Align TV layouts and close recovery gaps

docker/README.md

@@ -533,6 +533,48 @@ person's title/person projection. Title and performer disk copies remain isolate
 by both server and authenticated user; native retry and cache-isolation regressions
 exercise these boundaries without a live service.
 
+## TV fidelity and source gates
+
+Library/Discover page headings use the existing exact CSS line-box layout.
+Request sheets reserve the inherited inline text descent around their ratings;
+person rows and receipt panels therefore share the locked frame's vertical
+coordinates. Settings row title/facts also retain their CSS line boxes. These
+are local component fixes: shared typography tokens, Home and caption styling
+do not shift.
+
+Home ratings observations use independent six-hour, 300-entry title and
+series/season caches. A season retains each observed episode's own score and
+timestamp; changing a Jellyfin episode UUID does not lose the observation, and
+another episode or season never borrows that score. Episodes without a complete
+catalogue identity remain isolated by their Jellyfin identity.
+
+Cold library grids publish each cumulative 200-item SDK chunk before the next
+read completes. An existing complete saved copy stays visible throughout a
+refresh, and only a completed read replaces it on disk. A cold later-chunk
+failure keeps the already-readable titles with a retry tail, without saving an
+incomplete copy. Appended titles preserve the focused title even when the
+destination's sort inserts them before it. Catalogue row keys use the same
+media-type/TMDB identity as their cards.
+
+Undo restores a dismissed pick silently; Show again announces “Back in your
+picks.” Title pages own their own toast so the request adapter never duplicates
+it. The saved Discover retry tail is labelled More picks, not Try again twice.
+
+People retry retains an already signed-in Conductarr client and its uncertain
+submission ledger; only a signed-out identity is rebuilt. Home authorizes its
+Jellyfin read by the selected person's saved Jellyfin user ID, so a lost
+Conductarr operator or a renamed household profile does not hide that user's
+own library. A different saved user ID still fails closed.
+
+`make test` runs `OwnedSourceAuditTest` through the design module's JVM suite.
+It scans the owned Kotlin sources in `wolfskin-design/src/main/java` and
+`app/src/wolfskin`, rejecting untokened `.dp`/`.sp` conversions and numeric Color
+constructors outside generated tokens, token font sizes below 12 sp, raw
+household library labels, and page-counter/navigation wording. Its negative
+cases plant each violation independently. Existing native capture checks also
+verify rendered font sizes and wording. `LibraryProgressiveSurfaceTest` captures
+the usable first chunk while the final read is still suspended.
+
 ## Toolchain and disk use
 
 `Dockerfile` pins Temurin JDK `21.0.11+10` by image digest, command-line tools