chore: stop naming client projects in a public repository

Nav3Navigation/README.md

@@ -660,4 +660,4 @@ Two traps that produce false failures:
 - **Use `am kill`, never `force-stop`.** `force-stop` discards saved instance state, so it proves
   nothing about restore.
 
-Thanks to the Accelerate Android team for the cold-restore verification and both traps above.
+Thanks to the consuming-app team who ran the cold-restore verification and found both traps above.

app/src/main/java/uk/co/appoly/droid/network/TestBackendApis.kt

@@ -57,7 +57,7 @@ import uk.co.appoly.droid.data.remote.BaseService
  * ```json
  * {
  *   "email": "user@example.com",
- *   "password": "secret123"
+ *   "password": "<password>"
  * }
  * ```
  *
@@ -83,9 +83,13 @@ import uk.co.appoly.droid.data.remote.BaseService
  * ```
  *
  * ## Test Credentials
- * The test server accepts these credentials:
- * - Email: `bradley@appoly.co.uk`
- * - Password: `secret123`
+ * None are published here. The backend this demo was written against
+ * (a throwaway server used while building the multipart uploader) has been decommissioned, and
+ * real credentials do not belong in a public repository regardless — an email and password
+ * committed together are what credential-stuffing lists are built from.
+ *
+ * To exercise this against a live backend, point [TestBackendRetrofitClient.BASE_URL] at your own
+ * server and supply your own account.
  *
  * @see LoginRequest
  * @see LoginResponse

app/src/main/java/uk/co/appoly/droid/network/TestBackendRetrofitClient.kt

@@ -75,6 +75,11 @@ class TestBackendRetrofitClient(
          * This server provides:
          * - `/api/login` - Authentication endpoint
          * - `/api/s3/multipart/x` - Multipart upload endpoints
+         *
+         * **This host is no longer running.** It was a throwaway backend stood up while building
+         * the multipart uploader and has since been decommissioned, so the network-backed parts of
+         * this demo will fail until you point this at a server of your own implementing the two
+         * endpoint groups above. The rest of the demo app does not depend on it.
          */
         const val BASE_URL = "https://multipart-uploader.on-forge.com/"
 

publishing-check/build.gradle.kts

@@ -12,10 +12,10 @@ import org.gradle.api.attributes.java.TargetJvmEnvironment
 //
 // The 1.8.2 duplicate-class regression was invisible to the toolbox's own build: the library
 // compiled and published perfectly, and only an Android *consumer* resolving the published metadata
-// could see the problem. It was also invisible to most consumers — WenWe was green on identical
-// artifacts because it does not depend on MockInterceptor, and AssistantHood's `live` flavour built
-// fine because it only pulls MockInterceptor into `staging`. A defect visible only to consumers who
-// happen to pull one particular module should not be discovered by consumers.
+// could see the problem. It was also invisible to most consumers — one was green on identical
+// artifacts because it does not depend on MockInterceptor, and another's release flavour built fine
+// because it only pulls MockInterceptor into a debug-side flavour. A defect visible only to
+// consumers who happen to pull one particular module should not be discovered by consumers.
 //
 // So: resolve the published modules the way an Android app would, and assert the outcome.
 //