ZepiGit · Oct 3, 2026 · Oct 3, 2026
diff --git a/BUILDING.md b/BUILDING.md
@@ -7,7 +7,7 @@ Build status for `0.2.5-firefin`: local verification passed 83 JVM unit tests,
 strict lint (0 errors, 74 warnings), an R8 release build and the APK verifier,
 and two instrumented tests on an API 22 stock x86 emulator. Signed APKs come
 only from the protected release workflow; the newest published release is
-`0.2.4-firefin`. There is no AFTT hardware result. CI results are recorded per
+`0.2.5-firefin`. There is no AFTT hardware result. CI results are recorded per
 commit in GitHub Actions.
 
 ## Toolchain (native)
@@ -117,7 +117,8 @@ in GitHub Actions; the local results above are not CI evidence.
 ## Protected release (`Firefin signed release`, `.github/workflows/release.yml`)
 
 Manual (`workflow_dispatch`) only. Releases `0.2.3-firefin` (run 37055114680)
-and `0.2.4-firefin` (run 37067878548) were produced with it.
+`0.2.4-firefin` (run 37067878548) and `0.2.5-firefin` (run 37095893231) were
+produced with it.
 
 Inputs:
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,7 +8,9 @@ preserved unchanged as history.
 
 ### 0.2.5-firefin (versionCode 3001005)
 
-Not yet published as a signed release.
+Published on 2026-10-03 as a signed GitHub release (tag `firefin-v0.2.5-firefin`)
+by the protected release workflow (run 37095893231) from commit
+`7bf3345a21f2731cf25dbfbcb38e7a4cd95d7f78`. No AFTT hardware result is recorded.
 
 Sign-in and connection:
 

diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
@@ -22,7 +22,7 @@ servers work on all supported Android versions after a confirmation.
 | API 22 stock x86 emulator, `0.2.5-firefin` | Two instrumented tests pass (login screen; sign-in over HTTP, favorite set/clear, paging through 125 episodes, sign-out and prefilled sign-in against a local fixture server); sign-in error and cleartext dialog checked manually. Playback was not exercised for this version |
 | API 22 stock x86 emulator, snapshot `c9da933` (before 0.2.4) | Login, Moonfin-like Home/Library/Detail/Search/Settings, Seerr discovery/search/detail/season confirmation, TMDB artwork, baseline 480p playback up to 1080p, resume, D-pad controller, audio dialog and cleanup exercised |
 | Physical AFTT (ARMv7) | **Absent.** No hardware decoder/memory/thermal result |
-| Signed release APK | `0.2.3-firefin` (run 37055114680) and `0.2.4-firefin` (run 37067878548) were built, signed and verified against the pinned production certificate by the protected release workflow |
+| Signed release APK | `0.2.3-firefin` (run 37055114680), `0.2.4-firefin` (run 37067878548) and `0.2.5-firefin` (run 37095893231) were built, signed and verified against the pinned production certificate by the protected release workflow |
 | Final commit CI | Consult the exact commit's GitHub Actions record; local results are not CI evidence |
 
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -71,8 +71,8 @@ only to release maintainers. The release workflow reads the key from the
 `FIREFIN_CERTIFICATE_SHA256` variable (see [BUILDING.md](BUILDING.md)); the key
 should be exposed only to the protected `firefin-release` job. The secrets and
 the variable are currently stored at repository level, not inside the
-`firefin-release` environment, and were used to publish `0.2.3-firefin` and
-`0.2.4-firefin`; the
+`firefin-release` environment, and were used to publish `0.2.3-firefin`,
+`0.2.4-firefin` and `0.2.5-firefin`; the
 reviewer and branch rules of the environment gate the release job, but moving
 the values into the environment is an open hardening step. No production key or
 fingerprint is stored in this repository, and there is no debug-key release

diff --git a/docs/FIREFIN_MIGRATION.md b/docs/FIREFIN_MIGRATION.md
@@ -11,8 +11,8 @@ external prerequisites.
 **Status: incomplete; no AFTT hardware approval.** Earlier completion labels
 were not acceptance evidence. This ledger supersedes the inaccurate earlier
 claims of clean lint, all review findings fixed, protected signing, bounded disk
-decode and completed API-22 validation. Releases `0.2.3-firefin` and
-`0.2.4-firefin` were published by the protected workflow (see Gate 7); no AFTT
+decode and completed API-22 validation. Releases `0.2.3-firefin`,
+`0.2.4-firefin` and `0.2.5-firefin` were published by the protected workflow (see Gate 7); no AFTT
 hardware approval is claimed. The Flutter sources stay in the repository while
 active features lack native parity.
 
@@ -32,7 +32,7 @@ Actions and the pull request. No CI or device result is inferred from local test
 | Snapshot `c9da933aa2a331c760325b97e777b51be7d4980f` (before 0.2.4) on the API 22 stock x86 emulator: login, Moonfin-like Home/Library/Detail/Search/Settings, Seerr discovery/search/detail/season confirmation, TMDB artwork, 480p playback, resume, track dialog and cleanup | Verified manually; x86 codec evidence is not AFTT hardware evidence |
 | CI (`android.yml`) | Per SHA in GitHub Actions |
 | Physical AFTT (ARMv7) run | **Absent** |
-| Signed release (protected `release.yml`, production key, pinned fingerprint) | Published for `0.2.3-firefin` (run 37055114680) and `0.2.4-firefin` (run 37067878548); not validated on AFTT hardware |
+| Signed release (protected `release.yml`, production key, pinned fingerprint) | Published for `0.2.3-firefin` (run 37055114680), `0.2.4-firefin` (run 37067878548) and `0.2.5-firefin` (run 37095893231); not validated on AFTT hardware |
 | API 22 playback/D-pad run of `0.2.5-firefin`; media redirect behavior on device (JVM test present); feature parity outside the implemented slim Seerr/Moonbase subset (Live TV, downloads, music, books, DLNA, admin, plugin sync, Seerr people/4K) | **Open** |
 
 The old "18/21 tests" and "5m25s" CI figures describe earlier trees and are not
@@ -85,7 +85,7 @@ unproven or incomplete; HISTORICAL means evidence applies only to its named SHA.
 | Gate 6: stored/effective preferences and end-to-end plugin sync | Preferences and protocol fixture tests; no unused-only type proof | OPEN |
 | Gate 6: trust chain/hostname, API22 CA policy, redirect/token isolation, stalled media | Transport TLS, timeout and redirect negative tests | Partial: platform trust plus ISRG Root X1 for Jellyfin and TMDB; JVM tests for an added anchor, wrong hostname, unknown self-signed certificate, stalled and slow media bodies, REST/media redirects and header-only tokens; no API22 CA test on hardware |
 | Gate 7: actionlint, wrapper/dependency verification, tests, strict debug/release lint, both builds | android.yml with mandatory reports/APKs | `0.2.5-firefin` local run: 83 tests, 0 lint errors, both APKs and verifier pass; CI per SHA; dependency-verification metadata open |
-| Gate 7: separate protected signing, required secrets, stable cert, tag/full SHA, v1, checksums/source | release.yml, verifier, protected environment and actual run/release | DONE for 0.2.3 and 0.2.4: the protected `firefin-release` environment (required reviewer, `main` only), the production signing secrets and the pinned certificate fingerprint are configured; run 37055114680 published `firefin-v0.2.3-firefin` from `e9760aa62e71f5ddb1b7a7f806b0d26c0726c987`, run 37067878548 published `firefin-v0.2.4-firefin` from `503678d519950d74c4cfb6d3d93a08150716a3af`. Earlier attempts failed for setup reasons (SDK path, keystore secret content, annotated tag) and were corrected; the tags `firefin-v0.2.0-firefin`, `firefin-v0.2.1-firefin` and `firefin-v0.2.2-firefin` exist without a release |
+| Gate 7: separate protected signing, required secrets, stable cert, tag/full SHA, v1, checksums/source | release.yml, verifier, protected environment and actual run/release | DONE for 0.2.3, 0.2.4 and 0.2.5: the protected `firefin-release` environment (required reviewer, `main` only), the production signing secrets and the pinned certificate fingerprint are configured; run 37055114680 published `firefin-v0.2.3-firefin` from `e9760aa62e71f5ddb1b7a7f806b0d26c0726c987`, run 37067878548 published `firefin-v0.2.4-firefin` from `503678d519950d74c4cfb6d3d93a08150716a3af`, run 37095893231 published `firefin-v0.2.5-firefin` from `7bf3345a21f2731cf25dbfbcb38e7a4cd95d7f78`. Earlier attempts failed for setup reasons (SDK path, keystore secret content, annotated tag) and were corrected; the tags `firefin-v0.2.0-firefin`, `firefin-v0.2.1-firefin` and `firefin-v0.2.2-firefin` exist without a release |
 | Gate 8: native-only cleanup after parity; updated public English docs/templates | README, BUILDING, COMPATIBILITY, CHANGELOG, SECURITY, notices/templates | Partial: English docs and issue/PR templates describe Firefin; `FIRETV32-README.md` and `RELEASE_NOTES_*` stay as legacy history; the UI is English by default with a German translation |
 
 ## Actual feature matrix
@@ -119,7 +119,7 @@ retired with evidence, no potentially active area is removed as "out of scope".
 - A release needs the production signing key, the pinned signing certificate
   (`FIREFIN_CERTIFICATE_SHA256`) and the protected `firefin-release` environment
   with required reviewers; there is no debug-key release. These exist and
-  `0.2.3-firefin` and `0.2.4-firefin` were published with them. Every future
+  `0.2.3-firefin`, `0.2.4-firefin` and `0.2.5-firefin` were published with them. Every future
   release needs a new version, a lightweight tag `firefin-v<version>` on a
   `main` commit and a successful `android.yml` run for that SHA.
 - API22 stock emulator and actual AFTT are separate evidence. Hardware release

diff --git a/docs/FIREFIN_TECHNICAL_OVERVIEW.md b/docs/FIREFIN_TECHNICAL_OVERVIEW.md
@@ -49,7 +49,7 @@ The standard local verification command is:
 
 Version `0.2.5-firefin` has local evidence of 83 JVM tests, strict debug/release lint with 0 errors, APK verification, debug/unsigned-release assembly and two instrumented tests on the API-22 x86 emulator. Earlier emulator records cover login, navigation, search, Seerr flows, artwork, playback controls and resume; see the [migration ledger](FIREFIN_MIGRATION.md).
 
-Signed releases are built only by the protected release workflow, which requires signing credentials stored outside this repository. Releases `0.2.3-firefin` and `0.2.4-firefin` were built and verified against the pinned production certificate this way. None has been validated on physical AFTT hardware.
+Signed releases are built only by the protected release workflow, which requires signing credentials stored outside this repository. Releases `0.2.3-firefin`, `0.2.4-firefin` and `0.2.5-firefin` were built and verified against the pinned production certificate this way. None has been validated on physical AFTT hardware.
 
 ## Known boundaries