Move person-switch client disposal off the main thread

docker/README.md

@@ -104,6 +104,22 @@ household labels, requester capabilities and library audiences after sign-in.
 The locked shell projection in `app/src/debug/assets/wolfskin-shell.json` is used
 only when the Advanced debug fixture switch is enabled; release excludes it.
 
+Person selection immediately clears the old Conductarr identity and Jellyfin
+read gate before saved-login I/O. Detached clients are disposed exactly once on
+the application's IO scope, after the replacement (or signed-out) identity is
+published; a slow or failing socket close cannot block the picker or abort a
+switch. Cleanup outlives the replaced screen. Retry and session replacement use
+the same disposal owner. Superseded sign-ins are cancelled and serialized so a
+late reply cannot navigate back to an earlier person.
+
+Preference and people-fixture reads, Conductarr client construction (including
+Home/title retries), and private-cache directory initialization run on IO.
+`PersonSwitchThreadingTest` replays the real picker across Justin → Mindel →
+Shared → Justin while all closes are held pending, verifies retired clients
+cannot start reads, contains a failing close, and checks a burst of choices
+against a late sign-in reply. The thread-recording close fake rejects the main
+Looper; actual TLS/StrictMode verification remains a real-device check.
+
 Discover adds the picks hero, type chips, catalogue shelves, service pages, continuous
 See all grids, Hidden picks, request chooser and receipts. Its `discover-title/...`
 destination is an explicit title-family integration stub exposing only Discover's