Merge current main into upstream integration

docker/README.md

@@ -529,9 +529,9 @@ Down clamps a short final title row before entering the separate Try again / Sho
 more row; an empty slot cannot activate recovery. An unavailable library hides
 its unknown item count.
 
-Caption separators use 40% of the existing muted colour's alpha. The rail follows
-the locked prototype CSS: bold 24 px letters, with the focused letter bold 28 px,
-overriding the spec table's generic caption style for this component.
+Library titles and compact subtitles remain visible at rest, with one-line,
+card-width ellipsis rather than a 640 px focused caption. The letter rail uses
+bold 24 px letters, with the focused letter bold 28 px.
 Library and Settings header initials use the muted colour over the person's fill;
 navigation and picker avatars retain their dark initials.
 
@@ -575,12 +575,35 @@ Title shelves reserve vertical drawing room for the scaled ring.
 Before scaling the stroke, ring-to-neighbour clearances round to 28/22/16 px
 for poster/tile/wide cards; including stroke scale they are 27.6/21.8/16.1 px.
 
-Poster progress uses the independent 18 px title-card inset, not caption spacing:
-the track remains 220 px wide on a 256 px poster. Library focus-follow restarts
-when the effective column count, focused row or header geometry changes, retaining
-deep focus across live snapshots that add or remove the letter rail.
-`LibrarySpacingRegressionTest` renders both progress geometry and the unchanged
-focused index across the 199↔200-title boundary.
+Cards use the approved option-B bottom state line instead of a separate inset
+resume bar: watched is 3 px accent; resume is 6 px proportional accent over
+`color.progressTrack`; unwatched and Discover have no line. Opaque background
+backs the entire strip, including its bottom 2 px and the 2 px separator above
+the fill. Artwork is clipped out of the backing band before painting it so
+rounded-corner antialiasing cannot leak poster pixels into the lowest row.
+The separately drawn focus ring stays above the line.
+
+Film subtitles are year + duration + a 24 px watched check, episode subtitles
+are their own duration + check, and series subtitles are year + check with no
+single runtime. Resuming cards have no check. The poster caption band remains
+96 px; Home poster captions are focus-only. Home landscapes retain titles on
+the art and reserve 64 px for focused metadata below it, making wide/tile shelf
+pitches 522/441 px; poster shelves remain 632 px and grids remain 524 px.
+Loading rows reserve the same blank caption bands and share one pulse layer;
+only art-sized blocks are painted, with no title/subtitle placeholder pills.
+
+`CardBottomPixelTest` samples full native bottom rows on four real posters at
+rest and individually focused, including white Annie Hall and dark Locke.
+`CardGeometryTest` measures 210/327 px caption fitting, card-width titles,
+24 px checks, row pitches, pinned rows and ring clearances to 0.1 px, and checks
+that every reserved loading-caption pixel remains background-coloured.
+`CardCaptionMotionTest` checks visible native glyph pixels when a still-focused
+caption changes title directly or while moving across a Home shelf.
+The [native option-B proof gallery](https://pages.justinvisser.org/wolfskin/tv-card-meta-build/)
+contains the same illustrative watch-state data as the approved frames and
+records renderer/fixture artifacts; unapproved design changes block merge.
+`LibrarySpacingRegressionTest` retains the deep focused index across the
+199↔200-title letter-rail boundary.
 
 `LibraryCaptureTest.spacingShowsFirstFocused`,
 `HomeCaptureTest.spacingNextUpFirstFocused` and
@@ -1000,12 +1023,30 @@ Keep and back up this file across clean builds, disposable worktrees, container
 rebuilds and Gradle cache resets. Never commit it. The standard debug passwords
 are public; this key is for local debug/optimized builds, not release signing.
 
-**One-time reinstall:** the first build with the stable key still needs one
-uninstall+reinstall on the box because the signer changes once; later ones
-install in place with `adb install -r`, retaining sign-ins and settings.
-The initial uninstall removes app data, so sign in again once after that switch.
-Deleting/replacing the persistent key or choosing a different override changes
-the signer again and requires another reinstall.
+### Preserve household TV data
+
+Install and update the household TV app only in place with `adb install -r`,
+using the same package and persistent debug signer. Its certificate SHA-256 is:
+
+```text
+182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d
+```
+
+Never run `adb uninstall`, `pm uninstall` or `pm clear`, or switch signers on
+the household box: clearing/removing the app deletes saved people, sign-ins
+and settings, and a different signer cannot update the existing app in place.
+Do not delete or replace the persistent key. If an uninstall is unavoidable,
+use `adb uninstall -k <package>` to keep app data, then reinstall the same
+package with the same signer.
+
+The manifest sets `android:hasFragileUserData="true"` so Android 10+ can offer
+a **keep app data** choice during interactive uninstall. Choose it when
+available; older Android versions ignore the attribute. This is a retention
+prompt, not an automatic backup or a guarantee against data clearing.
+
+For an in-place update, compare `dumpsys package <pkg>` before and after:
+`firstInstallTime` must remain unchanged. The guarded installer that checks
+the signer and this timestamp lives in the operator's tooling, not this repo.
 
 
 ## Release credentials