Preserve TV Back viewports and person-switch authority

docker/README.md

@@ -221,12 +221,16 @@ shows “The household server didn’t answer.” Back from a reopened avatar pi
 dismisses to that person's navigation; the next Back exits. Back from a launch or
 setup picker exits instead of exposing a previous person's content. Settings,
 login and error panels return to the picker first; Back can exit a busy setup
-request. PIN and require-login selection rules are unchanged.
+request. PIN, require-login and rejected-credential authentication gates remain
+strict: an expired target sign-in still reaches the setup login form.
 
 Failed or cancelled Jellyfin switches restore the previous API token as well as
-retaining the signed-in identity. A person-switch cover has a ten-second deadline;
+retaining the signed-in identity. Recovering the picker also reattaches only that
+person's household client. A person-switch cover has a ten-second deadline;
 an unfinished switch/replacement falls back to the setup picker with a message,
-without choosing a different authenticated person.
+without choosing a different authenticated person. Repository user changes share
+one transaction gate, so late cancellation/rollback cannot overwrite a newer
+person's authenticated token.
 
 Jellyfin, Conductarr, artwork, playback and crash-report clients share one
 `PersistentDns` instance through the application graph. It keeps system-ordered
@@ -649,6 +653,10 @@ shell's logical focus without requests against uncomposed lazy items.
 Back preserves the viewport; returning to Home does not re-run focus-follow over
 a manually scrolled saved view. The next arrow re-enters visible content when
 scrolling moved focus off-screen.
+Shell-owned Home, Library/See all, Discover and Settings/Updates lists use
+Foundation's minimum-visibility bring-into-view policy, not TV's 30% focus pivot.
+Restoring focus therefore leaves already-visible cards at their saved position;
+native title/person and legacy handoffs retain their inherited policy.
 Pointing changes focus without activation, cards activate on key-up, and held
 OK events cannot activate twice.
 Between Home shelves, an unvisited row starts at its leftmost card. A visited row
@@ -971,12 +979,15 @@ retain the approved frames except for the requested feedback changes:
   cache, 128 MiB disk cache and four image-read limit remain unchanged.
 
 `HomeViewportTest` covers short/long poster, tile and wide rows, both row
-directions, first focus and exact scroll/card bounds after native Back from the
-actual title surface. `TitleEntryBackTest` also checks the production Home/title
-loaders through `NavDisplay` and its entry decorators on SDK 34 and 36, with
-animation and reduced motion. Native proof records real Bear season-three
-metadata through the title read facade; the proof-only harness is not part of
-the shipped tests or APK.
+directions, first focus and exact scroll/card bounds after returning from the
+actual title surface. `TitleEntryBackTest` also checks production MainContent,
+the Home/title loaders, `NavDisplay` decorators and native system Back on SDK 34
+and 36. It models Leanback capabilities and keyboard input, animation/reduced
+motion, initial Home loading and system animation scale zero. Phone/touch-mode
+tests miss the TV focus pivot; the zero-scale regression reproduced the exact
+72-pixel drift before the shared policy fix. Native proof records real Bear
+season-three metadata through the title read facade; the proof-only harness is
+not part of the shipped tests or APK.
 
 Episode lists request only ProviderIds and Overview. Next up reads only identity,
 then hydrates the selected playback target through the existing single-item read,