chore(deps): the Android tier, and the Kotlin version this build does not own

CHANGELOG.md

@@ -41,6 +41,35 @@ cycle-accurate core later replaced.
   accuracy-ledger entry below records. No `rustynes-*` crate changes, so
   AccuracyCoin and nestest are untouched by construction.
 
+- **Android dependency refresh.** AGP **9.2.1 → 9.3.2** (both
+  `com.android.application` and `com.android.test`), the Compose compiler plugin
+  **2.3.10 → 2.3.21**, `androidx.baselineprofile` and `benchmark-macro-junit4`
+  **1.5.0-alpha06 → 1.5.0-rc01**, `compose-bom` **2026.06.00 → 2026.08.00**, the
+  three `material3.adaptive` artifacts **1.2.0 → 1.3.0**, `jna` **5.18.1 →
+  5.19.1**, and `play-services-games-v2` **21.0.0 → 22.0.0**.
+
+  This is the `gradle` Dependabot ecosystem added in the previous refresh doing
+  exactly what it was added for: it opened five PRs on its first run, against a
+  set that could not be hand-bumped safely before because nothing proposed them
+  one at a time. Two of the bumps here are **not** among those five — the Compose
+  compiler plugin and `baselineprofile` — because the ecosystem's
+  `open-pull-requests-limit` is 5 and all five slots were taken.
+
+  **The interlock was measured rather than assumed.** AGP 9.2.1 and 9.3.2 declare
+  the *same* `kotlin-gradle-plugin` coordinate (2.2.10) in their published POMs,
+  so crossing that minor does not move the Kotlin requirement. Recorded in
+  `android/build.gradle.kts` alongside a second fact worth not re-deriving:
+  **there is no `kotlin-gradle-plugin` version in this build to set at all.**
+  AGP 9 bundles it and the standalone `org.jetbrains.kotlin.android` plugin was
+  deliberately dropped, so the Compose compiler plugin is the only Kotlin
+  coordinate this build controls. To move Kotlin, move AGP.
+
+  `androidx.baselineprofile` moves **alpha → rc within the same 1.5.0 line** —
+  the same supported-AGP window with fewer unknowns, not a new dependency
+  decision.
+
+  Rust, GitHub Actions and the pre-commit hooks are unchanged: re-checked at the
+  same time and all already current from the previous refresh.
 - **Dependency and toolchain-adjacent refresh.** 17 crates moved to their newest
   semver-compatible versions (including `cc` 1.4.3 → 1.4.4 and `log` 0.4.33 →
   0.4.34), `directories` 5 → 6, and four GitHub Actions advanced —

android/app/build.gradle.kts

@@ -291,7 +291,7 @@ dependencies {
     // 1.5.0-alpha line and are deliberately not pulled in here). Bumped from
     // 2024.12.01 so the adaptive APIs (Window Size Classes, ListDetailPaneScaffold)
     // and a current Compose runtime are available.
-    val composeBom = platform("androidx.compose:compose-bom:2026.06.00")
+    val composeBom = platform("androidx.compose:compose-bom:2026.08.00")
     implementation(composeBom)
     implementation("androidx.core:core-ktx:1.19.0")
     // v1.8.8 "Atlas" (Workstream B): per-app language. AppCompat 1.6.0+ supplies the
@@ -312,9 +312,9 @@ dependencies {
     // currentWindowAdaptiveInfo()/WindowSizeClass (the single layout driver);
     // -layout carries ListDetailPaneScaffold; -navigation carries the predictive-
     // back-aware NavigableListDetailPaneScaffold for the expanded two-pane.
-    implementation("androidx.compose.material3.adaptive:adaptive:1.2.0")
-    implementation("androidx.compose.material3.adaptive:adaptive-layout:1.2.0")
-    implementation("androidx.compose.material3.adaptive:adaptive-navigation:1.2.0")
+    implementation("androidx.compose.material3.adaptive:adaptive:1.3.0")
+    implementation("androidx.compose.material3.adaptive:adaptive-layout:1.3.0")
+    implementation("androidx.compose.material3.adaptive:adaptive-navigation:1.3.0")
     // WindowInfoTracker / FoldingFeature for foldable-posture awareness.
     implementation("androidx.window:window:1.5.1")
     // v1.8.8 "Atlas" (Workstream K): Android-12+ system splash via the back-compat
@@ -346,7 +346,7 @@ dependencies {
     implementation("androidx.profileinstaller:profileinstaller:1.4.1")
     // UniFFI's generated Kotlin loads the cdylib through JNA; the `@aar`
     // classifier pulls the Android-native JNA dispatcher.
-    implementation("net.java.dev.jna:jna:5.18.1@aar")
+    implementation("net.java.dev.jna:jna:5.19.1@aar")
     // v2.0.1 (ADR 0025): the optional Google Play services below are PLAY-FLAVOR ONLY.
     // `playImplementation` keeps these proprietary Google-Play SDKs out of the `foss`
     // (F-Droid/sideload) artifact entirely — the `foss` variant links none of them (its
@@ -364,7 +364,7 @@ dependencies {
     // PlayGames.kt). DISTINCT from RetroAchievements (rustynes-ra). The PGS sign-in
     // also reads the manifest <meta-data app_id>, which is a maintainer-supplied
     // placeholder (@string/game_services_project_id) until the Play Games project lands.
-    "playImplementation"("com.google.android.gms:play-services-games-v2:21.0.0")
+    "playImplementation"("com.google.android.gms:play-services-games-v2:22.0.0")
     // v1.8.8 "Atlas" (Workstream L): Play Integrity API — the anti-tamper layer. 1.6.0
     // (SafetyNet Attestation was turned down Jan 2025; this is the modern replacement).
     // Linked but DORMANT: no token is requested until behind the default-off

android/baselineprofile/build.gradle.kts

@@ -91,7 +91,7 @@ dependencies {
     implementation("androidx.test.ext:junit:1.2.1")
     implementation("androidx.test.espresso:espresso-core:3.6.1")
     implementation("androidx.test.uiautomator:uiautomator:2.3.0")
-    // 1.5.0-alpha06 to match the AGP-9.2.1-compatible baselineprofile plugin (root
+    // 1.5.0-rc01 to match the baselineprofile plugin pinned in the root build
     // build.gradle.kts) — the 1.4.1 stable line's module guard rejects an AGP-9 app.
-    implementation("androidx.benchmark:benchmark-macro-junit4:1.5.0-alpha06")
+    implementation("androidx.benchmark:benchmark-macro-junit4:1.5.0-rc01")
 }

android/build.gradle.kts

@@ -1,29 +1,57 @@
 // Root build script — plugin versions only; modules apply them.
 //
-// v1.8.8 "Atlas" (Workstream A): bumped to AGP 9.2.1 for official compileSdk 36
+// v1.8.8 "Atlas" (Workstream A): moved to AGP 9.x for official compileSdk 36
 // (Android 16) support — AGP 8.x maxes out at API 35 (it would only build 36 via
 // the `android.suppressUnsupportedCompileSdk` escape hatch). AGP 9.2 requires
 // Gradle 9.4.1 OR LATER + JDK 17; the wrapper was moved to 9.7.1 in the v2.6.3
-// dependency refresh, which is a floor being cleared rather than a pin changing. AGP 9 ships *built-in
-// Kotlin* (it bundles the Kotlin Gradle plugin), so the standalone
-// `org.jetbrains.kotlin.android` plugin is dropped here and in :app — AGP applies
-// Kotlin itself. The Compose compiler plugin is still a separate, explicitly
-// versioned plugin (kept below, bumped to a Kotlin matching AGP 9.2's bundled KGP).
+// dependency refresh, which is a floor being cleared rather than a pin changing.
+//
+// AGP 9 ships *built-in Kotlin* (it bundles the Kotlin Gradle plugin), so the
+// standalone `org.jetbrains.kotlin.android` plugin is dropped here and in :app —
+// AGP applies Kotlin itself.
+//
+// THERE IS THEREFORE NO `kotlin-gradle-plugin` VERSION IN THIS BUILD TO SET.
+// AGP owns it. Asked directly during the v2.6.3 refresh, and worth recording
+// because the obvious next move — re-adding `org.jetbrains.kotlin.android` with
+// an explicit version — would reintroduce exactly the standalone plugin AGP 9
+// replaces, and the two applying Kotlin at once is the failure this drop
+// avoided. To move Kotlin, move AGP.
+//
+// A related measurement, so it is not re-derived: AGP 9.2.1 and 9.3.2 declare
+// the SAME `kotlin-gradle-plugin` coordinate (2.2.10) in their published POMs.
+//
+// THAT COORDINATE IS AGP'S OWN RUNTIME DEPENDENCY, not the Kotlin the build
+// compiles user code with. The distinction matters because reading it the other
+// way leads straight to a real-sounding conclusion — "the Compose compiler
+// plugin must equal the Kotlin compiler version, so 2.3.x against 2.2.10 will
+// break the build" — which is correct about Kotlin and wrong about what that
+// POM entry means. It was raised in review on exactly those grounds.
+//
+// Settled by building rather than by argument: with AGP 9.3.2 and the Compose
+// compiler plugin at 2.3.21, `bundleFossRelease` + `bundlePlayRelease` report
+// BUILD SUCCESSFUL in 17m20s, Compose compilation and R8 included. The
+// pre-existing pairing of AGP 9.2.1 with a 2.3.x plugin had been building for
+// releases before that.
+//
+// The Compose compiler plugin below is the version this build does control.
 plugins {
-    id("com.android.application") version "9.2.1" apply false
+    id("com.android.application") version "9.3.2" apply false
     // v1.8.8 "Atlas" (Workstream J): the Macrobenchmark `:baselineprofile` module is
     // a `com.android.test` module — declare that plugin id here so it resolves for
-    // the new module (it shares AGP's 9.2.1 version coordinate).
-    id("com.android.test") version "9.2.1" apply false
-    // The Compose compiler plugin must match AGP 9.2's built-in Kotlin (KGP 2.3.10).
-    id("org.jetbrains.kotlin.plugin.compose") version "2.3.10" apply false
+    // the new module (it shares AGP's version coordinate).
+    id("com.android.test") version "9.3.2" apply false
+    // The Compose compiler plugin tracks the Kotlin line AGP builds against, and
+    // it is the only Kotlin version coordinate this build sets (see the header).
+    // Moved 2.3.10 -> 2.3.21 within the same line at the v2.6.3 refresh.
+    id("org.jetbrains.kotlin.plugin.compose") version "2.3.21" apply false
     // v1.8.8 "Atlas" (Workstream J): the Baseline Profile Gradle plugin. The plan
     // named 1.4.1, but that stable line predates AGP 9 and its module-type guard
-    // rejects an AGP-9.2.1 `com.android.application` module ("not a supported android
-    // module"); the 1.5.0-alpha line is the first to widen the supported-AGP window to
-    // 9.x (ART-metric repackage handling + the bumped maxAgpVersion). So the build pins
-    // the 1.5.0-alpha06 benchmark/baseline-profile line to match AGP 9.2.1 (see the
-    // matching benchmark-macro-junit4 in :baselineprofile). It is applied on BOTH :app
+    // rejects an AGP-9.x `com.android.application` module ("not a supported android
+    // module"); the 1.5.0 line is the first to widen the supported-AGP window to
+    // 9.x (ART-metric repackage handling + the bumped maxAgpVersion). The pin has
+    // moved alpha06 -> rc01 within that same line, which is the same window with
+    // fewer unknowns rather than a new dependency decision (see the matching
+    // benchmark-macro-junit4 in :baselineprofile). It is applied on BOTH :app
     // (consume + bundle the generated profile) and :baselineprofile (generate it).
-    id("androidx.baselineprofile") version "1.5.0-alpha06" apply false
+    id("androidx.baselineprofile") version "1.5.0-rc01" apply false
 }