distinct from the new red-family primary.)
+The "color-blind mode" toggle in Settings swaps both red suits (hearts + diamonds) from `#e35353` to `#acc267` (lime); clubs + spades stay at the near-white. The toggle does not turn the outlined glyphs on or off, because outlined glyphs are always on. (Was red→cyan before the 2026-05-08 primary-accent swap; CBM moved to lime to stay hue-distinct from the new red-family primary.)
 
 ## Typography
 
@@ -217,7 +222,7 @@ Selection highlights use a **2px inset stroke** in `#a54242` following the host
 
 Flat face design.
 - Background: `#1a1a1a`
-- Border: 1px solid in suit color (pink for hearts/diamonds, foreground gray for spades/clubs)
+- Border: none. The card shape is defined by the body fill alone against the play surface. The earlier 1px suit-coloured border was removed because it produced visible anti-aliasing artifacts at the rounded corners (a "gray sliver" where the colored stroke faded through gray pixels into the dark play surface). The 5-unit brightness gap between `#1a1a1a` body and `#151515` surface is enough to read as a card edge without an explicit stroke.
 - Top-left: rank in JetBrains Mono Bold 18px + small suit glyph (10px)
 - Bottom-right: large suit glyph (32px), upright (same orientation as the top-left small glyph — single-orientation digital play does not benefit from the traditional 180° inverted-corner indicator)
 - Corner radius: 8px
@@ -272,7 +277,7 @@ Top-right corner of the HUD: a 6px circular dot.
 
 ## Accessibility
 
-1. **Color-blind mode** (Settings → Gameplay): swaps red suits' default `#fb9fb1` for `#acc267` (lime). Outlined-glyph differentiation remains active in *all* modes.
+1. **Color-blind mode** (Settings → Gameplay): swaps the red suits' default `#e35353` for `#acc267` (lime). Outlined-glyph differentiation remains active in *all* modes.
 2. **High-contrast mode** (Settings → Gameplay): boosts on-surface from `#d0d0d0` to `#f5f5f5`, outline from `#505050` to `#a0a0a0`, suit-red from `#fb9fb1` to `#ff8aa0`.
 3. **Reduce-motion mode** (Settings → Gameplay): disables card-lift transition (instant z-lift), disables CRT scanline effect, disables the warning-chip pulse animation.
 4. **Tabular figures** are mandatory for any number that updates live (timer, score, moves) so they don't reflow.

solitaire_app/Cargo.toml

@@ -22,16 +22,25 @@ bevy             = { workspace = true }
 solitaire_engine = { workspace = true }
 solitaire_data   = { workspace = true }
 
-# `keyring`'s default-store init only matters on platforms with a
-# real keychain backend (Linux Secret Service, macOS Keychain,
-# Windows Credential Store). The crate also pulls `rpassword`
-# transitively, which uses `libc::__errno_location` — a symbol
-# Android's bionic doesn't expose. Target-gating keeps
-# `cargo apk build` viable; the call site in `lib.rs` has its own
-# `cfg(not(target_os = "android"))` guard so the desktop init path
-# is unchanged.
+# Desktop-only deps. `keyring`'s default-store init only matters on
+# platforms with a real keychain backend (Linux Secret Service,
+# macOS Keychain, Windows Credential Store), and its transitive
+# `rpassword` uses `libc::__errno_location` — a symbol Android's
+# bionic doesn't expose. `winit` is promoted from a transitive
+# Bevy 0.18 → bevy_winit 0.18 → winit 0.30 dep to a direct dep so
+# the `Window::icon` wiring in `set_window_icon` can construct
+# `winit::window::Icon` values (bevy_winit 0.18 doesn't re-export
+# `Icon`). Android draws its launcher icon from the APK manifest,
+# so neither dep matters there. Target-gating keeps `cargo apk
+# build` viable; the desktop call sites have their own
+# `cfg(not(target_os = "android"))` guards.
 [target.'cfg(not(target_os = "android"))'.dependencies]
 keyring   = { workspace = true }
+winit     = { version = "0.30", default-features = false }
+# `tiny-skia` is already in the workspace deps for `solitaire_engine`;
+# `solitaire_app` consumes it directly only on the desktop icon path
+# (PNG → raw RGBA decode for `set_window_icon`).
+tiny-skia = { workspace = true }
 
 # --- Android packaging metadata (read by `cargo-apk`) -------------------
 #

solitaire_app/src/lib.rs

@@ -18,19 +18,22 @@ use std::io::Write;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use bevy::prelude::*;
-use bevy::window::{
-    Monitor, MonitorSelection, PresentMode, PrimaryMonitor, PrimaryWindow, WindowPosition,
-};
+use bevy::window::{MonitorSelection, PresentMode, WindowPosition};
+#[cfg(not(target_os = "android"))]
+use bevy::window::{Monitor, PrimaryMonitor, PrimaryWindow};
+#[cfg(not(target_os = "android"))]
+use bevy::winit::WinitWindows;
 use solitaire_data::{load_settings_from, provider_for_backend, settings_file_path, Settings};
 use solitaire_engine::{
     register_theme_asset_sources, AchievementPlugin, AnimationPlugin, AssetSourcesPlugin,
     AudioPlugin, AutoCompletePlugin, CardAnimationPlugin, CardPlugin, ChallengePlugin,
-    CursorPlugin, DailyChallengePlugin, DiagnosticsHudPlugin, FeedbackAnimPlugin, FontPlugin,
-    GamePlugin, HelpPlugin, HomePlugin, HudPlugin, InputPlugin, LeaderboardPlugin,
-    OnboardingPlugin, PausePlugin, ProfilePlugin, ProgressPlugin, RadialMenuPlugin,
-    ReplayOverlayPlugin, ReplayPlaybackPlugin, SelectionPlugin, SettingsPlugin, SplashPlugin,
-    StatsPlugin, SyncPlugin, TablePlugin, ThemePlugin, ThemeRegistryPlugin, TimeAttackPlugin,
-    UiFocusPlugin, UiModalPlugin, UiTooltipPlugin, WeeklyGoalsPlugin, WinSummaryPlugin,
+    CursorPlugin, DailyChallengePlugin, DiagnosticsHudPlugin, DifficultyPlugin, FeedbackAnimPlugin,
+    FontPlugin, GamePlugin, HelpPlugin, HomePlugin, HudPlugin, InputPlugin, LeaderboardPlugin,
+    OnboardingPlugin, PausePlugin, PlayBySeedPlugin, ProfilePlugin, ProgressPlugin,
+    RadialMenuPlugin, ReplayOverlayPlugin, ReplayPlaybackPlugin, SelectionPlugin, SettingsPlugin,
+    SplashPlugin, StatsPlugin, SyncPlugin, TablePlugin, ThemePlugin, ThemeRegistryPlugin,
+    TimeAttackPlugin, UiFocusPlugin, UiModalPlugin, UiTooltipPlugin, WeeklyGoalsPlugin,
+    WinSummaryPlugin,
 };
 
 /// App entry point — builds and runs the Bevy app.
@@ -74,6 +77,7 @@ pub fn run() {
     // primary monitor) — `apply_smart_default_window_size` will resize
     // up to a monitor-relative target on the first frame so HiDPI / 4K
     // sessions don't end up with a comparatively tiny window.
+    #[cfg(not(target_os = "android"))]
     let had_saved_geometry = settings.window_geometry.is_some();
     let (window_resolution, window_position) = match settings.window_geometry {
         Some(geom) => (
@@ -114,6 +118,9 @@ pub fn run() {
                         // small enough that a few stray dropped frames from
                         // disabling vsync are imperceptible.
                         present_mode: PresentMode::AutoNoVsync,
+                        // Android windows always fill the screen; max_width/max_height
+                        // default to 0.0, which panics Bevy's clamp when min > max.
+                        #[cfg(not(target_os = "android"))]
                         resize_constraints: bevy::window::WindowResizeConstraints {
                             min_width: 800.0,
                             min_height: 600.0,
@@ -140,6 +147,13 @@ pub fn run() {
         .add_plugins(GamePlugin)
         .add_plugins(TablePlugin)
         .add_plugins(CardPlugin)
+        // Cursor-icon feedback is desktop-only; Android has no pointer cursor.
+        // The drop-target highlight systems (update_drop_highlights,
+        // update_drop_target_overlays) live in CursorPlugin but ARE useful
+        // on Android — they've been left running because their Bevy system
+        // params compile and function on Android; only the CursorIcon insert
+        // is inert. Gate the whole plugin if the cursor APIs ever cause
+        // Android linker issues; for now it's harmless to leave it registered.
         .add_plugins(CursorPlugin)
         .add_plugins(InputPlugin)
         .add_plugins(RadialMenuPlugin)
@@ -156,6 +170,8 @@ pub fn run() {
         .add_plugins(DailyChallengePlugin)
         .add_plugins(WeeklyGoalsPlugin)
         .add_plugins(ChallengePlugin)
+        .add_plugins(PlayBySeedPlugin)
+        .add_plugins(DifficultyPlugin)
         .add_plugins(TimeAttackPlugin)
         .add_plugins(HudPlugin)
         .add_plugins(HelpPlugin)
@@ -174,6 +190,14 @@ pub fn run() {
         .add_plugins(SplashPlugin)
         .add_plugins(DiagnosticsHudPlugin);
 
+    // Wire the runtime window icon. Bevy 0.18 has no first-class
+    // `Window::icon` field; the icon is set through the underlying
+    // `winit::window::Window` via `WinitWindows`. Android draws its
+    // launcher icon from the APK manifest, so the system is desktop-
+    // only — same target-gate as the `winit` dep itself.
+    #[cfg(not(target_os = "android"))]
+    app.add_systems(Update, set_window_icon);
+
     // Smart default window sizing: when no saved geometry was loaded,
     // resize the freshly-opened 1280×800 window to ~70 % of the primary
     // monitor's logical size on the first frame. Without this, a 4K
@@ -185,6 +209,8 @@ pub fn run() {
     // every fresh launch can flip `disable_smart_default_size` in
     // Settings to opt out. The flag is checked once at startup; a
     // mid-session change applies on the next launch.
+    // Android windows are always full-screen; the OS controls sizing.
+    #[cfg(not(target_os = "android"))]
     if !had_saved_geometry && !settings.disable_smart_default_size {
         app.add_systems(Update, apply_smart_default_window_size);
     }
@@ -205,6 +231,7 @@ pub fn run() {
 /// a dedicated resource. The Update tick is necessary because Bevy
 /// populates the `Monitor` entities asynchronously after winit's
 /// Resumed event fires; they may not exist on the first Startup pass.
+#[cfg(not(target_os = "android"))]
 fn apply_smart_default_window_size(
     mut applied: Local<bool>,
     monitors: Query<&Monitor, With<PrimaryMonitor>>,
@@ -251,6 +278,94 @@ fn apply_smart_default_window_size(
     *applied = true;
 }
 
+/// One-shot Update system that sets the primary window's taskbar /
+/// title-bar icon to the embedded 256 px Terminal-aesthetic mark
+/// generated by `solitaire_engine/examples/icon_generator.rs`.
+///
+/// Bevy 0.18 has no `Window::icon` field — the icon is set through
+/// the underlying `winit::window::Window` via the `WinitWindows`
+/// resource. The system is desktop-only (Android draws its launcher
+/// icon from the APK manifest, not from any runtime call). Returns
+/// silently and tries again next frame until both the primary
+/// window and `WinitWindows` are populated, then sets the icon
+/// once and self-disables via `Local<bool>`.
+///
+/// Icon bytes are `include_bytes!()`-embedded at compile time, same
+/// shape as the audio assets and default-theme SVGs — no runtime
+/// asset-path resolution, no `cargo run` working-directory
+/// assumptions. PNG → RGBA decode runs through `tiny_skia` (already
+/// in the build for SVG rasterisation), so this system adds zero
+/// new dependencies on top of the direct `winit` dep that's
+/// already required for `Icon` construction.
+#[cfg(not(target_os = "android"))]
+fn set_window_icon(
+    mut applied: Local<bool>,
+    primary_window: Query<Entity, With<PrimaryWindow>>,
+    // `Option<NonSend<...>>` rather than `NonSend<...>` because Bevy
+    // 0.18's stricter system-param validation panics on the first
+    // few frames before `WinitWindows` is inserted (the resource is
+    // populated after winit's `Resumed` event, which fires after
+    // the first system-tick batch). The early-return below handles
+    // the `None` window-wrapper case for the same lifecycle reason.
+    winit_windows: Option<NonSend<WinitWindows>>,
+) {
+    if *applied {
+        return;
+    }
+    let Some(winit_windows) = winit_windows else {
+        return;
+    };
+    let Ok(primary_entity) = primary_window.single() else {
+        return;
+    };
+    let Some(window_wrapper) = winit_windows.get_window(primary_entity) else {
+        // Primary window's underlying winit handle not yet
+        // populated — `WinitWindows` fills in after the first
+        // `Resumed` event. Try again next frame.
+        return;
+    };
+
+    // The 256 × 256 PNG is sufficient for `set_window_icon`; winit
+    // scales it for the actual rendered size. Smaller PNGs in
+    // `assets/icon/` exist for downstream Linux hicolor / Windows
+    // `.ico` / macOS `.icns` packaging — they're not used here.
+    const ICON_BYTES: &[u8] = include_bytes!("../../assets/icon/icon_256.png");
+
+    let pixmap = match tiny_skia::Pixmap::decode_png(ICON_BYTES) {
+        Ok(p) => p,
+        Err(e) => {
+            eprintln!("warn: could not decode embedded window icon PNG: {e}");
+            *applied = true; // don't retry every frame
+            return;
+        }
+    };
+    let rgba = pixmap.data().to_vec();
+    let icon = match winit::window::Icon::from_rgba(rgba, pixmap.width(), pixmap.height()) {
+        Ok(i) => i,
+        Err(e) => {
+            eprintln!("warn: could not construct window icon: {e}");
+            *applied = true;
+            return;
+        }
+    };
+    window_wrapper.set_window_icon(Some(icon));
+    *applied = true;
+}
+
+/// Android entry point called by NativeActivity after dlopen-ing the `.so`.
+/// Sets the `AndroidApp` handle that Bevy's winit backend reads before
+/// constructing the event loop, then delegates to [`run`].
+///
+/// The `#[bevy_main]` proc-macro would generate the same code but only
+/// works on a function named `main`; our shared entry point is `run`, so
+/// we emit the equivalent expansion manually.
+#[cfg(target_os = "android")]
+#[unsafe(no_mangle)]
+fn android_main(android_app: bevy::android::android_activity::AndroidApp) {
+    let _ = bevy::android::ANDROID_APP.set(android_app);
+    run();
+}
+
 /// Wraps the default panic hook with one that also appends a crash log
 /// to `<data_dir>/crash.log` (next to `settings.json`). The default hook
 /// still runs afterwards, so stderr output and debugger integration are

solitaire_assetgen/Cargo.toml

@@ -12,6 +12,8 @@ publish = false
 [dependencies]
 png     = "0.17"
 ab_glyph = "0.2"
+solitaire_core = { path = "../solitaire_core" }
+solitaire_data = { path = "../solitaire_data" }
 
 [[bin]]
 name = "gen_sfx"
@@ -20,3 +22,11 @@ path = "src/bin/gen_sfx.rs"
 [[bin]]
 name = "gen_art"
 path = "src/bin/gen_art.rs"
+
+[[bin]]
+name = "gen_seeds"
+path = "src/bin/gen_seeds.rs"
+
+[[bin]]
+name = "gen_difficulty_seeds"
+path = "src/bin/gen_difficulty_seeds.rs"

solitaire_assetgen/src/bin/gen_difficulty_seeds.rs

@@ -0,0 +1,195 @@
+//! Generate difficulty-stratified seed catalogs for `EASY_SEEDS`, `MEDIUM_SEEDS`,
+//! `HARD_SEEDS`, `EXPERT_SEEDS`, and `GRANDMASTER_SEEDS` in
+//! `solitaire_data/src/difficulty_seeds.rs`.
+//!
+//! A seed's tier is determined by the **smallest** `SolverConfig` budget that
+//! returns `SolverResult::Winnable`. Seeds that are `Unwinnable` at any budget
+//! are discarded; `Inconclusive` at all budgets are also discarded (we only emit
+//! provably-winnable seeds).
+//!
+//! # Usage
+//!
+//! ```bash
+//! cargo run -p solitaire_assetgen --bin gen_difficulty_seeds --release -- \
+//!     --start 0xD1FF0000_00000000 --per-tier 40
+//! ```
+//!
+//! Flags:
+//!   --start     Starting seed (decimal or 0x-prefixed hex, default 0xD1FF000000000000)
+//!   --per-tier  Seeds to emit per tier (default 40)
+//!   --help      Print this message
+
+use solitaire_core::game_state::DrawMode;
+use solitaire_core::solver::{try_solve, SolverConfig, SolverResult};
+
+// Budget boundaries defining each tier. A seed belongs to the lowest tier
+// whose budget proves it Winnable.
+const BUDGETS: &[(&str, u64, usize)] = &[
+    ("Easy",        1_000,   1_000),
+    ("Medium",      5_000,   5_000),
+    ("Hard",       25_000,  25_000),
+    ("Expert",    100_000, 100_000),
+    ("Grandmaster", 200_000, 200_000),
+];
+
+fn main() {
+    let mut args = std::env::args().skip(1).peekable();
+    let mut start: u64 = 0xD1FF_0000_0000_0000;
+    let mut per_tier: usize = 40;
+
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--start" => {
+                let val = args.next().unwrap_or_else(|| {
+                    eprintln!("error: --start requires a value");
+                    std::process::exit(1);
+                });
+                start = parse_u64(&val);
+            }
+            "--per-tier" => {
+                let val = args.next().unwrap_or_else(|| {
+                    eprintln!("error: --per-tier requires a value");
+                    std::process::exit(1);
+                });
+                per_tier = val.parse().unwrap_or_else(|_| {
+                    eprintln!("error: --per-tier must be a positive integer");
+                    std::process::exit(1);
+                });
+            }
+            "--help" | "-h" => {
+                eprintln!("gen_difficulty_seeds: generate tiered seed catalogs");
+                eprintln!("  --start <seed>     starting seed (hex or decimal)");
+                eprintln!("  --per-tier <n>     seeds per tier (default 40)");
+                return;
+            }
+            other => {
+                eprintln!("error: unknown argument: {other}");
+                std::process::exit(1);
+            }
+        }
+    }
+
+    if per_tier == 0 {
+        eprintln!("error: --per-tier must be > 0");
+        std::process::exit(1);
+    }
+
+    let draw_mode = DrawMode::DrawOne;
+    let num_tiers = BUDGETS.len();
+    let mut buckets: Vec<Vec<u64>> = vec![Vec::with_capacity(per_tier); num_tiers];
+    let mut tried: u64 = 0;
+    let mut seed = start;
+
+    eprintln!(
+        "gen_difficulty_seeds: finding {} seeds per tier from 0x{start:016X} (DrawOne) …",
+        per_tier
+    );
+    eprintln!(
+        "  Tiers: {}",
+        BUDGETS.iter().map(|(n, _, _)| *n).collect::<Vec<_>>().join(", ")
+    );
+
+    while buckets.iter().any(|b| b.len() < per_tier) {
+        tried += 1;
+        'tier: for (i, &(name, move_budget, state_budget)) in BUDGETS.iter().enumerate() {
+            if buckets[i].len() >= per_tier {
+                continue;
+            }
+            let cfg = SolverConfig { move_budget, state_budget };
+            match try_solve(seed, draw_mode.clone(), &cfg) {
+                SolverResult::Winnable => {
+                    buckets[i].push(seed);
+                    eprintln!(
+                        "  [{name}  {:>3}/{}]  0x{seed:016X}  (tried {tried})",
+                        buckets[i].len(),
+                        per_tier
+                    );
+                    break 'tier; // assign to the cheapest tier that proves it winnable
+                }
+                SolverResult::Unwinnable => {
+                    // Definitely unsolvable — skip all remaining tiers.
+                    break 'tier;
+                }
+                SolverResult::Inconclusive => {
+                    // Budget exhausted without proof — try the next larger tier.
+                    // If this is the last tier, the seed is discarded (Inconclusive
+                    // at max budget means "probably but not provably winnable").
+                    if i == num_tiers - 1 {
+                        break 'tier;
+                    }
+                }
+            }
+        }
+        seed = seed.wrapping_add(1);
+    }
+
+    eprintln!("\nDone ({tried} seeds examined). Paste the blocks below into difficulty_seeds.rs:\n");
+
+    let date = current_date();
+    for (i, (tier_name, _, _)) in BUDGETS.iter().enumerate() {
+        println!(
+            "    // Generated by solitaire_assetgen::gen_difficulty_seeds \
+             (tier={tier_name}, date={date})"
+        );
+        for chunk in buckets[i].chunks(5) {
+            for s in chunk {
+                println!(
+                    "    0x{:04X}_{:04X}_{:04X}_{:04X},",
+                    (s >> 48) & 0xFFFF,
+                    (s >> 32) & 0xFFFF,
+                    (s >> 16) & 0xFFFF,
+                    s & 0xFFFF,
+                );
+            }
+        }
+        println!();
+    }
+}
+
+fn parse_u64(s: &str) -> u64 {
+    let cleaned = s.replace('_', "");
+    if let Some(hex) = cleaned.strip_prefix("0x").or_else(|| cleaned.strip_prefix("0X")) {
+        u64::from_str_radix(hex, 16).unwrap_or_else(|_| {
+            eprintln!("error: could not parse '{s}' as a hex u64");
+            std::process::exit(1);
+        })
+    } else {
+        cleaned.parse().unwrap_or_else(|_| {
+            eprintln!("error: could not parse '{s}' as a decimal u64");
+            std::process::exit(1);
+        })
+    }
+}
+
+fn current_date() -> String {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    let secs = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let days = secs / 86400;
+    let mut y = 1970u64;
+    let mut d = days;
+    loop {
+        let leap = (y.is_multiple_of(4) && !y.is_multiple_of(100)) || y.is_multiple_of(400);
+        let days_in_year = if leap { 366 } else { 365 };
+        if d < days_in_year {
+            break;
+        }
+        d -= days_in_year;
+        y += 1;
+    }
+    let leap = (y.is_multiple_of(4) && !y.is_multiple_of(100)) || y.is_multiple_of(400);
+    let month_days: [u64; 12] = [
+        31, if leap { 29 } else { 28 }, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31,
+    ];
+    let mut m = 0usize;
+    for &md in &month_days {
+        if d < md {
+            break;
+        }
+        d -= md;
+        m += 1;
+    }
+    format!("{y}-{:02}-{:02}", m + 1, d + 1)
+}

solitaire_assetgen/src/bin/gen_seeds.rs

@@ -0,0 +1,157 @@
+//! Generate provably-winnable Klondike seeds for `CHALLENGE_SEEDS`.
+//!
+//! Walks seeds incrementally from `--start`, calls the solver on each, and
+//! collects only those that return `SolverResult::Winnable` (Inconclusive is
+//! rejected — the curated list wants proof). Prints Rust source suitable for
+//! pasting into `solitaire_data/src/challenge.rs`.
+//!
+//! # Usage
+//!
+//! ```bash
+//! cargo run -p solitaire_assetgen --bin gen_seeds --release -- \
+//!     --start 0xCAFE_BABE_0000_0000 --count 75
+//! ```
+//!
+//! Flags:
+//!   --start  Starting seed (decimal or 0x-prefixed hex, default 0xCAFEBABE00000000)
+//!   --count  Number of Winnable seeds to emit (default 75)
+//!   --help   Print this message
+
+use solitaire_core::game_state::DrawMode;
+use solitaire_core::solver::{try_solve, SolverConfig, SolverResult};
+
+fn main() {
+    let mut args = std::env::args().skip(1).peekable();
+    let mut start: u64 = 0xCAFE_BABE_0000_0000;
+    let mut count: usize = 75;
+
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--start" => {
+                let val = args.next().unwrap_or_else(|| {
+                    eprintln!("error: --start requires a value");
+                    std::process::exit(1);
+                });
+                start = parse_u64(&val);
+            }
+            "--count" => {
+                let val = args.next().unwrap_or_else(|| {
+                    eprintln!("error: --count requires a value");
+                    std::process::exit(1);
+                });
+                count = val.parse().unwrap_or_else(|_| {
+                    eprintln!("error: --count must be a positive integer");
+                    std::process::exit(1);
+                });
+            }
+            "--help" | "-h" => {
+                eprintln!("{}", include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/src/bin/gen_seeds.rs")).lines().take(20).collect::<Vec<_>>().join("\n"));
+                return;
+            }
+            other => {
+                eprintln!("error: unknown argument: {other}");
+                std::process::exit(1);
+            }
+        }
+    }
+
+    if count == 0 {
+        eprintln!("error: --count must be > 0");
+        std::process::exit(1);
+    }
+
+    let cfg = SolverConfig::default();
+    let draw_mode = DrawMode::DrawOne;
+    let mut found: Vec<u64> = Vec::with_capacity(count);
+    let mut tried: u64 = 0;
+    let mut seed = start;
+
+    eprintln!(
+        "gen_seeds: finding {count} Winnable seeds from 0x{start:016X} (DrawOne) …"
+    );
+
+    while found.len() < count {
+        tried += 1;
+        if matches!(
+            try_solve(seed, draw_mode.clone(), &cfg),
+            SolverResult::Winnable
+        ) {
+            found.push(seed);
+            eprintln!(
+                "  [{:>3}/{}]  0x{:016X}  ({} tried so far)",
+                found.len(),
+                count,
+                seed,
+                tried
+            );
+        }
+        seed = seed.wrapping_add(1);
+    }
+
+    eprintln!("\nDone. Paste the block below into CHALLENGE_SEEDS in solitaire_data/src/challenge.rs:\n");
+
+    println!(
+        "    // Generated by solitaire_assetgen::gen_seeds \
+         (start=0x{start:016X}, count={count}, date={date})",
+        date = current_date()
+    );
+    for chunk in found.chunks(5) {
+        for s in chunk {
+            println!(
+                "    0x{:04X}_{:04X}_{:04X}_{:04X},",
+                (s >> 48) & 0xFFFF,
+                (s >> 32) & 0xFFFF,
+                (s >> 16) & 0xFFFF,
+                s & 0xFFFF,
+            );
+        }
+        println!();
+    }
+}
+
+fn parse_u64(s: &str) -> u64 {
+    let cleaned = s.replace('_', "");
+    if let Some(hex) = cleaned.strip_prefix("0x").or_else(|| cleaned.strip_prefix("0X")) {
+        u64::from_str_radix(hex, 16).unwrap_or_else(|_| {
+            eprintln!("error: could not parse '{s}' as a hex u64");
+            std::process::exit(1);
+        })
+    } else {
+        cleaned.parse().unwrap_or_else(|_| {
+            eprintln!("error: could not parse '{s}' as a decimal u64");
+            std::process::exit(1);
+        })
+    }
+}
+
+fn current_date() -> String {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    let secs = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let days = secs / 86400;
+    // Gregorian calendar computation (Tomohiko Sakamoto's algorithm variant)
+    let mut y = 1970u64;
+    let mut d = days;
+    loop {
+        let leap = (y.is_multiple_of(4) && !y.is_multiple_of(100)) || y.is_multiple_of(400);
+        let days_in_year = if leap { 366 } else { 365 };
+        if d < days_in_year {
+            break;
+        }
+        d -= days_in_year;
+        y += 1;
+    }
+    let leap = (y.is_multiple_of(4) && !y.is_multiple_of(100)) || y.is_multiple_of(400);
+    let month_days: [u64; 12] = [31, if leap { 29 } else { 28 }, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    let mut m = 0usize;
+    for &md in &month_days {
+        if d < md {
+            break;
+        }
+        d -= md;
+        m += 1;
+    }
+    format!("{y}-{:02}-{:02}", m + 1, d + 1)
+}

solitaire_core/src/game_state.rs

@@ -50,6 +50,35 @@ pub enum DrawMode {
     DrawThree,
 }
 
+/// Difficulty tier for `GameMode::Difficulty`. Controls which pre-verified seed
+/// catalog is drawn from. `Random` skips verification entirely and uses a
+/// system-time seed — deals may or may not be winnable.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
+pub enum DifficultyLevel {
+    #[default]
+    Easy,
+    Medium,
+    Hard,
+    Expert,
+    Grandmaster,
+    /// Unverified system-time seed — may or may not be winnable.
+    Random,
+}
+
+impl DifficultyLevel {
+    /// Short human-readable label shown in the HUD and win summary.
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Easy => "Easy",
+            Self::Medium => "Medium",
+            Self::Hard => "Hard",
+            Self::Expert => "Expert",
+            Self::Grandmaster => "Grandmaster",
+            Self::Random => "Random",
+        }
+    }
+}
+
 /// Top-level game mode. Affects scoring, undo, and (eventually) timer behaviour.
 ///
 /// - `Classic`: standard Klondike scoring, undo allowed.
@@ -59,6 +88,8 @@ pub enum DrawMode {
 /// - `TimeAttack`: standard scoring + undo; the engine wraps a 10-minute
 ///   countdown around the session and auto-deals a fresh game on every win
 ///   (see `solitaire_engine::TimeAttackPlugin`).
+/// - `Difficulty(DifficultyLevel)`: seed drawn from a pre-verified per-tier catalog
+///   (or system-time for `Random`). Rules identical to Classic.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 pub enum GameMode {
     #[default]
@@ -70,6 +101,8 @@ pub enum GameMode {
     Challenge,
     /// Play as many games as possible within 10 minutes.
     TimeAttack,
+    /// Seed drawn from a difficulty-tiered catalog; rules identical to Classic.
+    Difficulty(DifficultyLevel),
 }
 
 /// Snapshot of game state used for undo.

solitaire_data/Cargo.toml

@@ -26,6 +26,13 @@ tokio          = { workspace = true }
 [target.'cfg(not(target_os = "android"))'.dependencies]
 keyring-core   = { workspace = true }
 
+[target.'cfg(target_os = "android")'.dependencies]
+jni            = { workspace = true }
+# android_keystore.rs uses bevy::android::ANDROID_APP to obtain the
+# process-wide JavaVM handle for JNI. Must be listed here so the
+# symbol resolves when cross-compiling for Android targets.
+bevy           = { workspace = true }
+
 [dev-dependencies]
 solitaire_server = { path = "../solitaire_server" }
 solitaire_sync   = { workspace = true }

solitaire_data/src/android_keystore.rs

@@ -0,0 +1,409 @@
+/// Android Keystore token storage via JNI.
+///
+/// Tokens are serialised to JSON, encrypted with AES-256/GCM/NoPadding using a
+/// device-bound key from the Android Keystore, and written atomically to
+/// `{data_dir}/auth_tokens.bin` as `[12-byte IV][ciphertext+GCM-tag]`.
+///
+/// The Keystore key survives app restarts but is destroyed on uninstall (or if
+/// the user changes biometric/lock credentials, in which case decryption fails
+/// and we surface `TokenError::KeychainUnavailable` so the caller knows to
+/// prompt re-login — identical semantics to a Linux box without Secret Service).
+///
+/// Only compiled and linked on `target_os = "android"`.
+use jni::{
+    objects::{JByteArray, JObject, JObjectArray, JValue, JValueOwned},
+    JNIEnv, JavaVM,
+};
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+use crate::auth_tokens::TokenError;
+
+const KEY_ALIAS: &str = "solitaire_quest_token_key";
+
+#[derive(Serialize, Deserialize)]
+struct TokenBlob {
+    username: String,
+    access_token: String,
+    refresh_token: String,
+}
+
+// ---------------------------------------------------------------------------
+// JVM helper
+// ---------------------------------------------------------------------------
+
+fn with_jvm<F, R>(f: F) -> Result<R, TokenError>
+where
+    F: for<'env> FnOnce(&mut JNIEnv<'env>) -> Result<R, jni::errors::Error>,
+{
+    let app = bevy::android::ANDROID_APP
+        .get()
+        .ok_or_else(|| TokenError::KeychainUnavailable("ANDROID_APP not initialised".into()))?;
+
+    // SAFETY: vm_as_ptr() is the process-wide JavaVM* set by the Android runtime.
+    let vm = unsafe { JavaVM::from_raw(app.vm_as_ptr().cast()) }
+        .map_err(|e| TokenError::Keyring(format!("JavaVM: {e}")))?;
+
+    let mut env = vm
+        .attach_current_thread_permanently()
+        .map_err(|e| TokenError::Keyring(format!("attach: {e}")))?;
+
+    f(&mut env).map_err(|e| TokenError::Keyring(format!("JNI: {e}")))
+}
+
+// ---------------------------------------------------------------------------
+// Keystore key management
+// ---------------------------------------------------------------------------
+
+/// Load the existing AES key from the Android Keystore, or generate one if it
+/// doesn't exist yet. Returns a local reference valid for the current JNI frame.
+fn load_or_create_key<'local>(env: &mut JNIEnv<'local>) -> jni::errors::Result<JObject<'local>> {
+    // KeyStore ks = KeyStore.getInstance("AndroidKeyStore"); ks.load(null);
+    let ks_class = env.find_class("java/security/KeyStore")?;
+    let ks_type = JValueOwned::from(env.new_string("AndroidKeyStore")?);
+    let ks = env
+        .call_static_method(
+            &ks_class,
+            "getInstance",
+            "(Ljava/lang/String;)Ljava/security/KeyStore;",
+            &[ks_type.borrow()],
+        )?
+        .l()?;
+
+    let null = JObject::null();
+    env.call_method(
+        &ks,
+        "load",
+        "(Ljava/security/KeyStore$LoadStoreParameter;)V",
+        &[JValue::Object(&null)],
+    )?
+    .v()?;
+
+    // Key key = ks.getKey(ALIAS, null)  — char[] password is null for hardware keys
+    let alias = JValueOwned::from(env.new_string(KEY_ALIAS)?);
+    let null2 = JObject::null();
+    let key = env
+        .call_method(
+            &ks,
+            "getKey",
+            "(Ljava/lang/String;[C)Ljava/security/Key;",
+            &[alias.borrow(), JValue::Object(&null2)],
+        )?
+        .l()?;
+
+    if !env.is_same_object(&key, JObject::null())? {
+        return Ok(key);
+    }
+
+    // No key yet — generate AES-256 with GCM block mode.
+    let builder_class =
+        env.find_class("android/security/keystore/KeyGenParameterSpec$Builder")?;
+    let alias2 = JValueOwned::from(env.new_string(KEY_ALIAS)?);
+    // PURPOSE_ENCRYPT | PURPOSE_DECRYPT = 1 | 2 = 3
+    let purpose = JValueOwned::Int(3);
+    let builder = env.new_object(
+        &builder_class,
+        "(Ljava/lang/String;I)V",
+        &[alias2.borrow(), purpose.borrow()],
+    )?;
+
+    let str_class = env.find_class("java/lang/String")?;
+
+    // builder.setBlockModes(["GCM"])
+    let gcm_str = env.new_string("GCM")?;
+    let block_modes: JObjectArray = env.new_object_array(1, &str_class, &gcm_str)?;
+    let block_modes_val = JValueOwned::Object(block_modes.into());
+    let builder = env
+        .call_method(
+            &builder,
+            "setBlockModes",
+            "([Ljava/lang/String;)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+            &[block_modes_val.borrow()],
+        )?
+        .l()?;
+
+    // builder.setEncryptionPaddings(["NoPadding"])
+    let nopad_str = env.new_string("NoPadding")?;
+    let enc_pads: JObjectArray = env.new_object_array(1, &str_class, &nopad_str)?;
+    let enc_pads_val = JValueOwned::Object(enc_pads.into());
+    let builder = env
+        .call_method(
+            &builder,
+            "setEncryptionPaddings",
+            "([Ljava/lang/String;)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+            &[enc_pads_val.borrow()],
+        )?
+        .l()?;
+
+    // KeyGenParameterSpec spec = builder.build()
+    let spec = env
+        .call_method(
+            &builder,
+            "build",
+            "()Landroid/security/keystore/KeyGenParameterSpec;",
+            &[],
+        )?
+        .l()?;
+
+    // KeyGenerator kg = KeyGenerator.getInstance("AES", "AndroidKeyStore")
+    let kg_class = env.find_class("javax/crypto/KeyGenerator")?;
+    let aes = JValueOwned::from(env.new_string("AES")?);
+    let ks_name = JValueOwned::from(env.new_string("AndroidKeyStore")?);
+    let kg = env
+        .call_static_method(
+            &kg_class,
+            "getInstance",
+            "(Ljava/lang/String;Ljava/lang/String;)Ljavax/crypto/KeyGenerator;",
+            &[aes.borrow(), ks_name.borrow()],
+        )?
+        .l()?;
+
+    // kg.init(spec); return kg.generateKey()
+    let spec_val = JValueOwned::Object(spec);
+    env.call_method(
+        &kg,
+        "init",
+        "(Ljava/security/spec/AlgorithmParameterSpec;)V",
+        &[spec_val.borrow()],
+    )?
+    .v()?;
+
+    env.call_method(&kg, "generateKey", "()Ljavax/crypto/SecretKey;", &[])?
+        .l()
+}
+
+// ---------------------------------------------------------------------------
+// AES-GCM encrypt / decrypt
+// ---------------------------------------------------------------------------
+
+/// Returns `[12-byte IV][ciphertext+GCM-tag]`.
+fn encrypt_gcm(
+    env: &mut JNIEnv<'_>,
+    key: &JObject<'_>,
+    plaintext: &[u8],
+) -> jni::errors::Result<Vec<u8>> {
+    let cipher_class = env.find_class("javax/crypto/Cipher")?;
+    let transform = JValueOwned::from(env.new_string("AES/GCM/NoPadding")?);
+    let cipher = env
+        .call_static_method(
+            &cipher_class,
+            "getInstance",
+            "(Ljava/lang/String;)Ljavax/crypto/Cipher;",
+            &[transform.borrow()],
+        )?
+        .l()?;
+
+    // cipher.init(Cipher.ENCRYPT_MODE=1, key)
+    let mode = JValueOwned::Int(1);
+    env.call_method(
+        &cipher,
+        "init",
+        "(ILjava/security/Key;)V",
+        &[mode.borrow(), JValue::Object(key)],
+    )?
+    .v()?;
+
+    // IV is generated by Android's provider; read it back after init.
+    let iv_jobj = env.call_method(&cipher, "getIV", "()[B", &[])?.l()?;
+    // SAFETY: the method signature guarantees a byte array return.
+    let iv_arr = unsafe { JByteArray::from_raw(iv_jobj.into_raw()) };
+    let iv = env.convert_byte_array(&iv_arr)?;
+
+    let pt_arr = env.byte_array_from_slice(plaintext)?;
+    let pt_val = JValueOwned::Object(pt_arr.into());
+    let ct_jobj = env
+        .call_method(&cipher, "doFinal", "([B)[B", &[pt_val.borrow()])?
+        .l()?;
+    // SAFETY: doFinal([B) returns [B.
+    let ct_arr = unsafe { JByteArray::from_raw(ct_jobj.into_raw()) };
+    let ciphertext = env.convert_byte_array(&ct_arr)?;
+
+    let mut out = Vec::with_capacity(iv.len() + ciphertext.len());
+    out.extend_from_slice(&iv);
+    out.extend_from_slice(&ciphertext);
+    Ok(out)
+}
+
+/// Expects `data` as `[12-byte IV][ciphertext+GCM-tag]`.
+fn decrypt_gcm(
+    env: &mut JNIEnv<'_>,
+    key: &JObject<'_>,
+    data: &[u8],
+) -> jni::errors::Result<Vec<u8>> {
+    let (iv, ciphertext) = data.split_at(12);
+
+    let cipher_class = env.find_class("javax/crypto/Cipher")?;
+    let transform = JValueOwned::from(env.new_string("AES/GCM/NoPadding")?);
+    let cipher = env
+        .call_static_method(
+            &cipher_class,
+            "getInstance",
+            "(Ljava/lang/String;)Ljavax/crypto/Cipher;",
+            &[transform.borrow()],
+        )?
+        .l()?;
+
+    // GCMParameterSpec spec = new GCMParameterSpec(128, iv)
+    let spec_class = env.find_class("javax/crypto/spec/GCMParameterSpec")?;
+    let tag_len = JValueOwned::Int(128);
+    let iv_arr = env.byte_array_from_slice(iv)?;
+    let iv_val = JValueOwned::Object(iv_arr.into());
+    let spec = env.new_object(
+        &spec_class,
+        "(I[B)V",
+        &[tag_len.borrow(), iv_val.borrow()],
+    )?;
+
+    // cipher.init(Cipher.DECRYPT_MODE=2, key, spec)
+    let mode = JValueOwned::Int(2);
+    let spec_val = JValueOwned::Object(spec);
+    env.call_method(
+        &cipher,
+        "init",
+        "(ILjava/security/Key;Ljava/security/spec/AlgorithmParameterSpec;)V",
+        &[mode.borrow(), JValue::Object(key), spec_val.borrow()],
+    )?
+    .v()?;
+
+    let ct_arr = env.byte_array_from_slice(ciphertext)?;
+    let ct_val = JValueOwned::Object(ct_arr.into());
+    let pt_jobj = env
+        .call_method(&cipher, "doFinal", "([B)[B", &[ct_val.borrow()])?
+        .l()?;
+    // SAFETY: doFinal([B) returns [B.
+    let pt_arr = unsafe { JByteArray::from_raw(pt_jobj.into_raw()) };
+    env.convert_byte_array(&pt_arr)
+}
+
+// ---------------------------------------------------------------------------
+// File helpers
+// ---------------------------------------------------------------------------
+
+fn token_file_path() -> Option<PathBuf> {
+    crate::platform::data_dir().map(|d| d.join("auth_tokens.bin"))
+}
+
+fn read_file_bytes() -> Result<Vec<u8>, TokenError> {
+    let path = token_file_path()
+        .ok_or_else(|| TokenError::KeychainUnavailable("no data dir".into()))?;
+    if !path.exists() {
+        return Err(TokenError::NotFound(String::new()));
+    }
+    std::fs::read(&path).map_err(|e| TokenError::Keyring(format!("read auth_tokens.bin: {e}")))
+}
+
+fn write_file_bytes(data: &[u8]) -> Result<(), TokenError> {
+    let path = token_file_path()
+        .ok_or_else(|| TokenError::KeychainUnavailable("no data dir".into()))?;
+    let tmp = path.with_extension("tmp");
+    std::fs::write(&tmp, data)
+        .map_err(|e| TokenError::Keyring(format!("write auth_tokens.tmp: {e}")))?;
+    std::fs::rename(&tmp, &path)
+        .map_err(|e| TokenError::Keyring(format!("rename auth_tokens: {e}")))
+}
+
+fn load_blob(username: &str) -> Result<TokenBlob, TokenError> {
+    let data = read_file_bytes().map_err(|e| match e {
+        TokenError::NotFound(_) => TokenError::NotFound(username.to_string()),
+        other => other,
+    })?;
+
+    if data.len() < 12 {
+        return Err(TokenError::Keyring("auth_tokens.bin corrupt (too short)".into()));
+    }
+
+    let plaintext = with_jvm(|env| {
+        let key = load_or_create_key(env)?;
+        decrypt_gcm(env, &key, &data)
+    })?;
+
+    let blob: TokenBlob = serde_json::from_slice(&plaintext)
+        .map_err(|e| TokenError::Keyring(format!("JSON decode: {e}")))?;
+
+    if blob.username != username {
+        return Err(TokenError::NotFound(username.to_string()));
+    }
+
+    Ok(blob)
+}
+
+// ---------------------------------------------------------------------------
+// Public API — mirrors auth_tokens desktop surface exactly.
+// ---------------------------------------------------------------------------
+
+/// Encrypt and store `access_token` and `refresh_token` for `username`.
+///
+/// Overwrites any previously stored tokens.
+pub fn store_tokens(
+    username: &str,
+    access_token: &str,
+    refresh_token: &str,
+) -> Result<(), TokenError> {
+    let blob = TokenBlob {
+        username: username.to_string(),
+        access_token: access_token.to_string(),
+        refresh_token: refresh_token.to_string(),
+    };
+    let plaintext = serde_json::to_vec(&blob)
+        .map_err(|e| TokenError::Keyring(format!("JSON encode: {e}")))?;
+
+    let encrypted = with_jvm(|env| {
+        let key = load_or_create_key(env)?;
+        encrypt_gcm(env, &key, &plaintext)
+    })?;
+
+    write_file_bytes(&encrypted)
+}
+
+/// Return the stored access token for `username`.
+///
+/// Returns [`TokenError::NotFound`] if no token has been stored yet.
+pub fn load_access_token(username: &str) -> Result<String, TokenError> {
+    load_blob(username).map(|b| b.access_token)
+}
+
+/// Return the stored refresh token for `username`.
+///
+/// Returns [`TokenError::NotFound`] if no token has been stored yet.
+pub fn load_refresh_token(username: &str) -> Result<String, TokenError> {
+    load_blob(username).map(|b| b.refresh_token)
+}
+
+/// Delete stored tokens and remove the Keystore key for `username`.
+///
+/// Missing file or missing Keystore entry are silently ignored.
+pub fn delete_tokens(_username: &str) -> Result<(), TokenError> {
+    if let Some(path) = token_file_path() {
+        if path.exists() {
+            std::fs::remove_file(&path)
+                .map_err(|e| TokenError::Keyring(format!("delete auth_tokens.bin: {e}")))?;
+        }
+    }
+
+    // Remove the Keystore key so a future re-login generates a fresh key.
+    with_jvm(|env| {
+        let ks_class = env.find_class("java/security/KeyStore")?;
+        let ks_type = JValueOwned::from(env.new_string("AndroidKeyStore")?);
+        let ks = env
+            .call_static_method(
+                &ks_class,
+                "getInstance",
+                "(Ljava/lang/String;)Ljava/security/KeyStore;",
+                &[ks_type.borrow()],
+            )?
+            .l()?;
+
+        let null = JObject::null();
+        env.call_method(
+            &ks,
+            "load",
+            "(Ljava/security/KeyStore$LoadStoreParameter;)V",
+            &[JValue::Object(&null)],
+        )?
+        .v()?;
+
+        let alias = JValueOwned::from(env.new_string(KEY_ALIAS)?);
+        env.call_method(&ks, "deleteEntry", "(Ljava/lang/String;)V", &[alias.borrow()])?
+            .v()
+    })
+}

solitaire_data/src/auth_tokens.rs

@@ -131,35 +131,29 @@ pub fn delete_tokens(username: &str) -> Result<(), TokenError> {
 }
 
 // -------------------------------------------------------------------
-// Android stub — same public API, always returns KeychainUnavailable.
-// Lets `sync_client::*` compile unchanged on Android; the runtime
-// effect is "session login required every launch", same as a Linux
-// box without Secret Service.
+// Android — delegate to the JNI Keystore bridge in android_keystore.
 // -------------------------------------------------------------------
 
-#[cfg(target_os = "android")]
-const ANDROID_STUB_MSG: &str = "android stub: keychain not yet wired (Phase-Android task)";
-
 #[cfg(target_os = "android")]
 pub fn store_tokens(
-    _username: &str,
-    _access_token: &str,
-    _refresh_token: &str,
+    username: &str,
+    access_token: &str,
+    refresh_token: &str,
 ) -> Result<(), TokenError> {
-    Err(TokenError::KeychainUnavailable(ANDROID_STUB_MSG.to_string()))
+    crate::android_keystore::store_tokens(username, access_token, refresh_token)
 }
 
 #[cfg(target_os = "android")]
-pub fn load_access_token(_username: &str) -> Result<String, TokenError> {
-    Err(TokenError::KeychainUnavailable(ANDROID_STUB_MSG.to_string()))
+pub fn load_access_token(username: &str) -> Result<String, TokenError> {
+    crate::android_keystore::load_access_token(username)
 }
 
 #[cfg(target_os = "android")]
-pub fn load_refresh_token(_username: &str) -> Result<String, TokenError> {
-    Err(TokenError::KeychainUnavailable(ANDROID_STUB_MSG.to_string()))
+pub fn load_refresh_token(username: &str) -> Result<String, TokenError> {
+    crate::android_keystore::load_refresh_token(username)
 }
 
 #[cfg(target_os = "android")]
-pub fn delete_tokens(_username: &str) -> Result<(), TokenError> {
-    Err(TokenError::KeychainUnavailable(ANDROID_STUB_MSG.to_string()))
+pub fn delete_tokens(username: &str) -> Result<(), TokenError> {
+    crate::android_keystore::delete_tokens(username)
 }

solitaire_data/src/challenge.rs

@@ -40,6 +40,82 @@ pub const CHALLENGE_SEEDS: &[u64] = &[
     0xDDDD_EEEE_FFFF_0000,
     0x0101_0101_0101_0101,
     0xA1B2_C3D4_E5F6_0718,
+    // Generated by solitaire_assetgen::gen_seeds (start=0xCAFEBABE00000000, count=75, date=2026-05-09)
+    0xCAFE_BABE_0000_0000,
+    0xCAFE_BABE_0000_0002,
+    0xCAFE_BABE_0000_0004,
+    0xCAFE_BABE_0000_0008,
+    0xCAFE_BABE_0000_000B,
+    0xCAFE_BABE_0000_000D,
+    0xCAFE_BABE_0000_000E,
+    0xCAFE_BABE_0000_0010,
+    0xCAFE_BABE_0000_0011,
+    0xCAFE_BABE_0000_0014,
+    0xCAFE_BABE_0000_0016,
+    0xCAFE_BABE_0000_0019,
+    0xCAFE_BABE_0000_001A,
+    0xCAFE_BABE_0000_001F,
+    0xCAFE_BABE_0000_0020,
+    0xCAFE_BABE_0000_0021,
+    0xCAFE_BABE_0000_0024,
+    0xCAFE_BABE_0000_0025,
+    0xCAFE_BABE_0000_0027,
+    0xCAFE_BABE_0000_002B,
+    0xCAFE_BABE_0000_002D,
+    0xCAFE_BABE_0000_0030,
+    0xCAFE_BABE_0000_0034,
+    0xCAFE_BABE_0000_0036,
+    0xCAFE_BABE_0000_003A,
+    0xCAFE_BABE_0000_003B,
+    0xCAFE_BABE_0000_003D,
+    0xCAFE_BABE_0000_0042,
+    0xCAFE_BABE_0000_0043,
+    0xCAFE_BABE_0000_0044,
+    0xCAFE_BABE_0000_004C,
+    0xCAFE_BABE_0000_004D,
+    0xCAFE_BABE_0000_004F,
+    0xCAFE_BABE_0000_0050,
+    0xCAFE_BABE_0000_0051,
+    0xCAFE_BABE_0000_0054,
+    0xCAFE_BABE_0000_0055,
+    0xCAFE_BABE_0000_0056,
+    0xCAFE_BABE_0000_0059,
+    0xCAFE_BABE_0000_005B,
+    0xCAFE_BABE_0000_005C,
+    0xCAFE_BABE_0000_005E,
+    0xCAFE_BABE_0000_0060,
+    0xCAFE_BABE_0000_0062,
+    0xCAFE_BABE_0000_0064,
+    0xCAFE_BABE_0000_0067,
+    0xCAFE_BABE_0000_0069,
+    0xCAFE_BABE_0000_006A,
+    0xCAFE_BABE_0000_006B,
+    0xCAFE_BABE_0000_006C,
+    0xCAFE_BABE_0000_006D,
+    0xCAFE_BABE_0000_006E,
+    0xCAFE_BABE_0000_006F,
+    0xCAFE_BABE_0000_0072,
+    0xCAFE_BABE_0000_0073,
+    0xCAFE_BABE_0000_0074,
+    0xCAFE_BABE_0000_0079,
+    0xCAFE_BABE_0000_007A,
+    0xCAFE_BABE_0000_007D,
+    0xCAFE_BABE_0000_007E,
+    0xCAFE_BABE_0000_007F,
+    0xCAFE_BABE_0000_0082,
+    0xCAFE_BABE_0000_0083,
+    0xCAFE_BABE_0000_0084,
+    0xCAFE_BABE_0000_0085,
+    0xCAFE_BABE_0000_0089,
+    0xCAFE_BABE_0000_008A,
+    0xCAFE_BABE_0000_008D,
+    0xCAFE_BABE_0000_008E,
+    0xCAFE_BABE_0000_0090,
+    0xCAFE_BABE_0000_0094,
+    0xCAFE_BABE_0000_0095,
+    0xCAFE_BABE_0000_0098,
+    0xCAFE_BABE_0000_0099,
+    0xCAFE_BABE_0000_009F,
 ];
 
 /// Resolve a `challenge_index` to its corresponding seed, wrapping when

solitaire_data/src/difficulty_seeds.rs

@@ -0,0 +1,320 @@
+//! Pre-verified seed catalogs for each [`DifficultyLevel`] tier.
+//!
+//! Each slice contains seeds that are provably winnable in Draw-One mode and
+//! that required a specific solver-budget range to solve — the **smallest**
+//! budget that returns `Winnable` determines the tier. See
+//! `solitaire_assetgen/src/bin/gen_difficulty_seeds.rs` for the generator.
+//!
+//! # Tiers and budget boundaries
+//!
+//! | Tier        | move_budget | state_budget |
+//! |-------------|-------------|--------------|
+//! | Easy        | 1 000       | 1 000        |
+//! | Medium      | 5 000       | 5 000        |
+//! | Hard        | 25 000      | 25 000       |
+//! | Expert      | 100 000     | 100 000      |
+//! | Grandmaster | 200 000     | 200 000      |
+//!
+//! [`DifficultyLevel::Random`] has no catalog — the engine picks a system-time
+//! seed and skips verification.
+
+use solitaire_core::game_state::DifficultyLevel;
+
+// ---------------------------------------------------------------------------
+// Catalogs (populated by gen_difficulty_seeds)
+// ---------------------------------------------------------------------------
+
+/// 40 seeds proven winnable within the Easy budget (≤ 1 000 states).
+pub const EASY_SEEDS: &[u64] = &[
+    // Generated by solitaire_assetgen::gen_difficulty_seeds (tier=Easy, date=2026-05-09)
+    0xD1FF_0000_0000_0001,
+    0xD1FF_0000_0000_0002,
+    0xD1FF_0000_0000_0007,
+    0xD1FF_0000_0000_0008,
+    0xD1FF_0000_0000_0009,
+    0xD1FF_0000_0000_000E,
+    0xD1FF_0000_0000_0013,
+    0xD1FF_0000_0000_0015,
+    0xD1FF_0000_0000_0018,
+    0xD1FF_0000_0000_001D,
+    0xD1FF_0000_0000_0021,
+    0xD1FF_0000_0000_0022,
+    0xD1FF_0000_0000_0026,
+    0xD1FF_0000_0000_002C,
+    0xD1FF_0000_0000_002E,
+    0xD1FF_0000_0000_002F,
+    0xD1FF_0000_0000_0035,
+    0xD1FF_0000_0000_0036,
+    0xD1FF_0000_0000_003C,
+    0xD1FF_0000_0000_0045,
+    0xD1FF_0000_0000_0046,
+    0xD1FF_0000_0000_0048,
+    0xD1FF_0000_0000_0049,
+    0xD1FF_0000_0000_004D,
+    0xD1FF_0000_0000_004F,
+    0xD1FF_0000_0000_0050,
+    0xD1FF_0000_0000_0051,
+    0xD1FF_0000_0000_0053,
+    0xD1FF_0000_0000_0054,
+    0xD1FF_0000_0000_0057,
+    0xD1FF_0000_0000_0058,
+    0xD1FF_0000_0000_005A,
+    0xD1FF_0000_0000_005B,
+    0xD1FF_0000_0000_005C,
+    0xD1FF_0000_0000_005D,
+    0xD1FF_0000_0000_005F,
+    0xD1FF_0000_0000_0061,
+    0xD1FF_0000_0000_0062,
+    0xD1FF_0000_0000_0063,
+    0xD1FF_0000_0000_0069,
+];
+
+/// 40 seeds proven winnable within the Medium budget (≤ 5 000 states).
+pub const MEDIUM_SEEDS: &[u64] = &[
+    // Generated by solitaire_assetgen::gen_difficulty_seeds (tier=Medium, date=2026-05-09)
+    0xD1FF_0000_0000_0000,
+    0xD1FF_0000_0000_0012,
+    0xD1FF_0000_0000_0016,
+    0xD1FF_0000_0000_001B,
+    0xD1FF_0000_0000_001C,
+    0xD1FF_0000_0000_0020,
+    0xD1FF_0000_0000_002A,
+    0xD1FF_0000_0000_0034,
+    0xD1FF_0000_0000_003A,
+    0xD1FF_0000_0000_0041,
+    0xD1FF_0000_0000_0043,
+    0xD1FF_0000_0000_0060,
+    0xD1FF_0000_0000_006A,
+    0xD1FF_0000_0000_006C,
+    0xD1FF_0000_0000_006E,
+    0xD1FF_0000_0000_006F,
+    0xD1FF_0000_0000_0071,
+    0xD1FF_0000_0000_0072,
+    0xD1FF_0000_0000_0075,
+    0xD1FF_0000_0000_0076,
+    0xD1FF_0000_0000_007B,
+    0xD1FF_0000_0000_007E,
+    0xD1FF_0000_0000_0081,
+    0xD1FF_0000_0000_0083,
+    0xD1FF_0000_0000_0084,
+    0xD1FF_0000_0000_0087,
+    0xD1FF_0000_0000_0090,
+    0xD1FF_0000_0000_0092,
+    0xD1FF_0000_0000_0093,
+    0xD1FF_0000_0000_0098,
+    0xD1FF_0000_0000_0099,
+    0xD1FF_0000_0000_009A,
+    0xD1FF_0000_0000_009E,
+    0xD1FF_0000_0000_00A5,
+    0xD1FF_0000_0000_00A8,
+    0xD1FF_0000_0000_00AA,
+    0xD1FF_0000_0000_00AB,
+    0xD1FF_0000_0000_00AE,
+    0xD1FF_0000_0000_00AF,
+    0xD1FF_0000_0000_00B0,
+];
+
+/// 40 seeds proven winnable within the Hard budget (≤ 25 000 states).
+pub const HARD_SEEDS: &[u64] = &[
+    // Generated by solitaire_assetgen::gen_difficulty_seeds (tier=Hard, date=2026-05-09)
+    0xD1FF_0000_0000_001F,
+    0xD1FF_0000_0000_0024,
+    0xD1FF_0000_0000_0025,
+    0xD1FF_0000_0000_0031,
+    0xD1FF_0000_0000_0032,
+    0xD1FF_0000_0000_003E,
+    0xD1FF_0000_0000_004A,
+    0xD1FF_0000_0000_006D,
+    0xD1FF_0000_0000_0079,
+    0xD1FF_0000_0000_007C,
+    0xD1FF_0000_0000_0080,
+    0xD1FF_0000_0000_008A,
+    0xD1FF_0000_0000_0097,
+    0xD1FF_0000_0000_00B1,
+    0xD1FF_0000_0000_00B2,
+    0xD1FF_0000_0000_00B3,
+    0xD1FF_0000_0000_00B5,
+    0xD1FF_0000_0000_00B7,
+    0xD1FF_0000_0000_00B8,
+    0xD1FF_0000_0000_00B9,
+    0xD1FF_0000_0000_00BA,
+    0xD1FF_0000_0000_00BB,
+    0xD1FF_0000_0000_00BC,
+    0xD1FF_0000_0000_00BD,
+    0xD1FF_0000_0000_00C2,
+    0xD1FF_0000_0000_00C3,
+    0xD1FF_0000_0000_00C5,
+    0xD1FF_0000_0000_00CC,
+    0xD1FF_0000_0000_00CE,
+    0xD1FF_0000_0000_00D1,
+    0xD1FF_0000_0000_00D2,
+    0xD1FF_0000_0000_00D6,
+    0xD1FF_0000_0000_00D7,
+    0xD1FF_0000_0000_00DC,
+    0xD1FF_0000_0000_00DF,
+    0xD1FF_0000_0000_00E0,
+    0xD1FF_0000_0000_00E1,
+    0xD1FF_0000_0000_00E4,
+    0xD1FF_0000_0000_00E6,
+    0xD1FF_0000_0000_00E7,
+];
+
+/// 40 seeds proven winnable within the Expert budget (≤ 100 000 states).
+pub const EXPERT_SEEDS: &[u64] = &[
+    // Generated by solitaire_assetgen::gen_difficulty_seeds (tier=Expert, date=2026-05-09)
+    0xD1FF_0000_0000_0006,
+    0xD1FF_0000_0000_000B,
+    0xD1FF_0000_0000_0019,
+    0xD1FF_0000_0000_0082,
+    0xD1FF_0000_0000_00CB,
+    0xD1FF_0000_0000_00D5,
+    0xD1FF_0000_0000_00D8,
+    0xD1FF_0000_0000_00E8,
+    0xD1FF_0000_0000_00EA,
+    0xD1FF_0000_0000_00EB,
+    0xD1FF_0000_0000_00EC,
+    0xD1FF_0000_0000_00ED,
+    0xD1FF_0000_0000_00F2,
+    0xD1FF_0000_0000_00F3,
+    0xD1FF_0000_0000_00F4,
+    0xD1FF_0000_0000_00FE,
+    0xD1FF_0000_0000_00FF,
+    0xD1FF_0000_0000_0102,
+    0xD1FF_0000_0000_0103,
+    0xD1FF_0000_0000_0104,
+    0xD1FF_0000_0000_0105,
+    0xD1FF_0000_0000_0106,
+    0xD1FF_0000_0000_0109,
+    0xD1FF_0000_0000_010B,
+    0xD1FF_0000_0000_010C,
+    0xD1FF_0000_0000_0110,
+    0xD1FF_0000_0000_0113,
+    0xD1FF_0000_0000_0114,
+    0xD1FF_0000_0000_011B,
+    0xD1FF_0000_0000_011C,
+    0xD1FF_0000_0000_011E,
+    0xD1FF_0000_0000_0120,
+    0xD1FF_0000_0000_0121,
+    0xD1FF_0000_0000_0122,
+    0xD1FF_0000_0000_0123,
+    0xD1FF_0000_0000_0124,
+    0xD1FF_0000_0000_0126,
+    0xD1FF_0000_0000_012B,
+    0xD1FF_0000_0000_012C,
+    0xD1FF_0000_0000_012E,
+];
+
+/// 40 seeds proven winnable only within the Grandmaster budget (≤ 200 000 states).
+pub const GRANDMASTER_SEEDS: &[u64] = &[
+    // Generated by solitaire_assetgen::gen_difficulty_seeds (tier=Grandmaster, date=2026-05-09)
+    0xD1FF_0000_0000_0027,
+    0xD1FF_0000_0000_00A0,
+    0xD1FF_0000_0000_00C4,
+    0xD1FF_0000_0000_00D4,
+    0xD1FF_0000_0000_00DE,
+    0xD1FF_0000_0000_00F9,
+    0xD1FF_0000_0000_0107,
+    0xD1FF_0000_0000_0108,
+    0xD1FF_0000_0000_0130,
+    0xD1FF_0000_0000_0132,
+    0xD1FF_0000_0000_0133,
+    0xD1FF_0000_0000_0134,
+    0xD1FF_0000_0000_0135,
+    0xD1FF_0000_0000_0137,
+    0xD1FF_0000_0000_0139,
+    0xD1FF_0000_0000_013A,
+    0xD1FF_0000_0000_013D,
+    0xD1FF_0000_0000_013F,
+    0xD1FF_0000_0000_0140,
+    0xD1FF_0000_0000_0141,
+    0xD1FF_0000_0000_0142,
+    0xD1FF_0000_0000_0143,
+    0xD1FF_0000_0000_0145,
+    0xD1FF_0000_0000_0146,
+    0xD1FF_0000_0000_014A,
+    0xD1FF_0000_0000_014B,
+    0xD1FF_0000_0000_014C,
+    0xD1FF_0000_0000_014D,
+    0xD1FF_0000_0000_014F,
+    0xD1FF_0000_0000_0150,
+    0xD1FF_0000_0000_0151,
+    0xD1FF_0000_0000_0152,
+    0xD1FF_0000_0000_0153,
+    0xD1FF_0000_0000_0157,
+    0xD1FF_0000_0000_0158,
+    0xD1FF_0000_0000_015B,
+    0xD1FF_0000_0000_015C,
+    0xD1FF_0000_0000_015E,
+    0xD1FF_0000_0000_0162,
+    0xD1FF_0000_0000_0164,
+];
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/// Type alias for the catalog lookup return: a static slice or `None` for `Random`.
+pub type DifficultySeeds = Option<&'static [u64]>;
+
+/// Return the seed catalog for `level`, or `None` for `Random` (caller must
+/// use a system-time seed instead).
+pub fn seeds_for(level: DifficultyLevel) -> DifficultySeeds {
+    match level {
+        DifficultyLevel::Easy => Some(EASY_SEEDS),
+        DifficultyLevel::Medium => Some(MEDIUM_SEEDS),
+        DifficultyLevel::Hard => Some(HARD_SEEDS),
+        DifficultyLevel::Expert => Some(EXPERT_SEEDS),
+        DifficultyLevel::Grandmaster => Some(GRANDMASTER_SEEDS),
+        DifficultyLevel::Random => None,
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn all_difficulty_seeds_are_unique() {
+        let all: Vec<u64> = [
+            EASY_SEEDS,
+            MEDIUM_SEEDS,
+            HARD_SEEDS,
+            EXPERT_SEEDS,
+            GRANDMASTER_SEEDS,
+        ]
+        .iter()
+        .flat_map(|s| s.iter().copied())
+        .collect();
+
+        let mut sorted = all.clone();
+        sorted.sort_unstable();
+        let before = sorted.len();
+        sorted.dedup();
+        assert_eq!(sorted.len(), before, "duplicate seeds found across difficulty tiers");
+    }
+
+    #[test]
+    fn seeds_for_random_returns_none() {
+        assert!(seeds_for(DifficultyLevel::Random).is_none());
+    }
+
+    #[test]
+    fn seeds_for_non_random_returns_some() {
+        for level in [
+            DifficultyLevel::Easy,
+            DifficultyLevel::Medium,
+            DifficultyLevel::Hard,
+            DifficultyLevel::Expert,
+            DifficultyLevel::Grandmaster,
+        ] {
+            assert!(
+                seeds_for(level).is_some(),
+                "{level:?} should return Some catalog"
+            );
+        }
+    }
+}

solitaire_data/src/lib.rs

@@ -138,6 +138,9 @@ pub use weekly::{
 pub mod challenge;
 pub use challenge::{challenge_count, challenge_seed_for, CHALLENGE_SEEDS};
 
+pub mod difficulty_seeds;
+pub use difficulty_seeds::{seeds_for, DifficultySeeds};
+
 pub mod settings;
 pub use settings::{
     load_settings_from, save_settings_to, settings_file_path, AnimSpeed, Settings, SyncBackend,
@@ -147,6 +150,9 @@ pub use settings::{
     TOOLTIP_DELAY_MIN_SECS, TOOLTIP_DELAY_STEP_SECS,
 };
 
+#[cfg(target_os = "android")]
+mod android_keystore;
+
 pub mod auth_tokens;
 pub use auth_tokens::{
     delete_tokens, load_access_token, load_refresh_token, store_tokens, TokenError,

solitaire_data/src/replay.rs

@@ -147,12 +147,38 @@ pub struct Replay {
     /// [`REPLAY_SCHEMA_VERSION`].
     #[serde(default)]
     pub share_url: Option<String>,
+    /// Index into [`moves`](Self::moves) of the move that triggered
+    /// the win condition (i.e. completed the last foundation pile).
+    ///
+    /// For replays recorded by the live engine this is always
+    /// `Some(moves.len() - 1)` because recording freezes on win — but
+    /// the field is stored explicitly so the playback UI can read it
+    /// directly without re-deriving "the last move was the win" each
+    /// time, and to leave room for future recording semantics that
+    /// might capture post-win state.
+    ///
+    /// `None` for replays loaded from disk that pre-date this field.
+    /// `#[serde(default)]` keeps older `latest_replay.json` /
+    /// `replays.json` files loadable without bumping
+    /// [`REPLAY_SCHEMA_VERSION`] — this is an additive optional
+    /// field, not a schema-breaking change.
+    ///
+    /// Surfaced by the replay-overlay scrub bar's WIN MOVE marker
+    /// (B-2 screen-takeover redesign) when present.
+    #[serde(default)]
+    pub win_move_index: Option<usize>,
 }
 
 impl Replay {
     /// Construct a fresh replay with the current schema version. The
     /// caller fills in the recorded fields; this is the canonical
     /// constructor used by the engine on win.
+    ///
+    /// [`win_move_index`](Self::win_move_index) and
+    /// [`share_url`](Self::share_url) default to `None` — the engine
+    /// uses [`with_win_move_index`](Self::with_win_move_index) at the
+    /// recording site to set the former, and `sync_plugin` writes the
+    /// latter directly when the upload task resolves.
     pub fn new(
         seed: u64,
         draw_mode: DrawMode,
@@ -172,8 +198,24 @@ impl Replay {
             recorded_at,
             moves,
             share_url: None,
+            win_move_index: None,
         }
     }
+
+    /// Builder-style setter for [`win_move_index`](Self::win_move_index).
+    /// Returns `self` so the recording site can chain it onto
+    /// [`Replay::new`]:
+    ///
+    /// ```ignore
+    /// let replay = Replay::new(...).with_win_move_index(Some(recording.moves.len() - 1));
+    /// ```
+    ///
+    /// `None` is a valid input — useful for tests that don't care about
+    /// the WIN MOVE marker's scrub-bar position.
+    pub fn with_win_move_index(mut self, idx: Option<usize>) -> Self {
+        self.win_move_index = idx;
+        self
+    }
 }
 
 /// Rolling history of the player's most recent winning replays.
@@ -737,4 +779,71 @@ mod tests {
 
         let _ = fs::remove_file(&path);
     }
+
+    // -----------------------------------------------------------------------
+    // win_move_index — additive optional field for the WIN MOVE marker
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn replay_new_defaults_win_move_index_to_none() {
+        let r = sample_replay();
+        assert_eq!(r.win_move_index, None);
+    }
+
+    #[test]
+    fn with_win_move_index_sets_value() {
+        let r = sample_replay().with_win_move_index(Some(3));
+        assert_eq!(r.win_move_index, Some(3));
+    }
+
+    #[test]
+    fn with_win_move_index_accepts_none() {
+        // Passing None through the builder is a valid no-op — useful for
+        // tests / synthetic replays that don't care about the marker.
+        let r = sample_replay().with_win_move_index(None);
+        assert_eq!(r.win_move_index, None);
+    }
+
+    #[test]
+    fn replay_with_win_move_index_round_trips_on_disk() {
+        let path = tmp_path("win_move_index_round_trip");
+        let _ = fs::remove_file(&path);
+
+        let original = sample_replay().with_win_move_index(Some(3));
+        save_latest_replay_to(&path, &original).expect("save");
+        let loaded = load_latest_replay_from(&path).expect("load");
+        assert_eq!(loaded.win_move_index, Some(3));
+        assert_eq!(loaded, original);
+
+        let _ = fs::remove_file(&path);
+    }
+
+    /// Older replay files written before this field was added must still
+    /// load — `#[serde(default)]` keeps `win_move_index` optional and
+    /// defaults missing fields to `None`. This is the contract that lets
+    /// us add the field without bumping `REPLAY_SCHEMA_VERSION`.
+    #[test]
+    fn replay_without_win_move_index_loads_with_none() {
+        let path = tmp_path("legacy_no_win_move_index");
+        let _ = fs::remove_file(&path);
+
+        // Hand-rolled minimal v2 replay JSON with no win_move_index field.
+        let v2_no_field = r#"{
+            "schema_version": 2,
+            "seed": 1,
+            "draw_mode": "DrawOne",
+            "mode": "Classic",
+            "time_seconds": 60,
+            "final_score": 100,
+            "recorded_at": "2026-05-02",
+            "moves": []
+        }"#;
+        fs::write(&path, v2_no_field).expect("write fixture");
+
+        let loaded = load_latest_replay_from(&path).expect("load");
+        assert_eq!(loaded.win_move_index, None);
+        assert_eq!(loaded.schema_version, REPLAY_SCHEMA_VERSION);
+
+        let _ = fs::remove_file(&path);
+    }
 }

solitaire_data/src/settings.rs

@@ -9,7 +9,7 @@ use std::io;
 use std::path::{Path, PathBuf};
 
 use serde::{Deserialize, Serialize};
-use solitaire_core::game_state::DrawMode;
+use solitaire_core::game_state::{DifficultyLevel, DrawMode};
 
 const APP_DIR_NAME: &str = "solitaire_quest";
 const SETTINGS_FILE_NAME: &str = "settings.json";
@@ -117,6 +117,24 @@ pub struct Settings {
     /// solely on colour.
     #[serde(default)]
     pub color_blind_mode: bool,
+    /// When `true`, boost foreground text + suit-red glyphs to higher-
+    /// luminance variants for better legibility on low-quality displays
+    /// or for low-vision users.  Per `design-system.md` §Accessibility:
+    /// on-surface `#d0d0d0` → `#f5f5f5`, suit-red `#fb9fb1` → `#ff8aa0`,
+    /// outline `#505050` → `#a0a0a0`.  Older `settings.json` files
+    /// written before this field existed deserialize cleanly to
+    /// `false` thanks to `#[serde(default)]`.
+    #[serde(default)]
+    pub high_contrast_mode: bool,
+    /// When `true`, suppresses non-essential motion: card-lift slide
+    /// transitions become instant snaps, splash scanline / cursor pulse
+    /// animations are disabled, and the warning-chip pulse holds at
+    /// rest.  Per `design-system.md` §Accessibility — the WCAG-required
+    /// reduce-motion mode.  Older `settings.json` files written before
+    /// this field existed deserialize cleanly to `false` thanks to
+    /// `#[serde(default)]`.
+    #[serde(default)]
+    pub reduce_motion_mode: bool,
     /// Window size and screen position to restore on next launch. `None`
     /// means "use platform defaults" — set on first run, then populated
     /// as the player resizes / moves the window. Older `settings.json`
@@ -206,6 +224,13 @@ pub struct Settings {
     /// `#[serde(default = "default_replay_move_interval_secs")]`.
     #[serde(default = "default_replay_move_interval_secs")]
     pub replay_move_interval_secs: f32,
+    /// Last difficulty tier the player selected. `None` means the player has
+    /// never used the difficulty picker. When `Some`, the difficulty section in
+    /// the home overlay opens pre-expanded and highlights this tier. Older
+    /// `settings.json` files written before this field existed deserialize
+    /// cleanly to `None` via `#[serde(default)]`.
+    #[serde(default)]
+    pub last_difficulty: Option<DifficultyLevel>,
 }
 
 fn default_draw_mode() -> DrawMode {
@@ -314,6 +339,8 @@ impl Default for Settings {
             selected_background: 0,
             first_run_complete: false,
             color_blind_mode: false,
+            high_contrast_mode: false,
+            reduce_motion_mode: false,
             window_geometry: None,
             selected_theme_id: default_theme_id(),
             shown_achievement_onboarding: false,
@@ -322,6 +349,7 @@ impl Default for Settings {
             winnable_deals_only: false,
             disable_smart_default_size: false,
             replay_move_interval_secs: default_replay_move_interval_secs(),
+            last_difficulty: None,
         }
     }
 }

solitaire_data/src/stats.rs

@@ -104,6 +104,13 @@ impl StatsExt for StatsSnapshot {
             // Time Attack uses its own session-level scoring; a per-game best
             // wouldn't compose with the other modes' single-game numbers.
             GameMode::TimeAttack => {}
+            // Difficulty games pool into the Classic best-score/time buckets per
+            // the user's stats preference.
+            GameMode::Difficulty(_) => {
+                self.classic_best_score = self.classic_best_score.max(score_u32);
+                self.classic_fastest_win_seconds =
+                    min_ignore_zero(self.classic_fastest_win_seconds, time_seconds);
+            }
         }
         self.last_modified = Utc::now();
     }

solitaire_engine/Cargo.toml

@@ -32,6 +32,9 @@ zip            = { workspace = true }
 [target.'cfg(not(target_os = "android"))'.dependencies]
 arboard        = { workspace = true }
 
+[target.'cfg(target_os = "android")'.dependencies]
+jni            = { workspace = true }
+
 [dev-dependencies]
 async-trait = { workspace = true }
 tempfile    = { workspace = true }

solitaire_engine/assets/themes/default/clubs_10.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">10</text>
+        fill="#e8e8e8">10</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_2.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">2</text>
+        fill="#e8e8e8">2</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_3.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">3</text>
+        fill="#e8e8e8">3</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_4.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">4</text>
+        fill="#e8e8e8">4</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_5.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">5</text>
+        fill="#e8e8e8">5</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_6.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">6</text>
+        fill="#e8e8e8">6</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_7.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">7</text>
+        fill="#e8e8e8">7</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_8.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">8</text>
+        fill="#e8e8e8">8</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_9.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">9</text>
+        fill="#e8e8e8">9</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_ace.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">A</text>
+        fill="#e8e8e8">A</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_jack.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">J</text>
+        fill="#e8e8e8">J</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_king.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">K</text>
+        fill="#e8e8e8">K</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/clubs_queen.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#d0d0d0" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#d0d0d0">Q</text>
+        fill="#e8e8e8">Q</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#d0d0d0" stroke-width="3"/>
+    <path d="M16,4 C 13,4 10,7 10,10 C 10,12 11,13 12,14 C 9,14 4,17 4,21 C 4,24 7,27 10,27 C 12,27 14,26 14,24 L 13,30 L 19,30 L 18,24 C 18,26 20,27 22,27 C 25,27 28,24 28,21 C 28,17 23,14 20,14 C 21,13 22,12 22,10 C 22,7 19,4 16,4 Z" fill="none" stroke="#e8e8e8" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/diamonds_10.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#fb9fb1" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#fb9fb1">10</text>
+        fill="#e35353">10</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/diamonds_2.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#fb9fb1" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#fb9fb1">2</text>
+        fill="#e35353">2</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 </svg>

solitaire_engine/assets/themes/default/diamonds_3.svg

@@ -1,18 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="256" height="384" viewBox="0 0 256 384">
-  <rect x="1" y="1" width="254" height="382" rx="16" ry="16"
-        fill="#1a1a1a" stroke="#fb9fb1" stroke-width="2"/>
+  <rect x="0" y="0" width="256" height="384" rx="16" ry="16"
+        fill="#1a1a1a"/>
 
   <!-- Top-left rank in JetBrains-Mono-styled FiraMono (rank digits
        and letters render correctly in FiraMono; only the suit glyphs
        needed to escape to paths). -->
   <text x="14" y="44" font-family="Fira Mono" font-size="36" font-weight="700"
-        fill="#fb9fb1">3</text>
+        fill="#e35353">3</text>
 
   <!-- Top-left small suit glyph at (14, 50), 20 × 20.
        `suit_path_d` is authored in a 32-unit box, so scale 0.625
        lands the visible glyph at 20 px. -->
   <g transform="translate(14 50) scale(0.625)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 
   <!-- Bottom-right large suit glyph at (178, 286), 64 × 64.
@@ -20,6 +20,6 @@
        (178, 286). Same upright orientation as the top-left small
        glyph — no 180° rotation applied. -->
   <g transform="translate(178 286) scale(2)">
-    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#fb9fb1" stroke-width="3"/>
+    <path d="M16,2 L 29,16 L 16,30 L 3,16 Z" fill="none" stroke="#e35353" stroke-width="3"/>
   </g>
 </svg>