Next major release/version1.50 (#89)

* Make DBController work on one database file per instance

The controller was a static singleton: an eagerly created static instance
opened the root database during class initialization, and both the connection
and the path were static fields. A second operator profile in the same process
was therefore impossible, and ChatController's own "new DBController()" never
opened anything - it silently adopted the eagerly opened root connection.

- drop the eager static instance in favour of a lazily created default instance
- turn connection and path into instance state
- add a constructor taking a database file name relative to the application
  directory plus a flag whether a missing file is seeded from the bundled
  template
- create additional profile databases empty instead of seeding them: the
  bundled template carries 3452 foreign callsigns and user_version 0, which
  would show a new operator foreign data and trigger the full callsign
  normalization rebuild. The schema is created by the existing table setup.
- remember the shutdown hook so closeDBConnection can deregister it; otherwise
  every profile switch would leave another hook holding a dead connection

All SQL statements keep referencing the plain field and are unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Allow preferences and chat controller to be bound to a file set

ChatPreferences gains a constructor taking a preferences file name relative to
the application directory, so "profiles/OP2/preferences.xml" is as valid as the
historic flat "preferences.xml". A missing file is still seeded from the
bundled template, which gives an additional operator the same clean defaults a
first installation gets.

ChatController gains a constructor that passes both relative file names and the
seed flag through to ChatPreferences and DBController. The existing
constructors delegate to the historic file names, so nothing changes yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Introduce the operator profile model and its registry

Adds the descriptor, the path derivation and the registry persistence for
operator profiles. Nothing calls them yet, so behaviour is unchanged.

The descriptor stores only a shared/own flag, never a path. All file names are
derived in OperatorProfilePaths, so a stored path can never drift apart from
the flag that produced it. A profile identifier is a stable, file system safe
slug assigned once, so renaming a profile never moves a directory.

The registry is created lazily. An installation that only has the historic flat
layout gets no registry file and no profiles directory; the root profile is
synthesised in memory instead. That keeps a single operator installation
byte for byte the one it was before, and it keeps a downgrade to an older
release a no-op. A missing, unreadable or malformed registry is logged and
treated like an installation without additional profiles, never as an error.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Select the operator profile at startup

Resolves the active operator profile before the chat controller is built and
passes its two file names on, so preferences, layout and worked data follow the
profile.

The resolution is deliberately quiet for existing installations. With no
registry or exactly one profile nothing is asked and nothing is written, so a
single operator start is unchanged. Only from two profiles on does a small
picker appear with the last used profile preselected, where Enter or a double
click starts immediately. A "--profile" argument, or the equivalent system
property, skips the picker; an unknown name warns and falls back to the normal
selection instead of refusing to start.

The startup decision itself lives in OperatorProfileBootstrap and contains no
user interface code, so it is covered by headless tests. The window title gains
the profile name only when a second profile exists.

Command line parsing happens in init() and is kept in a process wide holder,
because JavaFX only knows the parameters of the instance it launched itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Release the background resources a discarded runtime owns

Several resources outlived a disconnect on purpose, which was harmless while a
process ran exactly one session for its whole life. They are now released when
the controller itself is closed:

- the ON4KST connection supervisor thread, which stopByUser did not touch
- the sked reminder scheduler, which had no shutdown at all
- the reachability executor, whose shutdown method existed but was never called
- the PSTRotator retry scheduler and its pending retry
- the map tile proxy, whose stop method existed but was never called, leaving a
  server socket and a twelve thread pool behind
- the station map bridge listeners and its coalescing animation, which would
  otherwise keep firing into a dead user interface

These are real leaks today; they only become visible when a second runtime is
built in the same process.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Switch the operator profile while the application is running

Splits the teardown out of stop() into a reusable, idempotent shutdownRuntime()
and adds File - Switch operator profile..., which tears the current runtime
down and builds a fresh one for the selected profile.

The new runtime is a new application instance rather than a second start() on
the existing one. Many controls are instance fields created once, so reusing
the instance would re-parent mounted nodes and register every listener twice.
A fresh instance is safe because the class keeps no mutable static state.

Closing every window during a switch would end the process under the JavaFX
default, so the application takes over the exit decision: implicit exit is
turned off, the main window gets an explicit close handler, and every exit path
runs through the launcher. That also fixes losing the window layout on exit
after a switch, because JavaFX only calls stop() on the instance it launched.

The two view timers are now cancelled null-safe; stop() used to dereference
them unguarded, which would fail if shutdown happened before they were created.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Manage operator profiles from the settings window

Adds a "Profiles" tab, appended last so no established tab position shifts,
offering create, duplicate, rename, delete, a switch between shared and own
worked stations, and activation of another profile.

Duplicating copies the whole configuration except callsign and password. The
antenna, locator, layout and integration settings are exactly the work nobody
wants to enter twice, while the credentials belong to one operator only. The
root profile can neither be deleted nor moved off the common station database,
because its files are the installation itself.

The login callsign and its raw form now default to empty instead of a real
callsign. The XML reader treats an empty element as "not set" and falls back to
the field default, so without this change a profile created without credentials
would come up carrying the callsign compiled into the defaults - and an
operator could transmit under someone else's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Document operator profiles

Adds a manual section in both languages covering where profile files live, the
choice between shared and own worked stations, managing profiles, the startup
selection and the --profile argument, switching while running, and the fact
that passwords stay in clear text so profiles are not an access boundary.

Records the architecture in PROJECT_CONTEXT: lazy registry, derived paths, why
an additional profile database is created empty, why the login callsign default
is empty, and the constraints of rebuilding the runtime for a switch.

Adds a v1.50 changelog entry in both languages including the upgrade notes: no
file is moved, and going back to an older release stays possible.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Make the terrain profile cache multi operator safe

The cache stored a single owner identity in a meta table and dropped the whole
TerrainProfileCache table whenever the configured callsign or locator differed
from it. With several operator profiles that turns the cache into a permanent
miss: every switch between two operators with different locators would discard
every computed profile.

Entries are separated by owner identity through the primary key already, so the
wipe is replaced by an owner table that simply records which identities are in
use. A different owner now misses the cache instead of clearing everybody's.

The cache also moves out of the worked station database into its own global
terrainprofilecache.db. Terrain profiles are pure geometry derived from two
locators and a sample count; at a multi operator station both operators share
one location, so a per profile copy would only double the traffic against the
terrain service. No migration is needed, the new file refills itself, and the
old tables stay readable for older releases.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Fail cleanly when the registry path has no directory

SpotBugs flagged a null passed to Files.createTempFile: the null check guarded
only createDirectories, while the temporary file creation would still have
dereferenced it. The path is resolved absolute so this is practically
unreachable, but bailing out with a log line is cheaper than the latent NPE.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpa6bjie5qkeNG62y6FmXm

* Code Version 1.50

* Add the in-app update concept for 1.50

Captures the agreed design so it can be handed over later: extended
update feed with per-artifact metadata, a build-time package-type
marker, a testable check service replacing the blocking call in the
ChatController constructor, a non-modal hint suppressed while connected
to ON4KST, verified downloads and platform-specific execution.

Concept only, nothing implemented yet. Line anchors were verified
against this branch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HT8R7zTMoQnmJj6dGbaqqf

* Use one base font size and a per-profile startup design

JavaFX picks a 13px default font on macOS and Linux but 12px on
Windows, so labels in fixed-size controls were cut off outside
Windows. Both stylesheets now set 12px on the root.

Each operator profile now chooses light or dark mode for startup on
the GUI settings tab. The Windows menu entries remain a quick switch
for the running session. All windows, including the update window
and the top candidates list, follow the design, and the main window
no longer starts light while the station map starts dark.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Show a drag-to-install layout in the macOS DMG

The DMG window now has a background with an arrow from the app to
the Applications folder, in the KST4Contest colours. Finder applies
the layout through AppleScript; if that fails, e.g. on a headless
runner, the script warns and builds the plain DMG as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Use the macOS system menu bar in all windows

On macOS the main menus move into the system menu bar and are shared
with the secondary windows, so they stay available whichever window
has the focus. The connection state indicator becomes a read-only
LINK menu there instead of the status bar button. Other platforms
are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* List direct commits on main in the release notes

GitHub's generated release notes only cover merged pull requests, so
commits pushed straight to main were missing. The release job now
builds the notes itself: "What's Changed" holds "Commits on main"
(first-parent, without bot and squash-merge commits) and GitHub's PR
list as "Merged PRs".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Build with Gradle in two modules, and free core of JavaFX

Etappen 1 and 2 of the Compose migration (43 commits).

The Maven build, the single source tree and the JPMS module-info went together.
core now holds the domain and app-desktop the user interface, both built by
Gradle, packaged through jpackage from Gradle, with SpotBugs and PMD wired in.
JavaFX moves to the classpath, which is why the launcher is Main and not the
Application subclass. The PR check, the nightly artifacts, the release and the
AUR packages all build from Gradle; the macOS DMG points at its output.
Verified on Linux, macOS and Windows.

core then loses JavaFX entirely. It observes through kst4contest.observe --
ObservableValue, ObservableRoster, and UiDispatcher as the one boundary a
worker thread crosses to touch the interface. The controller collections become
rosters and the visible station list a pure derivation rather than a
FilteredList/SortedList chain, which is also what fixed two focus defects only
a load test had exposed: the keyboard focus stays where the operator put it,
and the send field keeps it after a row click.

The rule that outlives this commit: ObservableRoster is the store and the list
a view is bound to is a mirror of it, never the other way round.

* Draw the whole interface in Compose

Etappen 3 to 6a of the migration (129 commits). Every window the operator sees
is Compose; the JavaFX ones still exist beside them so the two could be
compared against a live session, which is the only way the differences came to
light.

The toolchain first, then the settings window with its eleven tabs and 72 real
preferences; then the multi-column table as a component, and with it the rules
it needs -- stable row identity, a selection that survives a refresh, column
order the operator can drag, and a repaint when the rows change rather than
when the list instance does. Then the update and monitor windows, and the main
window: 22 station columns, the filter bar, the selected-station panel, the
message tabs, the priority bar, the sked controls, the status indicators and
the timeline, assembled behind a splitter because Compose has none.

The map stops being a WebView. A Compose canvas projects WebMercator tiles
itself, with the clustering in core and an asynchronous fetcher in place of the
local tile proxy; derive() becomes a pure Kotlin reimplementation instead of a
reflection call into com.sun.javafx.

Most of the volume here is parity the operator would notice rather than new
behaviour: desktop density instead of Material's phone minimums, colours taken
from the JavaFX stylesheets instead of Material's palette, row dividers, band
columns, grid-square labels and their colours, the home marker and antenna
beam, pinch-to-zoom under Wayland, and layouts that survive a window narrower
than the chart they stack.

Two lessons are worth more than the diff. A control bound to a value Compose
cannot observe writes through and never redraws -- that one shipped repeatedly
with a green build, because no test drew anything. And a layout that clips
instead of wrapping is worse than one that is merely too narrow: half a word
is the worst available outcome.

* Remove JavaFX

The second half of Etappe 6 (61 commits). grep -rl "javafx\." over both main
source trees is empty, nothing imports javafx, neither classpath resolves it,
and org.openjfx is out of the build and the version catalog.

The finding that shaped the work: the JavaFX main window was built on every
start and never shown -- primaryStage's setScene and show were both commented
out. Most of those 11,655 lines were dead weight rather than a port. But not
all of them, and that is the trap this commit is really about: dead-looking
methods still fed live Compose sinks. They were cut at their seams instead of
deleted, and a sweep script that follows calls was written to find them,
because reading the code does not reveal them.

In order: the colour derivation frozen as checked-in test data, so the pin
survives JavaFX being removed instead of silently comparing against itself;
the live feeds lifted out of the never-shown window and given names and tests;
the dead scaffolding deleted in slices; then the lifecycle. UiDispatcher now
delivers to the AWT event dispatch thread, the ten Alerts are modal Compose
dialogs, HostServices gives way to java.awt.Desktop with the mailto/http split
JavaFX did not need, and extends Application, start(Stage), stop and launch are
gone -- main builds the runtime and a shutdown hook replaces stop().

An independent review found two deadlocks in that move, both the same failure
class, both invisible to the build: a blocking wait on the event thread for
work that can only advance on the event thread. The profile picker waited on a
latch and froze the client for good; ComposeWindowHost.close waited on
Thread.join and returned with the window still marked open, which made a
profile switch raise the dead runtime's window and leave the rebuilt profile
without its Connect button. A third came out of fixing them: a ComposeDialog
built off the event thread cannot create its GL context and never paints.

Three defects only a GUI run showed, never the build: an NPE on a deleted
field, a Compose menu still hanging on deleted MenuItems, and a category
bookkeeping field that looked dead but is read by the outgoing-message category
resolution -- deleting it would have sent messages in the wrong category.

The binding docs and the manual no longer describe a JavaFX client.

* Draw the menu bar in Compose, and give the drawing layer a net

What the removal left open (4 commits).

Compose's MenuBar is a javax.swing.JMenuBar set on the window, so Swing draws
it and no theme reaches it; with no look-and-feel configured that meant the
default Metal menu above a themed window. The bar is drawn in the window now,
except on macOS, where the system bar is where that platform expects it. Two
renderers read one description -- mainMenuModel is a plain function of the
state, which also gives the menus their first tests. Closing the main window
quits the application again, and the window writes its size back to the
profile; both had quietly stopped working when the last JavaFX stage went.

Then Etappe 7. Four faults shipped in the settings-window branch alongside a
green suite of 382 tests, because not one of those tests drew anything: a
control that never redrew, a tab strip that clipped mid-word, a form taller
than its window with no way down, and colours that came from Material rather
than the stylesheet. One regression test per class, and the spec's acceptance
criterion is met rather than assumed -- each fault was put back deliberately
and the matching test watched to fail.

The CI had never run the suite at all; it does now, headless. What that took
was not Xvfb: skiko's native library links against libGL and only has to be
loadable, since the drawing tests render in software. Without the package the
whole Compose half of the suite dies with a message that reads like a missing
display. Found by running the job under act rather than on GitHub.

The six tests that open a real window skip headless by their own guard. The
summary step counts from the result XML and fails on failures there, because
this project's rule is never to infer a green suite from an exit code.

* Make the colours adjustable per operator profile

Six colour roles per design, per profile: surface, window surface, field interior,
text, accent and separator line. A change applies at once in every open window and
survives a restart once the settings are saved, like any other preference.

Three sources, later wins role by role: the shipped stylesheet from the classpath,
then the profile's own stylesheet file if there is one, then the overrides stored in
the profile's preferences. resolvePalette is a pure function and reports where every
role's colour came from, which the tab shows per field -- with two sources able to
decide one colour, that is the only thing keeping "why is this colour what it is"
answerable, and the spec calls it mandatory rather than decorative.

Four things this had to get right, each learned the hard way and each pinned:

A role is a selector and a property, not a property alone. Three of the six are
stated outside .root -- text on .label, the separator on .separator *.line -- and
-fx-background-color alone appears a dozen times in the evening sheet. Measured: the
shipped daylight sheet states no colour at all, the evening sheet states five and
implies the sixth.

Kst4ContestTheme reads the palette from the store's state and not from remember.
That read is what makes a change repaint every open window; remember(darkMode) held
the palette until somebody toggled day/evening, so a change reached nothing.

A derived colour follows its source's value, never its provenance. The root
profile's own stylesheet is the one copyResourceIfRequired writes at every startup --
the shipped sheet itself -- so layer 2 declares the accent on every existing
installation with nobody having chosen anything. Keying textAccent on "does this come
from a file" repainted the evening accent from green to blue on upgrade and made
"reset to shipped" disagree with "discard my changes".

The contrast guard measures where colours are actually drawn, read off Theme.kt's
Material mapping rather than off the role names: background and surface are both the
window surface, and primary is textAccent, not accent. It reports a pair only when it
is both under WCAG AA and worse than the shipped sheet -- the shipped sheets have
three pairs under 4.5 themselves, so an absolute floor would warn on an untouched
client and teach the operator to ignore warnings.

The way back out of an unreadable palette is deliberately overbuilt, because it is
the one failure that locks itself in. "Reset to the shipped colours" takes the
shipped palette as a required parameter and reads no composition local, so there is
no path by which it could be drawn in the colours it exists to undo; it looks out of
place under a customised palette, and that is what makes it findable. Ctrl+Z, Ctrl+D
and Ctrl+R reach the three ways back even with the caret in a colour field. A
mistyped colour is refused and the field snaps back.

The profile's stylesheet is the hand-editing route the copy under ~/.praktiKST has
been promising since it was first written and never read. It is read now. A button
writes the shipped template as a starting point and never replaces a file that is
already there. An unreadable, truncated or non-CSS file does not prevent startup --
the role falls back to the shipped design. A sheet stating -fx-base and no
-fx-background states the derived window surface too, the way JavaFX does, or the
most natural hand edit would leave every window the shipped light grey.

101 new tests. All of it runs headless.

* Document the adjustable colours, and record the design and the plan

Both manuals get the Colours tab in full: the six roles, that a change applies at
once but survives a restart only after Save settings, the three ways back with their
keyboard shortcuts, what each provenance label means, and the readability notice that
warns without refusing.

Two things an operator would otherwise have to discover. The reset button is always
drawn in the shipped colours and works when nothing else can be read -- the risk
section of the design says plainly that a keyboard path only helps whoever knows it,
so the manual is where this has to be written down. And the root profile already has
both stylesheet files, because KST4Contest has been writing them at startup for
years, so most of its roles report "from file" rather than "shipped" with identical
values.

PROJECT_CONTEXT.md records the decisions that outlive this stage: the three sources
and their precedence, that a role is a selector and a property, that the theme must
read the store's state rather than remember, where the contrast pairs come from, why
the root profile's file layer always exists, and why the lifeline refuses the active
palette. Also corrects its claim that CSS stays global -- a profile now owns its
stylesheets.

The design document and the implementation plan are kept as they were written,
including the plan's own corrections where measuring the code contradicted it.

* Speak the operator's language

The interface is German or English, chosen per operator profile on the GUI tab, in force at
once in every open window, and remembered across restarts. 376 texts in both languages.

The texts are ordinary .properties files that nobody has to compile: a contributor copies the
English one, translates the values, and opens a pull request. A third module -- build tooling
that never ships -- turns them into Kotlin before anything compiles, which is what makes a
mistyped key and a wrong argument count compile errors rather than things an operator
discovers. It lives in the main build rather than buildSrc because buildSrc's tests do not run
on `./gradlew build`, measured, and a generator whose tests never run is the exact failure it
exists to prevent.

Incompleteness is allowed and incorrectness is not. A missing key warns and falls back to
English, so a partial contributed language can be submitted at all; an orphan key, a
placeholder the translation drops, a duplicate key or an unreadable file fail the build with
the generator's own message naming the file. The argument count always comes from the English
base. German is held complete by a test because it ships; a contributed language is not.

What is deliberately not translated is the harder half. Protocol frames and chat commands
would break the connection or go unread; the beacon texts, auto answers, snippets and
shortcuts go to other radio amateurs and sit in every operator's stored profile; the 273
println calls in core are diagnostics, and a German stack trace is worse for whoever reads the
bug report; and QRA, QRG, QTF, LOS, Fresnel and wkd read the same in either language. Three
tests guard the boundary by measuring behaviour rather than text: the protocol frames built
under three locales, every preference default compared by reflection, and no translation value
being a protocol command. The reflective one is the only one that covers what nobody thought
of.

One insight turned up three times. Anything built outside a composition freezes the language it
was built in: the window title, the settings tab strip and every column header are all
constructed once at startup -- the columns from Java -- so each now holds a function read when
it is drawn. That also fixed something older and unrelated to language: the main window's title
was a fixed "KST4Contest (Compose)" for the whole session, where the JavaFX window had carried
the live connection line. It carries it again.

A column's id is never translated. It is what the remembered widths and order are keyed on.

* Document the two languages, and how to contribute a third

Both manuals get the language picker in full: where it sits, that it applies per profile and
takes effect at once in every open window, and -- at more length -- what is deliberately left
alone and why. An operator who sees an English beacon text in a German client should be able
to read that it is meant that way.

The contribution route is written down in both, because plain text files are only useful if
somebody knows they are there: copy, translate, submit; a partial file is welcome; the build
reports mistakes by file name and writes a worksheet of what is still missing.

PROJECT_CONTEXT records the decisions that outlive this stage -- the four kinds of text and
the rule that the addressee decides, that core produces no display text, that incompleteness
is allowed and incorrectness is not, that anything built outside a composition needs its text
read inside one, and that a column id is never translated.

CLAUDE.md said two modules; there are three, and the third never ships. It also states the
German orthography now, which this session got wrong across a spec and two plans: ss after a
short vowel, so muss and dass.

* Remove the implementation plans now that every stage is executed

Thirteen plans, all of them step-by-step instructions for work that is committed. A plan left
behind reads to the next person like an open intention, and these describe a build that no
longer exists -- the first still explains how to introduce Gradle.

The specifications stay. They say why the architecture is what it is, which the code cannot,
and three of them are still argued from. The live-findings note stays too: CLAUDE.md sends
people to it, and its hardest lesson -- that a blocking wait on the AWT event thread deadlocks
the interface while the build stays green -- is written down nowhere else.

Its sweep script stays as well. The note argues explicitly that the script belongs beside the
finding so the next reader can measure rather than believe, and removing it would contradict
the reasoning it illustrates.

Two references in the note and one in the JavaFX-removal spec pointed at plans and now say
where the reasoning went instead.

* Point the JavaFX-removal spec at where its plan's reasoning went

* Remove the stray release-metadata patch from the working tree

A 416-line patch file that was applied long ago and has sat in the repository root since. It
predates this branch and stays in the shared history, where rewriting it would mean rewriting
commits that are already on main and on origin.

* Check the translation files in CI and say what they hold

classes already runs the generator, so an orphan key, a dropped placeholder
or a duplicate fails the compile job with the generator's own message naming
the file -- verified by breaking strings_de.properties on purpose.

A step summary counts each language against the base, so the author of a
translation PR sees what they covered without reading the build log.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Refuse a translation key that would not form a Kotlin name

The generator escaped every translation value but emitted the key verbatim as
the member identifier, and identifierFor strips only . _ - -- so a key carrying
a space, a brace, a quote or a newline from a \uXXXX escape broke out of
val <name>: String get() = lookup(...) into an init block or property
initializer that runs when Strings is instantiated. Translation files are the
contribution surface that arrives by pull request, so this was a path from a
merged .properties change to code in every client.

The generated identifier is now held to letters-then-letters-and-digits before
any source is written, alongside the existing orphan and collision refusals.
Proven by replaying a file-writing payload against the built generator: it now
throws and writes nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Port the rebased diagnostics and session logging onto the modules

origin/main landed replayable session logging (MessageHistoryRecorder), file
logging (ApplicationFileLogging) and a user-list refresh split on the old flat
layout. The rebase carried the new files, but three things needed the new
architecture:

- ChatController.fireUserListUpdate() used javafx Platform; core is toolkit-free
  now, so it dispatches through uiDispatcher like every other fire method.
- Two new tests were left in the old src/test/java; moved into core.
- ScoreServiceRefreshTest mocked javafx Platform statically; it now injects the
  DirectUiDispatcher the no-arg constructor installs.

The Leaflet map performance work was dropped with the HTML map it optimised.

classes testClasses and test are green: 1069 tests, 0 failures, 3 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Give the debug-to-file recording a home in the Compose settings

origin/main added a checkbox to the old JavaFX settings that recorded the whole
ON4KST session to file; the Compose redraw dropped the old settings UI, so the
toggle had no control left even though the preference and its wiring survived
the rebase.

It returns to the message-handling tab: the state writes the preference and asks
the application, through a new SettingsHost callback, to open or close the
error-log handler and the history recorder in the order the old checkbox kept.
The explanatory line and its German translation say that passwords are redacted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Fix Codex review findings on PR 89: station row key, map selection, sort after filter

- Station row key now includes the chat category, so the same callsign in two
  categories no longer collides.
- Map marker click and Reset view go through the central station selection.
- Sorting now operates on the filtered rows, so filters stay effective.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Keep the map drawing test off the network and the user's tile cache

The test assumed no tile ever arrives, but it used the default TileFetcher,
which reads the real disk cache and the OSM tile server. On CI a tile now and
then landed before the frame was rendered and covered the background the
'unreachable tile source' test asserts on. An empty temporary cache and a
source that always fails make the assumption hold by construction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

i18n-generator/src/main/kotlin/kst4contest/i18n/GeneratorMain.kt

@@ -0,0 +1,184 @@
+package kst4contest.i18n
+
+import java.io.File
+
+/**
+ * What generation reported.
+ *
+ * @param warnings incomplete translations -- allowed, and the reason a partial contribution
+ *        can be submitted at all
+ * @param coverage one line per language, so a pull request can be judged at a glance
+ */
+data class GenerationResult(val warnings: List<String>, val coverage: List<String>)
+
+/**
+ * English, because the source text lives in the code and AGENTS.md requires it there.
+ *
+ * Deliberately a second declaration: the generated `Translations.BASE_LANGUAGE` says the same
+ * thing on the application's side. They cannot be shared -- this module is build tooling and
+ * is not on the application's classpath -- and the generated source is written from this
+ * constant, so a drift would show up in `GenerationTest`.
+ */
+const val BASE_LANGUAGE: String = "en"
+
+/**
+ * Reads every translation file in a directory and writes the generated Kotlin.
+ *
+ * Incompleteness is allowed, incorrectness is not. A missing key warns and falls back to the
+ * base at runtime; an orphan key, a placeholder mismatch, a duplicate key, an unreadable file
+ * or two keys collapsing to one identifier all throw, which fails the build with this
+ * message.
+ *
+ * Anything in the directory that is not a translation file -- a README for contributors, say
+ * -- is ignored rather than refused: documentation must not break the build.
+ *
+ * @param inputDirectory holds `strings_<code>.properties`
+ * @param outputDirectory receives the generated source and any worksheets
+ * @return the warnings and the coverage lines
+ * @throws TranslationException on anything a contributor has to fix
+ */
+fun generate(inputDirectory: File, outputDirectory: File): GenerationResult {
+
+    val translations = (inputDirectory.listFiles() ?: emptyArray())
+        .filter { languageOf(it.name) != null }
+        .sortedBy { it.name }
+        .map(::readTranslation)
+
+    val base = translations.firstOrNull { it.language == BASE_LANGUAGE }
+        ?: throw TranslationException(
+            "strings_$BASE_LANGUAGE.properties is missing from ${inputDirectory.path}; the base "
+                    + "language is where every key and every argument count comes from"
+        )
+
+    refuseIllegalIdentifiers(base)
+    refuseIdentifierCollisions(base)
+
+    val others = translations.filter { it.language != BASE_LANGUAGE }
+    val warnings = mutableListOf<String>()
+
+    for (translation in others) {
+        refuseOrphans(base, translation)
+        refusePlaceholderMismatches(base, translation)
+
+        val missing = missingKeys(base.entries.keys, translation.entries.keys)
+
+        if (missing.isNotEmpty()) {
+            warnings += "strings_${translation.language}.properties is missing "
+                .plus("${missing.size} of ${base.entries.size} keys; they fall back to ")
+                .plus("$BASE_LANGUAGE: ${missing.sorted().take(10).joinToString(", ")}")
+
+            writeWorksheet(outputDirectory, translation.language, base, missing)
+        }
+    }
+
+    val target = File(outputDirectory, "kst4contest/view/i18n/Strings.kt")
+    target.parentFile.mkdirs()
+    target.writeText(stringsSource(base, others), Charsets.UTF_8)
+
+    return GenerationResult(
+        warnings = warnings,
+        coverage = translations.map { "${it.language}: ${it.entries.size}/${base.entries.size}" },
+    )
+}
+
+private fun refuseIllegalIdentifiers(base: Translation) {
+    val illegal = illegalIdentifierKeys(base.entries.keys)
+
+    if (illegal.isEmpty()) {
+        return
+    }
+
+    throw TranslationException(
+        "strings_$BASE_LANGUAGE.properties has keys that do not form a usable name -- a key is "
+                + "letters and digits with . _ - between words, nothing else. A key carrying "
+                + "anything more would be written into the generated source as code: "
+                + illegal.sorted().joinToString(", ")
+    )
+}
+
+private fun refuseIdentifierCollisions(base: Translation) {
+    val collisions = identifierCollisions(base.entries.keys)
+
+    if (collisions.isEmpty()) {
+        return
+    }
+
+    throw TranslationException(
+        "these keys would become the same Kotlin name: " + collisions.entries.joinToString("; ") {
+            "${it.key} <- ${it.value.sorted().joinToString(", ")}"
+        }
+    )
+}
+
+private fun refuseOrphans(base: Translation, translation: Translation) {
+    val orphans = orphanKeys(base.entries.keys, translation.entries.keys)
+
+    if (orphans.isEmpty()) {
+        return
+    }
+
+    throw TranslationException(
+        "strings_${translation.language}.properties names keys the base does not, so nothing "
+                + "would ever read them -- a typo? " + orphans.sorted().joinToString(", ")
+    )
+}
+
+private fun refusePlaceholderMismatches(base: Translation, translation: Translation) {
+    val mismatched = translation.entries.keys.filter { key ->
+        argumentCount(translation.entries.getValue(key)) != argumentCount(base.entries.getValue(key))
+    }
+
+    if (mismatched.isEmpty()) {
+        return
+    }
+
+    throw TranslationException(
+        "strings_${translation.language}.properties uses different placeholders than the base "
+                + "for: " + mismatched.sorted().joinToString(", ")
+                + ". A placeholder the translation leaves out drops its data silently."
+    )
+}
+
+/**
+ * Writes the keys a translation still lacks, with the base text as the value.
+ *
+ * A worksheet, not a build output: a contributor copies its lines into their own file and
+ * translates the right-hand side. Without it they would have to diff two files of several
+ * hundred lines to find out what is left.
+ *
+ * Only written when something is missing -- an empty worksheet is a file somebody has to open
+ * to learn there is nothing in it.
+ */
+private fun writeWorksheet(
+    outputDirectory: File,
+    language: String,
+    base: Translation,
+    missing: Set<String>,
+) {
+    val file = File(outputDirectory, "todo/strings_$language.todo.properties")
+    file.parentFile.mkdirs()
+
+    val header = "# ${missing.size} of ${base.entries.size} keys are not yet translated into "
+        .plus("$language. Copy these lines into strings_$language.properties and translate the ")
+        .plus("values. Partial is fine: anything left out falls back to $BASE_LANGUAGE.")
+
+    val lines = missing.sorted().joinToString("\n") { key ->
+        "$key=${base.entries.getValue(key)}"
+    }
+
+    file.writeText("$header\n\n$lines\n", Charsets.UTF_8)
+}
+
+/** Called by Gradle: input directory, output directory. */
+object GeneratorMain {
+
+    @JvmStatic
+    fun main(args: Array<String>) {
+        require(args.size == 2) { "usage: GeneratorMain <input dir> <output dir>" }
+
+        val result = generate(File(args[0]), File(args[1]))
+
+        result.warnings.forEach { println("[i18n, warning] $it") }
+        println("[i18n] coverage -- " + result.coverage.joinToString(", "))
+    }
+}

i18n-generator/src/main/kotlin/kst4contest/i18n/StringsSource.kt

@@ -0,0 +1,121 @@
+package kst4contest.i18n
+
+/**
+ * Turns translations into the Kotlin the application compiles against.
+ *
+ * Two things come out: a `Strings` class whose members are one per key -- a property for a
+ * plain text, a function for a parameterised one -- and a `Translations` object holding the
+ * texts. The class is what makes a typo and a wrong argument count compile errors rather than
+ * things an operator discovers.
+ *
+ * @param base the source language; every key and every argument count comes from here
+ * @param translations the other languages, each carrying only the keys it actually has
+ * @return the complete Kotlin source file
+ */
+fun stringsSource(base: Translation, translations: List<Translation>): String {
+
+    val members = base.entries.keys.sorted().joinToString("\n\n") { key ->
+        memberFor(key, base.entries.getValue(key))
+    }
+
+    val tables = (listOf(base) + translations).joinToString("\n\n") { translation ->
+        tableFor(translation, base.entries.size)
+    }
+
+    val byLanguage = (listOf(base) + translations).joinToString(",\n") { translation ->
+        "        ${kotlinLiteral(translation.language)} to ${tableName(translation.language)}"
+    }
+
+    return """
+        |// Generated from app-desktop/src/main/i18n by the :i18n-generator module.
+        |// Do not edit: edit the .properties files and rebuild.
+        |package kst4contest.view.i18n
+        |
+        |import java.text.MessageFormat
+        |
+        |/**
+        | * The interface texts of one language.
+        | *
+        | * One member per key, so a mistyped key and a wrong argument count are both compile
+        | * errors. Generated -- see the module named above.
+        | */
+        |class Strings(private val lookup: (String) -> String) {
+        |
+        |$members
+        |}
+        |
+        |/** The texts themselves, and which language has which. */
+        |object Translations {
+        |
+        |$tables
+        |
+        |    /** Every language this build carries, by its code. */
+        |    val BY_LANGUAGE: Map<String, Map<String, String>> = mapOf(
+        |$byLanguage,
+        |    )
+        |
+        |    /** The language every lookup falls back to. */
+        |    const val BASE_LANGUAGE: String = ${kotlinLiteral(base.language)}
+        |}
+        |
+    """.trimMargin()
+}
+
+/**
+ * A text as a Kotlin string literal.
+ *
+ * The `$` is the one that matters and the one a translator cannot be expected to know about:
+ * in Kotlin it opens a template, so an unescaped one produces source that either does not
+ * compile or means something other than the text. The backslash goes first, or it would
+ * escape the escapes added after it.
+ */
+fun kotlinLiteral(text: String): String {
+    val escaped = text
+        .replace("\\", "\\\\")
+        .replace("\"", "\\\"")
+        .replace("$", "\\$")
+        .replace("\n", "\\n")
+        .replace("\r", "\\r")
+        .replace("\t", "\\t")
+
+    return "\"$escaped\""
+}
+
+/** A property for a plain text, a function for one with placeholders. */
+private fun memberFor(key: String, text: String): String {
+    val identifier = identifierFor(key)
+    val arity = argumentCount(text)
+    val documentation = "    /** ${commentFor(text)} */"
+
+    if (arity == 0) {
+        return "$documentation\n    val $identifier: String get() = lookup(${kotlinLiteral(key)})"
+    }
+
+    val parameters = (0 until arity).joinToString(", ") { "arg$it: Any" }
+    val arguments = (0 until arity).joinToString(", ") { "arg$it" }
+
+    return documentation +
+        "\n    fun $identifier($parameters): String =" +
+        "\n        MessageFormat.format(lookup(${kotlinLiteral(key)}), $arguments)"
+}
+
+private fun tableFor(translation: Translation, baseSize: Int): String {
+    val entries = translation.entries.keys.sorted().joinToString(",\n") { key ->
+        "        ${kotlinLiteral(key)} to ${kotlinLiteral(translation.entries.getValue(key))}"
+    }
+
+    return "    /** ${translation.language}: ${translation.entries.size} of $baseSize. */\n" +
+        "    val ${tableName(translation.language)}: Map<String, String> = mapOf(\n$entries,\n    )"
+}
+
+/** `pt_BR` becomes `PT_BR`; the code is already identifier-safe. */
+private fun tableName(language: String): String = language.uppercase()
+
+/**
+ * The source text as a KDoc line, so a call site shows what it says.
+ *
+ * The comment terminator has to go: a text containing one would end the KDoc early and leave
+ * the rest of the text as stray source.
+ */
+private fun commentFor(text: String): String =
+    text.replace("*/", "* /").replace("\n", " ").take(120)

i18n-generator/src/main/kotlin/kst4contest/i18n/TranslationFiles.kt

@@ -0,0 +1,95 @@
+package kst4contest.i18n
+
+import java.io.File
+import java.util.Properties
+
+/** One language's texts. */
+data class Translation(val language: String, val entries: Map<String, String>)
+
+/** What the generator refuses. The message is read by a contributor, so it names the file. */
+class TranslationException(message: String) : RuntimeException(message)
+
+/**
+ * Reads one translation file.
+ *
+ * `Properties` does the parsing -- separators, comments, escapes, continuation lines -- and is
+ * battle-tested at it. What it does *not* do is complain about a key that appears twice: it
+ * keeps the last one silently. In a file of several hundred lines that is an easy mistake and
+ * an invisible loss, so the keys are counted separately before the values are taken.
+ *
+ * @throws TranslationException when the file cannot be read or names a key twice
+ */
+fun readTranslation(file: File): Translation {
+
+    if (!file.isFile) {
+        throw TranslationException("${file.name}: no such translation file (${file.path})")
+    }
+
+    val duplicates = duplicateKeysIn(file)
+
+    if (duplicates.isNotEmpty()) {
+        throw TranslationException(
+            "${file.name}: these keys appear more than once, so one translation would be "
+                    + "lost without a word: ${duplicates.sorted().joinToString(", ")}"
+        )
+    }
+
+    val properties = Properties()
+    runCatching { file.reader(Charsets.UTF_8).use(properties::load) }
+        .onFailure { throw TranslationException("${file.name}: cannot be read -- ${it.message}") }
+
+    val language = languageOf(file.name)
+        ?: throw TranslationException("${file.name}: the file name does not name a language")
+
+    return Translation(
+        language = language,
+        entries = properties.stringPropertyNames().associateWith { properties.getProperty(it) },
+    )
+}
+
+/**
+ * The language a translation file name names, or null when it names none.
+ *
+ * `strings_de.properties` is German, `strings_pt_BR.properties` is Brazilian Portuguese, and
+ * `strings.properties` is not a translation file at all.
+ */
+fun languageOf(fileName: String): String? =
+    FILE_NAME.matchEntire(fileName)?.groupValues?.get(1)
+
+/**
+ * Keys that appear more than once, found by reading the lines rather than the parsed map --
+ * which is the only place the information still exists.
+ *
+ * Deliberately does not understand continuation lines (a trailing backslash): a continuation
+ * whose text contains a separator would be counted as a key. That is acceptable here because
+ * these texts are one line each, and the alternative is reimplementing `Properties`' parser
+ * to find a mistake `Properties` itself does not report.
+ */
+private fun duplicateKeysIn(file: File): Set<String> {
+    val seen = mutableSetOf<String>()
+    val twice = mutableSetOf<String>()
+
+    file.forEachLine(Charsets.UTF_8) { raw ->
+        val line = raw.trim()
+
+        if (line.isEmpty() || line.startsWith("#") || line.startsWith("!")) {
+            return@forEachLine
+        }
+
+        val separator = line.indexOfFirst { it == '=' || it == ':' }
+
+        if (separator <= 0) {
+            return@forEachLine
+        }
+
+        val key = line.take(separator).trim()
+
+        if (!seen.add(key)) {
+            twice += key
+        }
+    }
+
+    return twice
+}
+
+private val FILE_NAME = Regex("""strings_([A-Za-z]{2}(?:_[A-Za-z]{2})?)\.properties""")

i18n-generator/src/main/kotlin/kst4contest/i18n/TranslationRules.kt

@@ -0,0 +1,82 @@
+package kst4contest.i18n
+
+/**
+ * The rules that decide whether a set of translations is usable.
+ *
+ * Pure functions over key sets and texts, with no file and no Gradle in sight, so the part
+ * that can be quietly wrong is the part that is tested.
+ */
+
+/** Keys the base has and a translation does not. Allowed: they fall back to the base. */
+fun missingKeys(base: Set<String>, other: Set<String>): Set<String> = base - other
+
+/** Keys a translation has and the base does not. Not allowed: a contributor's typo. */
+fun orphanKeys(base: Set<String>, other: Set<String>): Set<String> = other - base
+
+/**
+ * How many arguments a text needs.
+ *
+ * The highest placeholder index plus one, and deliberately not the number of occurrences:
+ * `MessageFormat` addresses arguments by index, so `{1} {1}` needs two and `{0} {0}` needs
+ * one. Counting occurrences makes the first throw and the second swallow an argument.
+ *
+ * A brace followed by anything but a digit is not a placeholder -- braces occur in real
+ * interface text.
+ */
+fun argumentCount(text: String): Int {
+    val indices = PLACEHOLDER.findAll(text).map { it.groupValues[1].toInt() }
+    return (indices.maxOrNull() ?: -1) + 1
+}
+
+/**
+ * The Kotlin identifier for a key.
+ *
+ * `settings.save` becomes `settingsSave`. Dots, underscores and dashes all separate words,
+ * because a contributor will use whichever they are used to and the generated name must not
+ * depend on which.
+ */
+fun identifierFor(key: String): String {
+    val words = key.split('.', '_', '-').filter { it.isNotEmpty() }
+
+    val joined = words.mapIndexed { index, word ->
+        if (index == 0) {
+            word.replaceFirstChar { it.lowercaseChar() }
+        } else {
+            word.replaceFirstChar { it.uppercaseChar() }
+        }
+    }.joinToString("")
+
+    /* A key may start with a digit; a Kotlin identifier may not. */
+    return if (joined.firstOrNull()?.isDigit() == true) "key$joined" else joined
+}
+
+/**
+ * Keys that would produce the same identifier, grouped by that identifier.
+ *
+ * Generating both would emit Kotlin that does not compile, and the compiler's complaint names
+ * the generated file -- which tells a contributor nothing about the line they wrote.
+ */
+fun identifierCollisions(keys: Collection<String>): Map<String, List<String>> =
+    keys.groupBy { identifierFor(it) }.filterValues { it.size > 1 }
+
+/**
+ * Keys whose identifier would not be a legal Kotlin name.
+ *
+ * [identifierFor] strips only `.`, `_` and `-`; every other character a `Properties` file can
+ * carry in a key -- a space, a brace, a quote, a `=`, a newline decoded from a `\uXXXX` escape
+ * -- passes through into identifier position unchanged. Emitted there it does not merely fail
+ * to compile: the member is written as `val <identifier>: String get() = lookup(...)`, so a
+ * key that reads `x: String get() = "" ... init { ... } ... val y` breaks out of the template
+ * and leaves a property initializer or an init block of the contributor's choosing, which
+ * runs when `Strings` is instantiated in the application. The value is already escaped before
+ * it becomes a literal; the identifier was not checked at all. So a generated name that is
+ * not letters-then-letters-and-digits is refused before any source is written.
+ */
+fun illegalIdentifierKeys(keys: Collection<String>): List<String> =
+    keys.filterNot { IDENTIFIER.matches(identifierFor(it)) }
+
+/** A letter, then letters and digits: the plain Kotlin identifier this generator emits. */
+private val IDENTIFIER = Regex("[A-Za-z][A-Za-z0-9]*")
+
+/** `{0}`, `{12}`, `{0,number}` -- a brace, digits, then either a brace or a comma. */
+private val PLACEHOLDER = Regex("""\{(\d+)\s*[,}]""")

i18n-generator/src/test/kotlin/kst4contest/i18n/GenerationTest.kt

@@ -0,0 +1,197 @@
+package kst4contest.i18n
+
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertFalse
+import org.junit.jupiter.api.Assertions.assertThrows
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+import java.io.File
+import java.nio.file.Files
+
+/**
+ * Generation end to end: what breaks the build and what only warns.
+ *
+ * The distinction is the whole arrangement. A translation that is 80 per cent finished has to
+ * be submittable, or nobody outside this project can contribute one; a translation that is
+ * wrong must not ship.
+ */
+class GenerationTest {
+
+    private fun directories(): Pair<File, File> {
+        val input = Files.createTempDirectory("kst4contest-i18n-in").toFile()
+        val output = Files.createTempDirectory("kst4contest-i18n-out").toFile()
+        return input to output
+    }
+
+    private fun write(directory: File, name: String, content: String) {
+        File(directory, name).writeText(content, Charsets.UTF_8)
+    }
+
+    private fun generated(output: File): File =
+        File(output, "kst4contest/view/i18n/Strings.kt")
+
+    @Test
+    fun aCompleteSetGeneratesAndWarnsAboutNothing() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\n")
+        write(input, "strings_de.properties", "a=eins\n")
+
+        val result = generate(input, output)
+
+        assertTrue(result.warnings.isEmpty(), "${result.warnings}")
+        assertTrue(generated(output).isFile, "no source written")
+    }
+
+    @Test
+    fun aMissingKeyOnlyWarnsAndStillGenerates() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\nb=two\n")
+        write(input, "strings_de.properties", "a=eins\n")
+
+        val result = generate(input, output)
+
+        assertEquals(1, result.warnings.size, "${result.warnings}")
+        assertTrue(result.warnings.single().contains("b"), result.warnings.single())
+        assertTrue(generated(output).isFile)
+    }
+
+    @Test
+    fun anOrphanKeyBreaksTheBuildAndNamesItself() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\n")
+        write(input, "strings_de.properties", "a=eins\ntypo=zwei\n")
+
+        val failure = assertThrows(TranslationException::class.java) { generate(input, output) }
+
+        assertTrue(failure.message!!.contains("typo"), failure.message)
+        assertTrue(failure.message!!.contains("strings_de"), failure.message)
+    }
+
+    @Test
+    fun aPlaceholderMismatchBreaksTheBuild() {
+        /*
+         * The one that would otherwise swallow data in silence: the base passes two
+         * arguments, the translation prints one, and MessageFormat says nothing.
+         */
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a={0} of {1}\n")
+        write(input, "strings_de.properties", "a={0}\n")
+
+        val failure = assertThrows(TranslationException::class.java) { generate(input, output) }
+
+        assertTrue(failure.message!!.contains("a"), failure.message)
+    }
+
+    @Test
+    fun anIdentifierCollisionBreaksTheBuild() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "gui.startupDesign=x\ngui.startup_design=y\n")
+
+        val failure = assertThrows(TranslationException::class.java) { generate(input, output) }
+
+        assertTrue(failure.message!!.contains("guiStartupDesign"), failure.message)
+    }
+
+    @Test
+    fun aKeyCarryingKotlinSyntaxBreaksTheBuildRatherThanInjectingCode() {
+        /*
+         * The key, not the value, becomes the member name, and only . _ - are stripped from
+         * it. A \uXXXX escape lets a contributed .properties file carry a key that, dropped
+         * into `val <name>: String get() = ...`, closes the template and opens a property
+         * initializer -- Kotlin that runs when Strings is built in every client. The base
+         * file is the vector: only base keys become members. This must fail the build the way
+         * an orphan or a collision does, not ship.
+         *
+         * The escapes below decode to the key `inject: Int = run{ pwn() }`.
+         */
+        val (input, output) = directories()
+        write(
+            input,
+            "strings_en.properties",
+            "ok=fine\n" +
+                "inject\\u003a\\u0020Int\\u0020\\u003d\\u0020run\\u007b\\u0020pwn()\\u0020\\u007d=value\n",
+        )
+
+        val failure = assertThrows(TranslationException::class.java) { generate(input, output) }
+
+        assertTrue(failure.message!!.contains("inject"), failure.message)
+        assertFalse(generated(output).exists(), "source was written despite an unusable key")
+    }
+
+    @Test
+    fun aMissingBaseFileBreaksTheBuild() {
+        val (input, output) = directories()
+        write(input, "strings_de.properties", "a=eins\n")
+
+        assertThrows(TranslationException::class.java) { generate(input, output) }
+    }
+
+    @Test
+    fun aThirdLanguageIsGeneratedToo() {
+        // Prüfschwerpunkt 6: a contributed language must not need any wiring.
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\nb=two\n")
+        write(input, "strings_de.properties", "a=eins\nb=zwei\n")
+        write(input, "strings_fr.properties", "a=un\n")
+
+        val result = generate(input, output)
+
+        assertTrue(generated(output).readText().contains("\"a\" to \"un\""))
+        assertTrue(result.coverage.any { it.startsWith("fr:") && it.contains("1/2") }, "${result.coverage}")
+    }
+
+    @Test
+    fun theCoverageLineNamesEveryLanguage() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\nb=two\n")
+        write(input, "strings_de.properties", "a=eins\nb=zwei\n")
+
+        val result = generate(input, output)
+
+        assertTrue(result.coverage.any { it.startsWith("de:") && it.contains("2/2") }, "${result.coverage}")
+    }
+
+    @Test
+    fun anIncompleteTranslationGetsAWorksheetWithTheEnglishTextToTranslate() {
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\nb=two\n")
+        write(input, "strings_de.properties", "a=eins\n")
+
+        generate(input, output)
+
+        val worksheet = File(output, "todo/strings_de.todo.properties")
+        assertTrue(worksheet.isFile, "no worksheet was written")
+
+        val content = worksheet.readText()
+        assertTrue(content.contains("b=two"), content)
+        assertFalse(content.lines().any { it.startsWith("a=") }, "an already translated key was listed")
+    }
+
+    @Test
+    fun aCompleteTranslationGetsNoWorksheet() {
+        // An empty worksheet is a file somebody has to open to learn there is nothing to do.
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\n")
+        write(input, "strings_de.properties", "a=eins\n")
+
+        generate(input, output)
+
+        assertFalse(File(output, "todo/strings_de.todo.properties").exists())
+    }
+
+    @Test
+    fun aFileThatIsNotATranslationIsIgnoredRatherThanRefused() {
+        /*
+         * The input directory may hold a README telling a contributor what to do. Refusing it
+         * would make the documentation break the build.
+         */
+        val (input, output) = directories()
+        write(input, "strings_en.properties", "a=one\n")
+        write(input, "README.md", "# how to contribute a language\n")
+
+        val result = generate(input, output)
+
+        assertTrue(result.warnings.isEmpty(), "${result.warnings}")
+        assertTrue(generated(output).isFile)
+    }
+}

i18n-generator/src/test/kotlin/kst4contest/i18n/StringsSourceTest.kt

@@ -0,0 +1,126 @@
+package kst4contest.i18n
+
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertFalse
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+
+/**
+ * Turning translations into Kotlin.
+ *
+ * The dangerous part is the escaping. This writes Kotlin source, and in Kotlin `$` opens a
+ * template: a translation containing one produces either source that does not compile or --
+ * worse -- source that means something else. A translator has no reason to know that.
+ */
+class StringsSourceTest {
+
+    private fun base(vararg pairs: Pair<String, String>) = Translation("en", mapOf(*pairs))
+
+    @Test
+    fun aPlainKeyBecomesAProperty() {
+        val source = stringsSource(base("settings.save" to "Save settings"), emptyList())
+
+        assertTrue(
+            source.contains("val settingsSave: String get() = lookup(\"settings.save\")"),
+            source,
+        )
+    }
+
+    @Test
+    fun aKeyWithAPlaceholderBecomesAFunctionWithThatManyArguments() {
+        val source = stringsSource(base("c.to" to "Connect to {0}"), emptyList())
+
+        assertTrue(source.contains("fun cTo(arg0: Any)"), source)
+        assertFalse(source.contains("val cTo"), "a parameterised key became a property")
+    }
+
+    @Test
+    fun theArityFollowsTheHighestIndexAndNotTheOccurrences() {
+        val source = stringsSource(base("x" to "{1} {1}"), emptyList())
+
+        assertTrue(source.contains("fun x(arg0: Any, arg1: Any)"), source)
+    }
+
+    @Test
+    fun theBaseTextsAreEmittedAsAMap() {
+        val source = stringsSource(base("a" to "one"), emptyList())
+
+        assertTrue(source.contains("\"a\" to \"one\""), source)
+    }
+
+    @Test
+    fun aTranslationIsEmittedWithOnlyTheKeysItHas() {
+        /*
+         * Incompleteness is allowed, so a translation carries only its own keys and the
+         * lookup falls through to the base. Padding it with English would make a missing
+         * translation indistinguishable from a deliberate English term.
+         */
+        val source = stringsSource(
+            base("a" to "one", "b" to "two"),
+            listOf(Translation("de", mapOf("a" to "eins"))),
+        )
+
+        assertTrue(source.contains("\"a\" to \"eins\""), source)
+        assertFalse(source.contains("\"b\" to \"zwei\""), "de gained a key it does not have")
+
+        // b belongs to the base table and to nothing else.
+        assertEquals(1, source.split("\"b\" to ").size - 1, "b appears more than once")
+    }
+
+    // ------------------------------------------------------------------ escaping
+
+    @Test
+    fun aDollarSignIsEscapedBecauseKotlinWouldReadItAsATemplate() {
+        assertEquals("\"5 \\\$ only\"", kotlinLiteral("5 \$ only"))
+    }
+
+    @Test
+    fun quotesAndBackslashesAreEscaped() {
+        assertEquals("\"say \\\"hi\\\"\"", kotlinLiteral("say \"hi\""))
+        assertEquals("\"a\\\\b\"", kotlinLiteral("a\\b"))
+    }
+
+    @Test
+    fun newlinesAndTabsBecomeEscapesRatherThanBreakingTheLiteral() {
+        assertEquals("\"a\\nb\"", kotlinLiteral("a\nb"))
+        assertEquals("\"a\\tb\"", kotlinLiteral("a\tb"))
+    }
+
+    @Test
+    fun anUmlautStaysItselfBecauseTheGeneratedFileIsUtf8() {
+        assertEquals("\"Grüße\"", kotlinLiteral("Grüße"))
+    }
+
+    @Test
+    fun aTranslationFullOfHazardsSurvivesIntoTheSource() {
+        // The end-to-end version of the escaping tests above.
+        val source = stringsSource(base("x" to "a \$b \"c\" d\\e"), emptyList())
+
+        assertTrue(source.contains("\\\$b"), source)
+        assertTrue(source.contains("\\\"c\\\""), source)
+        assertTrue(source.contains("d\\\\e"), source)
+    }
+
+    @Test
+    fun aTextContainingACommentEndDoesNotBreakTheKdoc() {
+        /*
+         * The texts are echoed into a KDoc line so the call site shows what they say. A text
+         * containing the comment terminator would end the comment early and leave the rest as
+         * stray source.
+         */
+        val source = stringsSource(base("x" to "ends a comment */ here"), emptyList())
+
+        /*
+         * The KDoc line only. Inside the string literal in the table below, a comment
+         * terminator is ordinary text and perfectly valid Kotlin -- asserting over the whole
+         * file would be asserting that a harmless thing does not happen.
+         *
+         * Writing this comment is itself the demonstration: the first version quoted the
+         * terminator and ended this comment three lines early.
+         */
+        val kdoc = source.lines().single { it.trimStart().startsWith("/** ends a comment") }
+
+        assertTrue(kdoc.trimEnd().endsWith("*/"), kdoc)
+        assertEquals(1, kdoc.split("*/").size - 1, "the KDoc line terminates twice: $kdoc")
+    }
+}

i18n-generator/src/test/kotlin/kst4contest/i18n/TranslationFilesTest.kt

@@ -0,0 +1,105 @@
+package kst4contest.i18n
+
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertNull
+import org.junit.jupiter.api.Assertions.assertThrows
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+import java.io.File
+
+/**
+ * Reading a translation file.
+ *
+ * The one rule with teeth: `java.util.Properties` keeps the last of two identical keys
+ * without a word. A contributor who translates a key twice -- easy in a file of several
+ * hundred lines -- would otherwise lose one of their translations and never find out.
+ */
+class TranslationFilesTest {
+
+    private fun createTempDirectory(): File =
+        java.nio.file.Files.createTempDirectory("kst4contest-i18n").toFile()
+
+    private fun fileWith(name: String, content: String): File {
+        val file = File(createTempDirectory(), name)
+        file.writeText(content, Charsets.UTF_8)
+        return file
+    }
+
+    @Test
+    fun aPlainFileIsReadKeyByKey() {
+        val file = fileWith("strings_en.properties", "settings.save=Save settings\nmenu.file=File\n")
+
+        val translation = readTranslation(file)
+
+        assertEquals("en", translation.language)
+        assertEquals("Save settings", translation.entries["settings.save"])
+        assertEquals("File", translation.entries["menu.file"])
+    }
+
+    @Test
+    fun umlautsSurviveBecauseTheFileIsUtf8() {
+        // Java 9 and later read .properties as UTF-8, which is why no escapes are needed.
+        val file = fileWith("strings_de.properties", "settings.save=Einstellungen speichern\nx=Grüße\n")
+
+        assertEquals("Grüße", readTranslation(file).entries["x"])
+    }
+
+    @Test
+    fun aDuplicateKeyIsRefusedRatherThanSilentlyWinning() {
+        /*
+         * Properties would keep the second and say nothing. For a contributor that means one
+         * of their two translations vanishes with a green build.
+         */
+        val file = fileWith("strings_de.properties", "a=erste\nb=zwei\na=zweite\n")
+
+        val failure = assertThrows(TranslationException::class.java) { readTranslation(file) }
+
+        assertTrue(failure.message!!.contains("a"), failure.message)
+        assertTrue(failure.message!!.contains("strings_de.properties"), failure.message)
+    }
+
+    @Test
+    fun aDuplicateKeyIsStillFoundWhenTheLinesAreNotAdjacentOrAreSpaced() {
+        val file = fileWith("strings_de.properties", "a = eins\nb=zwei\n a=drei\n")
+
+        assertThrows(TranslationException::class.java) { readTranslation(file) }
+    }
+
+    @Test
+    fun commentsAndBlankLinesAreNotKeys() {
+        val file = fileWith("strings_en.properties", "# a comment\n! another\n\na=one\n")
+
+        assertEquals(mapOf("a" to "one"), readTranslation(file).entries)
+    }
+
+    @Test
+    fun aValueMayContainAnEqualsSign() {
+        // Only the first separator splits; the rest is text. Operators do write "a=b".
+        val file = fileWith("strings_en.properties", "formula=a=b\n")
+
+        assertEquals("a=b", readTranslation(file).entries["formula"])
+    }
+
+    @Test
+    fun aMissingFileIsRefusedWithItsName() {
+        val absent = File("/nonexistent/kst4contest/strings_de.properties")
+
+        val failure = assertThrows(TranslationException::class.java) { readTranslation(absent) }
+
+        assertTrue(failure.message!!.contains("strings_de.properties"), failure.message)
+    }
+
+    @Test
+    fun theLanguageComesFromTheFileName() {
+        assertEquals("en", languageOf("strings_en.properties"))
+        assertEquals("de", languageOf("strings_de.properties"))
+        assertEquals("pt_BR", languageOf("strings_pt_BR.properties"))
+    }
+
+    @Test
+    fun aFileNameThatIsNotATranslationNamesNoLanguage() {
+        assertNull(languageOf("strings.properties"))
+        assertNull(languageOf("gradle.properties"))
+        assertNull(languageOf("strings_de.txt"))
+    }
+}

i18n-generator/src/test/kotlin/kst4contest/i18n/TranslationRulesTest.kt

@@ -0,0 +1,134 @@
+package kst4contest.i18n
+
+import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+
+/**
+ * The rules that decide whether a set of translations is usable.
+ *
+ * Pure functions, and therefore the part that can be wrong without anyone noticing: a build
+ * break that never breaks looks exactly like a clean project. Every rule here has a failure
+ * that reaches an operator -- a lost translation, a swallowed argument, or Kotlin that does
+ * not compile with a message a contributor cannot read.
+ */
+class TranslationRulesTest {
+
+    @Test
+    fun whatTheBaseHasAndATranslationLacksIsMissing() {
+        assertEquals(
+            setOf("b"),
+            missingKeys(base = setOf("a", "b"), other = setOf("a")),
+        )
+    }
+
+    @Test
+    fun whatATranslationHasAndTheBaseLacksIsAnOrphan() {
+        // A contributor's typo. Silently keeping it would mean a translation nothing uses.
+        assertEquals(
+            setOf("typo"),
+            orphanKeys(base = setOf("a"), other = setOf("a", "typo")),
+        )
+    }
+
+    @Test
+    fun aTextWithoutPlaceholdersNeedsNoArguments() {
+        assertEquals(0, argumentCount("Save settings"))
+        assertEquals(0, argumentCount(""))
+    }
+
+    @Test
+    fun theArgumentCountIsTheHighestIndexPlusOneAndNotTheNumberOfOccurrences() {
+        /*
+         * The trap. "{1} {1}" occurs twice and needs two arguments, because MessageFormat
+         * addresses them by index; "{0} {0}" occurs twice and needs one. Counting occurrences
+         * makes the first case throw and the second swallow an argument.
+         */
+        assertEquals(1, argumentCount("Connect to {0}"))
+        assertEquals(1, argumentCount("{0} and {0} again"))
+        assertEquals(2, argumentCount("{1} {1}"))
+        assertEquals(3, argumentCount("{2} {0}"))
+    }
+
+    @Test
+    fun aFormattedPlaceholderStillCounts() {
+        // MessageFormat allows {0,number} and {1,date,short}; both are arguments.
+        assertEquals(1, argumentCount("Seen {0,number} times"))
+        assertEquals(2, argumentCount("{0} at {1,date,short}"))
+    }
+
+    @Test
+    fun somethingThatMerelyLooksLikeAPlaceholderIsNotOne() {
+        // Braces appear in real text. Only a leading digit makes it an argument.
+        assertEquals(0, argumentCount("Press {Ctrl} to stop"))
+        assertEquals(0, argumentCount("100 {}"))
+    }
+
+    @Test
+    fun aDottedKeyBecomesALowerCamelCaseIdentifier() {
+        assertEquals("settingsSave", identifierFor("settings.save"))
+        assertEquals("menuFile", identifierFor("menu.file"))
+        assertEquals("guiBandColumnHints", identifierFor("gui.bandColumnHints"))
+    }
+
+    @Test
+    fun aKeyWithUnderscoresOrDashesBecomesOneIdentifierToo() {
+        assertEquals("guiStartupDesign", identifierFor("gui.startup_design"))
+        assertEquals("guiStartupDesign", identifierFor("gui.startup-design"))
+    }
+
+    @Test
+    fun anIdentifierNeverStartsWithADigit() {
+        // A key may legitimately start with a number; a Kotlin identifier may not.
+        assertTrue(identifierFor("2.metres").first().isLetter())
+    }
+
+    @Test
+    fun twoKeysCollapsingToOneIdentifierAreReported() {
+        /*
+         * gui.startupDesign and gui.startup_design both become guiStartupDesign. Generating
+         * both would produce Kotlin that does not compile, and the compiler's message names
+         * the generated file -- which tells a contributor nothing about their properties file.
+         */
+        val collisions = identifierCollisions(listOf("gui.startupDesign", "gui.startup_design"))
+
+        assertEquals(1, collisions.size)
+        assertEquals(
+            listOf("gui.startupDesign", "gui.startup_design"),
+            collisions.getValue("guiStartupDesign").sorted(),
+        )
+    }
+
+    @Test
+    fun distinctKeysReportNoCollision() {
+        assertTrue(identifierCollisions(listOf("a.b", "c.d")).isEmpty())
+    }
+
+    @Test
+    fun aKeyThatWouldNotFormALegalIdentifierIsRejected() {
+        /*
+         * identifierFor strips only . _ -, so every other character a Properties file can
+         * carry in a key -- a space, a brace, a quote, a newline decoded from a \uXXXX escape
+         * -- would reach identifier position verbatim. Emitted there it does not merely fail
+         * to compile: it breaks out of `val <name>: String get() = ...` into whatever the key
+         * says, which is Kotlin that then runs. So the generated name is held to the shape of
+         * an identifier before it is ever written.
+         */
+        val illegal = illegalIdentifierKeys(
+            listOf("settings.save", "a b", "x\": String get() = \"\"", "init { pwn() }\n    val")
+        )
+
+        assertEquals(
+            listOf("a b", "init { pwn() }\n    val", "x\": String get() = \"\""),
+            illegal.sorted(),
+        )
+    }
+
+    @Test
+    fun ordinaryKeysFormLegalIdentifiersAndAreNotRejected() {
+        // A digit-leading key is fine: identifierFor prefixes it, which is a letter again.
+        assertTrue(
+            illegalIdentifierKeys(listOf("settings.save", "gui.startup_design", "2.metres")).isEmpty()
+        )
+    }
+}