From ab3ceb0363717955d9e28a83dc4f07cfb2a2c90c Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Tue, 27 Oct 2026 09:15:01 +0700
Subject: [PATCH] docs(release): record 1.7.1; release.sh reads protected
 zsp.env by default

---
 AGENTS.md          | 14 ++++++++++----
 scripts/release.sh | 20 +++++++++++++-------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index c533b33..7137756 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2232,13 +2232,18 @@ Rules:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`.
     Complete non-interactive publish:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml`
-    ✅ **Published 1.6.1–1.7.0 on 2026-10-12/26** — the app's usual path is an **inline
-    `SIGN_WITH=<nsec1…>`** (the value lives only in the shell/history, never in
-    the repo); verify the signer is the app identity first (`nak key public` →
+    ✅ **Published 1.6.1–1.7.1 on 2026-10-12/27** — use the protected
+    `~/.config/skatespots/zsp.env` (mode 600) via **`scripts/release.sh`**;
+    the old inline `SIGN_WITH=<nsec1…>` path still works but should not be used.
+    Verify the signer is the app identity first (`nak key public` →
     `npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the
     `zsp` on `PATH` (`~/.local/bin/zsp`) is older (v0.4.10). `zsp` warns that a
     nsec in env is insecure (prefer `bunker://`); the relay event to check is
     `nak req -k 30063 -d org.skatespots.app@<version> wss://relay.zapstore.dev`.
+    - **1.7.1 (2026-10-27):** Hindi + Catalan/Basque/Galician (24 dictionaries /
+      25 codes), regional flag SVGs + English/Portuguese variants, single-world
+      map clamp with horizontal wrap to the Pacific, menu hardening; APK sha256
+      `846925af…`, versionCode 10701, released with `scripts/release.sh`.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@@ -2377,7 +2382,8 @@ Rules:
   `~/.local/state/skatespots-deps/failures/` (8 kept, rotated) and a
   `last-failure` marker; reports keep 12. Releases are one command via
   **`scripts/release.sh`** (notes check → `npm test` → bump → Android build →
-  `zsp publish` → relay verification → commit/push + tag). The deploy timer has
+  `zsp publish` → relay verification → commit/push + tag), reading the 0600
+  `~/.config/skatespots/zsp.env` by default. The deploy timer has
   `TimeoutStartSec=20min`, and all deploy/deps units are tracked in
   `scripts/systemd/`.
 
diff --git a/scripts/release.sh b/scripts/release.sh
index 6f02c50..a4c2772 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -10,11 +10,9 @@
 # Before running:
 #   1. write the new section at the TOP of release-notes.txt (do not commit it —
 #      this script commits it with the version bump);
-#   2. provide the release signer WITHOUT putting it in shell history:
-#        export SIGN_WITH=nsec1...                # current shell only
-#      or point at a 0600 file:
-#        export SKATES_RELEASE_ENV=$HOME/.config/skatespots/release.env
-#        # file contains: SIGN_WITH=nsec1...
+#   2. the signer is read from ~/.config/skatespots/zsp.env (chmod 600) by
+#      default. You can also export SIGN_WITH for the current shell, or set
+#      SKATES_RELEASE_ENV to another 0600 file.
 #
 # What it does NOT do: deploy the web (the skatespots-deploy.timer does that
 # within ~3 min, 24h throttle) or touch the relay.
@@ -35,15 +33,23 @@ log() { echo "• $*"; }
 [ -x "$ZSP" ] || die "zsp not found/executable at $ZSP (set ZSP=...)"
 [ -d "$ANDROID_HOME" ] || die "Android SDK not found at $ANDROID_HOME (set ANDROID_HOME=...)"
 
-# Optional protected env file (never commit it).
+# Protected env file (never commit it). Prefer the file documented in AGENTS.
+if [ -z "${SKATES_RELEASE_ENV:-}" ] && [ -f "$HOME/.config/skatespots/zsp.env" ]; then
+  SKATES_RELEASE_ENV="$HOME/.config/skatespots/zsp.env"
+fi
 if [ -z "${SIGN_WITH:-}" ] && [ -n "${SKATES_RELEASE_ENV:-}" ]; then
   [ -f "$SKATES_RELEASE_ENV" ] || die "SKATES_RELEASE_ENV does not exist: $SKATES_RELEASE_ENV"
+  mode="$(stat -c %a "$SKATES_RELEASE_ENV" 2>/dev/null || echo '?')"
+  case "$mode" in
+    600|400) ;;
+    *) log "warning: $SKATES_RELEASE_ENV is mode $mode (chmod 600 recommended)" ;;
+  esac
   set -a
   # shellcheck disable=SC1090
   . "$SKATES_RELEASE_ENV"
   set +a
 fi
-[ -n "${SIGN_WITH:-}" ] || die "SIGN_WITH is not set (export it or use SKATES_RELEASE_ENV)"
+[ -n "${SIGN_WITH:-}" ] || die "SIGN_WITH is not set (use ~/.config/skatespots/zsp.env, SKATES_RELEASE_ENV, or export it)"
 
 # Resolve the newest nvm Node (the old hard-coded path breaks after upgrades).
 if [ -d "$HOME/.nvm/versions/node" ]; then