@@ -0,0 +1,105 @@
+# RustyNES v2.0.1 — "Harbor"
+
+**The first release of the v2.0.x "Harbor" mobile-finalization train.** With the
+breaking v2.0.0 "Timebase" scheduler rewrite shipped, Harbor opens the runway to
+the joint mobile store launch (v2.1.0): the Android app is **re-ported onto the
+one-clock v2.0.0 core**, the **AccuracyCoin oracle is re-synced to upstream**, and
+the housekeeping that v2.0.0 (#225) deferred to "v2.0.1+" is done. Every core
+change is **behaviour-neutral** — the deterministic chip stack is byte-identical to
+v2.0.0, `nestest` stays 0-diff, and AccuracyCoin holds its honest **139/141
+(98.58%)**. No store submission yet (that is v2.1.0); Android continues as
+GitHub-sideload.
+
+---
+
+## Android re-ported onto Timebase (#235)
+
+The `rustynes-android` host + Jetpack Compose app rebuild against the one-clock
+`rustynes-mobile` UniFFI bridge (regenerated against **uniffi 0.32**);
+`versionCode 20000 → 20001`, `versionName "2.0.0" → "2.0.1"`. The deterministic
+chip stack is untouched, so on-device accuracy tracks the desktop core exactly.
+
+The **`.rnm` movie-epoch warning** now reaches the mobile bridge (ADR 0028):
+`NesController::movie_play` peeks `rustynes_core::recorded_before_v2_timebase` and,
+for a pre-v2.0.0 recording, queues a drainable host warning (new
+`drain_warnings`) — parity with the desktop + wasm frontends. Input replay still
+proceeds; the host can now tell the user that exact framebuffer/audio reproduction
+is not guaranteed across the engine-timebase boundary, rather than silently
+implying byte-exactness.
+
+## The `foss` / `play` Android flavor split — structural start (ADR 0025, #235)
+
+Harbor lays the groundwork for shipping to **F-Droid + GitHub sideload** (clean,
+Google-free, ad-free) *and* **Google Play** from one codebase. A new
+`distribution` flavor dimension adds a default **`foss`** flavor and a **`play`**
+flavor; the five proprietary Google-Play subsystems — Play Billing, the Cast
+Application Framework, Play Games v2, Play Integrity, in-app update/review — move
+from unconditional `implementation(…)` to **`playImplementation(…)`**, so the
+`foss` variant links **none** of them. Their glue lives behind `src/main` façades
+with **no-op `src/foss/`** twins and real `src/play/` implementations (including
+the CAF `MediaRouteButton`, routed through the `ChromecastSender` façade so
+`src/main` links no `androidx.mediarouter` / `com.google.android.gms.cast`). CI
+now builds **both** `assembleFoss*` and `assemblePlay*`. Monetization stays
+dormant; on-device flavor verification is deferred to v2.0.9.
+
+## AccuracyCoin oracle re-synced to upstream (#232)
+
+The vendored `100thCoin/AccuracyCoin` battery is re-synced: the catalog grows
+**144 → 146 rows / 139 → 141 assigned tests**, adding the two new upstream PPU
+tests **"ALE + Read"** and **"Hybrid Addresses"** (plus the upstream "$2002 Flag
+Timing" + "Sprites On Scanline 0" fixes folded into existing rows). The drift-guard
+moves to `catalog().len() == 146`.
+
+**Measured honestly: 139/141 (98.58%).** The two new tests are known gaps — they
+exercise the deep sub-instruction PPU octal-latch address-corruption timing when
+`$2007` is touched mid-render. Two bounded fixes were attempted this release —
+Option 2 (`mc-ppu-bus-addr-hybrid`, Mesen2's persistent `_ppuBusAddress` model,
+PR #234) and Option 1 (a 2-cycle-ALE fetch refactor, draft PR #236) — and **both
+reach only 139/141 with the flag on**, empirically confirming (**ADR 0030**) that
+closing these needs a dedicated Timebase-scale campaign, not a bounded fork. Both
+ship **default-off**; the shipped build is byte-identical at 139/141. The full fix
+is the headline accuracy work of the v2.0.2–v2.0.4 cycle.
+
+## Housekeeping (#237)
+
+The dead **`mc-r1-dmc-abort-probe`** diagnostic feature flag — a default-off
+DMC-DMA-abort scheduling probe left over from the v2.0.0 R-1 work — is removed in
+full (3 `[features]` decls, the ~210-line gated `abort_probe` module + its 13
+`#[cfg]` sites, the `bus.rs` log hooks). It gated **only** diagnostic counters,
+never shipped behaviour, so the default build is byte-identical. The
+`mmc3-m2-phase-irq` experiment was evaluated for the same treatment and
+deliberately **kept** — it gates real alternate MMC3-IRQ-timing behaviour and
+remains tied to the open R1/R2 residual (ADR 0002). A **measure-first perf pass**
+(`full_frame` re-measured at 3.77 ms / 4.42× realtime) adopted nothing per the
+3%-plus Criterion + byte-identical bar.
+
+## CI cost/time optimization (#233)
+
+The heavy CI legs (`test-roms`, `bench`, the full macOS/Windows matrix) now run
+only on `release/*` PRs plus a weekly drift-net cron — not on every intermediate
+PR — while the required correctness gates still run everywhere. Intermediate
+review cycles are dramatically cheaper; a release branch (like this one) still
+gets the full battery.
+
+## Dependencies
+
+**uniffi 0.31 → 0.32**, **mlua 0.11 → 0.12**, **wgpu/naga 29.0.3 → 29.0.4**,
+**cc 1.2.65 → 1.2.66**; security-advisory surface re-verified. Consolidates and
+closes Dependabot #226–#230. **wgpu/naga 30.0.0 is deferred**: `egui-wgpu 0.35`
+pins `wgpu ^29` and egui 0.35 is the newest release, so the majors cannot resolve
+until an egui 0.36+ targets wgpu 30.
+
+---
+
+## What's next — the rest of "Harbor"
+
+- **v2.0.2–v2.0.4** — Android feature-parity finalization, foss/play on-device
+  verification + monetization wiring, and the **full ALE+Read / Hybrid Addresses
+  accuracy fix** (Option 1 to 141/141).
+- **v2.0.5–v2.0.8** — iOS finalization on the v2.0.0 core.
+- **v2.0.9** — joint readiness verification for both apps.
+- **v2.1.0** — the **joint Google Play + Apple App Store + AltStore PAL + F-Droid
+  launch**.
+
+Full detail: `CHANGELOG.md` `[2.0.1]` · `docs/STATUS.md` (single source of truth) ·
+`to-dos/plans/v2.0.1-harbor-plan.md`.
@@ -15,71 +15,108 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Android — v2.0.1 core re-port onto Timebase + the start of the `foss`/`play` split
-
-- **Android re-ported onto the v2.0.0 "Timebase" core.** The `versionCode`/`versionName`
-  bump to `20001` / `2.0.1` cuts the first release of the Android mobile-finalization
-  re-port train (see `to-dos/ROADMAP.md`). The deterministic chip stack is byte-identical,
-  so host CI accuracy is unchanged (**AccuracyCoin 139/141**).
-- **Movie-epoch warning on the mobile bridge (ADR 0028).** `rustynes-mobile`'s
-  `NesController::movie_play` now peeks `rustynes_core::recorded_before_v2_timebase` and, for
-  a pre-v2.0.0 `.rnm`, queues a drainable host warning (new `NesController::drain_warnings`)
-  — mirroring the desktop + wasm frontends. Input replay still proceeds, but the host can now
-  tell the user that exact framebuffer/audio reproduction is not guaranteed across the
-  engine-timebase boundary. A pre-v2.0.0 `.rns` restore already maps to a clean
-  `MobileError::SaveState` (no crash). Host-shell wiring only; the core is untouched.
-- **Structural start of the `foss` / `play` Android product-flavor split (ADR 0025).** Added a
-  `distribution` flavor dimension — `foss` (default, `isDefault = true`) + `play` — with
-  `PLAY_BUILD` set per-flavor. Every proprietary Google-Play SDK (Play Billing, the Cast
-  Application Framework, Play Games v2, Play Integrity, in-app update/review) moved from
-  unconditional `implementation(…)` to **`playImplementation(…)`**, so the `foss` variant links
-  **none** of them. The glue that touches those SDKs (`LicenseManager`, `PlayGamesManager`,
-  `CloudSaveManager`, `IntegrityManager`, `PlayUpdatesManager`, `ChromecastSender`) moved to
-  `src/play/` with byte-compatible **no-op façades in `src/foss/`**; shared pure types
-  (`PgsIds`, `IntegrityVerdict`, `DEMO_SESSION_SECONDS`) moved to `src/main`; `MainActivity`
-  now reads a flavor-neutral `LicenseManager.priceLabel` instead of the Google `ProductDetails`
-  type, so `src/main` links no Play SDK. The Cast-framework OPTIONS_PROVIDER + Play-Games APP_ID
-  manifest meta-data moved to `src/play/AndroidManifest.xml` so they never merge into the
-  `foss` manifest. An `installDebug` alias forwards to `installFossDebug` so the dev/CI command
-  is unchanged; `android.yml` now bundles both flavors. The monetization / ad glue stays dormant
-  (the AppLovin/RevenueCat wiring is the v2.1.0 step). The AOSP Presentation-API `CastManager`
-  is not a proprietary SDK and stays shared in `src/main`.
-- **Docs:** added the previously-dangling `to-dos/v1.8.x-on-device-verification.md` (the manual
-  on-device checklist the mobile plan cites).
+*Nothing yet — the next planned milestone is **v2.0.2**, continuing the v2.0.x
+"Harbor" mobile-finalization train (see `to-dos/ROADMAP.md`).*
+
+## [2.0.1] - 2026-07-08 - "Harbor" (first Android re-port onto Timebase + AccuracyCoin re-sync + housekeeping)
+
+The first release of the **v2.0.x "Harbor" mobile-finalization train** — the
+Android app re-ported onto the v2.0.0 "Timebase" core, the AccuracyCoin oracle
+re-synced to upstream, and the housekeeping #225 deferred to "v2.0.1+". All core
+changes are behaviour-neutral: the deterministic chip stack is byte-identical to
+v2.0.0 and AccuracyCoin holds its honest **139/141 (98.58%)** (the two new upstream
+PPU tests are known, documented gaps — see below). No store submission (that is
+the future v2.1.0 joint launch); Android continues as GitHub-sideload.
+
+### Added
+
+- **Android core re-port onto the v2.0.0 Timebase core (ADR 0028, PR #235).** The
+  `rustynes-android` host + Jetpack Compose app rebuild against the one-clock
+  `rustynes-mobile` UniFFI bridge (regenerated against uniffi 0.32);
+  `versionCode 20000 → 20001`, `versionName "2.0.0" → "2.0.1"`. The `.rnm` movie
+  epoch warning is wired into the mobile `movie_play` path
+  (`recorded_before_v2_timebase` → a drainable host warning via
+  `NesController::drain_warnings` citing ADR 0028), reaching desktop/wasm parity: a
+  pre-v2.0.0 movie replays its input faithfully but surfaces the cross-timebase
+  reproduction caveat, and a pre-v2.0.0 `.rns` restore maps to a clean
+  `MobileError::SaveState`. Host-shell wiring only; the core is untouched.
+- **`foss` / `play` Android flavor split — structural scaffolding (ADR 0025, PR
+  #235).** A new `distribution` flavor dimension with a default **`foss`** flavor
+  (no Google SDKs, no ads, no tracking — the F-Droid/sideload artifact) and a
+  **`play`** flavor. The five proprietary subsystems (Billing, Cast/Chromecast,
+  Play Games v2, Integrity, in-app update/review) move to `playImplementation`
+  behind `src/main` façades with **no-op `src/foss/`** twins and real `src/play/`
+  implementations — including the CAF `MediaRouteButton` (routed through the
+  `ChromecastSender` façade so `src/main` links no `androidx.mediarouter` /
+  `com.google.android.gms.cast`). CI builds both `assembleFoss*`/`assemblePlay*`
+  (the foss+play Gradle bundle is green). Monetization stays dormant; on-device
+  flavor verification is deferred to v2.0.9. Also added the previously-dangling
+  `to-dos/v1.8.x-on-device-verification.md`.
+
+### Changed
+
+- **AccuracyCoin oracle re-synced to upstream `100thCoin/AccuracyCoin` (PR #232).**
+  The catalog grows **144 → 146 rows / 139 → 141 assigned tests** — the two new
+  upstream PPU tests, **"ALE + Read"** and **"Hybrid Addresses"**, plus the
+  upstream "$2002 Flag Timing" + "Sprites On Scanline 0" fixes folded into the
+  existing rows. The drift-guards in
+  `crates/rustynes-test-harness/src/accuracy_coin_catalog.rs` move to `== 146` /
+  last-index 145. **Measured honestly: 139/141 (98.58%)** — the two new tests are
+  known gaps (deep sub-instruction PPU octal-latch address-corruption timing)
+  tracked for a dedicated future accuracy campaign (ADR 0030), not blocked on here.
+- **CI cost/time optimization — full suite gated to release branches (PR #233).**
+  The heavy legs (`test-roms`, `bench`, and the full macOS/Windows matrix) now run
+  only on `release/*` PRs + a weekly `schedule` drift-net, not on every
+  intermediate PR; the required correctness gates still run on all PRs.
+- **`docs/performance.md`** gains a v2.0.1 `full_frame` measure-first entry
+  (`nes_run_frame_nestest` 3.77 ms / 4.42× realtime; `flowing_palette` 2.26 ms /
+  7.37×), confirmed far under the 16.639 ms NTSC budget. Per the
+  3%-plus Criterion-stable + byte-identical bar (v1.7.0 H7 precedent), **no
+  optimization was adopted**.
+- **`docs/adr/0030`** (new) records the octal-latch roadmap: both bounded v2.0.1
+  attempts — Option 2 (`mc-ppu-bus-addr-hybrid`, PR #234) and Option 1 (the
+  2-cycle-ALE draft, PR #236) — reach only 139/141 flag-on, empirically confirming
+  the ALE+Read / Hybrid Addresses fix needs a dedicated Timebase-scale campaign.
+  **139/141 is the honest v2.0.1 baseline.**
+- **`docs/STATUS.md`** feature-flags section: the DMC-abort-probe removal recorded
+  as done; the new default-off v2.0.1 experiments (`mc-ppu-bus-addr-hybrid`,
+  ADR 0030; `mmc3-m2-phase-irq`, ADR 0002) listed among the remaining flags.
+
 ### Removed
 
-- **Dead `mc-r1-dmc-abort-probe` diagnostic feature (v2.0.1 housekeeping).** The
-  default-off DMC-DMA-abort scheduling probe left over from the v2.0.0 Timebase
-  R-1 work is removed in full: the `[features]` declarations in `rustynes-apu`,
-  `rustynes-core`, and `rustynes-test-harness`; the gated `abort_probe` pub-static
-  atomic-counter module and its `lib.rs` re-export; every `#[cfg(feature =
-  "mc-r1-dmc-abort-probe")]` increment/dump site in `rustynes-apu/src/apu.rs` and
-  `rustynes-core/src/bus.rs`; and the probe-only reporting block in the
-  `scan_dma_abort` diagnostic bin (the bin itself is retained — its no-features
-  RAM-scan fast-path has standalone value). The flag gated **only** diagnostic
-  counters and CSV dumps, never shipped behaviour, so the default build is
-  byte-identical — **AccuracyCoin holds 139/141, nestest 0-diff**. The
-  `mmc3-m2-phase-irq` experiment was evaluated for the same treatment and
+- **Dead `mc-r1-dmc-abort-probe` diagnostic feature (v2.0.1 housekeeping, PR
+  #237).** The default-off DMC-DMA-abort scheduling probe left over from the
+  v2.0.0 Timebase R-1 work is removed in full: the `[features]` declarations in
+  `rustynes-apu`, `rustynes-core`, and `rustynes-test-harness`; the gated
+  `abort_probe` pub-static atomic-counter module and its `lib.rs` re-export; every
+  `#[cfg(feature = "mc-r1-dmc-abort-probe")]` increment/dump site in
+  `rustynes-apu/src/apu.rs` and `rustynes-core/src/bus.rs`; and the probe-only
+  reporting block in the `scan_dma_abort` diagnostic bin (the bin itself is
+  retained — its no-features RAM-scan fast-path has standalone value). The flag
+  gated **only** diagnostic counters and CSV dumps, never shipped behaviour, so the
+  default build is byte-identical — **AccuracyCoin holds 139/141, nestest 0-diff**.
+  The `mmc3-m2-phase-irq` experiment was evaluated for the same treatment and
   deliberately **kept**: it gates real alternate MMC3-IRQ-timing behaviour (with
   `#[cfg(not)]` shipped-path counterparts) and remains tied to the still-open
   R1/R2 residual investigation (ADR 0002, by-design-deferred, not closed).
 
-### Changed
+### Dependencies
 
-- **`docs/performance.md`** gains a v2.0.1 `full_frame` measure-first entry:
-  the end-to-end headless frame cost is re-measured and confirmed far under the
-  16.639 ms NTSC budget and against the ≤2 ms/frame target; per the standing
-  >3%-Criterion-stable + byte-identical bar (v1.7.0 H7 precedent), **no
-  optimization was adopted**.
-- **`docs/adr/0030`** records that both bounded v2.0.1 AccuracyCoin ALE/hybrid
-  attempts — Option 2 (`mc-ppu-bus-addr-hybrid`, PR #234) and Option 1 (the
-  2-cycle-ALE draft, PR #236) — reached only 139/141 flag-on, empirically
-  confirming the fix needs a dedicated Timebase-scale campaign, not a bounded
-  fork. **139/141 is the honest v2.0.1 baseline.**
-- **`docs/STATUS.md`** feature-flags section updated: the DMC-abort-probe removal
-  is now recorded as done, and the new default-off v2.0.1 experiments
-  (`mc-ppu-bus-addr-hybrid`, ADR 0030; `mmc3-m2-phase-irq`, ADR 0002) are listed
-  among the genuinely-remaining flags.
+- **uniffi 0.31 → 0.32** (`rustynes-mobile` + `rustynes-monetization`, lockstep),
+  **mlua 0.11 → 0.12** (`rustynes-script`), **wgpu/naga 29.0.3 → 29.0.4** (the
+  in-tier patch), **cc 1.2.65 → 1.2.66**; security-advisory surface re-verified
+  (cargo-deny + cargo-audit). Consolidates and closes Dependabot #226–#230.
+  **wgpu/naga 30.0.0 deferred**: `egui-wgpu 0.35` pins `wgpu ^29` and egui 0.35 is
+  the newest release, so the 30 majors cannot resolve until an egui 0.36+ targets
+  wgpu 30 (tracked follow-up).
+
+### Notes
+
+- The `mc-ppu-bus-addr-hybrid` (Option 2, PR #234) octal-latch scaffold ships
+  **default-off** and does **not** yet pass the two new AccuracyCoin tests; with
+  the flag off the build is byte-identical at 139/141. The full fix (Option 1,
+  2-cycle-ALE) is carried forward to the v2.0.2–v2.0.4 "Harbor" cycle (draft PR
+  #236, ADR 0030).
 
 ## [2.0.0] - 2026-07-03 - "Timebase" (one-clock master-clock rewrite + Vs. DualSystem)