Merge main into the round-two integration branch

app/src/main/AndroidManifest.xml

@@ -40,6 +40,7 @@
 
     <application
         android:allowBackup="true"
+        android:hasFragileUserData="true"
         android:banner="@mipmap/ic_banner"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"

app/src/test/java/org/justinvisser/wolfskin/tv/PersonPickerSessionTest.kt

@@ -128,6 +128,8 @@ class PersonPickerSessionTest {
     private fun awaitLoaded(user: JellyfinUser) {
         try {
             rule.waitUntil(10_000) {
+                // Setup navigation writes Compose state asynchronously; publish it before pumping replacement composition.
+                androidx.compose.runtime.snapshots.Snapshot.sendApplyNotifications()
                 Shadows.shadowOf(Looper.getMainLooper()).idle()
                 models.lastOrNull()?.signedInPerson == user.name!!.lowercase() &&
                     models.last().conductarr.identity.value?.signedIn == true &&

docker/README.md

@@ -27,6 +27,22 @@ Upstream enables JVM unit tests only for debug variants; there is no
 `testDefaultReleaseUnitTest` task. `make test` uses the closest default-flavor
 task without changing upstream's test configuration.
 
+### Full-suite test diagnostics
+
+The Gradle daemon heap (`org.gradle.jvmargs` in `gradle.properties`) is separate
+from the forked test-worker heap. The default test worker uses 512 MiB; changing
+the daemon's `-Xmx` does not increase it. A larger worker heap did not resolve
+the person-picker fixture's missing Compose snapshot notifications.
+
+Gradle 9.8.2 runs previously failed test classes first on the next invocation.
+An immediate green `make test` rerun can therefore hide an order-sensitive
+failure rather than prove a fix. For comparisons, clear only generated binary
+test-result history (`build/test-results/<task>/binary` in each module) before
+each run and record actual class-start order; XML file listing order is not
+execution order. Keep worker heap and parallelism unchanged between samples.
+`PersonPickerSessionTest` must also pass late in the full app JVM, not just alone
+or promoted to the front by previous failures.
+
 ## Saved-person launch and DNS
 
 Launch restores an unprotected saved Jellyfin login from local storage before
@@ -1024,12 +1040,30 @@ Keep and back up this file across clean builds, disposable worktrees, container
 rebuilds and Gradle cache resets. Never commit it. The standard debug passwords
 are public; this key is for local debug/optimized builds, not release signing.
 
-**One-time reinstall:** the first build with the stable key still needs one
+### Preserve household TV data
-uninstall+reinstall on the box because the signer changes once; later ones
+
-install in place with `adb install -r`, retaining sign-ins and settings.
+Install and update the household TV app only in place with `adb install -r`,
-The initial uninstall removes app data, so sign in again once after that switch.
+using the same package and persistent debug signer. Its certificate SHA-256 is:
-Deleting/replacing the persistent key or choosing a different override changes
+
-the signer again and requires another reinstall.
+```text
+182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d
+```
+
+Never run `adb uninstall`, `pm uninstall` or `pm clear`, or switch signers on
+the household box: clearing/removing the app deletes saved people, sign-ins
+and settings, and a different signer cannot update the existing app in place.
+Do not delete or replace the persistent key. If an uninstall is unavoidable,
+use `adb uninstall -k <package>` to keep app data, then reinstall the same
+package with the same signer.
+
+The manifest sets `android:hasFragileUserData="true"` so Android 10+ can offer
+a **keep app data** choice during interactive uninstall. Choose it when
+available; older Android versions ignore the attribute. This is a retention
+prompt, not an automatic backup or a guarantee against data clearing.
+
+For an in-place update, compare `dumpsys package <pkg>` before and after:
+`firstInstallTime` must remain unchanged. The guarded installer that checks
+the signer and this timestamp lives in the operator's tooling, not this repo.
 
 
 ## Release credentials