Record Hexium publication and verified download link

README.md

@@ -66,6 +66,7 @@ Use a compatible mod manager, or install the dependencies using their manual
 instructions and extract the release ZIP's `BepInEx` folder into each Valheim
 installation. Both `GuildChest.dll` and `GuildChest.Core.dll` belong together in
 `BepInEx/plugins/GuildChest`. Download reviewed builds from
+[Hexium](https://valheim.hexium.gg/mods/randenko/GuildChest),
 [Nexus Mods](https://www.nexusmods.com/valheim/mods/4476),
 [Thunderstore](https://thunderstore.io/c/valheim/p/Paper_Street_Software/GuildChest/),
 or [GitHub Releases](https://github.com/randenko/valheim-guildchest/releases/latest).

docs/HEXIUM.md

@@ -7,20 +7,28 @@ them with `scripts/release_assets.py`, and passes the original ZIP to official
 values used by the Thunderstore publisher. Releases are never rebuilt or
 repackaged for upload. Existing tags, assets, and published notes stay unchanged.
 
+Guild Chest 1.1.0 is now public on
+[Hexium](https://valheim.hexium.gg/mods/randenko/GuildChest). Its downloadable
+archive passes content verification; both DLLs have assembly and file version
+1.1.0.0. The categories and Client & Server requirement are complete. Hexium
+currently reports **Virus scan —**; the workflow remains incomplete until the
+requested version shows **Scan successful**. Clean Gale profile and gameplay
+checks remain manual. See the [publication record](VALIDATION.md).
+
 ## Configuration and first publication
 
 GitHub **Settings → Secrets and variables → Actions** must contain:
 
 | Type | Name | Value / purpose |
 | --- | --- | --- |
 | Variable | `HEXIUM_NAMESPACE` | `randenko` |
-| Variable | `HEXIUM_PUBLISH_ENABLED` | Initially `false`; set to `true` after preflight succeeds. |
+| Variable | `HEXIUM_PUBLISH_ENABLED` | `true`; enabled by the owner after Actions preflight passed. |
 | Secret | `HEXIUM_API_TOKEN` | API token belonging to team `randenko`. |
 
 All three settings were present when implementation started; the token value
 was not retrieved. Preflight checks configuration presence, public dependencies,
-categories, and release assets using GET requests. Upload authorization is
-established by the first successful publication, rather than by preflight.
+categories, and release assets using GET requests. Upload and metadata-write
+authorization were established during the 1.1.0 publication.
 Keep credentials in environment variables or GitHub Secrets, never arguments,
 committed files, or chat messages.
 
@@ -32,11 +40,16 @@ committed files, or chat messages.
    Thunderstore and Nexus Mods switches at their existing values.
 4. Manually dispatch **v1.1.0** again with **Validate without uploading** disabled.
    Its earlier GitHub release event will not replay automatically.
+   The launch API upload created a **private** listing that returned 404 from
+   the public package API. If this happens, open the existing listing and choose
+   **⚙ → Make public**, then retry the workflow to complete metadata. Do not
+   upload the archive again while that listing is private. Hexium's documented
+   API does not expose a visibility control.
 5. Check the public listing, four screenshots, changelog, Jötunn dependency,
    client/server requirement, and version scan. Install using a clean Gale
    profile; verify BepInEx and Jötunn resolution, both Guild Chest DLLs at
    **1.1.0.0**, and a chest interaction in a disposable world.
-6. Add the verified listing URL to the README and saved
+6. The verified listing URL is included in the README and saved
    [YouTube description](media/youtube-description.txt). Updating the live video
    description remains manual. Record actual results in [validation](VALIDATION.md).
 

docs/VALIDATION.md

@@ -6,23 +6,44 @@ provenance is recorded locally in `.local/references.json`; the publication reco
 below identifies the newer release build. A successful compile checks assembly
 compatibility; runtime behavior on newer builds needs separate verification.
 
-## Hexium publishing preparation (2026-10-17)
+## Hexium publication (2026-10-17)
 
-- GitHub has `HEXIUM_NAMESPACE=randenko`, `HEXIUM_PUBLISH_ENABLED=false`, and
-  the `HEXIUM_API_TOKEN` secret. Only presence and public variable values were
-  inspected; no secret value was retrieved. Existing Thunderstore and Nexus
-  publishing switches were left unchanged.
+- GitHub has `HEXIUM_NAMESPACE=randenko` and the `HEXIUM_API_TOKEN` secret.
+  The owner enabled `HEXIUM_PUBLISH_ENABLED=true` after the
+  [Actions preflight](https://github.com/randenko/valheim-guildchest/actions/runs/39080360051)
+  passed. Secret values were not retrieved. Existing Thunderstore and Nexus
+  publishing switches remain unchanged.
 - Live GET-only preflight for v1.1.0 passes using the published GitHub archive
   with SHA-256
   `133b8fe196e45c49fc0d984d07b9f948a070ca25557fe4b7eab8baa70bf7dbf3`.
   Hexium has active BepInExPack Valheim 5.4.2351 and Jötunn 2.30.2 versions,
   and Building, Storage, Quality of Life, and Open Source categories.
+- The [initial upload](https://github.com/randenko/valheim-guildchest/actions/runs/39080524361)
+  succeeded, establishing token authorization, but Hexium created a private
+  listing. Public API verification returned 404 for five minutes and correctly
+  remained incomplete. The owner made the existing listing public through its
+  gear menu. No archive was uploaded again.
+- [Guild Chest 1.1.0](https://valheim.hexium.gg/mods/randenko/GuildChest) is
+  publicly available. The downloaded ZIP has SHA-256
+  `b1138d63a7d4d64f1301a2c92ded5a608831969370071c394043ef877713aef6`.
+  Its exact file set and all file bytes match GitHub, allowing only JSON
+  formatting and removal of the BepInEx dependency from the manifest.
+  Both downloaded DLLs have assembly and file version **1.1.0.0**.
+- The [reconciliation run](https://github.com/randenko/valheim-guildchest/actions/runs/39080999495)
+  recognized the matching existing version and completed Building, Storage,
+  Quality of Life, Open Source, and Client & Server metadata. The public page
+  includes all four release-specific screenshots, the changelog, and Jötunn.
+  Static analysis reports 10 files analyzed. **Virus scan —** remains visible;
+  the required successful virus-scan result has not been established.
 - Regression tests cover the shared release checks, disabled publishing,
   GET-only preflight, exact outgoing ZIP bytes, manifest normalization, changed
   DLLs and other files, invalid categories/dependencies, credential isolation,
   delayed visibility, CLI errors/timeouts, unfinished metadata, version-specific
-  scans, and retry recovery. The [Hexium runbook](HEXIUM.md) records launch and
-  clean Gale profile/gameplay checks; those results remain pending publication.
+  scans, and retry recovery. Review found no actionable regressions; the full
+  NUKE Test target passed 15 C# and 154 Python tests, and actionlint passed.
+  The [Hexium runbook](HEXIUM.md) records clean Gale profile/gameplay checks;
+  those remain manual. The README and saved YouTube description include the
+  verified listing URL; updating the live video description remains manual.
 
 ## Nexus Mods publishing preparation (2026-10-17)
 

docs/media/youtube-description.txt

@@ -22,6 +22,9 @@ https://thunderstore.io/c/valheim/p/Paper_Street_Software/GuildChest/
 Download on Nexus Mods:
 https://www.nexusmods.com/valheim/mods/4476
 
+Download on Hexium:
+https://valheim.hexium.gg/mods/randenko/GuildChest
+
 Downloads and release notes:
 https://github.com/randenko/valheim-guildchest/releases/latest