Release each Android build to closed testing testers instead of leaving a draft

.github/workflows/android.yml

@@ -149,10 +149,12 @@ jobs:
           name=$(grep -m1 'versionName = ' app/build.gradle.kts | sed 's/.*versionName = "\(.*\)".*/\1/')
           echo "name=${PUSHTHAT_VERSION_CODE} (${name})" >> "$GITHUB_OUTPUT"
 
-      # `status: draft` stops short of releasing to testers: the bundle appears in the track
-      # and Play runs its checks, but a person still presses the button. That is the right
-      # default for something every push to `main` triggers. Change it to `completed` to
-      # have testers get the build without anyone asking.
+      # `status: completed` rolls the release out to the track's testers as soon as Play's
+      # checks pass, so a merge reaches their phones without anyone opening Play Console.
+      # It started as `draft`, which left every build waiting for a person to press the
+      # button, and closed testing is for getting each build onto testers' phones.
+      # Production is still promoted by hand in Play Console; nothing here can reach it,
+      # because the only track named is `alpha`.
       #
       # `alpha` is the API's name for the default closed testing track: "closed" is not a
       # track name, and a custom closed track is referenced by the name it was given in Play
@@ -166,7 +168,7 @@ jobs:
           packageName: com.makerocketgonow.pushthat
           releaseFiles: apps/android/app/build/outputs/bundle/release/*.aab
           tracks: alpha
-          status: draft
+          status: completed
           releaseName: ${{ steps.release_name.outputs.name }}
           # Written by hand in `apps/android/store/whatsnew/`, not generated from commit
           # subjects: those are addressed to whoever changes the code next, and a tester

AGENTS.md

@@ -120,7 +120,7 @@ functions' suites deliver signed events to the webhook over HTTP and point
 CI (`.github/workflows/ci.yml`) runs the functions' unit tests, the web app's lint, key
 vectors and builds, the Android unit tests and the encryption reference's tests on every
 pull request. `.github/workflows/android.yml` builds the Android release bundle, and on
-`main` uploads it to Play as a draft ([docs/android.md](docs/android.md#shipping-to-play)).
+`main` releases it to Play's closed testing track ([docs/android.md](docs/android.md#shipping-to-play)).
 The emulator suites run only in the deploy that follows a merge, and the Xcode builds not
 at all, so run them yourself when a change reaches the rules, the functions or the Apple
 apps: by the time CI runs them, the change is on `main`.

docs/android.md

@@ -54,9 +54,10 @@ Each value can also come from the environment, which is how CI signs:
 ## Shipping to Play
 
 A push to `main` that touches `apps/android/` builds a signed bundle and uploads it to the
-closed testing track as a **draft** (`.github/workflows/android.yml`): it appears in Play
-Console and passes Play's checks, but nobody receives it until a person promotes it. Making
-testers get it automatically is a one-word change (`status: completed`). Run the workflow
+closed testing track and rolls it out to that track's testers (`.github/workflows/android.yml`,
+`status: completed`): once Play's checks pass, testers get it without anyone opening Play
+Console. Production is not touched; promoting a build there stays a manual release in Play
+Console. Run the workflow
 from the Actions tab on `main` to cut a build without a push. Pull requests and other
 branches run only the `build` job: the tests and an unsigned bundle, which proves the
 release path compiles, with no secrets and nothing published.