feat: improve library and audiobook workflow

scripts/prepare-argus-package.ps1

@@ -188,7 +188,6 @@ function Resolve-KeystoreInfoPath {
         $candidates += $PreferredPath
     }
     $candidates += @(
-        (Join-Path $ProjectRoot "signing\release-keystore-info.txt"),
         (Join-Path $env:USERPROFILE ".aletheia\signing\release-keystore-info.txt")
     )
 
@@ -215,7 +214,6 @@ function Resolve-KeystorePath {
         $configuredLeaf = Split-Path -Leaf $ConfiguredPath
         if ($configuredLeaf) {
             $candidates += (Join-Path (Split-Path -Parent $KeystoreInfoPath) $configuredLeaf)
-            $candidates += (Join-Path (Join-Path $ProjectRoot "signing") $configuredLeaf)
         }
     }
 
@@ -275,6 +273,7 @@ $env:ANDROID_SDK_ROOT = $sdkDirPath
 
 if (-not $SkipBuild) {
     & $gradleExePath assembleRelease --stacktrace
+    if ($LASTEXITCODE -ne 0) { throw "Release build failed: $LASTEXITCODE" }
 }
 
 $outputMetadataPath = Join-Path $projectRoot "app\build\outputs\apk\release\output-metadata.json"
@@ -328,9 +327,10 @@ foreach ($path in @($alignedApk, $signedApk, $idsigPath)) {
 }
 
 & $zipalignExe -p -f 4 $unsignedApk $alignedApk
+if ($LASTEXITCODE -ne 0) { throw "zipalign failed: $LASTEXITCODE" }
 
-$storePassFile = Join-Path $env:TEMP "aletheia-store-pass.txt"
-$keyPassFile = Join-Path $env:TEMP "aletheia-key-pass.txt"
+$storePassFile = (New-TemporaryFile).FullName
+$keyPassFile = (New-TemporaryFile).FullName
 
 try {
     Set-Content -LiteralPath $storePassFile -Value $keystoreInfo["StorePassword"] -NoNewline
@@ -345,6 +345,7 @@ try {
         --v4-signing-enabled true `
         --out $signedApk `
         $alignedApk
+    if ($LASTEXITCODE -ne 0) { throw "APK signing failed: $LASTEXITCODE" }
 }
 finally {
     foreach ($secretPath in @($storePassFile, $keyPassFile)) {
@@ -358,6 +359,7 @@ finally {
 }
 
 $verifyOutputLines = & $apksignerBat verify --verbose --print-certs --v4-signature-file $idsigPath $signedApk
+if ($LASTEXITCODE -ne 0) { throw "APK verification failed: $LASTEXITCODE" }
 $verifyOutput = $verifyOutputLines | Out-String
 foreach ($requiredVerificationLine in @(
     "Verified using v2 scheme (APK Signature Scheme v2): true",

scripts/publish-argus-release.ps1

@@ -1,8 +1,8 @@
 param(
     [string]$ManifestPath,
-    [string]$SshHost = "192.168.0.25",
+    [string]$SshHost = "192.168.0.185",
     [string]$SshUser = "sevenhill",
-    [string]$ArgusDataPath = "/opt/argus/data",
+    [string]$ArgusDataPath = "/mnt/data/argus",
     [switch]$RestartArgus
 )
 
@@ -206,11 +206,22 @@ shutil.copy2(source, target_path)
 
 size_bytes = target_path.stat().st_size
 sha256 = hashlib.sha256(target_path.read_bytes()).hexdigest()
+if sha256 != os.environ["ARGUS_SHA256"]:
+    target_path.unlink()
+    raise RuntimeError("Transferred package SHA-256 mismatch")
 content_type = mimetypes.guess_type(source.name)[0] or "application/octet-stream"
 if source.suffix.lower() == ".apk":
     content_type = "application/vnd.android.package-archive"
 
 conn = sqlite3.connect(db_path)
+backup_dir = data_root / "backups"
+backup_dir.mkdir(parents=True, exist_ok=True)
+backup_path = backup_dir / f"argus-before-{slug}-{safe_version}-{release_id}.db"
+with sqlite3.connect(backup_path) as backup:
+    conn.backup(backup)
+    if backup.execute("PRAGMA integrity_check").fetchone()[0] != "ok":
+        raise RuntimeError("Argus backup integrity check failed")
+print(f"DatabaseBackup={backup_path}")
 try:
     conn.execute("PRAGMA foreign_keys = ON")
     conn.execute("BEGIN")
@@ -280,6 +291,8 @@ try:
     )
 
     conn.commit()
+    if conn.execute("PRAGMA integrity_check").fetchone()[0] != "ok":
+        raise RuntimeError("Argus database integrity check failed after publication")
 except Exception:
     conn.rollback()
     try:
@@ -313,6 +326,7 @@ $remoteScriptLines = @(
     "export ARGUS_PLATFORM=$(ConvertTo-BashSingleQuoted $platform)",
     "export ARGUS_PACKAGE_KIND=$(ConvertTo-BashSingleQuoted $packageKind)",
     "export ARGUS_NOTES=$(ConvertTo-BashSingleQuoted $releaseNotes)",
+    "export ARGUS_SHA256=$(ConvertTo-BashSingleQuoted $packageSha256)",
     'trap ''rm -f -- "$SOURCE_FILE"'' EXIT',
     'python3 - "$SOURCE_FILE" <<''PY''',
     $pythonBlock,