0.2.3: 重绘系列通用安装图标并记录功能审核决定（#413、#77/#408、#444、#407）

docs/ASSETS.md

@@ -2,8 +2,52 @@
 
 Owner: `tools/fetch-assets.mjs` and `tools/assets/*`. Research background: `docs/research/07-assets.md`.
 
-All art, Spine models and audio are **downloaded at install time**. They are never committed; `public/assets/` is git-ignored.
-Everything the client needs is listed in **`data/assets.json`**. The client should only request URLs that appear in that manifest.
+All official game art, Spine models and audio are **downloaded at install time**. They are never committed; `public/assets/` is git-ignored.
+All downloaded game assets the client needs are listed in **`data/assets.json`**. Game-art requests must use that manifest.
+The original project icons below are shipped static files, not downloaded game assets.
+
+## Original project application icons (#413)
+
+`public/icons/app.svg` is the original vector master for the **卫戍协议 series**, independent of any season.
+Three battlements lead into a shield-shaped wall around one square tactical cell: defending a position on a board.
+The only colours are charcoal `#242424` and off-white `#f2f2f2`; the mark contains no text, gradients or fine texture.
+It contains no 「盟约」 lettering, Alliance badge or season-exclusive colours / elements.
+
+**Originality statement (2026-10-10):** the SVG geometry was drawn from basic rectangles and polygons for this
+project. No official logo, artwork, icon or font was used, downloaded, embedded, traced or redrawn to make it.
+The vector and exports are project-owned work under the repository's GPL-3.0-or-later licence, separate from the
+Hypergryph / Yostar game assets below. The abstract fortification / tactical-board idea does not assert official branding.
+
+Rebuild offline with Python 3 and Pillow (the same image library used by local-extract):
+
+```bash
+python3 tools/export-app-icons.py
+# Optional review export without replacing shipped files:
+python3 tools/export-app-icons.py --out /tmp/stronghold-icons
+```
+
+The script reads only the master SVG's flat rectangle / polygon geometry, renders at 8× and downsamples; unsupported
+SVG elements fail rather than silently disappearing. It needs no game art, fonts, browser or network.
+
+| Files in `public/icons/` | Use |
+|---|---|
+| `app-192.png`, `app-512.png` | Manifest `purpose: any`, 192 / 512 px |
+| `app-maskable-192.png`, `app-maskable-512.png` | Manifest `purpose: maskable`, opaque full-bleed background |
+| `favicon-16.png`, `favicon-32.png`, `favicon-48.png`, `favicon.ico` | Tab / legacy favicon; ICO contains 16 / 32 / 48 px frames |
+| `apple-touch-icon.png` | 180 px home-screen icon |
+| `app.svg` | Scalable favicon and editable source |
+
+The maskable mark is scaled to 87.5% around the canvas centre. Its outermost vertex is about 34.8% of the canvas
+width from that centre; even antialiased edge pixels stay inside the **40%-radius safe circle** specified by
+[Web Application Manifest §2.3](https://www.w3.org/TR/appmanifest/#icon-masks).
+The background remains opaque to every edge; launcher masks may remove the background outside the safe zone.
+Normal icons and favicons retain the larger mark for readability. `public/index.html` links the SVG / ICO / PNG
+favicons and Apple icon; `public/manifest.json` lists all four install icons. All these static files must be tracked
+and included by the full and lite package allowlist; no changes to `data/assets.json` are needed.
+
+`test/ui/pwa-install-023.test.js` checks decoded pixels, mask safety and references; `test/package.test.js` checks
+packaging inclusion. The local handoff holds old/new light/dark, small-size and phone-layout previews with their
+render script. These are offline review renders, not evidence of browser or native OS installation.
 
 ## Running
 

docs/design/client.md

@@ -115,8 +115,13 @@ refused recovery can return to the previous identity and nickname. It does not i
 Without BroadcastChannel it refuses shared recovery. Server restart / expiry clears
 obsolete metadata on the next welcome. A spectator never registers a recoverable player seat.
 
-`manifest.json` enables browser installation; its original fortress favicon is packaged as actual 192/512 px icons in
-`public/icons/`, including lite packages. The install button appears only for a live browser install offer and hides
+`manifest.json` enables browser installation. The original season-independent fortress / shield mark in
+`public/icons/app.svg` uses neutral greys and no official art, logos, icons, fonts or season-specific insignia.
+`tools/export-app-icons.py` exports 192/512 px PNGs for `any` and separate opaque `maskable` icons: the latter scale
+only the mark to 87.5%, keeping every foreground pixel inside the central circle of radius 40% of the canvas.
+The same master supplies 16/32/48 px PNG / ICO favicons and the 180 px Apple touch icon linked from `index.html`.
+These project-owned assets live in `public/icons/` and ship in full and lite packages; ASSETS.md records their provenance.
+The install button appears only for a live browser install offer and hides
 in standalone/fullscreen windows or after installation. Every offer is consumed before awaiting the prompt, including
 cancellation or failure. No service worker, offline cache or persistent server is introduced; HTTPS or localhost and
 browser support still govern installation.

docs/design/overview.md

@@ -15,6 +15,10 @@ In scope:
 - Rendering with the real Spine battle chibis (PixiJS 7 + pixi-spine 4), procedural tiles, VFX, damage numbers, real BGM/SFX, emotes, broadcast ticker.
 - Reconnect, AI take-over of disconnected players, robust validation of every client intent.
 
+New features require explicit maintainer approval before implementation. The 2026-10-10 review approved retaining
+the existing PWA installation, unanimous opening reroll, teammate emotes and cooperative purchasing heuristic
+(DESIGN §28.15, §28.16, §28.19, §28.21); this is not blanket approval for future additions.
+
 Out of scope v1: matchmaking queue, training/tutorial, DIY (甄选) slots (the 4 DIY chess are removed from the shared pool — 0.2.0 plays them as 自选编队: the picks of the 干员调配 overlay's 自选编队 tab, each sold only in its player's shop; DATA.md §18, shared/diy.js, server/match/player/diy.js), trophies/progression persistence, reporting.
 
 ---

docs/history/0.2.3.md

@@ -215,6 +215,8 @@ English overflow; the corrected browser suite passes. Current behavior is in des
 
 ### 28.15 Cooperative card purchasing — PR #407
 
+维护者 2026-10-10 审核后同意保留。此前未获明确批准，本次审核追认仅适用于本节已有功能；以后新增功能必须先取得维护者明确同意。
+
 Adapted from @IceCodeNew. [ASSUMED] A tier V/VI shared-pool card matching another living teammate's active opening
 bond receives one 18-point buying-score penalty. It is a soft preference, not reserved stock; normal/elite and DIY
 stock semantics remain unchanged. Humans and bots receive the same cooperation. This does not add persona presets.
@@ -225,6 +227,8 @@ measurement of the purchasing heuristic. Current rule: design/match.md §6.6 and
 
 ### 28.16 AI teammate emotes — PR #444
 
+维护者 2026-10-10 审核后同意保留。此前未获明确批准，本次审核追认仅适用于本节已有功能；以后新增功能必须先取得维护者明确同意。
+
 Event wiring from @DDDarkstar, with corrected dispatch semantics. [ASSUMED] Cosmetic reactions are enabled only in
 mixed human/AI matches, under the existing emote whitelist and cooldown; `SP_BOT_EMOTES=0` disables all hooks.
 Responses skip cooling bots and stop after one reply. MVP uses this round's kills and damage, with stable order for
@@ -265,20 +269,30 @@ a real phone-sized browser changes the control, reloads and resets it. Current c
 
 ### 28.19 Browser installation — PR #413
 
+维护者 2026-10-10 审核后同意保留。此前未获明确批准，本次审核追认仅适用于本节已有功能；以后新增功能必须先取得维护者明确同意。
+
 Based on @Cromemadnd's proposal, with a one-use install controller. Buttons appear only after a browser install offer;
 standalone/fullscreen and installed sessions hide them. Accept, dismiss, failure and duplicate clicks all consume the
 same offer once. See [the prompt API](https://developer.mozilla.org/en-US/docs/Web/API/BeforeInstallPromptEvent/prompt)
 and [installability requirements](https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Making_PWAs_installable).
-The existing original fortress favicon supplies correctly sized 192/512 px icons, shipped outside optional game art.
+The 2026-10-10 icon revision replaces the previous mint rook with an original, season-independent fortress / shield
+and defended square. Its neutral grey palette and geometry use no official logos, artwork, icons or fonts and no
+Alliance lettering or seasonal insignia. `public/icons/app.svg` is the master; `tools/export-app-icons.py` exports
+192/512 px `any` and separate opaque `maskable` PNGs (the mark stays inside the central 40%-radius safe circle),
+16/32/48 px PNG / ICO favicons and a 180 px Apple touch icon. All ship outside optional game art, including lite
+packages. See ASSETS.md for the source, reproduction command and originality statement.
 No service worker or offline cache is installed; the server is still required.
 The lobby keeps Settings immediately before How to Play even when the optional install/recovery buttons appear;
 the full browser run caught and corrected an initial insertion between that established pair.
 The settings-entry check tests the absent board-style/background-music option labels, allowing the text-size help
 to explain that the board keeps its scale.
 
-Tests: offer lifecycle/disposal, actual PNG dimensions, real Chrome manifest and installability checks, and a synthetic
+Tests: offer lifecycle/disposal, decoded PNG dimensions / opacity / maskable safe zone, favicon references and packaging inclusion.
+The initial feature also had real Chrome manifest and installability checks, and a synthetic
 dismissed offer through the actual button. Initial incognito rejection was a test-environment limitation; the real
 installability check runs in Chrome's ordinary temporary profile. Native OS installation itself is not performed.
+The icon revision is verified offline; browser / OS validation of these replacement assets is deferred to the follow-up
+review environment (this sandbox cannot listen on a port).
 
 ### 28.20 Recover a closed local match window — #431
 
@@ -294,6 +308,8 @@ the match tab. The existing identity/static suite also passes. Current contract:
 
 ### 28.21 Unanimous opening reroll — #77 / PR #408
 
+维护者 2026-10-10 审核后同意保留。此前未获明确批准，本次审核追认仅适用于本节已有功能；以后新增功能必须先取得维护者明确同意。
+
 Adapted from @Siornya, excluding the unrelated result-screen redesign. [ASSUMED] This remake feature is host-proposed,
 requires every connected human's consent, and pauses confirmation while voting. Bots/spectators do not vote; autoplay
 humans still do. Single-human matches refresh immediately. Refusal, cancellation, disconnect or leave restores the