Integrate shared offline recovery and saved-state isolation

docker/README.md

@@ -205,8 +205,8 @@ disk cache. A missing saved library becomes a recovery panel; a saved library
 stays visible when Jellyfin is unreachable. Playback resolves an actual film or
 episode and checks Jellyfin before opening upstream's player. No season,
 recommendation stub or different person's session is promoted to playback.
-An unresolved person switch shows the same sign-in guard for Home as for native
-library content, before mounting Home's source reads.
+An unresolved person switch guards Home and both owned/upstream library content
+before mounting any source read with the prior person's Jellyfin session.
 
 Debug variants additionally package the locked fixture and local artwork under
 `wolfskin-design/src/debug/assets/wolfskin-home/`; release variants exclude them.
@@ -401,6 +401,56 @@ The shorter 1/5/6/2 title-entry replays remain as focused regressions. SDK cache
 exact-episode, track-index, identity, locale-layout and trailer-handler tests
 run offline with in-process service replies and local art.
 
+## Offline states and recovery
+
+Owned screens share `RecoveryToast`: the warning glyph, 760 px maximum width,
+22/28 px padding, 14 px icon gap, 22 px corners and CSS-sized body line boxes.
+Network failures never expose transport exception text. Playback failure reads
+“Can’t reach Jellyfin to play. Check the network and try again.” and leaves the
+originating card focused; no simulated player hand-off panel is shipped. Retry
+failure reads “Still can’t reach it. The last saved view stays on screen.”
+
+Library headers and the nav publish the same saved-copy timestamp. Failed library
+refreshes retain cards and expose a reachable Try again tail. Discover retains its
+current catalogue after a failed refresh, adds a recovery tail and disables request
+and dismissal writes until recovery; a revoked sign-in discards that saved projection.
+Previously observed plates can remain visible offline, but moving to an uncached
+card cannot start a ratings read. `SavedPill` shares the compact cached-header
+treatment across Home, Libraries and Requests; the nav retains its larger wifi chip.
+
+Requests focus, observed ratings and retained rows are partitioned by selected person.
+A failed authenticated read preserves the last rows and their timestamp; Down from
+the final row reaches Try again and Up returns to the row. Signed-out data is not
+retained as an authenticated copy. Returning to a foreground person triggers that
+person's refresh rather than waiting for the prior person's polling timer.
+
+Home disk snapshots remain server/user scoped. A new identity starts with its own
+skeleton or saved copy, never the previous person's projection; late responses from
+an older read cannot overwrite the current identity. A disk-write failure does not
+turn a successful Jellyfin read into an outage. Skeleton-only Home, Library and
+Discover screens keep focus in the nav even when Down is pressed repeatedly.
+
+Library/Discover posters use the same title/glyph/160-degree gradient fallback as
+Home, including an actual Coil read failure. Discover hero image failures use the
+shared ambient background; missing artwork is not a successful data refresh.
+
+`RecoveryStateTest`, `RecoveryCaptureTest`, `HomeRecoveryTest` and `PlayerHandoffTest`
+exercise state transitions, person isolation, native recovery focus/geometry and the
+real upstream playback destination with offline fixtures. New native captures and
+rendered text/font metrics go to `build/wolfskin-captures/recovery/`; Dutch score
+captures configure the Android resource locale as well as the JVM locale.
+
+Production Conductarr TV sign-in/provider wiring remains outside these state
+components: release Discover is signed out and release Requests is unavailable.
+The generated client's identity-scoped disk cache is the Conductarr cache boundary;
+no Seerr fallback, live-test server, handwritten HTTP or offline request queue is added.
+Title and person surfaces publish saved timestamps through the same per-person
+`RememberedView` partition and nav Saved indicator. Their timed notices render
+the shared `RecoveryToast`; failed Try again and playback use `RecoveryMessage`
+without transport details. A selected-person mismatch never renders the former
+person's title/person projection. Title and performer disk copies remain isolated
+by both server and authenticated user; native retry and cache-isolation regressions
+exercise these boundaries without a live service.
 
 ## Toolchain and disk use