android-test: matrix published + stable-self + master builds

Add run-android-variant-matrix.sh so smoke covers F-Droid stable APK,
a self-build of the same release tag (wallet-1.6.1), and origin/master.
Build helper accepts tags; avoids relying on a single developer tree.

scripts/taler-monitoring/GIT-AUTOMATION-NOTES.md

@@ -183,8 +183,13 @@ For reliable full UI confirm/pay use a physical phone or a host with **≥6–8
 ### From-source smoke (same tests as F-Droid)
 
 ```bash
-# build latest master + adb smoke
+# single ref (default: inference fix branch)
 ./android-test/run-android-build-and-smoke.sh
+BRANCH=master ./android-test/run-android-build-and-smoke.sh
+# self-build published stable tag (parity with F-Droid 1.6.1 source)
+BRANCH=wallet-1.6.1 LABEL=stable-self ./android-test/run-android-build-and-smoke.sh
+# matrix: published APK + stable self-build + master (anti–weird-build)
+./android-test/run-android-variant-matrix.sh
 STACK=goa ./android-test/run-android-build-and-smoke.sh
 # already built:
 APK_PATH=$HOME/taler/taler-android/wallet/build/outputs/apk/fdroid/debug/wallet-fdroid-debug.apk \

scripts/taler-monitoring/android-test/.gitignore

@@ -2,6 +2,8 @@ apks/*.apk
 out/
 *.png
 out-source/
+out-source-*/
 out-gui/
 out-source-gui/
 out-gui-chain/
+out-matrix-*/

scripts/taler-monitoring/android-test/GUI-AUTOMATION-NOTES.md

@@ -235,11 +235,24 @@ Scripts **today** implement Android only; they should honour:
 | `run-android-pay-smoke.sh` | Hybrid: install + deep-link + light taps |
 | `run-android-gui-smoke.sh` | Multi-round GUI drive |
 | `run-goa-gui-chain.sh` | Multi mint/withdraw/pay (gui-workflows port) |
-| `run-android-build-and-smoke.sh` | Build inference fix branch + smoke (`GUI=1` optional) |
+| `run-android-build-and-smoke.sh` | Build git ref (branch/tag) + smoke (`GUI=1` optional) |
+| `run-android-variant-matrix.sh` | **published + stable-self + master** (compare builds) |
 | `start-android-emulator.sh` | Start AVD (**headless default**, SwiftShader) |
 | `lib_android_env.sh` | Flags, PATH, `android_ensure_device` |
 | `lib_ui.py` | Dump/tap/ANR helpers |
 
+### Build variants (anti–“weird local build”)
+
+| Variant | Source | Package | Purpose |
+|---------|--------|---------|---------|
+| **published** | F-Droid APK URL | `net.taler.wallet.fdroid` | What users install |
+| **stable-self** | tag `wallet-1.6.1` (override `STABLE_TAG`) rebuilt here | `…fdroid.debug` | Same release tree as stable, **our** Gradle — excludes odd publisher-only or dirty-tree builds |
+| **master** | `origin/master` rebuilt here | `…fdroid.debug` | Tip of mainline |
+| **fix** (optional) | inference fix branch | `…fdroid.debug` | GOA automation fixes |
+
+Default matrix: `published,stable-self,master`.  
+`./run-android-variant-matrix.sh` — see README.
+
 ---
 
 ## Stacks under test

scripts/taler-monitoring/android-test/README.md

@@ -11,22 +11,44 @@ STACK=stage ./run-android-pay-smoke.sh
 
 APK: F-Droid **1.6.1** (`net.taler.wallet.fdroid`).
 
-## 2) Latest source build + same tests
+## 2) Source build + same tests
 
-Pulls/builds `taler-android` master (`:wallet:assembleFdroidDebug`), then
+Builds `taler-android` at a git **ref** (`:wallet:assembleFdroidDebug`), then
 runs the **same** smoke (install + withdraw/pay deep-links).
 
 ```bash
-# default source: $HOME/taler/taler-android
+# default: inference fix branch (GOA withdraw reliability)
 ./run-android-build-and-smoke.sh
-STACK=goa ./run-android-build-and-smoke.sh
+# tip of master
-SKIP_PULL=1 ./run-android-build-and-smoke.sh   # use tree as-is
+BRANCH=master ./run-android-build-and-smoke.sh
+# self-build of published stable **tag** (same release as F-Droid 1.6.1)
+BRANCH=wallet-1.6.1 LABEL=stable-self ./run-android-build-and-smoke.sh
+SKIP_PULL=1 BRANCH=master ./run-android-build-and-smoke.sh
 TALER_ANDROID_SRC=/path/to/taler-android ./run-android-build-and-smoke.sh
 ```
 
 Built package id: `net.taler.wallet.fdroid.debug`.  
 Needs `ANDROID_HOME` (e.g. `$HOME/Android/Sdk`), Java 17+, network for Maven.
 
+## 2b) Variant matrix (published + stable self-build + master)
+
+Runs several smokes so a single odd developer build cannot be the only sample:
+
+| Variant | What |
+|---------|------|
+| **published** | F-Droid stable APK (`net.taler.wallet.fdroid` 1.6.1 / 854) |
+| **stable-self** | Rebuild tag `wallet-1.6.1` on this host (same source as stable) |
+| **master** | Rebuild `origin/master` |
+
+```bash
+./run-android-variant-matrix.sh
+STACK=goa ./run-android-variant-matrix.sh
+VARIANTS=master,stable-self ./run-android-variant-matrix.sh
+VARIANTS=published,stable-self,master,fix GUI=0 ./run-android-variant-matrix.sh
+```
+
+Artifacts + `SUMMARY.txt` under `out-matrix-<timestamp>/`.
+
 ## 3) Graphical UI (vanilla)
 
 Deep-link entry (≡ QR) **plus** multi-round uiautomator taps:

scripts/taler-monitoring/android-test/run-android-build-and-smoke.sh

@@ -1,18 +1,24 @@
 #!/usr/bin/env bash
-# Build the **latest** GNU Taler Android wallet from source, then run the same
+# Build GNU Taler Android wallet from source at a git **ref**, then run the same
-# adb deep-link smoke as run-android-pay-smoke.sh.
+# adb deep-link (or GUI) smoke as run-android-pay-smoke.sh.
 #
-# Source (default): $HOME/taler/taler-android  (git@git.taler.net:taler-android.git)
+# Source (default): $HOME/taler/taler-android
 # Build:            ./gradlew :wallet:assembleFdroidDebug
 # Package id:       net.taler.wallet.fdroid.debug
 #
-# No root required if ANDROID_HOME points at a user SDK ($HOME/Android/Sdk).
+# Typical refs:
+#   BRANCH=master                         # tip of master
+#   BRANCH=wallet-1.6.1                   # published stable **tag** (self-build)
+#   BRANCH=dev/hernani-inference/fix-…   # GOA automation fix branch
+#
+# For a multi-variant matrix (master + stable self-build + published APK):
+#   ./run-android-variant-matrix.sh
 #
 # Usage:
-#   ./android-test/run-android-build-and-smoke.sh
+#   ./run-android-build-and-smoke.sh
-#   STACK=goa ./android-test/run-android-build-and-smoke.sh
+#   BRANCH=master STACK=goa ./run-android-build-and-smoke.sh
-#   STACK=stage SKIP_PULL=1 ./android-test/run-android-build-and-smoke.sh
+#   BRANCH=wallet-1.6.1 LABEL=stable-self ./run-android-build-and-smoke.sh
-#   TALER_ANDROID_SRC=/path/to/taler-android ./android-test/run-android-build-and-smoke.sh
+#   SKIP_PULL=1 BRANCH=master ./run-android-build-and-smoke.sh
 #
 set -euo pipefail
 ROOT=$(cd "$(dirname "$0")" && pwd)
@@ -20,9 +26,11 @@ SMOKE="$ROOT/run-android-pay-smoke.sh"
 SRC="${TALER_ANDROID_SRC:-$HOME/taler/taler-android}"
 SKIP_PULL="${SKIP_PULL:-0}"
 # Prefer existing inference fix branch for GOA withdraw (spinner/exchange resolve).
-# Override: BRANCH=master or BRANCH=dev/hernani-inference/fix-withdraw-spinner-fallback
+# Matrix uses BRANCH=master and BRANCH=$STABLE_TAG explicitly.
 BRANCH="${BRANCH:-dev/hernani-inference/fix-bank-withdraw-auto-exchange}"
-VARIANT="${VARIANT:-fdroidDebug}"   # assemble task suffix: FdroidDebug / NightlyDebug / …
+# Optional human label for logs / artifact names (default = sanitized BRANCH)
+LABEL="${LABEL:-}"
+VARIANT="${VARIANT:-fdroidDebug}"
 export ANDROID_HOME="${ANDROID_HOME:-$HOME/Android/Sdk}"
 export ANDROID_SDK_ROOT="${ANDROID_SDK_ROOT:-$ANDROID_HOME}"
 
@@ -37,72 +45,123 @@ fi
 
 printf 'sdk.dir=%s\n' "$ANDROID_HOME" >"$SRC/local.properties"
 
+# --- checkout REF (branch, origin/branch, or tag) --------------------------------
 cd "$SRC"
 if [ -d .git ]; then
-  git fetch origin 2>/dev/null || true
+  git fetch origin --tags 2>/dev/null || git fetch origin 2>/dev/null || true
-  if [ -n "$BRANCH" ] && git rev-parse --verify "origin/$BRANCH" >/dev/null 2>&1; then
+  REF="$BRANCH"
-    echo "checkout origin/$BRANCH (minimal GOA/automation fixes; override BRANCH=)"
+  checked=0
-    git checkout -B "$BRANCH" "origin/$BRANCH" 2>/dev/null || git checkout "$BRANCH" 2>/dev/null || true
+  if [ -n "$REF" ]; then
+    if git rev-parse --verify "refs/tags/${REF}" >/dev/null 2>&1; then
+      echo "checkout tag ${REF} (stable / release self-build)"
+      git checkout -f "refs/tags/${REF}"
+      checked=1
+      SKIP_PULL=1
+    elif git rev-parse --verify "origin/${REF}" >/dev/null 2>&1; then
+      echo "checkout origin/${REF}"
+      git checkout -B "$REF" "origin/${REF}" 2>/dev/null || git checkout "$REF" 2>/dev/null || true
+      checked=1
+    elif git rev-parse --verify "${REF}" >/dev/null 2>&1; then
+      echo "checkout ${REF}"
+      git checkout -f "$REF"
+      checked=1
+    else
+      echo "WARN: ref '${REF}' not found locally after fetch — staying on current HEAD" >&2
+    fi
   fi
-  if [ "$SKIP_PULL" != "1" ]; then
+  if [ "$SKIP_PULL" != "1" ] && [ "$checked" = "1" ]; then
-    br=$(git rev-parse --abbrev-ref HEAD)
+    # only pull real branches, never tags
-    git pull --ff-only origin "$br" 2>/dev/null || true
+    if git symbolic-ref -q HEAD >/dev/null 2>&1; then
+      br=$(git rev-parse --abbrev-ref HEAD)
+      git pull --ff-only origin "$br" 2>/dev/null || true
+    fi
   fi
 fi
-COMMIT=$(git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
-echo "source: $SRC @ $COMMIT (branch $(git rev-parse --abbrev-ref HEAD 2>/dev/null || ?))"
-echo "variant: assemble${VARIANT^}" 2>/dev/null || true
 
-# Map VARIANT → gradle task (fdroidDebug → assembleFdroidDebug)
+COMMIT=$(git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
-task="assemble$(printf '%s' "$VARIANT" | python3 -c 'import sys; s=sys.stdin.read().strip(); print(s[:1].upper()+s[1:] if s else "FdroidDebug")')"
+HEAD_DESC=$(git describe --tags --always 2>/dev/null || echo "$COMMIT")
-# Prefer explicit known tasks
+BR_NOW=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo detached)
+if [ -z "$LABEL" ]; then
+  LABEL=$(printf '%s' "$BRANCH" | tr '/:' '--' | tr -c 'A-Za-z0-9._-' '-' | cut -c1-48)
+fi
+echo "source: $SRC @ $COMMIT ($HEAD_DESC)  ref=$BRANCH  label=$LABEL  head=$BR_NOW"
+echo "variant: $VARIANT"
+
+# Map VARIANT → gradle task
 case "$VARIANT" in
   fdroidDebug|FdroidDebug) task=assembleFdroidDebug ;;
   fdroidRelease|FdroidRelease) task=assembleFdroidRelease ;;
   nightlyDebug|NightlyDebug) task=assembleNightlyDebug ;;
   googleDebug|GoogleDebug) task=assembleGoogleDebug ;;
+  *)
+    task="assemble$(printf '%s' "$VARIANT" | python3 -c 'import sys; s=sys.stdin.read().strip(); print(s[:1].upper()+s[1:] if s else "FdroidDebug")')"
+    ;;
 esac
 
-# Low-RAM hosts: cap JVM (override GRADLE_OPTS to raise)
+# Low-RAM hosts: cap JVM
 export GRADLE_OPTS="${GRADLE_OPTS:--Xmx1280m -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=1}"
 echo "gradle :wallet:$task …"
 ./gradlew ":wallet:$task" --no-daemon --max-workers="${GRADLE_MAX_WORKERS:-1}" \
   -Dorg.gradle.jvmargs="${GRADLE_JVMARGS:--Xmx1280m}"
 
-# Locate APK
+# Prefer fdroid debug APK if multiple exist
-APK=$(find "$SRC/wallet/build/outputs/apk" -name '*.apk' -type f 2>/dev/null | sort | tail -1)
+APK=$(find "$SRC/wallet/build/outputs/apk" -path '*fdroid*debug*.apk' -type f 2>/dev/null | sort | tail -1)
+if [ -z "$APK" ] || [ ! -f "$APK" ]; then
+  APK=$(find "$SRC/wallet/build/outputs/apk" -name '*.apk' -type f 2>/dev/null | sort | tail -1)
+fi
 if [ -z "$APK" ] || [ ! -f "$APK" ]; then
   echo "no APK under wallet/build/outputs/apk" >&2
   exit 4
 fi
 echo "built apk: $APK ($(wc -c <"$APK") bytes)"
 
-# Package id from aapt if available
 PKG="${PKG:-}"
 if [ -z "$PKG" ] && command -v aapt >/dev/null 2>&1; then
   PKG=$(aapt dump badging "$APK" 2>/dev/null | sed -n "s/^package: name='\([^']*\)'.*/\1/p" | head -1)
 fi
+if [ -z "$PKG" ] && command -v aapt2 >/dev/null 2>&1; then
+  PKG=$(aapt2 dump badging "$APK" 2>/dev/null | sed -n "s/^package: name='\([^']*\)'.*/\1/p" | head -1)
+fi
 : "${PKG:=net.taler.wallet.fdroid.debug}"
 
-mkdir -p "$ROOT/apks"
+mkdir -p "$ROOT/apks" "$ROOT/out"
-STAMP_APK="$ROOT/apks/wallet-from-source-${COMMIT}.apk"
+STAMP_APK="$ROOT/apks/wallet-${LABEL}-${COMMIT}.apk"
 cp -f "$APK" "$STAMP_APK"
 echo "copied → $STAMP_APK"
-echo "$COMMIT" >"$ROOT/out/build-commit.txt" 2>/dev/null || mkdir -p "$ROOT/out" && echo "$COMMIT" >"$ROOT/out/build-commit.txt"
+{
+  echo "label=$LABEL"
+  echo "ref=$BRANCH"
+  echo "commit=$COMMIT"
+  echo "describe=$HEAD_DESC"
+  echo "apk=$STAMP_APK"
+  echo "pkg=$PKG"
+  echo "task=$task"
+} | tee "$ROOT/out/build-${LABEL}.txt"
+echo "$COMMIT" >"$ROOT/out/build-commit.txt"
 echo "$APK" >"$ROOT/out/build-apk-path.txt"
 
-# Same smoke as published F-Droid path (CLI hybrid or GUI)
 export APK_PATH="$STAMP_APK"
-export APK_NAME="$(basename "$STAMP_APK")"
+export APK_NAME
+APK_NAME="$(basename "$STAMP_APK")"
 export PKG
-export OUT_DIR="${OUT_DIR:-$ROOT/out-source}"
+export OUT_DIR="${OUT_DIR:-$ROOT/out-source-$LABEL}"
 mkdir -p "$OUT_DIR"
+cp -f "$ROOT/out/build-${LABEL}.txt" "$OUT_DIR/build-meta.txt" 2>/dev/null || true
+
 SMOKE_CMD="$SMOKE"
 if [ "${GUI:-0}" = "1" ]; then
   SMOKE_CMD="$ROOT/run-android-gui-smoke.sh"
-  OUT_DIR="${OUT_DIR%-source}-source-gui"
+  case "$OUT_DIR" in
-  export OUT_DIR
+    *-gui) ;;
+    *) OUT_DIR="${OUT_DIR}-gui"; export OUT_DIR; mkdir -p "$OUT_DIR" ;;
+  esac
 fi
-echo "=== smoke with built APK (PKG=$PKG · GUI=${GUI:-0}) ==="
+echo "=== smoke label=$LABEL PKG=$PKG GUI=${GUI:-0} OUT_DIR=$OUT_DIR ==="
-exec env APK_DIR="$ROOT/apks" APK_NAME="$APK_NAME" APK_PATH="$APK_PATH" PKG="$PKG" OUT_DIR="$OUT_DIR" \
+# Do not exec: allow matrix wrapper to run multiple variants
+set +e
+env APK_DIR="$ROOT/apks" APK_NAME="$APK_NAME" APK_PATH="$APK_PATH" PKG="$PKG" OUT_DIR="$OUT_DIR" \
   "$SMOKE_CMD"
+rc=$?
+set -e
+echo "=== smoke label=$LABEL exit=$rc ==="
+exit "$rc"

scripts/taler-monitoring/android-test/run-android-variant-matrix.sh

@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# Run Android wallet smoke against **several build variants** so a single
+# "weird" developer tree or a bad local build cannot be the only sample.
+#
+# Default matrix:
+#   1) **published**   — F-Droid stable APK (bit-for-bit what users install)
+#   2) **stable-self** — rebuild the same release **tag** as published (self-build)
+#   3) **master**      — rebuild origin/master (tip / CI-style)
+#
+# Why stable-self in addition to published?
+#   Rare, but a published APK *or* a one-off developer build can be odd
+#   (wrong flags, dirty tree, wrong ABI). Rebuilding the release tag on *this*
+#   machine with the same script path as master isolates "our toolchain" vs
+#   "F-Droid binary" vs "current master source".
+#
+# Usage:
+#   ./run-android-variant-matrix.sh
+#   STACK=goa ./run-android-variant-matrix.sh
+#   VARIANTS=master,stable-self ./run-android-variant-matrix.sh
+#   VARIANTS=published,stable-self,master,fix GUI=1 ./run-android-variant-matrix.sh
+#   STABLE_TAG=wallet-1.6.1 MASTER_BRANCH=master ./run-android-variant-matrix.sh
+#
+# Env:
+#   STABLE_TAG       default wallet-1.6.1 (must match published F-Droid release)
+#   STABLE_APK_URL   published APK (same as pay-smoke default)
+#   MASTER_BRANCH    default master
+#   FIX_BRANCH       inference fix branch (variant "fix")
+#   VARIANTS         comma list: published,stable-self,master,fix
+#   GUI=1            use gui-smoke instead of pay-smoke after each build
+#   FAIL_FAST=1      stop on first non-zero smoke (default 0 = run all)
+#   MATRIX_OUT       summary dir (default out-matrix-<timestamp>)
+#
+set -euo pipefail
+ROOT=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=lib_android_env.sh
+. "$ROOT/lib_android_env.sh"
+
+: "${STABLE_TAG:=wallet-1.6.1}"
+: "${STABLE_APK_URL:=https://f-droid.org/repo/net.taler.wallet.fdroid_854.apk}"
+: "${STABLE_APK_NAME:=net.taler.wallet.fdroid_854.apk}"
+: "${MASTER_BRANCH:=master}"
+: "${FIX_BRANCH:=dev/hernani-inference/fix-bank-withdraw-auto-exchange}"
+: "${VARIANTS:=published,stable-self,master}"
+: "${FAIL_FAST:=0}"
+: "${GUI:=0}"
+: "${STACK:=auto}"
+
+TS=$(date +%Y%m%d-%H%M%S)
+MATRIX_OUT="${MATRIX_OUT:-$ROOT/out-matrix-$TS}"
+mkdir -p "$MATRIX_OUT"
+SUMMARY="$MATRIX_OUT/SUMMARY.txt"
+: >"$SUMMARY"
+
+echo "=== Android variant matrix ===" | tee -a "$SUMMARY"
+echo "STACK=$STACK  GUI=$GUI  headless=${EMULATOR_HEADLESS}  variants=$VARIANTS" | tee -a "$SUMMARY"
+echo "STABLE_TAG=$STABLE_TAG  MASTER_BRANCH=$MASTER_BRANCH" | tee -a "$SUMMARY"
+echo "out: $MATRIX_OUT" | tee -a "$SUMMARY"
+
+# Ensure device once (headless AVD by default)
+android_ensure_device || {
+  echo "no adb device — start ./start-android-emulator.sh --wait" >&2
+  exit 3
+}
+export SERIAL ANDROID_SERIAL
+echo "device: $SERIAL" | tee -a "$SUMMARY"
+
+IFS=',' read -r -a VLIST <<<"$VARIANTS"
+declare -a RESULTS=()
+overall=0
+
+run_published() {
+  local out="$MATRIX_OUT/published"
+  mkdir -p "$out"
+  echo "" | tee -a "$SUMMARY"
+  echo "-------- variant: published (F-Droid stable binary) --------" | tee -a "$SUMMARY"
+  local smoke="$ROOT/run-android-pay-smoke.sh"
+  [ "$GUI" = "1" ] && smoke="$ROOT/run-android-gui-smoke.sh"
+  set +e
+  env STACK="$STACK" \
+    APK_URL="$STABLE_APK_URL" \
+    APK_NAME="$STABLE_APK_NAME" \
+    APK_PATH="" \
+    PKG=net.taler.wallet.fdroid \
+    OUT_DIR="$out" \
+    SERIAL="$SERIAL" \
+    AUTO_START_EMULATOR=0 \
+    "$smoke"
+  local rc=$?
+  set -e
+  echo "published exit=$rc" | tee -a "$SUMMARY"
+  echo "published $rc" >>"$MATRIX_OUT/results.tsv"
+  return "$rc"
+}
+
+run_selfbuild() {
+  local label="$1"
+  local ref="$2"
+  local out="$MATRIX_OUT/$label"
+  mkdir -p "$out"
+  echo "" | tee -a "$SUMMARY"
+  echo "-------- variant: $label (self-build ref=$ref) --------" | tee -a "$SUMMARY"
+  set +e
+  env STACK="$STACK" \
+    BRANCH="$ref" \
+    LABEL="$label" \
+    GUI="$GUI" \
+    OUT_DIR="$out" \
+    SERIAL="$SERIAL" \
+    ANDROID_SERIAL="$SERIAL" \
+    AUTO_START_EMULATOR=0 \
+    PKG=net.taler.wallet.fdroid.debug \
+    "$ROOT/run-android-build-and-smoke.sh"
+  local rc=$?
+  set -e
+  echo "$label (ref=$ref) exit=$rc" | tee -a "$SUMMARY"
+  echo "$label $rc $ref" >>"$MATRIX_OUT/results.tsv"
+  if [ -f "$out/build-meta.txt" ]; then
+    echo "build-meta:" | tee -a "$SUMMARY"
+    cat "$out/build-meta.txt" | tee -a "$SUMMARY"
+  fi
+  return "$rc"
+}
+
+for raw in "${VLIST[@]}"; do
+  v=$(echo "$raw" | tr -d '[:space:]')
+  [ -n "$v" ] || continue
+  rc=0
+  case "$v" in
+    published|fdroid|stable-published)
+      run_published || rc=$?
+      ;;
+    stable-self|stable|self-stable|release-self)
+      run_selfbuild "stable-self" "$STABLE_TAG" || rc=$?
+      ;;
+    master|main)
+      run_selfbuild "master" "$MASTER_BRANCH" || rc=$?
+      ;;
+    fix|fix-branch|inference)
+      run_selfbuild "fix" "$FIX_BRANCH" || rc=$?
+      ;;
+    *)
+      # treat as raw git ref / label
+      run_selfbuild "ref-${v//\//-}" "$v" || rc=$?
+      ;;
+  esac
+  RESULTS+=("$v:$rc")
+  if [ "$rc" -ne 0 ]; then
+    overall=1
+    if [ "$FAIL_FAST" = "1" ]; then
+      echo "FAIL_FAST: stopping after $v rc=$rc" | tee -a "$SUMMARY"
+      break
+    fi
+  fi
+done
+
+echo "" | tee -a "$SUMMARY"
+echo "=== matrix done (overall=$overall) ===" | tee -a "$SUMMARY"
+for r in "${RESULTS[@]}"; do
+  echo "  $r" | tee -a "$SUMMARY"
+done
+echo ""
+echo "Compare OUT_DIR trees under $MATRIX_OUT"
+echo "Intent: published vs stable-self should behave similarly;"
+echo "        master may diverge (new features / fixes)."
+echo "A odd stable-self vs published suggests toolchain or unsigned-debug differences;"
+echo "a odd master-only failure suggests tip breakage, not F-Droid stable."
+exit "$overall"