@@ -56,8 +56,9 @@ For each changed first-party file, check the applicable rules. Each rule cites i
 | 9 | **Dependency substitution:** don't add a Maven coordinate for something already vendored/substituted (`build-deps*`); don't add a new dependency without checking `gradle/libs.versions.toml` first. | ADR 0003 |
 | 10 | **Strings** live in the `:resources` module's `strings.xml` (not per-module, not inline literals). | REVIEW.md §7 |
 | 11 | **UI never drawn over the two system bars** (top status bar, bottom navigation bar). | CLAUDE.md |
+| 12 | **Text scales:** new/changed screens verified at font scale 1.0 and 2.0 — `sp` for text and `dp` for spacing (no `sp` dimen used as margin/padding), no text boxed in a fixed `dp` size, a scroll container on content that can grow, and `maxLines`/`singleLine`/`ellipsize` only on genuinely disposable text. | CLAUDE.md, REVIEW.md §8 |
 
-Rules 1, 2, 6 apply to UI changes; 4, 5 to data/model changes; 8, 9 to Gradle changes. Judge by what the diff touches — don't flag rules a file doesn't engage.
+Rules 1, 2, 6, 10, 11, 12 apply to UI changes; 4, 5 to data/model changes; 8, 9 to Gradle changes; 3 wherever a dependency, singleton, or ViewModel is introduced; 7 wherever a module's dependencies or cross-module imports change. Any rule not listed here is still checked whenever the diff touches its subject. Judge by what the diff touches — don't flag rules a file doesn't engage.
 
 For a **large diff (~15+ first-party files)**, fan out: spawn a subagent per dimension (UI/state, DI, persistence, Gradle/modules), each instructed to read the relevant ADR and report only its dimension's findings; then merge. For a small diff, do it inline.
 
 
@@ -0,0 +1,91 @@
+name: Deploy well-known Worker
+
+# Deploys infra/well-known-worker, which serves
+# https://<host>/.well-known/assetlinks.json out of the private "well-known" R2
+# bucket. The object itself is written by signing-fingerprint.yml; this workflow
+# owns only the code that reads it, and does not verify the served result -
+# signing-fingerprint.yml already does that end to end when it deploys.
+#
+# A Cloudflare Origin Rule cannot do this job on the Free plan: host header, SNI
+# and DNS record overrides are Enterprise-only, and R2 selects a bucket from the
+# Host header. The Worker uses an R2 binding instead, so the bucket stays private.
+#
+# Requires a CLOUDFLARE_WORKERS_DEPLOY_TOKEN secret with:
+#   Account -> Workers Scripts    -> Edit   (upload the script)
+#   Account -> Workers R2 Storage -> Read   (see below)
+#   Zone    -> Workers Routes     -> Edit   (attach the routes on appdevforall.org)
+# The R2 read scope is not optional: wrangler resolves the bucket named in the
+# r2_buckets binding via GET /accounts/<id>/r2/buckets/well-known and fails the
+# deploy with "Authentication error [code: 10000]" without it. Note that a scope
+# added to an existing token takes a few minutes to take effect - that same error
+# persists across an immediate re-run, so wait before concluding the scope is wrong.
+# The existing CLOUDFLARE_KEY_ID / CLOUDFLARE_SECRET_ACCESS_KEY pair is an R2
+# S3-compatible credential and cannot deploy a Worker.
+
+on:
+  workflow_dispatch:
+  # Dispatch is only offered for workflows on the default branch, so run on push
+  # to let this work from a feature branch before it reaches stage. Note that a
+  # push on any branch therefore deploys the live Worker.
+  push:
+    paths:
+      - 'infra/well-known-worker/**'
+      - '.github/workflows/deploy-well-known-worker.yml'
+
+permissions:
+  contents: read
+
+# One deploy at a time: concurrent uploads of the same script race on the routes.
+concurrency:
+  group: deploy-well-known-worker
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy Worker
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check Cloudflare credentials
+        env:
+          CLOUDFLARE_WORKERS_DEPLOY_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -euo pipefail
+
+          # wrangler reports a missing token as an opaque auth error, so name the
+          # actual gap here. Required scopes are listed at the top of this file.
+          for var in CLOUDFLARE_WORKERS_DEPLOY_TOKEN CLOUDFLARE_ACCOUNT_ID; do
+            if [ -z "${!var:-}" ]; then
+              echo "ERROR: $var is not set. See the header of this workflow." >&2
+              exit 1
+            fi
+          done
+
+      - name: Deploy with Wrangler
+        uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }}
+          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          workingDirectory: infra/well-known-worker
+          wranglerVersion: '4.124.0'
+          command: deploy
+
+      - name: Write job summary
+        run: |
+          set -euo pipefail
+          {
+            echo "## well-known Worker deployed"
+            echo
+            echo "Routes now served from the \`well-known\` R2 bucket:"
+            echo
+            echo "- \`https://appdevforall.org/.well-known/assetlinks.json\`"
+            echo "- \`https://www.appdevforall.org/.well-known/assetlinks.json\`"
+            echo
+            echo "A route with no matching object falls through to the site origin."
+            echo "Run **Print release signing certificate fingerprint** with \`deploy\` enabled to publish the object and verify it end to end."
+          } >> "$GITHUB_STEP_SUMMARY"