Makefile

@@ -4,7 +4,7 @@ WOLFSKIN_GRADLE_VOLUME ?= wolfskin-gradle
 WOLFSKIN_SECRETS_DIR ?= /opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin
 export WOLFSKIN_BUILD_IMAGE WOLFSKIN_GRADLE_VOLUME WOLFSKIN_SECRETS_DIR
 
-.PHONY: build-image apk apk-debug test release-tag tv-release tv-publish tv-tooling-test
+.PHONY: build-image apk apk-debug test release-tag
 build-image:
 	docker build --platform linux/amd64 --tag "$(WOLFSKIN_BUILD_IMAGE)" docker
 
@@ -19,13 +19,3 @@ test: build-image
 
 release-tag:
 	@bash docker/release-tag.sh
-
-TV_RELEASE_DIR ?= /var/tmp/wolfskin-tv-release-$(VERSION)
-tv-release: build-image
-	@python3 docker/tv_release.py --version "$(VERSION)" --version-code "$(VERSION_CODE)" --output "$(TV_RELEASE_DIR)" $(TV_RELEASE_FLAGS)
-
-tv-publish:
-	@python3 docker/tv_publish.py --directory "$(TV_RELEASE_DIR)" $(TV_PUBLISH_FLAGS)
-
-tv-tooling-test:
-	@python3 -m unittest discover -s docker -p 'test_tv_*.py' -v

app/build.gradle.kts

@@ -56,10 +56,6 @@ val gitDescribe =
         .standardOutput.asText
         .getOrElse("v0.0.0")
 
-val tvVersion = providers.gradleProperty("tvVersion").orElse("1.1.1")
-val tvVersionCode = providers.gradleProperty("tvVersionCode")
-apply(from = "household-version.gradle.kts")
-
 kotlin {
     compilerOptions {
         languageVersion = org.jetbrains.kotlin.gradle.dsl.KotlinVersion.KOTLIN_2_3
@@ -232,13 +228,6 @@ configure<ApplicationExtension> {
 
 androidComponents {
     onVariants(selector().all()) { variant ->
-        if (variant.name == "defaultOptimized") {
-            variant.outputs.forEach {
-                it.versionName.set(tvVersion)
-                // The sentinel is configuration-only: optimized tasks require the explicit input above.
-                it.versionCode.set(tvVersionCode.map(String::toInt).orElse(1))
-            }
-        }
         variant.outputs
             .map { it as com.android.build.api.variant.impl.VariantOutputImpl }
             .forEach { output ->

app/household-version.gradle.kts

@@ -1,18 +0,0 @@
-// Household assembly inputs remain mandatory even through aggregate Gradle tasks.
-val tvVersion = providers.gradleProperty("tvVersion").orElse("1.1.1")
-val tvVersionCode = providers.gradleProperty("tvVersionCode")
-
-fun requireHouseholdVersion() {
-    require(tvVersionCode.isPresent) { "Household builds require -PtvVersionCode=<monotonic code>" }
-    require(tvVersionCode.get().toInt() in 1..2100000000) { "Invalid household versionCode" }
-    require(Regex("""\d+\.\d+\.\d+""").matches(tvVersion.get())) { "Household versionName must be plain major.minor.patch" }
-}
-
-if (gradle.startParameter.taskNames.any { it.contains("Optimized", ignoreCase = true) }) {
-    requireHouseholdVersion()
-}
-tasks.configureEach {
-    if (name.contains("DefaultOptimized", ignoreCase = true)) {
-        doFirst { requireHouseholdVersion() }
-    }
-}

app/src/main/AndroidManifest.xml

@@ -36,18 +36,10 @@
             <action android:name="android.intent.action.VIEW" />
             <data android:mimeType="video/*" />
         </intent>
-        <intent>
-            <action android:name="android.intent.action.INSTALL_PACKAGE" />
-            <data android:mimeType="application/vnd.android.package-archive" />
-        </intent>
-        <intent>
-            <action android:name="android.settings.MANAGE_UNKNOWN_APP_SOURCES" />
-        </intent>
     </queries>
 
     <application
         android:allowBackup="true"
-        android:hasFragileUserData="true"
         android:banner="@mipmap/ic_banner"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
@@ -77,13 +69,6 @@
                 <data android:scheme="wholphin" />
             </intent-filter>
         </activity>
-        <receiver
-            android:name="org.justinvisser.wolfskin.tv.update.UpdateInstallReceiver"
-            android:exported="false" />
-        <activity
-            android:name="org.justinvisser.wolfskin.tv.update.UpdateConfirmationActivity"
-            android:exported="false"
-            android:excludeFromRecents="true" />
 
         <provider
             android:name="androidx.core.content.FileProvider"

app/src/main/java/com/github/damontecres/wholphin/preferences/AppPreference.kt

@@ -16,7 +16,6 @@ import com.github.damontecres.wholphin.ui.preferences.PreferenceGroup
 import com.github.damontecres.wholphin.ui.preferences.PreferenceScreenOption
 import com.github.damontecres.wholphin.ui.preferences.PreferenceValidation
 import com.github.damontecres.wholphin.util.DebugLogTree
-import org.justinvisser.wolfskin.tv.update.UpdateChannel
 import kotlin.time.Duration.Companion.hours
 import kotlin.time.Duration.Companion.milliseconds
 import kotlin.time.Duration.Companion.minutes
@@ -628,7 +627,7 @@ sealed interface AppPreference<Pref, T> {
         val UpdateUrl =
             AppStringPreference<AppPreferences>(
                 title = R.string.update_url,
-                defaultValue = UpdateChannel.defaultUrl(BuildConfig.APPLICATION_ID),
+                defaultValue = "https://git.justinvisser.org/api/v1/repos/justinzeus/wolfskin/releases/latest",
                 getter = { it.updateUrl },
                 setter = { prefs, value ->
                     prefs.update { updateUrl = value }

app/src/main/java/com/github/damontecres/wholphin/services/UpdateChecker.kt

@@ -36,9 +36,6 @@ import kotlinx.serialization.json.jsonPrimitive
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
-import org.justinvisser.wolfskin.tv.update.AndroidUpdateService
-import org.justinvisser.wolfskin.tv.update.UpdateChannel
-import org.justinvisser.wolfskin.tv.update.UpdateTransport
 import timber.log.Timber
 import java.io.File
 import java.io.InputStream
@@ -46,7 +43,6 @@ import java.io.OutputStream
 import java.util.Date
 import javax.inject.Inject
 import javax.inject.Singleton
-import javax.inject.Provider
 import kotlin.time.Duration.Companion.hours
 import kotlin.time.Duration.Companion.milliseconds
 
@@ -59,7 +55,6 @@ class UpdateChecker
     constructor(
         @param:ApplicationContext private val context: Context,
         @param:StandardOkHttpClient private val okHttpClient: OkHttpClient,
-        private val household: Provider<AndroidUpdateService>,
     ) {
         companion object {
             const val ASSET_NAME = "Wolfskin"
@@ -128,10 +123,6 @@ class UpdateChecker
             updateUrl: String,
             showNegativeToast: Boolean = false,
         ) {
-            if (context.packageName == UpdateChannel.PACKAGE) {
-                household.get().controller.check(manual = showNegativeToast)
-                return
-            }
             val pref = PreferenceManager.getDefaultSharedPreferences(context)
             val now = Date()
             val lastUpdateCheckThreshold =
@@ -190,12 +181,6 @@ class UpdateChecker
          * so this searches the release list instead of fetching a tag.
          */
         suspend fun getRelease(version: Version): Release? {
-            if (context.packageName == UpdateChannel.PACKAGE) {
-                return withContext(WholphinDispatchers.IO) {
-                    val releases = UpdateTransport().releasesForLatest(household.get().channelUrl())
-                    findReleaseByVersion(releases, version)?.let { parseRelease(it, false) }
-                }
-            }
             val request =
                 Request
                     .Builder()
@@ -248,9 +233,6 @@ class UpdateChecker
             release: Release,
             callback: DownloadCallback,
         ) {
-            check(context.packageName != UpdateChannel.PACKAGE) {
-                "Household updates require the verified update controller"
-            }
             withContext(WholphinDispatchers.IO) {
                 cleanup()
                 val request =

app/src/main/java/com/github/damontecres/wholphin/ui/CoilConfig.kt

@@ -15,8 +15,7 @@ import coil3.network.NetworkResponse
 import coil3.network.cachecontrol.CacheControlCacheStrategy
 import coil3.network.okhttp.OkHttpNetworkFetcherFactory
 import coil3.request.Options
-import coil3.request.transitionFactory
+import coil3.request.crossfade
-import org.justinvisser.wolfskin.design.NetworkArtTransition
 import coil3.util.DebugLogger
 import com.github.damontecres.wholphin.preferences.AppPreference
 import com.github.damontecres.wholphin.preferences.AppPreferences
@@ -90,7 +89,7 @@ fun CoilConfig(
                     memoryCache(null)
                     diskCache(null)
                 }
-            }.transitionFactory(NetworkArtTransition)
+            }.crossfade(false)
             .logger(if (debugLogging) DebugLogger() else null)
             .components {
                 add(

app/src/main/java/com/github/damontecres/wholphin/ui/preferences/PreferencesContent.kt

@@ -47,7 +47,6 @@ import androidx.tv.material3.Text
 import androidx.tv.material3.surfaceColorAtElevation
 import coil3.SingletonImageLoader
 import coil3.imageLoader
-import com.github.damontecres.wholphin.BuildConfig
 import com.github.damontecres.wholphin.R
 import com.github.damontecres.wholphin.preferences.AppPreference
 import com.github.damontecres.wholphin.preferences.AppPreferences
@@ -90,7 +89,6 @@ import com.github.damontecres.wholphin.util.DataLoadingState
 import com.github.damontecres.wholphin.util.ExceptionHandler
 import com.github.damontecres.wholphin.util.LoadingState
 import kotlinx.coroutines.launch
-import org.justinvisser.wolfskin.tv.update.UpdateChannel
 import timber.log.Timber
 import java.util.Locale
 
@@ -357,9 +355,7 @@ fun PreferencesContent(
                                 AppPreference.Update -> {
                                     ClickPreference(
                                         title =
-                                            if (BuildConfig.APPLICATION_ID == UpdateChannel.PACKAGE) {
+                                            if (release != null && updateAvailable) {
-                                                stringResource(R.string.check_for_updates)
-                                            } else if (release != null && updateAvailable) {
                                                 stringResource(R.string.install_update)
                                             } else if (!preferences.autoCheckForUpdates && release == null) {
                                                 stringResource(R.string.check_for_updates)
@@ -368,9 +364,7 @@ fun PreferencesContent(
                                             },
                                         onClick = {
                                             if (movementSounds) playOnClickSound(context)
-                                            if (BuildConfig.APPLICATION_ID == UpdateChannel.PACKAGE) {
+                                            if (release != null && updateAvailable) {
-                                                viewModel.navigationManager.navigateTo(Destination.UpdateApp)
-                                            } else if (release != null && updateAvailable) {
                                                 release?.let {
                                                     viewModel.navigationManager.navigateTo(
                                                         Destination.UpdateApp,

app/src/main/java/com/github/damontecres/wholphin/ui/setup/InstallUpdatePage.kt

@@ -44,7 +44,6 @@ import androidx.tv.material3.MaterialTheme
 import androidx.tv.material3.Text
 import androidx.tv.material3.surfaceColorAtElevation
 import com.github.damontecres.wholphin.R
-import com.github.damontecres.wholphin.BuildConfig
 import com.github.damontecres.wholphin.preferences.UserPreferences
 import com.github.damontecres.wholphin.services.DownloadCallback
 import com.github.damontecres.wholphin.services.NavigationManager
@@ -74,9 +73,6 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.update
 import kotlinx.coroutines.launch
 import timber.log.Timber
-import org.justinvisser.wolfskin.tv.update.ClassicUpdatePage
-import org.justinvisser.wolfskin.tv.update.UpdateChannel
-import org.justinvisser.wolfskin.tv.update.UpdateController
 import javax.inject.Inject
 
 @HiltViewModel
@@ -86,7 +82,6 @@ class UpdateViewModel
         private val userPreferencesService: UserPreferencesService,
         val updater: UpdateChecker,
         val navigationManager: NavigationManager,
-        val householdController: UpdateController,
     ) : ViewModel(),
         DownloadCallback {
         private val _state = MutableStateFlow(InstallUpdateState())
@@ -98,10 +93,6 @@ class UpdateViewModel
         val currentVersion = updater.getInstalledVersion()
 
         fun init() {
-            if (BuildConfig.APPLICATION_ID == UpdateChannel.PACKAGE) {
-                householdController.check(true)
-                return
-            }
             _state.update { it.copy(loading = LoadingState.Loading) }
             viewModelScope.launchIO {
                 val updateUrl = userPreferencesService.getCurrent().appPreferences.updateUrl
@@ -175,10 +166,6 @@ fun InstallUpdatePage(
     modifier: Modifier = Modifier,
     viewModel: UpdateViewModel = hiltViewModel(),
 ) {
-    if (BuildConfig.APPLICATION_ID == UpdateChannel.PACKAGE) {
-        ClassicUpdatePage(viewModel.householdController, modifier)
-        return
-    }
     OneTimeLaunchedEffect { viewModel.init() }
 
     val state by viewModel.state.collectAsState()

app/src/main/java/com/github/damontecres/wholphin/ui/setup/seerr/SwitchSeerrViewModel.kt

@@ -52,9 +52,6 @@ class SwitchSeerrViewModel
                         _state.update { it.copy(loading = LoadingState.Success) }
                     }
                 }
-            } else {
-                // Nothing to check so set success
-                _state.update { it.copy(loading = LoadingState.Success) }
             }
         }
 

app/src/test/java/com/github/damontecres/wholphin/test/TestUpdateChecker.kt

@@ -18,16 +18,6 @@ import java.nio.file.Paths
 import kotlin.io.path.readText
 
 class TestUpdateChecker {
-    @Test
-    fun householdChannelMigrationDoesNotChangeCustomOrOldProductionFeeds() {
-        val channel = org.justinvisser.wolfskin.tv.update.UpdateChannel
-        Assert.assertEquals(channel.LATEST_URL, channel.migrateUrl(channel.PACKAGE, channel.LEGACY_URL))
-        Assert.assertEquals("https://custom.test/releases/latest", channel.migrateUrl(channel.PACKAGE, "https://custom.test/releases/latest"))
-        Assert.assertEquals(channel.LEGACY_URL, channel.migrateUrl("org.justinvisser.wolfskin.tv", channel.LEGACY_URL))
-        Assert.assertEquals(channel.LEGACY_URL, channel.defaultUrl("org.justinvisser.wolfskin.tv"))
-        Assert.assertEquals(channel.LATEST_URL, channel.defaultUrl(channel.PACKAGE))
-    }
-
     lateinit var releaseJson: JsonObject
     val assetsJson: JsonArray by lazy { releaseJson["assets"]!!.jsonArray }
 

app/src/test/java/com/github/damontecres/wholphin/test/VersionCompareTests.kt

@@ -22,14 +22,7 @@ class VersionCompareTests {
     @Test
     fun optimizedVersionRemainsCompatibleWithUpgradeAndUpdateChecks() {
         val optimizedVersion = Version.fromString(requireNotNull(System.getProperty("wolfskin.optimizedVersionName")))
-        Assert.assertTrue(optimizedVersion.isGreaterThan(Version.fromString("1.1.0-140-g5162c299")))
+        Assert.assertEquals(Version.fromString(BuildConfig.VERSION_NAME), optimizedVersion)
-    }
-
-    @Test
-    fun householdAvailabilityOrdersAndroidCodesNotDisplayVersions() {
-        Assert.assertTrue(org.justinvisser.wolfskin.tv.update.UpdateChannel.isNewer(100001, 65))
-        Assert.assertFalse(org.justinvisser.wolfskin.tv.update.UpdateChannel.isNewer(65, 100001))
-        Assert.assertFalse(org.justinvisser.wolfskin.tv.update.UpdateChannel.isNewer(100001, 100001))
     }
 
     @Test

app/src/test/java/org/justinvisser/wolfskin/tv/DiscoverSkeletonKeysTest.kt

@@ -1,51 +0,0 @@
-package org.justinvisser.wolfskin.tv
-
-import android.app.Application
-import androidx.activity.ComponentActivity
-import androidx.compose.ui.input.key.Key
-import androidx.compose.ui.test.junit4.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.performKeyInput
-import androidx.compose.ui.test.pressKey
-import io.mockk.mockk
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import org.junit.Assert.*
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.justinvisser.wolfskin.design.*
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-/** A pending shelf cannot capture the D-pad or break the shell's Back ladder. */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [34], application = Application::class, qualifiers = "w960dp-h540dp-xhdpi")
-class DiscoverSkeletonKeysTest {
-    @get:Rule val rule = createAndroidComposeRule<ComponentActivity>()
-
-    @Test fun downAndUpSkipPendingLanesAndBackReturnsToNavWhenOnlySkeletonsRemain() {
-        val shell = ShellState(listOf(ShellPerson("justin", "Justin", "J", false)), "justin").apply {
-            pickerVisible = false; pickerLaunch = false; enterDestination("discover")
-        }
-        val pending = DiscoverLane("pending", "Pending", emptyList(), pending = true)
-        val ready = DiscoverLane("ready", "Available", listOf(DiscoverTitle(1, "movie", "A real title")))
-        val snapshot = DiscoverSnapshot(status = DiscoverStatus.Ready, lanes = listOf(pending, ready))
-        val state = DiscoverState(shell, snapshot, mockk(relaxed = true), CoroutineScope(Dispatchers.Main.immediate), {}, {})
-        state.focus(1)
-        rule.setContent { WolfskinTheme { ShellSurface(shell) { DiscoverScreen(state, it) } } }
-        press(Key.DirectionDown)
-        rule.runOnIdle { assertEquals("ready", state.focusedLane?.id); assertEquals("ready:0", state.cardKey) }
-        press(Key.DirectionUp)
-        rule.runOnIdle {
-            assertEquals(1, state.focusedRow)
-            state.updateSnapshot(snapshot.copy(lanes = listOf(pending)))
-        }
-        press(Key.DirectionDown)
-        rule.runOnIdle { assertEquals(1, state.focusedRow); assertNull(state.cardKey) }
-        press(Key.Back)
-        rule.runOnIdle { assertTrue(shell.navFocused); assertFalse(shell.pickerVisible); assertEquals("discover", shell.route) }
-    }
-
-    private fun press(key: Key) { rule.onNodeWithTag("wolfskin-shell").performKeyInput { pressKey(key) } }
-}

app/src/test/java/org/justinvisser/wolfskin/tv/FirstSignInNavigationTest.kt

@@ -84,7 +84,7 @@ class FirstSignInNavigationTest {
                 coEvery { views.getUserViews(userId = user.id) } returns successQueryResult(listOf(movies, shows))
                 for ((library, kind, count) in listOf(Triple(movies, BaseItemKind.MOVIE, 6), Triple(shows, BaseItemKind.SERIES, 29))) {
                     coEvery { items.getItems(userId = user.id, parentId = library.id, recursive = true,
-                        includeItemTypes = listOf(kind), fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.DATE_CREATED),
+                        includeItemTypes = listOf(kind), fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.SORT_NAME, ItemFields.DATE_CREATED),
                         sortBy = listOf(ItemSortBy.SORT_NAME), startIndex = 0, limit = 200) } returns successQueryResult(
                             List(count) { BaseItemDto(id = UUID.randomUUID(), name = "${library.name} title $it", type = kind) })
                 }

app/src/test/java/org/justinvisser/wolfskin/tv/LibraryReadFacadeTest.kt

@@ -51,7 +51,7 @@ class LibraryReadFacadeTest {
         val offsets = mutableListOf<Int>()
         coEvery { items.getItems(userId = user, parentId = library.id, recursive = true,
             includeItemTypes = listOf(BaseItemKind.MOVIE),
-            fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.DATE_CREATED),
+            fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.SORT_NAME, ItemFields.DATE_CREATED),
             sortBy = listOf(ItemSortBy.SORT_NAME), startIndex = capture(offsets), limit = 200) } coAnswers {
             if (offsets.last() == 0) successQueryResult(firstChunk, 202) else {
                 assertEquals(200, offsets.last())

app/src/test/java/org/justinvisser/wolfskin/tv/PersonPickerSessionTest.kt

@@ -128,8 +128,6 @@ class PersonPickerSessionTest {
     private fun awaitLoaded(user: JellyfinUser) {
         try {
             rule.waitUntil(10_000) {
-                // Setup navigation writes Compose state asynchronously; publish it before pumping replacement composition.
-                androidx.compose.runtime.snapshots.Snapshot.sendApplyNotifications()
                 Shadows.shadowOf(Looper.getMainLooper()).idle()
                 models.lastOrNull()?.signedInPerson == user.name!!.lowercase() &&
                     models.last().conductarr.identity.value?.signedIn == true &&

app/src/test/java/org/justinvisser/wolfskin/tv/TitleReadFacadeTest.kt

@@ -33,8 +33,6 @@ import com.github.damontecres.wholphin.test.TestTracks
 import org.jellyfin.sdk.model.api.MediaStreamType
 import org.jellyfin.sdk.model.api.request.GetEpisodesRequest
 import org.jellyfin.sdk.model.api.request.GetItemsRequest
-import org.jellyfin.sdk.model.api.ItemFields
-import org.jellyfin.sdk.model.api.request.GetNextUpRequest
 import org.junit.Assert.*
 import org.junit.After
 import org.junit.Before
@@ -221,43 +219,6 @@ class TitleReadFacadeTest {
         assertEquals(2, TitleState(data, ShellPerson("justin", "Justin", "J", false)) {}.season)
     }
 
-    @Test fun leanEpisodeListsKeepSingleItemPlaybackTracksEvenWithoutNextUp() = runTest {
-        val series = BaseItemDto(id = seriesId, name = "Series", type = BaseItemKind.SERIES, people = emptyList(), providerIds = mapOf("Tmdb" to "42"))
-        val episode = file(firstId, BaseItemKind.EPISODE).copy(seriesId = seriesId, parentIndexNumber = 3, indexNumber = 1)
-        coEvery { library.getItem(seriesId) } returns successResponse(series)
-        coEvery { library.getItem(firstId) } returns successResponse(episode)
-        coEvery { shows.getNextUp(any<GetNextUpRequest>()) } coAnswers {
-            assertTrue(firstArg<GetNextUpRequest>().fields.orEmpty().isEmpty())
-            successQueryResult(emptyList())
-        }
-        coEvery { items.getItems(any<GetItemsRequest>()) } returns successQueryResult(
-            listOf(BaseItemDto(id = seasonId, type = BaseItemKind.SEASON, indexNumber = 3)))
-        coEvery { shows.getEpisodes(any<GetEpisodesRequest>()) } coAnswers {
-            val fields = firstArg<GetEpisodesRequest>().fields.orEmpty()
-            assertFalse(fields.any { it in listOf(ItemFields.MEDIA_SOURCES, ItemFields.MEDIA_STREAMS, ItemFields.PEOPLE, ItemFields.PARENT_ID) })
-            successQueryResult(listOf(episode.copy(mediaSources = null, overview = "Episode synopsis")))
-        }
-        val page = facade.read(seriesId, 3, preferences)
-        assertEquals(firstId.toString(), page.playTarget?.id)
-        assertEquals("MKV", page.versions.single().container)
-        assertEquals(listOf(3), page.versions.single().audio.map { it.index })
-        val saved = requireNotNull(facade.readSaved(seriesId, preferences))
-        assertEquals(page.versions, saved.versions)
-    }
-
-    @Test fun performerCreditListsOmitStreamsButKeepCharacterRoles() = runTest {
-        coEvery { library.getItem(firstId) } returns successResponse(
-            BaseItemDto(id = firstId, type = BaseItemKind.PERSON, name = "Actor"))
-        coEvery { items.getItems(any<GetItemsRequest>()) } coAnswers {
-            val fields = firstArg<GetItemsRequest>().fields.orEmpty()
-            assertFalse(fields.any { it in listOf(ItemFields.MEDIA_SOURCES, ItemFields.MEDIA_STREAMS, ItemFields.PARENT_ID) })
-            assertTrue(ItemFields.PEOPLE in fields)
-            successQueryResult(listOf(file(secondId).copy(people = listOf(
-                org.jellyfin.sdk.model.api.BaseItemPerson(id = firstId, name = "Actor", role = "Chef")))))
-        }
-        assertEquals("Chef", facade.readPerson(firstId, 0).credits.single().character)
-    }
-
     @Test fun compactJellyfinSourceIdUsesTheSameVersionPersistenceKey() = runTest {
         coEvery { library.getItem(firstId) } returns successResponse(file(firstId))
         coEvery { playback.savePlayVersion(any(), any()) } returns null

app/src/test/java/org/justinvisser/wolfskin/tv/update/HouseholdUpdateControllerTest.kt

@@ -1,455 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import com.sun.net.httpserver.HttpServer
-import java.io.File
-import java.net.InetSocketAddress
-import java.security.MessageDigest
-import kotlinx.coroutines.ExperimentalCoroutinesApi
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.test.UnconfinedTestDispatcher
-import kotlinx.coroutines.test.advanceUntilIdle
-import kotlinx.coroutines.test.runTest
-import org.junit.After
-import org.junit.Assert.*
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-import org.junit.rules.TemporaryFolder
-
-/** Exercises the production transport, verification store and state machine against HTTP bytes. */
-@OptIn(ExperimentalCoroutinesApi::class)
-class HouseholdUpdateControllerTest {
-    @get:Rule val temporary = TemporaryFolder()
-    private lateinit var server: HttpServer
-    private lateinit var directory: File
-    private lateinit var base: String
-    private val apk = ByteArray(128 * 1024) { (it % 251).toByte() }
-    private var code = 100001L
-    private var releaseStatus = 200
-    private var assetStatus = 200
-    private var wireTruncated = false
-    private var metadataTruncated = false
-    private var listStatus = 200
-    private var listBody = "[]"
-    private var invalidJson = false
-    private var badHash = false
-    private var truncated = false
-    private var chunked = false
-    private var unsupported = false
-    private var manifestSigner = UpdateChannel.SIGNER
-    private var redirect = false
-    private var redirectTarget: String? = null
-    private val requests = mutableListOf<Map<String, List<String>>>()
-    private val platform = Platform()
-
-    private inner class Platform : UpdatePlatform {
-        var archive = ApkIdentity(UpdateChannel.PACKAGE, InstalledVersion("1.1.1", 100001), setOf(UpdateChannel.SIGNER))
-        var installed = ApkIdentity(UpdateChannel.PACKAGE, InstalledVersion("1.1.0", 65), setOf(UpdateChannel.SIGNER))
-        var permission = true
-        var settingsAvailable = true
-        var installs = 0
-        var settingsOpens = 0
-        var inspectAction: (() -> Unit)? = null
-        var outcome = InstallOutcome.Cancelled
-        override fun installed() = installed
-        override fun inspect(file: File): ApkIdentity { inspectAction?.invoke(); return archive }
-        override fun hasInstallPermission() = permission
-        override fun openPermissionSettings(): Boolean { settingsOpens++; return settingsAvailable }
-        override fun install(file: File, asset: UpdateAsset, outcome: (InstallOutcome) -> Unit) { installs++; outcome(this.outcome) }
-    }
-    private val preferences = object : UpdatePreferences {
-        override val autoCheck = MutableStateFlow(true)
-        override suspend fun url() = "$base/releases/latest"
-        override suspend fun enabled() = autoCheck.value
-        override suspend fun setAutoCheck(enabled: Boolean) { autoCheck.value = enabled }
-    }
-
-    @Before fun start() {
-        directory = temporary.newFolder()
-        server = HttpServer.create(InetSocketAddress("127.0.0.1", 0), 0)
-        base = "http://127.0.0.1:${server.address.port}"
-        server.createContext("/") { exchange ->
-            synchronized(requests) { requests += exchange.requestHeaders.mapValues { it.value.toList() } }
-            val path = exchange.requestURI.path
-            val status = when (path) {
-                "/releases/latest" -> releaseStatus
-                "/releases" -> listStatus
-                "/apk" -> assetStatus
-                else -> 200
-            }
-            val content = when (path) {
-                "/releases/latest", "/redirected" -> if (invalidJson) "not json" else """{"name":"v1.1.1","body":"Household notes","published_at":"2026-11-07T12:00:00Z","assets":[{"name":"wolfskin-update.json","browser_download_url":"$base/manifest"},{"name":"Wolfskin-armeabi-v7a.apk","browser_download_url":"$base/apk"}]}"""
-                "/manifest" -> UpdateManifest.encode(manifest())
-                "/releases" -> listBody
-                else -> ""
-            }
-            if (redirect && path == "/releases/latest") {
-                exchange.responseHeaders.add("Location", redirectTarget ?: "$base/redirected")
-                exchange.responseHeaders.add("Set-Cookie", "private-session=never-forward")
-                exchange.sendResponseHeaders(302, -1)
-            } else {
-                val bytes = if (path == "/apk") (if (truncated) apk.copyOf(apk.size / 2) else apk) else content.toByteArray()
-                val length = when {
-                    chunked && path == "/apk" -> 0L
-                    wireTruncated && path == "/apk" -> apk.size.toLong()
-                    metadataTruncated && path == "/releases/latest" -> bytes.size + 1L
-                    else -> bytes.size.toLong()
-                }
-                exchange.sendResponseHeaders(status, length)
-                exchange.responseBody.use { it.write(bytes) }
-            }
-            exchange.close()
-        }
-        server.start()
-    }
-    @After fun stop() { server.stop(0) }
-
-    private fun manifest() = UpdateManifest(1, UpdateChannel.PACKAGE, "1.1.1", code,
-        "2026-11-07T12:00:00Z", "a".repeat(40), "pwolfskin-opt-v1.1.1", manifestSigner,
-        listOf(UpdateAsset(if (unsupported) "x86_64" else "armeabi-v7a", if (unsupported) "Wolfskin-x86_64.apk" else "Wolfskin-armeabi-v7a.apk", apk.size.toLong(),
-            if (badHash) "0".repeat(64) else MessageDigest.getInstance("SHA-256").digest(apk).joinToString("") { "%02x".format(it) }, 23)))
-
-    private fun controller(scope: kotlinx.coroutines.CoroutineScope) = HouseholdUpdateController(scope, preferences, platform,
-        UpdateTransport(allowLocalTestHttp = true), VerifiedUpdateStore(directory, platform), listOf("armeabi-v7a"), 30)
-
-    @Test fun newerReleaseDownloadsVerifiesAndRestoresWithoutInstalling() = runTest {
-        val controller = controller(this)
-        controller.check(true); advanceUntilIdle()
-        assertTrue(controller.state.value is UpdateUiState.Available)
-        val metadata = controller.release.value
-        assertEquals(controller.state.value, metadata)
-        controller.download(); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-        assertEquals(metadata, controller.release.value)
-        assertEquals(0, platform.installs)
-        val restored = controller(this); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), restored.state.value)
-        assertEquals(metadata, restored.release.value)
-        restored.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.InstallCancelled, restored.state.value)
-        assertEquals(1, platform.installs)
-        assertTrue(File(directory, "verified.apk").exists())
-    }
-
-    @Test fun existingManifestOnlyReadyRecordRemainsReadable() = runTest {
-        val old = controller(this); old.check(true); advanceUntilIdle(); old.download(); advanceUntilIdle()
-        val metadata = old.release.value!!
-        assertEquals(manifest(), UpdateManifest.parse(File(directory, "ready.json").readText()))
-        File(directory, "ready.json").writeText(UpdateManifest.encode(manifest()))
-        val recreated = controller(this); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), recreated.state.value)
-        assertEquals(metadata.copy(notes = ""), recreated.release.value)
-        assertEquals(0, platform.installs)
-    }
-
-    @Test fun equalCodeIsUpToDateAndOlderCodeIsNotASuccess() = runTest {
-        code = 65
-        val equal = controller(this); equal.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.UpToDate, equal.state.value)
-        code = 64
-        val older = controller(this); older.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.LowerVersionCode, (older.state.value as UpdateUiState.Failed).kind)
-    }
-
-    @Test fun emptyChannelIsDistinctFromMissingOrRefusedEndpoint() = runTest {
-        releaseStatus = 404
-        val empty = controller(this); empty.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.NoReleasePublished, empty.state.value)
-        for (status in listOf(401, 403, 404, 500, 503)) {
-            listStatus = status
-            val failure = controller(this); failure.check(true); advanceUntilIdle()
-            assertEquals(UpdateFailure.HttpRefused, (failure.state.value as UpdateUiState.Failed).kind)
-        }
-    }
-
-    @Test fun refusedLatestNeverBecomesUpToDate() = runTest {
-        for (status in listOf(401, 403, 500, 503)) {
-            releaseStatus = status
-            val controller = controller(this); controller.check(true); advanceUntilIdle()
-            assertEquals(UpdateFailure.HttpRefused, (controller.state.value as UpdateUiState.Failed).kind)
-        }
-    }
-
-    @Test fun invalidJsonAndUnavailableAbiAreTypedFailures() = runTest {
-        invalidJson = true
-        val invalid = controller(this); invalid.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.InvalidMetadata, (invalid.state.value as UpdateUiState.Failed).kind)
-        invalidJson = false; unsupported = true
-        val unsupported = controller(this); unsupported.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.UnsupportedAbi, (unsupported.state.value as UpdateUiState.Failed).kind)
-    }
-
-    @Test fun manifestSignerDifferentFromInstallationFailsBeforeDownload() = runTest {
-        manifestSigner = "b".repeat(64)
-        val controller = controller(this)
-        controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.WrongSigner, (controller.state.value as UpdateUiState.Failed).kind)
-        assertFalse(File(directory, "verified.apk").exists())
-        assertEquals(0, platform.installs)
-    }
-
-    @Test fun checksumAndLengthFailuresNeverCommitReady() = runTest {
-        for (badChecksum in listOf(true, false)) {
-            badHash = badChecksum; truncated = !badChecksum
-            val controller = controller(this); controller.check(true); advanceUntilIdle()
-            controller.download(); advanceUntilIdle()
-            assertEquals(UpdateFailure.ChecksumMismatch, (controller.state.value as UpdateUiState.Failed).kind)
-            assertFalse(File(directory, "ready.json").exists())
-            assertFalse(File(directory, "download.part").exists())
-        }
-    }
-
-    @Test fun wrongPackageSignerAndArchiveCodeCannotBecomeReady() = runTest {
-        val original = platform.archive
-        for ((archive, expected) in listOf(
-            original.copy(packageId = "other.package") to UpdateFailure.WrongPackage,
-            original.copy(signers = setOf("b".repeat(64))) to UpdateFailure.WrongSigner,
-            original.copy(version = InstalledVersion("1.1.1", 65)) to UpdateFailure.LowerVersionCode,
-        )) {
-            platform.archive = archive
-            val controller = controller(this); controller.check(true); advanceUntilIdle()
-            controller.download(); advanceUntilIdle()
-            assertEquals(expected, (controller.state.value as UpdateUiState.Failed).kind)
-            assertFalse(File(directory, "ready.json").exists())
-        }
-    }
-
-    @Test fun chunkedTransferReportsUnknownTotalAndCancelDeletesPartial() = runTest {
-        chunked = true
-        val controller = controller(this)
-        var observedUnknownLength = false
-        backgroundScope.launch(UnconfinedTestDispatcher(testScheduler)) {
-            controller.state.collect { state ->
-                if (state is UpdateUiState.Downloading && state.bytesDone > 0) {
-                    observedUnknownLength = state.bytesTotal == null
-                    controller.cancel()
-                }
-            }
-        }
-        controller.check(true); advanceUntilIdle()
-        controller.download(); advanceUntilIdle()
-        assertTrue(observedUnknownLength)
-        assertTrue(controller.state.value is UpdateUiState.Available)
-        assertFalse(File(directory, "download.part").exists())
-        assertFalse(File(directory, "ready.json").exists())
-    }
-
-    @Test fun redirectRequestsContainNoCredentialsAndRejectUrlUserInfo() = runTest {
-        redirect = true
-        redirectTarget = "http://localhost:${server.address.port}/redirected"
-        val controller = controller(this); controller.check(true); advanceUntilIdle()
-        assertTrue(controller.state.value is UpdateUiState.Available)
-        assertTrue(requests.size >= 3)
-        requests.forEach { headers ->
-            assertFalse(headers.keys.any { it.equals("Authorization", true) || it.equals("Cookie", true) ||
-                it.contains("Jellyfin", true) || it.contains("Emby", true) || it.contains("MediaBrowser", true) })
-        }
-        redirectTarget = "http://user:password@127.0.0.1:${server.address.port}/redirected"
-        val rejected = controller(this); rejected.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.InvalidMetadata, (rejected.state.value as UpdateUiState.Failed).kind)
-    }
-
-    @Test fun manualCheckWorksWithAutoOffAndPermissionDenialKeepsReady() = runTest {
-        preferences.autoCheck.value = false
-        val controller = controller(this)
-        controller.check(false); advanceUntilIdle()
-        assertEquals(UpdateUiState.Idle, controller.state.value)
-        controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        platform.permission = false
-        controller.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.PermissionNeeded, controller.state.value)
-        controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.PermissionNeeded, controller.state.value)
-        controller.onResume(); advanceUntilIdle()
-        assertEquals(UpdateUiState.InstallCancelled, controller.state.value)
-        assertEquals(0, platform.installs)
-        platform.settingsAvailable = false
-        controller.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.NoInstaller, controller.state.value)
-    }
-
-    @Test fun permissionDismissalRetainsReadyAndInstallReopensSettings() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        val metadata = controller.release.value
-        platform.permission = false
-        controller.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.PermissionNeeded, controller.state.value)
-        controller.install(); advanceUntilIdle()
-        assertEquals(2, platform.settingsOpens)
-        controller.cancel(); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-        assertEquals(metadata, controller.release.value)
-        assertArrayEquals(apk, File(directory, "verified.apk").readBytes())
-        controller.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.PermissionNeeded, controller.state.value)
-        assertEquals(3, platform.settingsOpens)
-        assertEquals(0, platform.installs)
-    }
-
-    @Test fun handoffDismissalKeepsReadyWithoutAllowingAnotherOwnedSession() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        platform.outcome = InstallOutcome.Pending
-        controller.install(); advanceUntilIdle()
-        controller.cancel(); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-        controller.handleInstallOutcome(InstallOutcome.Pending); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-        val before = requests.size
-        controller.install(); advanceUntilIdle()
-        controller.check(true); advanceUntilIdle()
-        controller.download(); advanceUntilIdle()
-        assertEquals(1, platform.installs)
-        assertEquals(before, requests.size)
-        assertArrayEquals(apk, File(directory, "verified.apk").readBytes())
-        controller.handleInstallOutcome(InstallOutcome.Cancelled); advanceUntilIdle()
-        controller.install(); advanceUntilIdle()
-        assertEquals(2, platform.installs)
-    }
-
-    @Test fun dismissalDuringInstallVerificationDoesNotDiscardVerifiedBytes() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        platform.inspectAction = { controller.cancel() }
-        controller.install(); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-        assertArrayEquals(apk, File(directory, "verified.apk").readBytes())
-        assertEquals(0, platform.installs)
-    }
-
-    @Test fun corruptPersistedBytesAndUnverifiedPartialsAreDiscarded() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        File(directory, "verified.apk").appendText("corrupt")
-        File(directory, "download.part").writeText("incomplete")
-        val recreated = controller(this); advanceUntilIdle()
-        assertEquals(UpdateUiState.Idle, recreated.state.value)
-        assertFalse(File(directory, "verified.apk").exists())
-        assertFalse(File(directory, "download.part").exists())
-    }
-
-    @Test fun downloadHttpFailureRetriesWithoutFalseSuccess() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle()
-        assetStatus = 403
-        controller.download(); advanceUntilIdle()
-        assertEquals(UpdateFailure.HttpRefused, (controller.state.value as UpdateUiState.Failed).kind)
-        assetStatus = 200
-        controller.retry(); advanceUntilIdle()
-        assertEquals(UpdateUiState.Ready("1.1.1"), controller.state.value)
-    }
-
-    @Test fun failuresIdentifyCheckDownloadAndInstallWithoutParsingMessages() = runTest {
-        val controller = controller(this)
-        releaseStatus = 403
-        controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateOperation.Check, (controller.state.value as UpdateUiState.Failed).operation)
-        releaseStatus = 200
-        controller.retry(); advanceUntilIdle()
-        assetStatus = 403
-        controller.download(); advanceUntilIdle()
-        assertEquals(UpdateOperation.Download, (controller.state.value as UpdateUiState.Failed).operation)
-        assetStatus = 200
-        controller.retry(); advanceUntilIdle()
-        File(directory, "verified.apk").writeBytes(ByteArray(apk.size))
-        controller.install(); advanceUntilIdle()
-        val failed = controller.state.value as UpdateUiState.Failed
-        assertEquals(UpdateOperation.Install, failed.operation)
-        assertEquals(UpdateFailure.ChecksumMismatch, failed.kind)
-        assertFalse(File(directory, "ready.json").exists())
-    }
-
-    @Test fun interruptedWireDownloadDoesNotPersistReady() = runTest {
-        truncated = true; wireTruncated = true
-        val controller = controller(this); controller.check(true); advanceUntilIdle()
-        controller.download(); advanceUntilIdle()
-        assertTrue(controller.state.value is UpdateUiState.Failed)
-        assertFalse(File(directory, "ready.json").exists())
-        assertFalse(File(directory, "download.part").exists())
-    }
-
-    @Test fun exhaustedStorageFailsBeforeDownloading() = runTest {
-        val fullDirectory = object : File(directory.absolutePath) { override fun getUsableSpace(): Long = 0 }
-        val controller = HouseholdUpdateController(this, preferences, platform, UpdateTransport(true),
-            VerifiedUpdateStore(fullDirectory, platform), listOf("armeabi-v7a"), 30)
-        controller.check(true); advanceUntilIdle()
-        val before = requests.size
-        controller.download(); advanceUntilIdle()
-        assertEquals(UpdateFailure.InsufficientStorage, (controller.state.value as UpdateUiState.Failed).kind)
-        assertEquals(before, requests.size)
-    }
-
-    @Test fun successCallbackRefreshesPackageManagerInsteadOfClaimingAnUpgrade() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        platform.outcome = InstallOutcome.Success
-        controller.install(); advanceUntilIdle()
-        assertEquals(65L, controller.installedVersion.value.versionCode)
-        assertTrue(File(directory, "verified.apk").exists())
-        controller.cancel(); advanceUntilIdle(); controller.install(); advanceUntilIdle()
-        assertEquals(1, platform.installs)
-        platform.installed = platform.archive
-        controller.onResume(); advanceUntilIdle()
-        assertEquals(100001L, controller.installedVersion.value.versionCode)
-        assertEquals(UpdateUiState.Idle, controller.state.value)
-        assertFalse(File(directory, "verified.apk").exists())
-    }
-
-    @Test fun successCallbackDeliveredToTheReplacedProcessDoesNotLeaveAFalseHandoff() = runTest {
-        val old = controller(this); old.check(true); advanceUntilIdle(); old.download(); advanceUntilIdle()
-        platform.installed = platform.archive
-        val replaced = controller(this); advanceUntilIdle()
-        replaced.handleInstallOutcome(InstallOutcome.Success); advanceUntilIdle()
-        assertEquals(100001L, replaced.installedVersion.value.versionCode)
-        assertEquals(UpdateUiState.Idle, replaced.state.value)
-        replaced.handleInstallOutcome(InstallOutcome.Cancelled); advanceUntilIdle()
-        assertEquals(UpdateUiState.Idle, replaced.state.value)
-        assertFalse(File(directory, "verified.apk").exists())
-        replaced.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.UpToDate, replaced.state.value)
-    }
-
-    @Test fun reentryCheckCannotReplacePendingConfirmationOrStartAnotherSession() = runTest {
-        val controller = controller(this); controller.check(true); advanceUntilIdle(); controller.download(); advanceUntilIdle()
-        platform.outcome = InstallOutcome.Pending
-        controller.install(); advanceUntilIdle()
-        val before = requests.size
-        controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.HandingOff, controller.state.value)
-        controller.install(); advanceUntilIdle()
-        assertEquals(1, platform.installs)
-        assertEquals(before, requests.size)
-        controller.handleInstallOutcome(InstallOutcome.Cancelled); advanceUntilIdle()
-        assertEquals(UpdateUiState.InstallCancelled, controller.state.value)
-        assertTrue(File(directory, "verified.apk").exists())
-    }
-
-    @Test fun productionTransportRefusesCleartextBeforeRequesting() = runTest {
-        try {
-            UpdateTransport().latest("$base/releases/latest", listOf("armeabi-v7a"), 30)
-            fail("Cleartext should be refused")
-        } catch (error: UpdateException) { assertEquals(UpdateFailure.InvalidMetadata, error.kind) }
-        assertTrue(requests.isEmpty())
-    }
-
-    @Test fun unavailableNetworkIsOfflineNotUpToDate() = runTest {
-        server.stop(0)
-        val controller = controller(this); controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateUiState.Offline, controller.state.value)
-    }
-
-    @Test fun interruptedFirstCheckIsNetworkFailureNotMissingDownloadStorage() = runTest {
-        directory = File(directory, "not-created")
-        metadataTruncated = true
-        val controller = controller(this); controller.check(true); advanceUntilIdle()
-        assertEquals(UpdateFailure.Network, (controller.state.value as UpdateUiState.Failed).kind)
-        assertFalse(directory.exists())
-    }
-
-    @Test fun compatibleArm32IsPreferredAndUniversalRespectsMinimumSdk() {
-        val arm32 = manifest().assets.single()
-        val arm64 = arm32.copy(abi = "arm64-v8a", name = "Wolfskin-arm64-v8a.apk")
-        val universal = arm32.copy(abi = "universal", name = "Wolfskin.apk", minSdk = 31)
-        val manifest = manifest().copy(assets = listOf(arm64, arm32, universal))
-        assertEquals(arm32, manifest.selectAsset(listOf("arm64-v8a", "armeabi-v7a"), 30))
-        try { manifest.selectAsset(listOf("unknown"), 30); fail("Minimum SDK must be enforced") }
-        catch (error: UpdateException) { assertEquals(UpdateFailure.UnsupportedAbi, error.kind) }
-    }
-}

app/src/test/java/org/justinvisser/wolfskin/tv/update/UpdateManifestTest.kt

@@ -1,49 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.fail
-import org.junit.Test
-
-/** Malformed channel metadata must never become a compatible version comparison. */
-class UpdateManifestTest {
-    private val asset = UpdateAsset("armeabi-v7a", "Wolfskin-armeabi-v7a.apk", 128, "a".repeat(64), 23)
-    private val manifest = UpdateManifest(1, UpdateChannel.PACKAGE, "1.1.1", 100001,
-        "2026-11-07T12:00:00Z", "b".repeat(40), "pwolfskin-opt-v1.1.1", UpdateChannel.SIGNER, listOf(asset))
-
-    @Test fun malformedManifestFieldsAreRejectedBeforeVersionComparison() {
-        val invalid = listOf(
-            manifest.copy(schemaVersion = 2),
-            manifest.copy(versionName = "1.1.1-opt"),
-            manifest.copy(versionCode = 0),
-            manifest.copy(publishedAt = "yesterday"),
-            manifest.copy(sourceCommit = "main"),
-            manifest.copy(sourceTag = ""),
-            manifest.copy(signerSha256 = "not-a-certificate-fingerprint"),
-            manifest.copy(assets = emptyList()),
-            manifest.copy(assets = listOf(asset.copy(bytes = 0))),
-            manifest.copy(assets = listOf(asset.copy(sha256 = "not-a-checksum"))),
-            manifest.copy(assets = listOf(asset.copy(abi = "arm64-v8a"))),
-            manifest.copy(assets = listOf(asset, asset)),
-        )
-        invalid.forEach { candidate ->
-            try { UpdateManifest.parse(UpdateManifest.encode(candidate)); fail("Invalid manifest was accepted: $candidate") }
-            catch (error: UpdateException) { assertEquals(UpdateFailure.InvalidMetadata, error.kind) }
-        }
-    }
-
-    @Test fun fallbackRequiresACompatibleStandaloneAsset() {
-        val universal = asset.copy(abi = "universal", name = "Wolfskin.apk", minSdk = 35)
-        val parsed = UpdateManifest.parse(UpdateManifest.encode(manifest.copy(assets = listOf(universal))))
-        assertEquals(universal, parsed.selectAsset(listOf("arm64-v8a"), 35))
-        try { parsed.selectAsset(listOf("arm64-v8a"), 34); fail("Unsupported minimum SDK was accepted") }
-        catch (error: UpdateException) { assertEquals(UpdateFailure.UnsupportedAbi, error.kind) }
-    }
-
-    @Test fun universalDoesNotMakeAnUnsupportedProcessorCompatible() {
-        val universal = asset.copy(abi = "universal", name = "Wolfskin.apk")
-        val parsed = UpdateManifest.parse(UpdateManifest.encode(manifest.copy(assets = listOf(universal))))
-        try { parsed.selectAsset(listOf("riscv64"), 34); fail("Unsupported processor was accepted") }
-        catch (error: UpdateException) { assertEquals(UpdateFailure.UnsupportedAbi, error.kind) }
-    }
-}

app/src/test/java/org/justinvisser/wolfskin/tv/update/UpdateSessionStreamTest.kt

@@ -1,34 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import java.io.ByteArrayOutputStream
-import java.security.MessageDigest
-import org.junit.Assert.assertEquals
-import org.junit.Assert.fail
-import org.junit.Test
-
-/** A replacement or incomplete stream must never reach the session commit boundary. */
-class UpdateSessionStreamTest {
-    private val original = ByteArray(128 * 1024) { (it % 251).toByte() }
-    private val asset = UpdateAsset("armeabi-v7a", "Wolfskin-armeabi-v7a.apk", original.size.toLong(),
-        MessageDigest.getInstance("SHA-256").digest(original).toHexString(), 23)
-
-    @Test fun sameLengthReplacementAfterVerificationIsRejected() {
-        val replaced = original.copyOf().also { it[it.lastIndex] = (it.last() + 1).toByte() }
-        expectMismatch(replaced)
-    }
-
-    @Test fun truncatedAndOversizedSessionStreamsAreRejected() {
-        expectMismatch(original.copyOf(original.size - 1))
-        expectMismatch(original + byteArrayOf(1))
-    }
-
-    private fun expectMismatch(bytes: ByteArray) {
-        try {
-            bytes.inputStream().use { copyVerifiedUpdate(it, ByteArrayOutputStream(), asset) }
-            fail("Changed installation bytes were accepted")
-        } catch (error: UpdateException) {
-            assertEquals(UpdateFailure.ChecksumMismatch, error.kind)
-        }
-    }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/read/LibraryReadFacade.kt

@@ -72,7 +72,7 @@ class LibraryReadFacade @Inject constructor(private val api: ApiClient) {
                 val response = api.itemsApi.getItems(
                     userId = userId, parentId = library.id, recursive = true,
                     includeItemTypes = listOf(if (destination == "movies") BaseItemKind.MOVIE else BaseItemKind.SERIES),
-                    fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.DATE_CREATED),
+                    fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.SORT_NAME, ItemFields.DATE_CREATED),
                     sortBy = listOf(ItemSortBy.SORT_NAME), startIndex = offset,
                     limit = WolfskinTokens.Behaviour.libraryChunk.toInt(),
                 ).content

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/read/TitleReadFacade.kt

@@ -53,8 +53,7 @@ class TitleReadFacade @Inject constructor(
     @param:ApplicationContext private val context: Context,
 ) {
     private val json = Json { ignoreUnknownKeys = true }
-    private val episodeFields = listOf(ItemFields.PROVIDER_IDS, ItemFields.OVERVIEW)
+    private val fields = listOf(ItemFields.PROVIDER_IDS, ItemFields.MEDIA_SOURCES, ItemFields.MEDIA_STREAMS, ItemFields.OVERVIEW, ItemFields.PEOPLE, ItemFields.PARENT_ID)
-    private val creditFields = listOf(ItemFields.PROVIDER_IDS, ItemFields.OVERVIEW, ItemFields.PEOPLE)
 
     /** Resolve through this user's Jellyfin permissions before granting a catalogue card playback. */
     suspend fun findHeld(tmdb: Long, media: String): UUID? {
@@ -89,12 +88,12 @@ class TitleReadFacade @Inject constructor(
         val series = if (opened.type == BaseItemKind.EPISODE && opened.seriesId != null) readItem(opened.seriesId!!) else opened
         val seasons = if (series.type == BaseItemKind.SERIES) api.itemsApi.getItems(GetItemsRequest(parentId = series.id, includeItemTypes = listOf(BaseItemKind.SEASON), recursive = false, sortBy = listOf(ItemSortBy.INDEX_NUMBER))).content.items.orEmpty() else emptyList()
         val next = if (opened.type == BaseItemKind.EPISODE || opened.type == BaseItemKind.MOVIE) opened else {
-            api.tvShowsApi.getNextUp(GetNextUpRequest(seriesId = series.id, userId = repository.currentUser?.id, limit = 1, enableResumable = true)).content.items.firstOrNull()?.let { readItem(it.id) }
+            api.tvShowsApi.getNextUp(GetNextUpRequest(seriesId = series.id, userId = repository.currentUser?.id, limit = 1, fields = fields, enableResumable = true)).content.items.firstOrNull()?.let { api.userLibraryApi.getItem(it.id).content }
         }
         val selectedNumber = season ?: next?.parentIndexNumber ?: seasons.firstOrNull()?.indexNumber
         val selected = seasons.firstOrNull { it.indexNumber == selectedNumber } ?: seasons.firstOrNull()
-        val episodes = selected?.let { api.tvShowsApi.getEpisodes(GetEpisodesRequest(seriesId = series.id, seasonId = it.id, fields = episodeFields)).content.items.orEmpty() }.orEmpty()
+        val episodes = selected?.let { api.tvShowsApi.getEpisodes(GetEpisodesRequest(seriesId = series.id, seasonId = it.id, fields = fields)).content.items.orEmpty() }.orEmpty()
-        val target = next ?: episodes.firstOrNull { it.type == BaseItemKind.EPISODE }?.let { readItem(it.id) }
+        val target = next ?: episodes.firstOrNull { it.type == BaseItemKind.EPISODE }
         val rows = (listOf(series, opened) + listOfNotNull(target) + episodes).distinctBy { it.id }
         val numbers = seasons.mapNotNull { it.indexNumber }
         val result = build(rows, numbers, selected?.indexNumber, opened.id.toString(), target?.id?.toString(), preferences)
@@ -166,7 +165,7 @@ class TitleReadFacade @Inject constructor(
         } else emptyList()
         val person = previous.firstOrNull() ?: api.userLibraryApi.getItem(id).content
         val credits = api.itemsApi.getItems(GetItemsRequest(personIds = listOf(id), recursive = true,
-            includeItemTypes = listOf(BaseItemKind.MOVIE, BaseItemKind.SERIES), fields = creditFields, startIndex = start, limit = 200,
+            includeItemTypes = listOf(BaseItemKind.MOVIE, BaseItemKind.SERIES), fields = fields, startIndex = start, limit = 200,
             sortBy = listOf(ItemSortBy.PRODUCTION_YEAR, ItemSortBy.SORT_NAME))).content.items.orEmpty()
         val rows = listOf(person) + (previous.drop(1) + credits).distinctBy { it.id }
         if (personCacheFile(id) != file) throw kotlinx.coroutines.CancellationException("Performer identity changed")

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/AndroidUpdatePlatform.kt

@@ -1,111 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageInfo
-import android.content.pm.PackageInstaller
-import android.content.pm.PackageManager
-import android.net.Uri
-import android.os.Build
-import android.provider.Settings
-import dagger.hilt.android.qualifiers.ApplicationContext
-import java.io.File
-import java.io.InputStream
-import java.io.OutputStream
-import java.security.MessageDigest
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/** PackageManager inspection and confirmation-required PackageInstaller sessions. */
-@Singleton
-class AndroidUpdatePlatform @Inject constructor(@param:ApplicationContext private val context: Context) : UpdatePlatform {
-    private val manager = context.packageManager
-    private val sessions = context.getSharedPreferences("update-install-session", Context.MODE_PRIVATE)
-    override fun installed(): ApkIdentity = identity(manager.getPackageInfo(context.packageName, signatureFlags()))
-    override fun inspect(file: File): ApkIdentity? = manager.getPackageArchiveInfo(file.absolutePath, signatureFlags())?.let(::identity)
-
-    @Suppress("DEPRECATION")
-    private fun signatureFlags(): Int = if (Build.VERSION.SDK_INT >= 28) PackageManager.GET_SIGNING_CERTIFICATES else PackageManager.GET_SIGNATURES
-
-    @Suppress("DEPRECATION")
-    private fun identity(info: PackageInfo): ApkIdentity {
-        val certificates = if (Build.VERSION.SDK_INT >= 28) info.signingInfo?.apkContentsSigners else info.signatures
-        val hashes = certificates.orEmpty().map {
-            MessageDigest.getInstance("SHA-256").digest(it.toByteArray()).toHexString()
-        }.toSet()
-        val code = if (Build.VERSION.SDK_INT >= 28) info.longVersionCode else info.versionCode.toLong()
-        return ApkIdentity(info.packageName, InstalledVersion(info.versionName.orEmpty(), code), hashes)
-    }
-
-    override fun hasInstallPermission(): Boolean = if (Build.VERSION.SDK_INT >= 26) manager.canRequestPackageInstalls()
-        else Settings.Secure.getInt(context.contentResolver, Settings.Secure.INSTALL_NON_MARKET_APPS, 0) == 1
-
-    override fun openPermissionSettings(): Boolean {
-        val intent = if (Build.VERSION.SDK_INT >= 26) Intent(Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES, Uri.parse("package:${context.packageName}"))
-            else Intent(Settings.ACTION_SECURITY_SETTINGS)
-        if (intent.resolveActivity(manager) == null) return false
-        return try { context.startActivity(intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)); true } catch (_: RuntimeException) { false }
-    }
-
-    override fun install(file: File, asset: UpdateAsset, outcome: (InstallOutcome) -> Unit) {
-        if (context.noBackupFilesDir.usableSpace < file.length()) {
-            outcome(InstallOutcome.InsufficientStorage)
-            return
-        }
-        val installer = manager.packageInstaller
-        val parameters = PackageInstaller.SessionParams(PackageInstaller.SessionParams.MODE_FULL_INSTALL).apply {
-            setAppPackageName(context.packageName)
-            setSize(asset.bytes)
-            if (Build.VERSION.SDK_INT >= 31) setRequireUserAction(PackageInstaller.SessionParams.USER_ACTION_REQUIRED)
-        }
-        var sessionId: Int? = null
-        try {
-            sessionId = installer.createSession(parameters)
-            check(sessions.edit().putInt("id", sessionId).commit())
-            installer.openSession(sessionId).use { session ->
-                session.openWrite("Wolfskin.apk", 0, asset.bytes).use { output ->
-                    file.inputStream().use { copyVerifiedUpdate(it, output, asset) }
-                    session.fsync(output)
-                }
-                val intent = Intent(context, UpdateInstallReceiver::class.java).setAction("${context.packageName}.UPDATE_RESULT")
-                val flags = PendingIntent.FLAG_UPDATE_CURRENT or if (Build.VERSION.SDK_INT >= 31) PendingIntent.FLAG_MUTABLE else 0
-                val result = PendingIntent.getBroadcast(context, sessionId, intent, flags)
-                session.commit(result.intentSender)
-            }
-        } catch (error: Exception) {
-            sessionId?.let { runCatching { installer.abandonSession(it) } }
-            if (error is UpdateException) throw error
-            outcome(InstallOutcome.Unavailable)
-        }
-    }
-
-    fun ownsSession(intent: Intent): Boolean = intent.getIntExtra(PackageInstaller.EXTRA_SESSION_ID, -1) == sessions.getInt("id", -2)
-
-    fun launchConfirmation(intent: Intent): Boolean {
-        val activity = Intent(context, UpdateConfirmationActivity::class.java).putExtra("confirmation", intent)
-        return try {
-            context.startActivity(activity.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
-            true
-        } catch (_: RuntimeException) { false }
-    }
-}
-
-/** Check the bytes actually staged into Android, not a prior read of the private path. */
-internal fun copyVerifiedUpdate(input: InputStream, output: OutputStream, asset: UpdateAsset) {
-    val digest = MessageDigest.getInstance("SHA-256")
-    val buffer = ByteArray(64 * 1024)
-    var count = 0L
-    while (true) {
-        val length = input.read(buffer)
-        if (length < 0) break
-        count += length
-        if (count > asset.bytes) throw UpdateException(UpdateFailure.ChecksumMismatch, "APK changed while staging installation")
-        digest.update(buffer, 0, length)
-        output.write(buffer, 0, length)
-    }
-    if (count != asset.bytes || digest.digest().toHexString() != asset.sha256) {
-        throw UpdateException(UpdateFailure.ChecksumMismatch, "APK changed while staging installation")
-    }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/AndroidUpdateService.kt

@@ -1,58 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import android.content.Context
-import android.os.Build
-import androidx.datastore.core.DataStore
-import com.github.damontecres.wholphin.preferences.AppPreferences
-import com.github.damontecres.wholphin.preferences.update
-import com.github.damontecres.wholphin.services.hilt.IoCoroutineScope
-import dagger.Module
-import dagger.Provides
-import dagger.hilt.InstallIn
-import dagger.hilt.android.qualifiers.ApplicationContext
-import dagger.hilt.components.SingletonComponent
-import java.io.File
-import javax.inject.Inject
-import javax.inject.Singleton
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.flow.SharingStarted
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.stateIn
-
-/** Hilt entry point shared by app startup, Wolfskin UI and classic update controls. */
-@Singleton
-class AndroidUpdateService @Inject constructor(
-    @param:ApplicationContext context: Context,
-    @param:IoCoroutineScope scope: CoroutineScope,
-    dataStore: DataStore<AppPreferences>,
-    val platform: AndroidUpdatePlatform,
-) {
-    private val preferences = object : UpdatePreferences {
-        override val autoCheck = dataStore.data.map { it.autoCheckForUpdates }.stateIn(scope, SharingStarted.Eagerly, true)
-        override suspend fun enabled() = dataStore.data.first().autoCheckForUpdates
-        override suspend fun url(): String {
-            val prefs = dataStore.updateData { current ->
-                val url = UpdateChannel.migrateUrl(context.packageName, current.updateUrl)
-                if (url == current.updateUrl) current else current.update { updateUrl = url }
-            }
-            return prefs.updateUrl
-        }
-        override suspend fun setAutoCheck(enabled: Boolean) {
-            dataStore.updateData { it.update { autoCheckForUpdates = enabled } }
-        }
-    }
-    val controller = HouseholdUpdateController(scope, preferences, platform, UpdateTransport(),
-        VerifiedUpdateStore(File(context.noBackupFilesDir, "updates"), platform), Build.SUPPORTED_ABIS.toList(), Build.VERSION.SDK_INT)
-    suspend fun channelUrl(): String = preferences.url()
-}
-
-/** Single process-scoped controller binding for every update entry point. */
-@Module
-@InstallIn(SingletonComponent::class)
-object UpdateModule {
-    @Provides
-    @Singleton
-    fun provideUpdateController(service: AndroidUpdateService): UpdateController = service.controller
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/ClassicUpdatePage.kt

@@ -1,82 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.collectAsState
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.LifecycleEventObserver
-import androidx.lifecycle.compose.LocalLifecycleOwner
-import androidx.tv.material3.Button
-import androidx.tv.material3.Text
-import com.github.damontecres.wholphin.ui.components.ScrollableDialog
-import com.mikepenz.markdown.m3.Markdown
-import org.justinvisser.wolfskin.design.WolfskinTokens
-
-/** Trial entry point uses the same verified service, never the legacy download-and-install path. */
-@Composable
-fun ClassicUpdatePage(controller: UpdateController, modifier: Modifier = Modifier) {
-    val state by controller.state.collectAsState()
-    val installed by controller.installedVersion.collectAsState()
-    val lifecycle = LocalLifecycleOwner.current.lifecycle
-    var notes by remember { mutableStateOf<String?>(null) }
-    LaunchedEffect(controller) { controller.check(true) }
-    DisposableEffect(lifecycle, controller) {
-        val observer = LifecycleEventObserver { _, event -> if (event == Lifecycle.Event.ON_RESUME) controller.onResume() }
-        lifecycle.addObserver(observer)
-        onDispose { lifecycle.removeObserver(observer) }
-    }
-    Column(modifier, verticalArrangement = Arrangement.spacedBy(WolfskinTokens.Shell.settingsRowGap)) {
-        Text("Installed: ${installed.versionName}")
-        when (val current = state) {
-            is UpdateUiState.Available -> {
-                Text("${current.versionName} · ${current.bytes} bytes · ${current.dateText}")
-                Button(onClick = controller::download) { Text("Download") }
-                if (current.notes.isNotBlank()) {
-                    Button(onClick = { notes = current.notes }) { Text("Release notes") }
-                }
-            }
-            is UpdateUiState.Downloading -> {
-                Text("${current.bytesDone} / ${current.bytesTotal ?: "—"} bytes")
-                Button(onClick = controller::cancel) { Text("Cancel download") }
-            }
-            is UpdateUiState.Ready, UpdateUiState.InstallCancelled, UpdateUiState.PermissionNeeded, UpdateUiState.NoInstaller -> {
-                Text(when (current) {
-                    UpdateUiState.InstallCancelled -> "Installation cancelled; verified download retained"
-                    UpdateUiState.PermissionNeeded -> "Allow updates from this app in Android settings"
-                    UpdateUiState.NoInstaller -> "Android installer or permission settings unavailable"
-                    else -> "Verified update ready"
-                })
-                Button(onClick = controller::install) { Text("Install update") }
-            }
-            is UpdateUiState.Failed -> {
-                Text(current.message)
-                Button(onClick = controller::retry) { Text("Retry") }
-            }
-            UpdateUiState.HandingOff -> Text("Confirm installation in Android")
-            else -> {
-                Text(when (current) {
-                    UpdateUiState.UpToDate -> "Up to date"
-                    UpdateUiState.NoReleasePublished -> "No release published"
-                    UpdateUiState.Offline -> "No network"
-                    UpdateUiState.Checking -> "Checking"
-                    else -> "Check for an update"
-                })
-                Button(onClick = { controller.check(true) }) { Text("Check again") }
-            }
-        }
-    }
-    notes?.let { body ->
-        ScrollableDialog(onDismissRequest = { notes = null }) {
-            item { Markdown(content = body) }
-        }
-    }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/FakeUpdateController.kt

@@ -1,36 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.asStateFlow
-
-/** Deterministic capture/test controller; no network, storage or Android hand-off. */
-class FakeUpdateController(
-    initialState: UpdateUiState = UpdateUiState.Idle,
-    initialAutoCheck: Boolean = true,
-    initialVersion: InstalledVersion = InstalledVersion("1.1.1", 100001),
-    initialRelease: UpdateUiState.Available? = initialState as? UpdateUiState.Available,
-) : UpdateController {
-    private val mutableState = MutableStateFlow(initialState)
-    private val mutableAutoCheck = MutableStateFlow(initialAutoCheck)
-    private val mutableVersion = MutableStateFlow(initialVersion)
-    private val mutableRelease = MutableStateFlow(initialRelease)
-    override val state = mutableState.asStateFlow()
-    override val autoCheck = mutableAutoCheck.asStateFlow()
-    override val installedVersion = mutableVersion.asStateFlow()
-    override val release = mutableRelease.asStateFlow()
-    val actions = mutableListOf<String>()
-
-    fun show(state: UpdateUiState) {
-        if (state is UpdateUiState.Available) mutableRelease.value = state
-        mutableState.value = state
-    }
-    fun showInstalled(version: InstalledVersion) { mutableVersion.value = version }
-    override fun check(manual: Boolean) { actions += "check:$manual" }
-    override fun download() { actions += "download" }
-    override fun cancel() { actions += "cancel" }
-    override fun install() { actions += "install" }
-    override fun retry() { actions += "retry" }
-    override fun onResume() { actions += "resume" }
-    override fun setAutoCheck(enabled: Boolean) { mutableAutoCheck.value = enabled }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/HouseholdUpdateController.kt

@@ -1,223 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import java.io.IOException
-import java.net.ConnectException
-import java.net.UnknownHostException
-import java.time.Instant
-import java.time.ZoneId
-import java.time.format.DateTimeFormatter
-import java.util.Locale
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.async
-import kotlinx.coroutines.currentCoroutineContext
-import kotlinx.coroutines.ensureActive
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-
-/** Existing app preferences, not a separate updater preference store. */
-interface UpdatePreferences {
-    val autoCheck: StateFlow<Boolean>
-    suspend fun url(): String
-    suspend fun enabled(): Boolean
-    suspend fun setAutoCheck(enabled: Boolean)
-}
-
-/** Process-owned operations outlive screens; only explicit install() crosses into Android. */
-class HouseholdUpdateController(
-    private val scope: CoroutineScope,
-    private val preferences: UpdatePreferences,
-    private val platform: UpdatePlatform,
-    private val transport: UpdateTransport,
-    private val store: VerifiedUpdateStore,
-    private val abis: List<String>,
-    private val sdk: Int,
-) : UpdateController {
-    private val mutableState = MutableStateFlow<UpdateUiState>(UpdateUiState.Idle)
-    private val mutableVersion = MutableStateFlow(platform.installed().version)
-    private val mutableRelease = MutableStateFlow<UpdateUiState.Available?>(null)
-    override val state = mutableState.asStateFlow()
-    override val installedVersion = mutableVersion.asStateFlow()
-    override val autoCheck = preferences.autoCheck
-    override val release = mutableRelease.asStateFlow()
-    private var candidate: UpdateCandidate? = null
-    private var ready: UpdateManifest? = null
-    private var operation: Job? = null
-    @Volatile private var installerActive = false
-    private var retryOperation: () -> Unit = { check(true) }
-    private val restored = scope.async {
-        store.restore(abis, sdk)?.let {
-            ready = it.manifest
-            mutableRelease.value = available(it.manifest, it.asset, it.notes)
-            mutableState.value = UpdateUiState.Ready(it.manifest.versionName)
-        }
-    }
-
-    @Synchronized
-    private fun runOperation(operationKind: UpdateOperation, action: suspend () -> Unit): Unit {
-        if (operation?.isActive == true) return
-        operation = scope.launch {
-            restored.await()
-            try { action() }
-            catch (error: CancellationException) { throw error }
-            catch (error: UpdateException) { mutableState.value = UpdateUiState.Failed(error.kind, error.message, operationKind) }
-            catch (_: UnknownHostException) { mutableState.value = UpdateUiState.Offline }
-            catch (_: ConnectException) { mutableState.value = UpdateUiState.Offline }
-            catch (error: IOException) {
-                val release = candidate
-                val full = state.value is UpdateUiState.Downloading && release != null &&
-                    store.directory.usableSpace < release.asset.bytes
-                mutableState.value = UpdateUiState.Failed(if (full) UpdateFailure.InsufficientStorage else UpdateFailure.Network,
-                    if (full) "Not enough storage for the update" else "Update transfer failed; try again", operationKind)
-            }
-            catch (_: Exception) { mutableState.value = UpdateUiState.Failed(UpdateFailure.InvalidMetadata, "Update could not be processed", operationKind) }
-        }
-    }
-
-    private fun systemOwnsFlow(current: UpdateUiState): Boolean =
-        installerActive || current == UpdateUiState.HandingOff || current == UpdateUiState.PermissionNeeded
-
-    override fun check(manual: Boolean): Unit = runOperation(UpdateOperation.Check) {
-        if (systemOwnsFlow(state.value)) return@runOperation
-        if (!manual && !preferences.enabled()) return@runOperation
-        ready?.let { manifest ->
-            mutableState.update { if (systemOwnsFlow(it)) it else UpdateUiState.Ready(manifest.versionName) }
-            return@runOperation
-        }
-        retryOperation = { check(true) }
-        mutableState.value = UpdateUiState.Checking
-        val release = transport.latest(preferences.url(), abis, sdk)
-        if (release == null) {
-            candidate = null; mutableRelease.value = null
-            mutableState.value = UpdateUiState.NoReleasePublished
-            return@runOperation
-        }
-        val installed = platform.installed()
-        mutableVersion.value = installed.version
-        if (release.manifest.packageId != installed.packageId) throw UpdateException(UpdateFailure.WrongPackage, "Release belongs to a different application")
-        if (installed.signers != setOf(release.manifest.signerSha256)) throw UpdateException(UpdateFailure.WrongSigner, "Release signer differs from this installation")
-        if (release.manifest.versionCode < installed.version.versionCode) throw UpdateException(UpdateFailure.LowerVersionCode, "Channel release is older than this installation")
-        if (release.manifest.versionCode == installed.version.versionCode) {
-            candidate = null; mutableRelease.value = null
-            mutableState.value = UpdateUiState.UpToDate
-        } else {
-            candidate = release
-            val metadata = available(release.manifest, release.asset, release.notes)
-            mutableRelease.value = metadata
-            mutableState.value = metadata
-        }
-    }
-
-    private fun available(manifest: UpdateManifest, asset: UpdateAsset, notes: String): UpdateUiState.Available {
-        val date = DateTimeFormatter.ofLocalizedDate(java.time.format.FormatStyle.MEDIUM).withLocale(Locale.getDefault())
-            .withZone(ZoneId.systemDefault()).format(Instant.parse(manifest.publishedAt))
-        return UpdateUiState.Available(manifest.versionName, asset.bytes, date, notes)
-    }
-
-    override fun download(): Unit = runOperation(UpdateOperation.Download) {
-        if (systemOwnsFlow(state.value)) return@runOperation
-        if (ready != null) return@runOperation
-        val release = candidate ?: return@runOperation
-        retryOperation = { download() }
-        store.prepare()
-        if (store.directory.usableSpace < release.asset.bytes) throw UpdateException(UpdateFailure.InsufficientStorage, "Not enough storage for the update")
-        mutableState.value = UpdateUiState.Downloading(0, null)
-        try {
-            transport.download(release, store.partial) { done, total -> mutableState.value = UpdateUiState.Downloading(done, total) }
-            currentCoroutineContext().ensureActive()
-            store.commit(release.manifest, release.asset, release.notes)
-            currentCoroutineContext().ensureActive()
-            ready = release.manifest
-            mutableState.value = UpdateUiState.Ready(release.manifest.versionName)
-        } catch (error: Exception) {
-            store.clear()
-            throw error
-        } finally { store.partial.delete() }
-    }
-
-    @Synchronized
-    override fun cancel() {
-        transport.cancel()
-        val previous = operation
-        if (!installerActive) previous?.cancel()
-        operation = scope.launch {
-            previous?.join()
-            store.partial.delete()
-            mutableState.value = ready?.let { UpdateUiState.Ready(it.versionName) }
-                ?: candidate?.let { mutableRelease.value } ?: UpdateUiState.Idle
-        }
-    }
-
-    override fun install(): Unit = runOperation(UpdateOperation.Install) {
-        if (installerActive || state.value == UpdateUiState.HandingOff) return@runOperation
-        val manifest = ready ?: return@runOperation
-        retryOperation = { install() }
-        val asset = manifest.selectAsset(abis, sdk)
-        try {
-            store.verify(store.apk, manifest, asset)
-            if (!platform.hasInstallPermission()) {
-                mutableState.value = if (platform.openPermissionSettings()) UpdateUiState.PermissionNeeded else UpdateUiState.NoInstaller
-                return@runOperation
-            }
-            currentCoroutineContext().ensureActive()
-            installerActive = true
-            mutableState.value = UpdateUiState.HandingOff
-            platform.install(store.apk, asset, ::handleInstallOutcome)
-        } catch (error: CancellationException) {
-            installerActive = false
-            throw error
-        } catch (error: Exception) {
-            installerActive = false
-            store.clear(); ready = null
-            retryOperation = { if (candidate != null) download() else check(true) }
-            throw error
-        }
-    }
-
-    fun handleInstallOutcome(outcome: InstallOutcome) {
-        scope.launch {
-            restored.await()
-            installerActive = outcome == InstallOutcome.Pending || outcome == InstallOutcome.Success
-            if (ready == null && outcome != InstallOutcome.Pending) {
-                installerActive = false
-                retryOperation = { check(true) }
-                mutableState.value = UpdateUiState.Idle
-                onResume()
-                return@launch
-            }
-            mutableState.value = when (outcome) {
-                InstallOutcome.Pending -> if (state.value is UpdateUiState.Ready) state.value else UpdateUiState.HandingOff
-                InstallOutcome.Cancelled -> UpdateUiState.InstallCancelled
-                InstallOutcome.Unavailable -> UpdateUiState.NoInstaller
-                InstallOutcome.InsufficientStorage -> UpdateUiState.Failed(UpdateFailure.InsufficientStorage, "Android needs more storage to install the retained update", UpdateOperation.Install)
-                InstallOutcome.Failed -> UpdateUiState.Failed(UpdateFailure.InvalidMetadata, "Android could not install the update; the verified download is retained", UpdateOperation.Install)
-                InstallOutcome.Success -> UpdateUiState.HandingOff
-            }
-            if (outcome != InstallOutcome.Pending) onResume()
-        }
-    }
-
-    override fun retry() { retryOperation() }
-    override fun setAutoCheck(enabled: Boolean) { scope.launch { preferences.setAutoCheck(enabled) } }
-    override fun onResume() {
-        scope.launch {
-            operation?.join()
-            restored.await()
-            mutableVersion.value = platform.installed().version
-            val manifest = ready ?: return@launch
-            if (mutableVersion.value.versionCode >= manifest.versionCode) {
-                installerActive = false
-                store.clear(); ready = null; candidate = null; mutableRelease.value = null; mutableState.value = UpdateUiState.Idle
-            } else if (state.value == UpdateUiState.PermissionNeeded) {
-                // Returning from settings requires another explicit Install press.
-                mutableState.value = if (platform.hasInstallPermission()) UpdateUiState.Ready(manifest.versionName)
-                    else UpdateUiState.InstallCancelled
-            }
-        }
-    }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/UpdateChannel.kt

@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-/** Package-scoped channel policy; the old production sandbox retains its original feed. */
-object UpdateChannel {
-    const val PACKAGE = "org.justinvisser.wolfskin.tv.opt"
-    const val SIGNER = "182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d"
-    const val LEGACY_URL = "https://git.justinvisser.org/api/v1/repos/justinzeus/wolfskin/releases/latest"
-    const val LATEST_URL = "https://git.justinvisser.org/api/v1/repos/justinzeus/wolfskin-tv-updates/releases/latest"
-    fun defaultUrl(packageId: String): String = if (packageId == PACKAGE) LATEST_URL else LEGACY_URL
-    fun migrateUrl(packageId: String, saved: String): String =
-        if (packageId == PACKAGE && (saved == LEGACY_URL || saved.isBlank())) LATEST_URL else saved
-    fun isNewer(candidateCode: Long, installedCode: Long): Boolean = candidateCode > installedCode
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/UpdateController.kt

@@ -1,52 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import kotlinx.coroutines.flow.StateFlow
-
-/** Shared process-scoped updater for Wolfskin and classic settings. */
-interface UpdateController {
-    val state: StateFlow<UpdateUiState>
-    val autoCheck: StateFlow<Boolean>
-    val installedVersion: StateFlow<InstalledVersion>
-    val release: StateFlow<UpdateUiState.Available?>
-
-    fun check(manual: Boolean)
-    fun download()
-    /** Discard partial bytes; retain verified bytes and restore Ready without duplicating a system session. */
-    fun cancel()
-    fun install()
-    fun retry()
-    fun setAutoCheck(enabled: Boolean)
-
-    /** Refresh installed identity and unknown-source permission after Android returns. */
-    fun onResume()
-}
-
-/** PackageManager identity, refreshed after returning from the system installer. */
-data class InstalledVersion(val versionName: String, val versionCode: Long)
-
-/** Only verified, app-private bytes may produce Ready. Checking never initiates download. */
-sealed interface UpdateUiState {
-    data object Idle : UpdateUiState
-    data object Checking : UpdateUiState
-    data object UpToDate : UpdateUiState
-    data object NoReleasePublished : UpdateUiState
-    data class Available(val versionName: String, val bytes: Long, val dateText: String, val notes: String) : UpdateUiState
-    data class Downloading(val bytesDone: Long, val bytesTotal: Long?) : UpdateUiState
-    data class Ready(val versionName: String) : UpdateUiState
-    data object PermissionNeeded : UpdateUiState
-    data object HandingOff : UpdateUiState
-    data object InstallCancelled : UpdateUiState
-    data class Failed(val kind: UpdateFailure, val message: String, val operation: UpdateOperation) : UpdateUiState
-    data object Offline : UpdateUiState
-    data object NoInstaller : UpdateUiState
-}
-
-/** The failed action is structured; UI must not infer it from a reason string. */
-enum class UpdateOperation { Check, Download, Install }
-
-/** Failures are distinct from a successful version comparison or an empty channel. */
-enum class UpdateFailure {
-    Network, HttpRefused, InvalidMetadata, UnsupportedAbi, InsufficientStorage,
-    ChecksumMismatch, WrongPackage, WrongSigner, LowerVersionCode,
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/UpdateInstallReceiver.kt

@@ -1,61 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import androidx.activity.ComponentActivity
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageInstaller
-import android.os.Bundle
-import dagger.hilt.android.AndroidEntryPoint
-import javax.inject.Inject
-
-/** Explicit, non-exported callback target accepts only the locally recorded install session. */
-@AndroidEntryPoint
-class UpdateInstallReceiver : BroadcastReceiver() {
-    @Inject lateinit var service: AndroidUpdateService
-    @Suppress("DEPRECATION")
-    override fun onReceive(context: Context, intent: Intent) {
-        if (!service.platform.ownsSession(intent)) return
-        val outcome = when (intent.getIntExtra(PackageInstaller.EXTRA_STATUS, PackageInstaller.STATUS_FAILURE)) {
-            PackageInstaller.STATUS_PENDING_USER_ACTION -> {
-                val confirmation = intent.getParcelableExtra<Intent>(Intent.EXTRA_INTENT)
-                if (confirmation != null && service.platform.launchConfirmation(confirmation)) InstallOutcome.Pending else InstallOutcome.Unavailable
-            }
-            PackageInstaller.STATUS_SUCCESS -> InstallOutcome.Success
-            PackageInstaller.STATUS_FAILURE_ABORTED -> InstallOutcome.Cancelled
-            PackageInstaller.STATUS_FAILURE_STORAGE -> InstallOutcome.InsufficientStorage
-            else -> InstallOutcome.Failed
-        }
-        service.controller.handleInstallOutcome(outcome)
-    }
-}
-
-/** System confirmation is launched for result so cancelling retains the already-verified APK. */
-@AndroidEntryPoint
-class UpdateConfirmationActivity : ComponentActivity() {
-    @Inject lateinit var service: AndroidUpdateService
-    @Suppress("DEPRECATION")
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        if (savedInstanceState != null) return
-        val confirmation = intent.getParcelableExtra<Intent>("confirmation")
-        if (confirmation == null || confirmation.resolveActivity(packageManager) == null) {
-            service.controller.handleInstallOutcome(InstallOutcome.Unavailable)
-            finish()
-            return
-        }
-        try { startActivityForResult(confirmation, 1) } catch (_: RuntimeException) {
-            service.controller.handleInstallOutcome(InstallOutcome.Unavailable)
-            finish()
-        }
-    }
-
-    @Deprecated("System installer uses the activity result contract")
-    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
-        super.onActivityResult(requestCode, resultCode, data)
-        if (requestCode == 1 && resultCode == RESULT_CANCELED) service.controller.handleInstallOutcome(InstallOutcome.Cancelled)
-        service.controller.onResume()
-        finish()
-    }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/UpdateManifest.kt

@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import java.time.Instant
-import kotlinx.serialization.Serializable
-import kotlinx.serialization.json.Json
-
-/** Signed APK metadata published only after the final APKs have been inspected. */
-@Serializable
-data class UpdateManifest(
-    val schemaVersion: Int,
-    val packageId: String,
-    val versionName: String,
-    val versionCode: Long,
-    val publishedAt: String,
-    val sourceCommit: String,
-    val sourceTag: String,
-    val signerSha256: String,
-    val assets: List<UpdateAsset>,
-) {
-    fun selectAsset(abis: List<String>, sdk: Int): UpdateAsset {
-        fun compatible(abi: String) = assets.firstOrNull { it.abi == abi && it.minSdk <= sdk }
-        if ("armeabi-v7a" in abis) compatible("armeabi-v7a")?.let { return it }
-        for (abi in abis) {
-            if (abi != "armeabi-v7a" && abi != "universal") compatible(abi)?.let { return it }
-        }
-        if (abis.any { it != "universal" && it in supportedAbis }) {
-            compatible("universal")?.let { return it }
-        }
-        throw UpdateException(UpdateFailure.UnsupportedAbi, "No compatible APK for this device")
-    }
-
-    companion object {
-        private val json = Json { ignoreUnknownKeys = true }
-        private val versionPattern = Regex("[0-9]+\\.[0-9]+\\.[0-9]+")
-        private val commitPattern = Regex("[0-9a-f]{40}")
-        private val hashPattern = Regex("[0-9a-f]{64}")
-        private val supportedAbis = setOf("armeabi-v7a", "arm64-v8a", "x86_64", "universal")
-        fun parse(text: String): UpdateManifest {
-            try {
-                val manifest = json.decodeFromString<UpdateManifest>(text)
-                require(manifest.schemaVersion == 1)
-                require(manifest.packageId.isNotBlank())
-                require(versionPattern.matches(manifest.versionName))
-                require(manifest.versionCode in 1..2100000000)
-                Instant.parse(manifest.publishedAt)
-                require(commitPattern.matches(manifest.sourceCommit))
-                require(manifest.sourceTag.isNotBlank())
-                require(isHash(manifest.signerSha256))
-                require(manifest.assets.isNotEmpty())
-                require(manifest.assets.map { it.abi }.distinct().size == manifest.assets.size)
-                require(manifest.assets.map { it.name }.distinct().size == manifest.assets.size)
-                manifest.assets.forEach {
-                    require(it.abi in supportedAbis)
-                    require(it.name == if (it.abi == "universal") "Wolfskin.apk" else "Wolfskin-${it.abi}.apk")
-                    require(it.bytes > 0 && it.minSdk > 0 && isHash(it.sha256))
-                }
-                return manifest
-            } catch (error: Exception) {
-                throw UpdateException(UpdateFailure.InvalidMetadata, "Invalid update manifest", error)
-            }
-        }
-        private fun isHash(value: String) = hashPattern.matches(value)
-        fun encode(manifest: UpdateManifest): String = json.encodeToString(manifest)
-    }
-}
-
-/** A standalone APK, not a split installation dependency. */
-@Serializable
-data class UpdateAsset(val abi: String, val name: String, val bytes: Long, val sha256: String, val minSdk: Int)
-
-/** Selected immutable release metadata and its anonymous asset URL. */
-data class UpdateCandidate(val manifest: UpdateManifest, val asset: UpdateAsset, val url: String, val notes: String)
-
-/** Typed boundary error, never interpreted as an up-to-date result. */
-class UpdateException(val kind: UpdateFailure, override val message: String, cause: Throwable? = null) : Exception(message, cause)

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/UpdateTransport.kt

@@ -1,149 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import com.github.damontecres.wholphin.BuildConfig
-import java.io.File
-import java.util.concurrent.atomic.AtomicReference
-import kotlinx.coroutines.currentCoroutineContext
-import kotlinx.coroutines.ensureActive
-import kotlinx.coroutines.suspendCancellableCoroutine
-import kotlin.coroutines.resumeWithException
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonArray
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.contentOrNull
-import kotlinx.serialization.json.jsonArray
-import kotlinx.serialization.json.jsonObject
-import kotlinx.serialization.json.jsonPrimitive
-import okhttp3.Call
-import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.Response
-
-/** Dedicated unauthenticated client; redirects are individually validated before any request. */
-class UpdateTransport(private val allowLocalTestHttp: Boolean = false) {
-    private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false).build()
-    private val activeCall = AtomicReference<Call?>()
-
-    fun cancel() { activeCall.get()?.cancel() }
-
-    private fun validateUrl(value: String): okhttp3.HttpUrl {
-        val url = value.toHttpUrlOrNull()
-            ?: throw UpdateException(UpdateFailure.InvalidMetadata, "Invalid update URL")
-        val fixture = BuildConfig.DEBUG && allowLocalTestHttp && url.host in listOf("localhost", "127.0.0.1", "::1")
-        if ((!url.isHttps && !fixture) || url.username.isNotEmpty() || url.password.isNotEmpty()) {
-            throw UpdateException(UpdateFailure.InvalidMetadata, "Update URLs must use credential-free HTTPS")
-        }
-        return url
-    }
-
-    private suspend fun request(value: String): Response {
-        var url = validateUrl(value)
-        repeat(6) {
-            val call = client.newCall(Request.Builder().url(url).get().build())
-            activeCall.set(call)
-            val response = suspendCancellableCoroutine<Response> { continuation ->
-                continuation.invokeOnCancellation { call.cancel() }
-                try {
-                    continuation.resume(call.execute()) { _, response, _ -> response.close() }
-                } catch (error: Exception) { continuation.resumeWithException(error) }
-            }
-            if (response.code !in listOf(301, 302, 303, 307, 308)) return response
-            response.use {
-                val location = it.header("Location")
-                    ?: throw UpdateException(UpdateFailure.InvalidMetadata, "Redirect has no location")
-                url = validateUrl(url.resolve(location)?.toString()
-                    ?: throw UpdateException(UpdateFailure.InvalidMetadata, "Invalid redirect"))
-            }
-        }
-        throw UpdateException(UpdateFailure.HttpRefused, "Too many update redirects")
-    }
-
-    private suspend fun readJson(url: String): kotlinx.serialization.json.JsonElement = request(url).use {
-        requireSuccess(it)
-        val source = it.body.source()
-        if (source.request(MAX_METADATA_BYTES + 1) && source.buffer.size > MAX_METADATA_BYTES) {
-            throw UpdateException(UpdateFailure.InvalidMetadata, "Update metadata is too large")
-        }
-        try { Json.parseToJsonElement(source.readUtf8()) } catch (error: java.io.IOException) { throw error } catch (error: Exception) {
-            throw UpdateException(UpdateFailure.InvalidMetadata, "Invalid release JSON", error)
-        }
-    }
-
-    /** Installed-release notes share the same anonymous redirect policy as checks and assets. */
-    suspend fun releasesForLatest(url: String, limit: Int = 50): JsonArray {
-        val latest = validateUrl(url)
-        val list = latest.newBuilder()
-        var last = latest.pathSegments.lastIndex
-        while (last > 0 && latest.pathSegments[last].isEmpty()) {
-            list.removePathSegment(last)
-            last--
-        }
-        return readJson(list.removePathSegment(last).setQueryParameter("limit", limit.toString()).build().toString()).jsonArray
-    }
-
-    /** A latest 404 is empty only when the release-list endpoint successfully returns an empty array. */
-    suspend fun latest(url: String, abis: List<String>, sdk: Int): UpdateCandidate? {
-        try {
-            val release = request(url).use {
-                if (it.code == 404) {
-                    if (releasesForLatest(url, 1).isEmpty()) return null
-                }
-                requireSuccess(it)
-                val source = it.body.source()
-                if (source.request(MAX_METADATA_BYTES + 1) && source.buffer.size > MAX_METADATA_BYTES) {
-                    throw UpdateException(UpdateFailure.InvalidMetadata, "Release metadata is too large")
-                }
-                Json.parseToJsonElement(source.readUtf8()).jsonObject
-            }
-            return candidate(release, abis, sdk)
-        } catch (error: UpdateException) { throw error } catch (error: java.io.IOException) { throw error }
-        catch (error: kotlinx.coroutines.CancellationException) { throw error }
-        catch (error: Exception) { throw UpdateException(UpdateFailure.InvalidMetadata, "Invalid release metadata", error) }
-    }
-
-    private suspend fun candidate(release: JsonObject, abis: List<String>, sdk: Int): UpdateCandidate {
-        val assets = release.getValue("assets").jsonArray.map { it.jsonObject }
-        val manifestAsset = assets.single { it["name"]?.jsonPrimitive?.content == "wolfskin-update.json" }
-        val manifest = UpdateManifest.parse(readJson(manifestAsset.getValue("browser_download_url").jsonPrimitive.content).toString())
-        val selected = manifest.selectAsset(abis, sdk)
-        val asset = assets.single { it["name"]?.jsonPrimitive?.content == selected.name }
-        return UpdateCandidate(manifest, selected, validateUrl(asset.getValue("browser_download_url").jsonPrimitive.content).toString(),
-            release["body"]?.jsonPrimitive?.contentOrNull.orEmpty())
-    }
-
-    /** A fresh transfer always truncates partials; no unvalidated HTTP range concatenation. */
-    suspend fun download(candidate: UpdateCandidate, file: File, progress: (Long, Long?) -> Unit) {
-        currentCoroutineContext().ensureActive()
-        request(candidate.url).use { response ->
-            requireSuccess(response)
-            val length = response.body.contentLength().takeIf { it >= 0 }
-            if (length != null && length != candidate.asset.bytes) {
-                throw UpdateException(UpdateFailure.ChecksumMismatch, "APK length differs from manifest")
-            }
-            response.body.byteStream().use { input ->
-                file.outputStream().use { output ->
-                    val buffer = ByteArray(64 * 1024)
-                    var done = 0L
-                    while (true) {
-                        currentCoroutineContext().ensureActive()
-                        val count = input.read(buffer)
-                        if (count == -1) break
-                        done += count
-                        if (done > candidate.asset.bytes) throw UpdateException(UpdateFailure.ChecksumMismatch, "APK exceeds manifest length")
-                        output.write(buffer, 0, count)
-                        progress(done, length)
-                    }
-                    output.fd.sync()
-                }
-            }
-        }
-    }
-
-    private fun requireSuccess(response: Response) {
-        if (!response.isSuccessful) throw UpdateException(UpdateFailure.HttpRefused, "Update server refused request (HTTP ${response.code})")
-    }
-
-    companion object { private const val MAX_METADATA_BYTES = 1024L * 1024 }
-}

app/src/wolfskin/java/org/justinvisser/wolfskin/tv/update/VerifiedUpdateStore.kt

@@ -1,100 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-package org.justinvisser.wolfskin.tv.update
-
-import java.io.File
-import java.security.MessageDigest
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.JsonPrimitive
-import kotlinx.serialization.json.contentOrNull
-import kotlinx.serialization.json.jsonObject
-import kotlinx.serialization.json.jsonPrimitive
-
-/** Actual APK identity, read independently of channel metadata. */
-data class ApkIdentity(val packageId: String, val version: InstalledVersion, val signers: Set<String>)
-
-/** Android boundary replaced by an in-process fixture in controller tests. */
-interface UpdatePlatform {
-    fun installed(): ApkIdentity
-    fun inspect(file: File): ApkIdentity?
-    fun hasInstallPermission(): Boolean
-    fun openPermissionSettings(): Boolean
-    fun install(file: File, asset: UpdateAsset, outcome: (InstallOutcome) -> Unit)
-}
-
-/** Installer results do not imply the running process has been replaced. */
-enum class InstallOutcome { Pending, Success, Cancelled, Failed, Unavailable, InsufficientStorage }
-
-/** Metadata returned only after verifying the persisted APK against this release. */
-data class VerifiedRelease(val manifest: UpdateManifest, val asset: UpdateAsset, val notes: String)
-
-/** Private staging; a metadata commit occurs only after independently verifying the APK. */
-class VerifiedUpdateStore(val directory: File, private val platform: UpdatePlatform) {
-    val partial = File(directory, "download.part")
-    val apk = File(directory, "verified.apk")
-    private val record = File(directory, "ready.json")
-
-    fun prepare() {
-        if (!directory.isDirectory && !directory.mkdirs()) {
-            throw UpdateException(UpdateFailure.InsufficientStorage, "Cannot create private update storage")
-        }
-    }
-
-    fun verify(file: File, manifest: UpdateManifest, asset: UpdateAsset) {
-        if (file.length() != asset.bytes || sha256(file) != asset.sha256) {
-            throw UpdateException(UpdateFailure.ChecksumMismatch, "APK length or checksum does not match")
-        }
-        val identity = platform.inspect(file)
-            ?: throw UpdateException(UpdateFailure.InvalidMetadata, "Android could not inspect the APK")
-        val installed = platform.installed()
-        if (identity.packageId != installed.packageId || identity.packageId != manifest.packageId) {
-            throw UpdateException(UpdateFailure.WrongPackage, "APK belongs to a different application")
-        }
-        if (identity.signers != installed.signers || identity.signers != setOf(manifest.signerSha256)) {
-            throw UpdateException(UpdateFailure.WrongSigner, "APK signer does not match this installation")
-        }
-        if (!UpdateChannel.isNewer(identity.version.versionCode, installed.version.versionCode)) {
-            throw UpdateException(UpdateFailure.LowerVersionCode, "APK is not newer than the installed application")
-        }
-        if (identity.version.versionCode != manifest.versionCode || identity.version.versionName != manifest.versionName) {
-            throw UpdateException(UpdateFailure.InvalidMetadata, "APK version differs from manifest")
-        }
-    }
-
-    fun commit(manifest: UpdateManifest, asset: UpdateAsset, notes: String) {
-        verify(partial, manifest, asset)
-        check(partial.renameTo(apk)) { "Could not commit verified APK" }
-        val temporary = File(directory, "ready.pending")
-        val metadata = Json.parseToJsonElement(UpdateManifest.encode(manifest)).jsonObject
-        val stored = JsonObject(metadata + ("releaseNotes" to JsonPrimitive(notes)))
-        temporary.outputStream().use { it.write(stored.toString().toByteArray()); it.fd.sync() }
-        check(temporary.renameTo(record)) { "Could not commit verified metadata" }
-    }
-
-    /** Re-hash and re-inspect after process death; a marker alone never establishes trust. */
-    fun restore(abis: List<String>, sdk: Int): VerifiedRelease? {
-        partial.delete()
-        File(directory, "ready.pending").delete()
-        if (!record.exists()) { apk.delete(); return null }
-        return try {
-            val text = record.readText()
-            val manifest = UpdateManifest.parse(text)
-            val asset = manifest.selectAsset(abis, sdk)
-            verify(apk, manifest, asset)
-            val notes = Json.parseToJsonElement(text).jsonObject["releaseNotes"]?.jsonPrimitive?.contentOrNull.orEmpty()
-            VerifiedRelease(manifest, asset, notes)
-        } catch (_: Exception) { clear(); null }
-    }
-
-    fun clear() { record.delete(); apk.delete(); partial.delete() }
-    companion object {
-        fun sha256(file: File): String {
-            val digest = MessageDigest.getInstance("SHA-256")
-            file.inputStream().use { input ->
-                val buffer = ByteArray(64 * 1024)
-                while (true) { val count = input.read(buffer); if (count < 0) break; digest.update(buffer, 0, count) }
-            }
-            return digest.digest().toHexString()
-        }
-    }
-}

data/tv-spec/spec.md

@@ -1,6 +1,6 @@
-# Wolfskin TV specification — revision 6
+# Wolfskin TV specification — revision 5
 
-2026-11-07. Revision 6 adds the approved direction-A motion and loading states from [the motion reference](https://pages.justinvisser.org/wolfskin/tv-motion-speed.html), frozen with SHA-256 checksums at `data/tv-v2/motion-2026-11-06/`, and the subsequently approved **option B** [card metadata frames](https://pages.justinvisser.org/wolfskin/tv-card-meta-frames.html). Revision-5 feedback below still applies except where the card amendment explicitly supersedes it. Unchanged navigation, typography and colours remain governed by the [written specification](https://pages.justinvisser.org/wolfskin/tv-spec). The revision-5 prototype delta remains `data/tv-v2/feedback-2026-11-06/`.
+2026-11-06. This feedback amendment applies to the approved revision-4 specification and frozen frames at `data/tv-v2/focus-2026-11-06/` (prototype SHA-256 `1bb7f4097a5303a58e45ec5e61cf867fa6cfdcbfe12fc7a196f00acacae5e48d`). Unchanged geometry, navigation, typography, colours and motion remain governed by those frames and the [written specification](https://pages.justinvisser.org/wolfskin/tv-spec). The amendment's prototype delta is `data/tv-v2/feedback-2026-11-06/`.
 
 ## Who’s watching
 
@@ -54,62 +54,8 @@ Read-only source measurement: Desperate Housewives has a 2732×1536 Backdrop. Wi
 
 Every Discover lane, including Movies for you, Series for you, service entries, service-specific lanes and Hidden picks, uses a **104 px heading band**: heading line plus **60 px heading-to-card gap**, up from 40 px. This is a consistent Level 2 extension, not a Series-only exception. Poster shelves become 652 px high and service-entry shelves 316 px. Captions and frame scroll offsets use the same heading band. Home headings remain unchanged.
 
-## Motion and loading — revision 6
-
-Home heroes and shelves, Library rows, Discover hero/lanes, title headers, episodes and cast, and person headers/filmography use shaped placeholders without loading sentences. The placeholder fill is `surface2` (`#1b1b25`). A complete shelf shares **one** alpha layer: **0.55 → 1 → 0.55 over 1400 ms**, CSS ease-in-out (`.42,0,.58,1`), 700 ms each way. All loading shelves under the screen's theme share one clock, so late arrivals join the current phase. The clock stops when the last loading shelf leaves. No per-card clocks, staggered pulse phases, shimmer, moving gradient, or animated blur.
-
-| Transition | Duration and curve | Transform |
-|---|---|---|
-| Focus scale/ring | 180 ms, ease-out (`.33,1,.68,1`) | Existing locked focus scale; no geometry change |
-| Poster caption in / out | 60 ms delay + 180 ms ease-out / 100 ms ease-out | 10 px rise on entry only; exit holds its position, including when entry was interrupted |
-| Network artwork only | 160 ms, Coil painter alpha | None; memory, disk and local hits are instant |
-| Row/tab content reveal | 180 ms, ease-out | One layer per row, 24 px rise |
-| Initial hero/title copy | 180 ms, ease-out | 16 px rise |
-| Hero backdrop hand-off | 320 ms, ease-in-out (`.65,0,.35,1`) | Alpha only; retain previous art until incoming art or its final fallback is ready |
-| Hero copy hand-off | Old copy out 120 ms ease (`.25,.1,.25,1`); new copy starts at 140 ms and enters over 200 ms ease-out | 14 px rise on entry |
-| Late ratings, genres, overview and readiness | 200 ms, ease | Alpha only, inside existing measured slots; rating plates keep their existing plate fade rather than adding a nested fade |
-| Horizontal / vertical focus-follow scroll | 160 ms ease / 180 ms ease-out | Existing scroll geometry |
-
-Row reveals are grouped rather than the browser prototype's per-card staging: the armv7 frame budget permits one animated layer per shelf, not one per card. Tabs have no full-screen transition layer. The upper Home hero blend is bounded to **1920×820 px**, Discover to **1920×740 px**; the lower backdrop changes without an animated screen-sized layer. Hero copy is a separate bounded block. Image reveal uses Coil's painter, not a new full-screen compositing layer. Existing poster-only blur is static.
-
-The title page's scroll dim is a draw-only colour overlay, not an alpha-animated full-screen layer. Discover scrolls its backdrop through placement offsets rather than a full-screen translation layer. Initial loading animated layers are Home **2**, Library **up to 3** lazy rows, Discover **2**, title header **1**, person **2**; pending title episode/cast shelves add **1 each**, and each pending Discover lane owns **1**. Deep Home loading is bounded to **4** visible shelf layers. These are animated layers, not independent pulse clocks or every static display-list node: one shared pulse clock drives the loading screen without adding a layer. A hero hand-off adds at most **2** bounded owners (outgoing art and copy). Focus changes can animate **2** card transforms, **1** caption and at most **2** rating plates; artwork fades are painter draws without additional compositing layers. Late title metadata adds at most **4** bounded alpha layers: title ratings, play-target ratings, genres and overview. No animated owner is full-screen.
-
-The series readiness band reserves **56 px (28 dp)** from its first content paint, including when empty or when readiness later disappears. Ratings remain inside the fixed-height facts band. The series header's measured height therefore cannot change when late ratings/readiness arrive; overview, actions, season and episode anchors retain their coordinates. Skeletons have no click/hover focus targets; pending episode/cast rows remain absent from the key-navigation state until real cards exist. Initial loading keeps nav focus and Back still pops the title/person route.
-
-Discover key traversal skips pending lanes in both directions. If every remaining lane is pending, Down stays on the real filter chips and Back returns to nav; a skeleton must never create an empty-column focus range.
-
-`Settings.Global.ANIMATOR_DURATION_SCALE == 0`, exposed by Compose's window `MotionDurationScale`, or the host's `LocalReducedMotion` flag disables pulse and translation/scroll motion. Focus scale and nav geometry snap; permitted fades are capped at **80 ms**. The window context supplies live scale state without settings or disk reads on the main thread. Fetch/decode dispatchers and image URL logic are unchanged.
-
-Native **1920×1080** before/after frames and the frame-budget inventory are published at [the motion build proof](https://pages.justinvisser.org/wolfskin/tv-motion-build/). Before frames use the pre-change surface sources in this same isolated worktree; after frames use the shipped Compose surfaces. No device access, installation or optimized APK is part of this lane. On-box acceptance remains: no series layout change after first content, Home scrolling no worse than **39.6% janky / p90 65 ms**. Native JVM rendering does not measure that GPU/frame-timing target.
-
-
-## Card metadata and bottom state line — revision 6, option B
-
-Film cards show year, duration and a **24 px watched check**. Episodes show their own duration and check, without a year; series show year and check, never an aggregate runtime. Resuming and unwatched cards have no check. Compact metadata omits media-type words, season counts, character roles, ownership and remaining-time prose. Duration rounds total minutes before formatting hours/minutes; narrow layouts tighten metadata gaps from **12 → 8 → 4 px**, never shrink text or ellipsise duration.
-
-Movies, Shows, Anime, Home See all and person filmography always show their card-width title/subtitle. Titles are one-line ellipses: **28 px / 32 px line**, medium muted at rest, bold foreground when focused. Metadata is **24 px / 26 px line**. The **96 px** poster caption band starts its text **38 px** below unscaled art. Home poster captions remain focus-only; Home landscape titles stay on the art with focus-only metadata below it. Landscape shelves reserve **64 px** below art. Loading placeholders reserve identical **blank** caption bands: only art-sized blocks are painted, with no title/subtitle pills. Each shelf still shares the motion lane's single pulse layer.
-
-| Geometry at 1920×1080 | Pixels |
-|---|---:|
-| Library row pitch | 524 |
-| Home poster shelf pitch | 632 |
-| Home wide / tile shelf pitch | 522 / 441 |
-| Initial library art row tops | 372 / 896 |
-| Pinned library art row tops / second-row bottom | 168 / 692 / 1076 |
-| Focus ring to caption / caption to next focused row ring | 20.48 / 26.48 |
-
-One bottom state line replaces the independent resume bar. Unwatched and Discover have no state line; watched has a full-width **3 px accent** line; resume has proportional **6 px accent** fill on a full-width `color.progressTrack` track. Left/right are zero, with **2 px bottom backing** and **2 px opaque separator** above the fill, clipped by the art's **16 px** radius. Focus scales the art/line by **1.08**, with its **4 px** straddle ring drawn independently above them.
-
-Completed Home progress (`resumeSeconds / runtimeSeconds >= 1`) follows the same state precedence as library/title cards: it is no longer resuming, so a played title uses the 3 px watched line and an unplayed title has no state line.
-
-Justin's additional correction is binding even where a reference frame leaks: **the lowest card row must contain card/edge/fill colour, never art**. Clip artwork out of the backing band before painting it; merely overdrawing after a rounded clip can retain poster colours in antialiased corners. The backing is opaque `color.bg` (**#07070a**). Precompose and quantise the track over that backing once to preserve the approved **#3d3d3f** browser pixels instead of native alpha-rounding differences; fill is **#cc9fff**. The approved Annie Hall and Locke treatment frames themselves expose artwork below their inset state line; the native build deliberately makes that row solid.
-
-Native same-fixture comparisons and the exhaustive real-art bottom-row proof are published in [the card metadata build gallery](https://pages.justinvisser.org/wolfskin/tv-card-meta-build/). `CardBottomPixelTest` checks white Annie Hall, dark Locke, colourful Apocalypse Now and Avatar Aang at rest and individually focused; every pixel across each full bottom row must equal an art-free rendering of the same clipped backing/ring, while straight-edge and fill/track pixels additionally match exact state colours. It also checks Home/library parity when progress reaches or exceeds completion. `CardGeometryTest` measures narrow fitting, the 24 px check, grid/shelf pitches, pinned rows and ring clearances to 0.1 px, and asserts every pixel in reserved loading caption bands remains background-coloured. `CardCaptionMotionTest` compares native glyph pixels after changing a focused title and moving across a focused Home shelf. Reference comparisons retain documented renderer/fixture artifacts; unapproved visible design changes remain merge blockers.
-
 ## Sources and verification
 
 Authoritative changed values live in `wolfskin-design/tokens.json`, `title-tokens.json` and `discover-tokens.json`; regenerate Kotlin, CSS and the drift manifest with `python3 wolfskin-design/generate_tokens.py`.
 
-`MotionSurfaceTest`, `HeroMotionTest`, `NetworkArtTransitionTest` and `DiscoverSkeletonKeysTest` cover late-line geometry, loading/ready row eligibility, Back/nav ownership, rendered pulse suppression under both motion controls, strict main-thread I/O policy, network-versus-cache reveal, bounded hero blending, delayed art and interrupted hand-offs. Native follow-up cases compare the pulse pixels of a late-joining shelf, hold caption translation through both settled and interrupted exits, and observe late ratings/genres/overview fading without moving their slots or actions. Manually clocked captures explicitly deliver snapshot changes before advancing animation time; interrupted-exit assertions sample after the hide has committed. The frozen prototype includes `index.html`, its local media, the original CSS/JS/builder and a complete SHA-256 manifest; replay the HTML, not the preserved builder's live-publishing entry point.
-
 The feedback prototype delta links the native 1920×1080 before/after frames. `HomeViewportTest` exercises short and long poster/tile/wide rows, first focus, both row directions and native Back from the shipped title surface. The real-Bear capture harness reads recorded Jellyfin metadata through `TitleReadFacade`; it is a throwaway proof and is not shipped. The final gates are `make test` and `make apk-debug`. No TV access or optimized-APK build is part of this worker's validation.

data/tv-v2/motion-2026-11-06/SHA256SUMS

@@ -1,47 +0,0 @@
-8cca2384b2ed67b28626a316fb5b9c421c3fe0b48de4438d8c1683f6061db81d  build_page.py
-924b013c685c8eefe98ba985ec61d45d14a38ddc2c3e4269895ed148cee2e9e5  delta.json
-e480b84afed8fbae72df846cc980b309ef3ca9342b89df74eeff8cf031050813  index.html
-64ec89bd409e79737e615344ffb19eea2e358c5f61b571b2e8ad989a349cab5c  proto.css
-bba2e150d5ca24a0a7765cc684a7e39bb5742756e19ff855f1743e3a62950684  proto.js
-7cf975a048ca1b9c2f8b2627ee034012c325246d4b6e56048c864f1ced7de09f  tv-motion-speed/b1t.webp
-c53fd37b2946bf54386883b321925a4d006a5e79d4e07bcb0a02755e0b2f19ec  tv-motion-speed/b1.webp
-6dd4a715be2361ecaee06b825559fec32432363d302d3b06b1a4d95b1dedf757  tv-motion-speed/b2t.webp
-8ec6be1c5d143b5786ed4b811e42585ac92a456cf0e88795f6a2ebcaa734e75d  tv-motion-speed/b2.webp
-674cb1302d66e930504fcc4dff0f8c9d267c43d5a26f97ace8517dd776100cc9  tv-motion-speed/b3t.webp
-261dd7de5e6a204e5b4a0433a9210a3883720be09bab890afbde37d51acf3e06  tv-motion-speed/b3.webp
-3a6128506526ce54eb7c9e018880be57a1f2fbe7198f2d0fc47efa9ef82fc700  tv-motion-speed/b4t.webp
-71427d171d31b499d406410b51a61a683e5fb1f664e8b483d2a95acd0f69b88c  tv-motion-speed/b4.webp
-825ef8387d3d035d69dcfdf618b6030dabf560e7bdb4b9f3b473990f3d5eaa48  tv-motion-speed/before-discover-tab.webm
-c82bf1e41fa2866ff94369173ffd5af83efe6a6fa8499d0498f6be25682451bf  tv-motion-speed/before-home-enter.webm
-15d166f0741ae7b5422f466fc8e2001de167deecb81c8b9eff33e9e7ac139ff8  tv-motion-speed/before-launch-fast.webm
-bacdbb57858f7f28e7af9f50d70bb3cfeac878f0204ee02b8c94e2abb686a011  tv-motion-speed/before-launch-spinner.webm
-d492f500ce464b0a529dce81ed0be09d53c868d554973d61a69097b0a1f6fef5  tv-motion-speed/before-movies-grid.webm
-1cfc443f8f67bbdf5acfa1341e2616fd5e0895035c390709b3e11600ea7a37e6  tv-motion-speed/before-person.webm
-7d9b7acf81981f2058ef85aaff18aa6f1668dfdceca0991da1480099757baa1a  tv-motion-speed/before-title-discover.webm
-1a934ff576601de973103145fb00db3059b5bf114b8d36aa49fe2f2a421b324f  tv-motion-speed/before-title-movie.webm
-6366d9b410b5460eba7348bc9e6356f906fa2b8771931232f9a55ea4e4272c46  tv-motion-speed/before-title-series.webm
-65577079db9f4a40e62bd5c676d1c4d51a1ca0c9802e364b314a5b162b9dc90b  tv-motion-speed/c1.webp
-91a325404fa9e6f925bab3a4370f80065f24efbb314fa75252307cf3c642af1f  tv-motion-speed/c2.webp
-ff018c6db960483f8a2eb73242b087a41b866e05a5bde3f6f4c76eeb1abec21b  tv-motion-speed/c3.webp
-75ab6defe098a403999a7a267061346afb29748bd2651791d62eb9ca9cdb1acb  tv-motion-speed/c4.webp
-b01e96165bc33ff5cf47da086ea966b24d58ef2e995cb16ef4af00375a54efca  tv-motion-speed/c5.webp
-faa1e271643dc3585c70382988fd609f6522d622887a8595658e96831226837d  tv-motion-speed/c6.webp
-92c1e9bea498f957e5eda418c9c74698cf693f7e7ca406b8e90cd55357a46499  tv-motion-speed/c7.webp
-2a62c58b79b0592ba74498f8b7a0a996cb12b7430d5fe00bf8e8550400c3f619  tv-motion-speed/c8.webp
-0366fa40daa0328bca55183b656ffc94dfb7fb1b7433732a2effce093e8e4ab0  tv-motion-speed/e1.webp
-9a84c464aa98dba31e1aa0d97665e273305d08fbe33fd579136c8964073f42bb  tv-motion-speed/home-before-tab.webp
-8903c80b69479a5d8ffc6361628f8117a601fe5b88897f3dcc0a62f9b8a533b7  tv-motion-speed/launcher.webp
-1026e09bdbd9a6a7570ebd041c098d04b2bb2e738e7047217dae479efd944120  tv-motion-speed/p10.webp
-d862e8a85b49b5128837a58bad4051f460c736702d0ce2befb057ad29448b63e  tv-motion-speed/p11.webp
-b6f7a0c96949d690124413e7e9df249730d0b5f95cebdb1345e0f91f784577c1  tv-motion-speed/p12.webp
-eebb8bec042819923bddedd2abee4841b62c0e1c10f05dc0af4569c98d5a3a54  tv-motion-speed/p1.webp
-e5f6079132aa33e0a1741a335cfa00d1a476d7da38a556ac1cbadb0f410df407  tv-motion-speed/p2.webp
-af3c62f1acb37a7675594179ae285b3092ca6fd3e40216bbcc442190d87c216f  tv-motion-speed/p3.webp
-7b303cc200c7f3932b077fcae3908a3c6ec0b75922d2bf048d876177d6c4bf4d  tv-motion-speed/p4.webp
-8650904e68d4085f1ef1c58a8312ed501bddcca5f5565180861339efa6cf4a92  tv-motion-speed/p5.webp
-4c102e76ef046c979f728990cb9ed96a87a67ca570cafd2ead8cc3c3c7fb7900  tv-motion-speed/p6.webp
-3a30007a21825461d99732063ce3e9a6dc256cb46937bfd1f29236f95480fb5b  tv-motion-speed/p7.webp
-9fa546b84609ef91ca43ff943b245eda53ff06715cf75f800d556fd3ba2abb12  tv-motion-speed/p8.webp
-6e859f5ce40cfa21702b9458586913affafda1454a295dd6099ebc3b462f7aa4  tv-motion-speed/p9.webp
-3ab8a7da1d0c2532933eb1803a3408d23e42cbed5923575deb1db62d7cbbb477  tv-motion-speed/s1t.webp
-40fb5827a46bcd9d6c9e2f10190c58e0670e29e0ba908ae28600a2f8cae297cc  tv-motion-speed/s1.webp

data/tv-v2/motion-2026-11-06/build_page.py

@@ -1,298 +0,0 @@
-#!/usr/bin/env python3
-"""Build the Wolfskin TV load-states / motion / speed spike page (dark only).
-
-Inputs : page/proto.css, page/proto.js, page/tv-motion-speed/* (webm clips from the box, fixture art), numbers below
-         (all from data/tv-spike-motion-speed/raw/ and report.md).
-Output : /opt/stacks/pages/store/wolfskin/tv-motion-speed.html + tv-motion-speed/ assets (mode 660).
-"""
-import os, shutil
-
-HERE = os.path.dirname(os.path.abspath(__file__))
-STORE = '/opt/stacks/pages/store/wolfskin/'
-OUT = STORE + 'tv-motion-speed.html'
-ASSETS = STORE + 'tv-motion-speed/'
-
-CSS = open(os.path.join(HERE, 'proto.css')).read()
-JS = open(os.path.join(HERE, 'proto.js')).read()
-
-
-def table(head, rows, cls=''):
-    h = ''.join(f'<th>{c}</th>' for c in head)
-    b = ''.join('<tr>' + ''.join(f'<td>{c}</td>' for c in r) + '</tr>' for r in rows)
-    return f'<div class="tw"><table class="{cls}"><thead><tr>{h}</tr></thead><tbody>{b}</tbody></table></div>'
-
-
-def pair(pid, scene, before, after_title, lead, note='', variants=False, before2=None):
-    vids = ''.join(f'<div class="pane"><p class="lab">{lab}</p><div class="sbox"><video src="tv-motion-speed/{src}.webm" muted loop playsinline autoplay preload="auto"></video></div></div>'
-                   for src, lab in ([before] + ([before2] if before2 else [])))
-    var = f'<div class="tabs" data-variants="{pid}"></div>' if variants else ''
-    return f'''<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button>{f'<span class="muted small">{note}</span>' if note else ''}</div>
-<div class="panes">{vids}<div class="pane"><p class="lab">{after_title}</p>{var}<div class="sbox" id="{pid}" data-scene="{scene}" data-lead="{lead}"></div></div></div></div>'''
-
-
-def opt(title, gain, effort, risk, see, where='TV'):
-    return [title, gain, effort, risk, see, where]
-
-
-OPT_HEAD = ['Option', 'Expected gain (measured basis)', 'Effort', 'Risk', 'What you would see', 'Ships in']
-
-page = f'''<!doctype html><html lang="en" data-lavish-annotate="off"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark"><title>Wolfskin TV: faster, quieter, smoother</title><style>
-:root{{color-scheme:dark;--bg:#07070a;--panel:#13131a;--line:rgba(255,255,255,.1);--fg:#f4f4f6;--muted:rgba(244,244,246,.74);--acc:oklch(78% 0.14 305);--ok:#7ed6a0;--warn:#ffc46b;--bad:#ff8a7a}}
-*{{box-sizing:border-box}}html{{-webkit-text-size-adjust:100%}}body{{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,Segoe UI,sans-serif}}
-main{{max-width:1400px;margin:0 auto;padding:16px 14px 120px}}h1{{font-size:28px;line-height:1.2;margin:6px 0 6px}}h2{{font-size:21px;margin:34px 0 8px;color:var(--acc);border-bottom:1px solid var(--line);padding-bottom:4px}}
-h3{{font-size:17px;margin:20px 0 6px}}a{{color:var(--acc)}}.muted{{color:var(--muted)}}.small{{font-size:13px}}p{{margin:6px 0}}li{{margin:3px 0}}
-.lead{{font-size:17px}}.k{{color:var(--ok)}}.w{{color:var(--warn)}}.b{{color:var(--bad)}}
-.tw{{overflow-x:auto;margin:8px 0;border:1px solid var(--line);border-radius:10px}}table{{border-collapse:collapse;width:100%;font-size:14px}}
-th,td{{padding:6px 9px;border-top:1px solid var(--line);text-align:left;vertical-align:top}}thead th{{border-top:0;background:#1b1a22;white-space:nowrap}}
-td:first-child{{font-weight:600}}table.num td:not(:first-child){{white-space:nowrap}}
-.card2{{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:12px 16px;margin:10px 0}}
-.pair{{margin:14px 0 26px}}.ph{{display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin:0 0 6px}}
-.panes{{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(380px,100%),1fr));gap:12px}}.pane{{min-width:0}}.lab{{font-size:13px;color:var(--muted);margin:0 0 4px}}
-.decision{{padding:18px 22px;background:#13131a;border:1px solid var(--line);border-radius:14px;margin:14px 0}}.decision h3{{margin-top:0}}
-.opt{{display:block;border:1px solid var(--line);border-radius:10px;padding:9px 12px;margin:7px 0;cursor:pointer;background:#100e16}}.opt:has(input:checked){{background:oklch(26% 0.07 305);border-color:var(--acc)}}
-.opt .t{{display:block;color:var(--muted);font-size:14px;margin-left:24px}}.rec{{font-size:12px;color:var(--ok);margin-left:6px}}
-textarea{{width:100%;min-height:70px;background:#0c0b10;color:var(--fg);border:1px solid var(--line);border-radius:8px;padding:8px;font:inherit;margin-top:6px}}
-.tabs{{display:flex;gap:6px;flex-wrap:wrap;margin:0 0 6px}}
-.tab,button.replay{{font:inherit;font-size:13px;border-radius:999px;padding:4px 11px;border:1px solid var(--line);background:#1b1a22;color:var(--fg);cursor:pointer}}.tab.on{{background:oklch(26% 0.07 305);border-color:var(--acc)}}
-button.replay{{background:oklch(26% 0.07 305);border-color:var(--acc)}}
-form.decision button[type=submit]{{font:inherit;font-size:15px;font-weight:600;border-radius:999px;padding:8px 18px;border:1px solid var(--acc);background:oklch(26% 0.07 305);color:var(--fg);cursor:pointer;margin-top:8px}}
-form.decision [role=status]{{font-size:13px;margin-left:10px;opacity:.8}}
-.ctl{{position:sticky;top:0;z-index:8;background:#07070aee;backdrop-filter:blur(6px);border-bottom:1px solid var(--line);padding:8px 0;margin:0 0 8px;display:flex;gap:18px;flex-wrap:wrap;align-items:center;font-size:14px}}
-.ctl label{{display:inline-flex;gap:6px;align-items:center;cursor:pointer}}
-ol.plan>li{{margin:10px 0}}code{{font-size:13px;color:oklch(88% 0.08 305)}}
-{CSS}
-</style></head><body><main>
-<h1>Wolfskin TV: faster, quieter, smoother</h1>
-<p class="lead">Measured on your Xiaomi box with <b>Wolfskin (Opt)</b> 1.1.0-133 and from tank, on 2026-11-06. This page has the options, the plan, and live prototypes of the loading and motion. Each prototype sits next to a recording of the real app doing the same thing today.</p>
-
-<div class="card2"><b>The short version</b><ul>
-<li><b>The biggest wait isn't the app.</b> Two of four cold launches showed a spinner for <b>1.5 s</b>, and the other two showed none. The box looks up <code>jelly.justinvisser.org</code> through AdGuard Private DNS, and an uncached lookup takes <b>0.45–1.35 s</b>. The address only stays cached for 60 s, so the first launch after a minute's pause pays it, and so does the first title page that fetches TMDB art. A small TV-side DNS cache (or one box setting) removes it.</li>
-<li><b>The second biggest is Conductarr.</b> On a title page, the detail, season and "Ready for you" reads take <b>1.1 s, 1.1 s and 2.9 s</b> at the median. Each one re-lists the whole Radarr/Sonarr library on every request, with no cache. A title page can't settle until the slowest arrives (3.4 s on a series). This needs a Conductarr release.</li>
-<li><b>Screens are already quick, but they pop.</b> Home, the grids, Discover and Settings settle in <b>0.2–0.75 s</b>. What makes the wait visible is art and fields arriving in steps, and the layout jumping when a late line lands. That's fixable on the TV alone: fade art in, reserve space for late lines, keep last-known screens, and prefetch.</li>
-<li><b>Frames are slow for two reasons.</b> At the median a frame takes 30–46 ms during moves, where 60 fps needs 16.7 ms. On grid and row scrolls, <b>30–44 %</b> of frames miss. The GPU alone takes 14–21 ms per frame, so motion here has to be cheap: fades, small rises and scale on one layer. No full-screen blur or shimmer sweeps.</li>
-</ul></div>
-
-<div class="ctl"><label><input type="checkbox" id="boxrate"> Play prototypes at the box's frame rate (40 ms per frame, measured)</label><label><input type="checkbox" id="rm"> Reduced motion (fades only, ≤100 ms)</label><span class="muted small">Prototypes loop. "Replay together" restarts the recording and the prototype in step. Counters are ms after the screen first reacts to the key.</span></div>
-
-<h2>1. Where the time goes today</h2>
-<h3>Per screen, from the first frame that reacts to the key until the screen stops changing</h3>
-<p class="muted small">Method: on-device <code>screenrecord</code> (it only emits frames on change), scene-change detection with ffmpeg, logcat (OkHttp and ActivityManager) and Conductarr's own request log for the same seconds. "Settled" is the last visible change. Raw clips and sheets are in <code>data/tv-spike-motion-speed/</code>.</p>
-{table(['Screen', 'First content', 'Settled', 'What arrives late', 'Repeat visit'], [
- ['Cold start (am start -W TotalTime, 4 runs)', '583 / 538 / 438 / 453 ms to first frame', 'picker at +0.3–0.4 s (DNS warm) or <b class="b">+1.65 s</b> (DNS cold)', 'Spinner while <code>Users/Me</code> then <code>System/Info/Public</code> run one after the other (ServerRepository.kt:104,107)', 'same, bimodal on the 60 s DNS cache'],
- ['Who\'s watching → Home', 'hero text 135 ms', '430 ms', 'shelf tiles flat grey until 400 ms, then all images pop', '370 ms'],
- ['Home → Discover tab', 'content 270 ms (dims first)', '700 ms', 'posters pop in over 0.4 s', '600 ms'],
- ['Movies grid', '230 ms (blank tiles)', '750 ms', 'posters fill row by row', '500 ms'],
- ['Shows grid', '280 ms', '640 ms', 'posters', '—'],
- ['Title, movie in library (American Gangster)', '430 ms (text)', '<b class="w">2.69 s</b>', 'backdrop 470 ms; cast portraits 2.7 s (initials until then)', '450 ms total'],
- ['Title, Discover pick (Donnie Brasco)', '980 ms (blank skeleton until then)', '1.53 s', 'backdrop 1.37 s, cast 1.5 s', '—'],
- ['Title, series (Adults)', '620 ms', '<b class="b">3.42 s</b>', 'ratings and "Ready for you · by Mindel" land at 3.4 s and push the overview down', '—'],
- ['Person page (Martin Sheen)', '620 ms', '720 ms', 'filmography posters', '—'],
- ['Back from title / series / person', '260 / 300 / 450 ms', '', '', ''],
- ['Settings', '220 ms', '220 ms', '—', ''],
- ['Coming in sheet', '74 ms', '74 ms (from cache)', 'posters refresh silently', ''],
-], 'num')}
-
-<h3>Frame timing per interaction (dumpsys gfxinfo, ART status <code>speed</code>)</h3>
-{table(['Interaction', 'Frames', 'Janky', 'p50', 'p90', 'p99', 'Main thread slow / GPU slow'], [
- ['Home rows scroll (down 7, up 6, right 5), run 1 / 2', '149 / 115', '38.9 % / 34.8 %', '44 / 46 ms', '69 / 65', '89 / 101', '43 / 52 · 27 / 35'],
- ['Movies grid scroll (down 8, up 8), run 1 / 2', '180 / 159', '43.9 % / 32.1 %', '30 / 30 ms', '53 / 46', '93 / 73', '30 / 69 · 20 / 48'],
- ['Discover scroll', '146', '30.1 %', '34 ms', '57', '73', '34 / 35'],
- ['Tab switch ×4', '158', '18.4 %', '28 ms', '65', '150', '15 / 29'],
- ['Title open + back ×3', '103', '33.0 %', '48 ms', '113', '150', '29 / 34'],
- ['Who\'s watching → Home', '15', '53.3 %', '61 ms', '117', '133', '7 / 8'],
- ['Open title (movie, first time)', '20', '60.0 %', '57 ms', '150', '200', '9 / 12'],
- ['Back from person', '12', '75.0 %', '93 ms', '150', '150', '8 / 9'],
-], 'num')}
-<p class="muted small">Frame phases on the Shows grid (framestats, 68 frames): record p50 0.5 / p90 10.3 ms, GPU issue p50 4.3 / p90 8.9 ms, GPU complete p50 <b>14.3</b> / p90 <b>21.2</b> ms, total p50 25.6 / p90 41.4 ms. The app renders at 1920×1080 and the box outputs 3840×2160 at 59.94 Hz. Today's grid is worse than the earlier Opt measurement (17.7 % janky), which was taken before the spacing and focus-ring builds.</p>
-
-<h3>Network, from tank (10 runs each; cold = new connection, warm = kept-alive)</h3>
-{table(['Call', 'Bytes', 'Cold p50 / p95', 'Warm p50 / p95', 'Cache headers'], [
- ['Jellyfin UserViews (called 4–5× per launch)', '2.3 KB', '65 / 166 ms', '46 / 51 ms', 'none'],
- ['Home Resume (20)', '1.4 KB', '58 / 66', '30 / 41', 'none'],
- ['Home NextUp (20)', '6.2 KB', '71 / 91', '47 / 52', 'none'],
- ['Home Items/{{id}} per series (sequential)', '4.0 KB', '43 / 60', '24 / 28', 'none'],
- ['Home library shelf (20)', '18.7 KB', '85 / 116', '74 / 84', 'none'],
- ['Movies grid page (200)', '51 KB', '68 / 148', '61 / 64', 'none'],
- ['Title episodes with MediaSources + People', '<b class="w">96.8 KB</b>', '142 / 185', '122 / 169', 'none'],
- ['Title episodes, lean fields', '6.5 KB', '26 / 65', '11 / 12', 'none'],
- ['Grid poster, no size (today, LibraryReadFacade.kt:86)', '<b class="b">626 KB</b>', '26 / 30', '8 / 9', 'max-age 1 y, immutable, ETag'],
- ['Grid poster fillWidth 256×384 q96', '31.6 KB', '19 / 131', '2 / 4', 'same'],
- ['Grid poster 256×384 q80 WebP', '11.2 KB', '19 / 118', '1 / 2', 'same'],
- ['Backdrop 1280 q96 / q80 WebP', '91 / 31 KB', '19 / 25', '2 / 2', 'same'],
- ['TMDB poster w780 (today, ConductarrProjection.kt:9)', '131 KB', '128 / 144', '49 / 70', 'max-age 1 y'],
- ['TMDB poster w342 / w185', '41 / 15 KB', '100 / 76', '31 / 30', 'max-age 1 y'],
-], 'num')}
-<p class="muted small">Box-side DNS (ping timing, 6 samples 70 s apart): uncached <code>jelly.justinvisser.org</code> 490–1390 ms, <code>wolfskin-tv</code> 460–490 ms, <code>image.tmdb.org</code> 60–1170 ms; cached 40–50 ms. The box uses Private DNS <code>dns.adguard.com</code>. The LAN resolver 192.168.1.2 answers uncached names in 136–160 ms and cached in 0 ms. The A record behind both hosts has a 60 s TTL. Cold launches 1 and 3 were more than 60 s after the previous lookup, and 2 and 4 were within it.</p>
-<h3>Conductarr TV routes, server-side (Conductarr request log, 22 h, 200/304)</h3>
-{table(['Route', 'n', 'p50', 'p95', 'Body p50', 'Why'], [
- ['activity/titles/{{tmdb}}/{{type}} (Ready for you)', '45', '<b class="b">2856 ms</b>', '5002 ms', '1.7 KB', 'Re-reads the held title twice, the Seerr requests and a Jellyfin GET per episode; no cache (activity/detail.go:21, request_evidence.go:45, users.go:262). The 5002 ms p95 is most likely the TV giving up: its read timeout is 5 s (ConductarrSession.kt:53), so on the slowest titles the line never appears'],
- ['catalogue/titles/{{tmdb}}/{{type}} (detail)', '51', '<b class="b">1198 ms</b>', '3217 ms', '11.9 KB', 'Held-title read lists every Arr library unpaged, then Seerr details, then ratings; sequential (catalogue/detail.go:14-17, library_detail.go:81)'],
- ['catalogue/tv/{{tmdb}}/seasons/{{n}}', '76 / 17 (304)', '1084 / 2282 ms', '2664 ms', '1 KB', 'Same held-title read; a 304 still renders and hashes the full body first (read_validators.go)'],
- ['…/ratings', '265', '147 ms', '449 ms', '0.5 KB', '6 h server cache, 300 titles'],
- ['…/enrichment · …/related · …/cast', '46 · 42 · 26', '103 · 124 · 33 ms', '465 · 261 · 78', '3 · 14 · 12.5 KB', 'enrichment uncached'],
- ['recommendations feed', '42', '16 ms', '40 ms', '<b class="w">204 KB, uncompressed</b>', 'no gzip/br on the TV door (Caddyfile.base:316-333, serve.go:140)'],
- ['activity (polled every 30 s)', '713 × 304', '52 ms', '83 ms', '62.5 KB when 200', ''],
- ['operator · profiles · dismissals · options · display', '', '12–25 ms', '30–93 ms', '', 'cheap; display is called ≈1 400×/day, once per poster'],
-], 'num')}
-<p class="muted small">Every TV request also costs Conductarr an uncached Jellyfin <code>/Users/Me</code> to check the token (clients/jellyfin/token.go:42). Every authenticated response is <code>Cache-Control: no-store</code> (authority.go:32). The TV client revalidates with its own ETag store instead.</p>
-
-<h3>Caches the app has today</h3>
-{table(['Cache', 'Where', 'Behaviour', 'Observed'], [
- ['Wolfskin image loader (Coil 3)', 'WolfskinImages.kt:46-61', '64 MiB memory, 128 MiB disk, 4 parallel reads, crossfade off', 'repeat visits paint art from memory; first grid visit downloads 626 KB per poster (no size)'],
- ['Upstream Wholphin image loader', 'CoilConfig.kt:80-101', 'separate memory + 200 MB disk', 'a second copy of the same art in memory'],
- ['Conductarr JSON', 'FileCacheStore, noBackupFilesDir/conductarr', 'saved copy shown first, then revalidated with ETag; no memory layer', 'title re-open: every ON_OPEN route re-fetched (cast 304, detail 875 ms again)'],
- ['Home, library, title, person snapshots', 'filesDir/wolfskin-home, -library-cache, -title', 'disk JSON, painted first', 'repeat visits 370–500 ms instead of 430–750'],
- ['HTTP cache (OkHttp)', 'none', '—', 'Jellyfin JSON never cached; images rely on Coil only'],
- ['DNS', 'system only', '60 s TTL through Private DNS', '1.5 s launch spinner when expired'],
-])}
-
-<h2>2. Load states</h2>
-<p>Today: a spinner on launch, flat grey blocks on Home, the grids and title pages, and a blank title page until Conductarr answers on Discover picks. Images snap in because crossfade is off in both loaders. Nothing shows a "loading" sentence; that rule already holds.</p>
-{table(OPT_HEAD, [
- opt('Picker from the saved people list, verify in the background', 'Removes the 1.5 s spinner on every DNS-cold launch (2 of 4 measured)', 'S', 'Low. A revoked session must still land on the recovery picker', 'The launcher fades straight into Who\'s watching'),
- opt('Shaped skeletons that breathe (opacity only, staggered)', 'No speed change; replaces the flat grey and spinner states', 'S', 'Low. One alpha layer per row', 'Card-shaped tiles gently pulsing until the art lands'),
- opt('Art fades in (120–160 ms) instead of popping', 'Removes the pop on every first visit', 'XS', 'Low. Keep it off for memory-cache hits so repeat visits stay instant', 'Posters settle instead of flickering in'),
- opt('Reserve space for late fields (ratings, Ready for you, genres, overview)', 'No layout jump at 3.4 s on series pages', 'S', 'Low', 'The line fades into a gap that was already there'),
- opt('Title page paints what the card already knew', 'First content 430–980 ms → about 60 ms', 'M', 'Medium. Card data must match detail (year, runtime, ratings)', 'Title, year, ratings and Play at once, over a colour wash of the poster'),
- opt('Shimmer sweep skeletons', 'None', 'S', '<b class="w">High on this GPU</b>: a moving gradient over every card, every frame', 'Light sweeps across the tiles. Not recommended'),
-])}
-<h3>See it: launch</h3>
-{pair('p-launch', 'launch', ('before-launch-spinner', 'Today, DNS cold (2 of 4 launches): 1.5 s spinner'), 'After: no spinner, people from the saved list', 180, '', False, ('before-launch-fast', 'Today, DNS warm'))}
-<h3>See it: skeleton styles</h3>
-<p class="muted small">Pick a style. Content lands at 900 ms in each, about the Movies grid's first visit.</p>
-{pair('p-skel', 'skeleton', ('before-movies-grid', 'Today: Movies grid, first visit'), 'Options', 140, '', True)}
-
-<h2>3. Motion and transitions</h2>
-<p>Today's motion tokens: focus scale 1.08 over 140 ms, ring and caption fades of 140 ms, a nav blob spring, and 160–180 ms row scrolls. There are no screen transitions or hero cross-fades, and reduced motion is defined but nothing reads it (WolfskinTokens.kt:218). At 30–46 ms per frame, a 140 ms tween is drawn in 3–4 frames. Tick <b>box frame rate</b> at the top to see that.</p>
-{table(OPT_HEAD, [
- opt('Staged reveal on screen entry (hero copy rises 16 px, rows rise 24 px, staggered 30–40 ms, 180 ms ease-out)', 'Perceived: art arrives into motion instead of popping. Cost: translate + alpha on one layer per row', 'S', 'Low. Stagger must not delay focus', 'Home and Discover settle like a curtain rather than tiles snapping'),
- opt('Hero cross-fade (backdrop 320 ms, copy hands off)', 'Removes the hard cut when the hero changes', 'S', 'Medium. Two 1080p bitmaps for 320 ms; the GPU is already at 14–21 ms/frame, so fade the backdrop only and keep the scrim static', 'The next pick dissolves in'),
- opt('Focus: 180 ms ease-out, caption rises 10 px', 'Same frame cost as today; the curve hides dropped frames better', 'XS', 'Low', 'Focus glides rather than ticks'),
- opt('Title entry: grid fades 160 ms, page builds from the poster colour', 'Hides the 470 ms backdrop fetch', 'M', 'Medium (see load states)', 'No black gap between grid and title'),
- opt('Shared-element poster → title sheet', 'None measurable', 'L', '<b class="w">High</b>. Compose shared elements across NavHost destinations on this GPU; the movie page has no poster sheet when a backdrop exists', 'The card flies into place. Not recommended now'),
- opt('Honour reduced motion (system animator scale 0 or a Wolfskin toggle)', 'Accessibility', 'S', 'Low', 'Fades only, ≤100 ms; the toggle at the top shows it'),
-])}
-<h3>See it: Who's watching → Home</h3>
-{pair('p-home', 'home', ('before-home-enter', 'Today: grey tiles, then art pops at 400 ms'), 'After', 200)}
-<h3>See it: tab switch and row reveal (Home → Discover)</h3>
-{pair('p-tab', 'tab', ('before-discover-tab', 'Today'), 'After', 150)}
-<h3>See it: title page entry</h3>
-{pair('p-title', 'title', ('before-title-movie', 'Today: American Gangster, first open (cast at 2.7 s)'), 'After: Apocalypse Now from the same grid', 170, '', False, ('before-title-discover', 'Today: Donnie Brasco from Discover, blank until 980 ms'))}
-<h3>See it: a late line on a series page</h3>
-{pair('p-series', 'series', ('before-title-series', 'Today: Adults, the readiness line lands at 3.4 s and pushes the text down'), 'After', 150, '', True)}
-<h3>See it: focus move</h3>
-{pair('p-focus', 'focus', ('before-movies-grid', 'Today, real grid'), 'Focus along a row', 0, 'Tick box frame rate to compare at 25 fps.', True)}
-<h3>See it: hero cross-fade</h3>
-{pair('p-hero', 'hero', ('before-discover-tab', 'Today (Discover hero)'), 'Hero advances', 0, '', True)}
-
-<h2>4. Caching</h2>
-{table(OPT_HEAD, [
- opt('Persisted DNS answers (OkHttp Dns: serve the last address at once, refresh behind)', 'Removes 0.45–1.35 s on launch and on the first TMDB image after any 60 s pause', 'S', 'Low. Fall back to the system lookup if the cached address fails', 'No spinner on launch; first cast photos in ≈0.6 s instead of 2.7 s [inference: DNS is the cast delay]'),
- opt('Warm the connections at process start (Jellyfin, Conductarr door, TMDB) in parallel', 'Overlaps DNS + TLS with the 450 ms first frame', 'XS', 'Low', 'Same as above, smaller'),
- opt('Memory layer over the Conductarr disk cache', 'Skips disk read and JSON decode on back and re-open (title re-open settles at 450 ms today; ~250 expected) [inference]', 'S', 'Low', 'Back and re-open feel instant'),
- opt('Stale-while-revalidate for ON_OPEN title routes (skip refetch if validated in the last 5 min)', 'Re-opening a title stops costing the server 875–2 900 ms', 'S', 'Low. Requests and readiness may be 5 min old; keep requests on FORCE', 'Nothing visible; less churn'),
- opt('Prefetch the focused card\'s title page (detail JSON + backdrop) after 350 ms of dwell', 'Title first content 430 ms → about 60 ms; backdrop already decoded', 'M', 'Medium. Bandwidth: at most one title per dwell; cancel on move', 'Opening a title is instant'),
- opt('Pre-decode last-known Home art while Who\'s watching is up', 'Home settles at 430 ms → about 250 ms with no pops', 'S', 'Low. Memory: 6 backdrops ≈ 21 MiB of the 64 MiB', 'Home appears whole'),
- opt('One image loader instead of two', 'Frees a second memory cache (Coil default ≈ 25 % of the heap) [inference]', 'M', 'Medium. Upstream screens use their own', 'Fewer re-downloads after big screens'),
- opt('OkHttp HTTP cache for Jellyfin JSON', 'Small. Jellyfin sends no cache headers, so only conditional revalidation is possible', 'S', 'Low', 'Nothing visible'),
-])}
-
-<h2>5. Backend retrieval</h2>
-{table(OPT_HEAD, [
- opt('Cache the held-title read in Conductarr (Arr library list, queue, history) for 30–60 s, shared across routes', 'Title detail 1.2 s → ≈0.1 s, season 1.1 s → ≈0.1 s, readiness 2.9 s → <1 s [inference from the code path]', 'M', 'Medium. Freshness of "Ready" after an import; invalidate on Arr webhook (already received)', 'Series pages settle in under a second; no late line', 'Conductarr release'),
- opt('Readiness: drop the duplicate held-title read and the per-episode Jellyfin GETs', 'The 5 s tail on readiness', 'M', 'Medium', '"Ready for you" appears with the page', 'Conductarr release'),
- opt('Compress the TV door (Caddy <code>encode zstd gzip</code>)', 'Feed 204 KB → ~25–35 KB [inference: JSON typically 6–8×], activity 62 KB → ~8 KB', 'XS', 'Low', 'Discover opens a little faster on Wi-Fi', 'Caddy change (server-docs)'),
- opt('304 before rendering (keep a per-route version, not a hash of the full body)', 'Season 304 2.3 s → ms', 'M', 'Medium', 'Nothing visible except speed', 'Conductarr release'),
- opt('Cache the token check (<code>/Users/Me</code>) for 60 s per token', 'Removes a Jellyfin round trip from every TV request (~10–40 ms each, 6–10 per title page)', 'S', 'Low. Revocation lag 60 s', 'Nothing visible', 'Conductarr release'),
- opt('Batch display reads (one call for a row of posters)', '≈1 400 display calls/day → a few dozen', 'M', 'Low', 'Coming in and Discover rows fill together', 'Conductarr release + TV'),
- opt('Size the grid posters (<code>fillWidth=256&fillHeight=384&quality=80&format=Webp</code>)', '626 KB → 11 KB per poster (57×); 85 films 53 MB → 1 MB', 'XS', 'Low', 'Movies and Shows fill at once on first visit', 'TV'),
- opt('Ask TMDB for w342 posters, not w780', '131 KB → 41 KB per Discover poster', 'XS', 'Low. 342 px for a 256 px card', 'Discover rows fill sooner', 'TV'),
- opt('Lean episode fields (drop MediaSources/MediaStreams/People from the list; fetch them on Play)', '96.8 KB → 6.5 KB per season, 142 → 26 ms', 'S', 'Medium. The episode row shows file chips', 'Series pages settle sooner', 'TV'),
- opt('Fewer launch calls: UserViews 4–5× and LiveTv/Recordings/Folders 2× per launch', '≈250 ms of serial calls', 'S', 'Low', 'Nothing visible', 'TV'),
-])}
-
-<h2>6. Kotlin and Compose</h2>
-{table(OPT_HEAD, [
- opt('Library load re-emits the full list per 200-item page and re-sorts each time (LibraryReadFacade.kt:96, LibraryGridState.kt:99)', 'Grid first visit; matters more as the library grows', 'S', 'Low', 'Grid appears in one step', 'TV'),
- opt('Hoist the Regex in titleFallbackBackground / titleAmbientBackground (TitleArtwork.kt:152,167)', 'Draw-time cost per card', 'XS', 'Low', '—', 'TV'),
- opt('Discover reads firstVisibleItemIndex in composition (DiscoverScreen.kt:107) → derivedStateOf', 'Fewer recompositions while scrolling Discover (34 of 44 janky frames were UI-thread)', 'XS', 'Low', 'Smoother Discover scroll', 'TV'),
- opt('NavBar label colour read in composition (NavBar.kt:86) → draw-phase', 'Tab switch frames', 'XS', 'Low', '—', 'TV'),
- opt('WolfskinImages.loader() is @Synchronized and called in composition', 'Lock on every poster recomposition', 'XS', 'Low', '—', 'TV'),
- opt('Cut full-screen layers: hero blur (RenderEffect) + two full-screen gradient scrims + ambient', 'GPU 14–21 ms/frame is the floor today; pre-blurred tiny art and one combined scrim drawn once', 'M', 'Medium. Must match the approved frames', 'Smoother scroll on Home and Discover', 'TV'),
- opt('Keys and contentType', 'Already done everywhere', '—', '—', '—', ''),
-])}
-
-<h2>7. Baseline profile</h2>
-<p>Today: a hand seed of 6 lines (<code>app/src/optimized/baselineProfiles/baseline-prof.txt</code>), no generator and no Macrobenchmark. The box is at <code>speed</code> only because it was forced with <code>cmd package compile</code>. Every new install starts at <code>verify</code> (interpreted/JIT) until background dexopt runs.</p>
-{table(['State (same box, earlier tv-perf run)', 'Cold start', 'Home scroll janky / p50 / p90', 'Movies grid'], [
- ['Opt just installed (verify)', '0.5–1.0 s', '51.4 % / 65 / 117 ms', '—'],
- ['Opt after forced AOT (speed)', '0.39–0.44 s', '29.2 % / 38 / 61 ms', '17.7 % / 19 / 36 ms'],
-], 'num')}
-<p><b>Expected from a recorded profile</b> (Baseline Profile Gradle plugin plus one UiAutomator journey through picker, Home, Discover, the grids, a title and a person page): a fresh install behaves like the AOT row from the first launch. That is roughly −40 % janky frames on Home scroll and up to half a second off cold start, for every build the second mate installs. It does <b>not</b> change steady state on a box already at <code>speed</code>. Effort M: the journey can run on an emulator in the build container; the box itself isn't needed. Risk low.</p>
-
-<h2>8. Recommended plan</h2>
-<ol class="plan">
-<li><b>DNS and launch (TV, S, ~1 day).</b> Persisted DNS answers plus parallel connection warm-up at process start. Show the picker from saved people and check the session in the background. <i>Prove it:</i> 6 cold launches spaced &gt;60 s apart, picker at ≤0.5 s every time (today 1.65 s in half); first cast photos on a new title ≤1 s.</li>
-<li><b>Image sizes (TV, XS, hours).</b> Sized WebP grid posters, TMDB w342, lean episode fields. <i>Prove it:</i> first Movies visit settles ≤400 ms (today 750); tank payload table.</li>
-<li><b>Load states and motion (TV, M, 2–3 days, against your pick on this page).</b> Breathing shaped skeletons, art fade-in for network loads only, reserved late-line slots, staged reveal, hero cross-fade, reduced motion. <i>Prove it:</i> recordings like the ones above, no layout change after first content, gfxinfo janky no worse than today.</li>
-<li><b>Prefetch and memory cache (TV, M, 2 days).</b> Dwell prefetch of title pages, a memory layer over the Conductarr cache, pre-decoded Home art behind the picker. <i>Prove it:</i> title first content ≤100 ms and Home settled ≤250 ms.</li>
-<li><b>Conductarr release (M–L, 2–4 days):</b> held-title cache with webhook invalidation, readiness without duplicate reads or per-episode GETs, 304 before render, token-check cache. <b>Caddy</b>: compress the TV door. <i>Prove it:</i> the route table above for 24 h, with detail, season and readiness p50 ≤200 ms and p95 ≤600 ms, and the feed on the wire ≤40 KB.</li>
-<li><b>Baseline profile (TV build, M, 1–2 days).</b> Recorded journey profile. <i>Prove it:</i> fresh install without a forced compile, Home scroll janky ≤30 %, cold start ≤0.5 s.</li>
-<li><b>Frame cost (TV, M, 2–3 days).</b> The Compose fixes in section 6 and fewer full-screen layers. <i>Prove it:</i> Home and grid scroll janky ≤20 %, GPU p90 ≤16 ms in framestats.</li>
-</ol>
-<p><b>Total:</b> about 2 weeks of TV work and 3–4 days for a Conductarr release. Steps 1–2 alone remove the two waits you can feel today (the launch spinner and grids filling slowly), in about a day and a half.</p>
-<p class="muted small">A box-side alternative to step 1's DNS part: switch the box's Private DNS from <code>dns.adguard.com</code> to Automatic, so it uses the LAN resolver (136–160 ms uncached, 0 ms cached). That changes the whole box, not just Wolfskin, so it's your call; the TV-side fix works either way.</p>
-<h2>9. Your picks (all of them on one page)</h2>
-<p class="muted">Six decisions. Each locks the moment you send it and the build lanes start on it. Nothing here touches the TV while you are playing.</p>
-<form class="decision" data-decision-key="tv-motion-speed-direction" data-lavish-question="tv-motion-speed-direction"><h3>1. Load-state and motion direction</h3>
-<p class="muted">Decides plan step 3 (skeletons and motion). The prototypes above show each part.</p>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="recommended" data-choice-key="tv-motion-speed-direction"> <b>A · As recommended</b> <span class="rec">recommended</span><span class="t">Breathing shaped skeletons, art fades in only when it came from the network, reserved space for late lines, hero cross-fade, reduced-motion safe.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="flat" data-choice-key="tv-motion-speed-direction"> <b>B · Same, but flat skeletons</b><span class="t">Still card-shaped, no pulse. The calmest option.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="shimmer" data-choice-key="tv-motion-speed-direction"> <b>C · Same, but shimmer skeletons</b><span class="t">A light sweep across the tiles. Costs GPU on this box every frame while loading.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="changes" data-choice-key="tv-motion-speed-direction"> <b>D · Different</b><span class="t">Say what in the note: a prototype to change, a speed, an option to drop.</span></label>
-<textarea aria-label="Notes for 1. Load-state and motion direction" name="tv-motion-speed-direction-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-speed-quick-fixes" data-lavish-question="tv-speed-quick-fixes"><h3>2. The two quick speed fixes (about a day and a half, TV only)</h3>
-<p class="muted">(a) DNS cache with stale-serve plus a picker painted from saved people, so the launch spinner goes away; (b) sized WebP grid posters, smaller TMDB art, lean episode fields, so grids fill fast. Both ship in the next TV build.</p>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="go" data-choice-key="tv-speed-quick-fixes"> <b>Go, start now</b> <span class="rec">recommended</span><span class="t">Two small lanes, merged and staged for the next install.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="a-only" data-choice-key="tv-speed-quick-fixes"> <b>Only (a), the launch spinner</b><span class="t">Leave the image sizing for later.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="b-only" data-choice-key="tv-speed-quick-fixes"> <b>Only (b), the image sizes</b><span class="t">Leave the DNS cache for later.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="later" data-choice-key="tv-speed-quick-fixes"> <b>Not now</b><span class="t">Skip until after the motion work.</span></label>
-<textarea aria-label="Notes for 2. The two quick speed fixes (about a day and a half, TV only)" name="tv-speed-quick-fixes-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-box-dns" data-lavish-question="tv-box-dns"><h3>3. Change the box Private DNS (your call, system setting)</h3>
-<p class="muted">Today the box uses dns.adguard.com: an uncached lookup costs 450 to 1350 ms. Automatic uses the LAN resolver (136 to 160 ms uncached, 0 ms cached). It changes DNS for the whole box, not just Wolfskin. I do it with ADB only when the TV is free and you say so; the TV-side fix in 2(a) works either way.</p>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="leave" data-choice-key="tv-box-dns"> <b>Leave it as it is</b> <span class="rec">recommended</span><span class="t">The TV-side cache covers the launch spinner.</span></label>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="automatic" data-choice-key="tv-box-dns"> <b>Switch to Automatic</b><span class="t">I change it when you free the TV and show before and after timings.</span></label>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="ask" data-choice-key="tv-box-dns"> <b>Ask me when the TV is free</b><span class="t">Decide then.</span></label>
-<textarea aria-label="Notes for 3. Change the box Private DNS (your call, system setting)" name="tv-box-dns-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-speed-later-steps" data-lavish-question="tv-speed-later-steps"><h3>4. Later plan steps to queue (TV, after the build above)</h3>
-<p class="muted">Prefetch and memory cache (title pages, 2 days); recorded Baseline Profile (1 to 2 days); frame cost and Compose fixes (2 to 3 days). Each has its own proof target in section 8.</p>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="all" data-choice-key="tv-speed-later-steps"> <b>Queue all three in that order</b> <span class="rec">recommended</span><span class="t">They follow the motion work, one lane at a time.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="prefetch" data-choice-key="tv-speed-later-steps"> <b>Only prefetch and memory cache</b><span class="t">Skip the profile and frame work for now.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="none" data-choice-key="tv-speed-later-steps"> <b>None yet</b><span class="t">Revisit after you have seen the motion build on the TV.</span></label>
-<textarea aria-label="Notes for 4. Later plan steps to queue (TV, after the build above)" name="tv-speed-later-steps-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-conductarr-retrieval" data-lavish-question="tv-conductarr-retrieval"><h3>5. Conductarr title-read speed-up (needs a Conductarr release)</h3>
-<p class="muted">Held-title cache with Arr webhook invalidation, readiness without duplicate reads or per-episode calls, 304 before render, token-check cache, compression on the TV door. 3 to 4 days, plus a release and a server-docs update. Title pages are slow because of this (readiness p50 2.9 s).</p>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="scope" data-choice-key="tv-conductarr-retrieval"> <b>Scope it first, then I decide</b> <span class="rec">recommended</span><span class="t">A short scout writes the exact change list and risks for a release; nothing ships.</span></label>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="go" data-choice-key="tv-conductarr-retrieval"> <b>Go: build it and release it</b><span class="t">You are giving the word to build and release Conductarr when it is green.</span></label>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="later" data-choice-key="tv-conductarr-retrieval"> <b>Not now</b><span class="t">Skip until after the TV-side wins.</span></label>
-<textarea aria-label="Notes for 5. Conductarr title-read speed-up (needs a Conductarr release)" name="tv-conductarr-retrieval-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-build-order" data-lavish-question="tv-build-order"><h3>6. When should these land on the TV?</h3>
-<p class="muted">You said you will not be using the TV during this session.</p>
-<label class="opt"><input required type="radio" name="tv-build-order" value="as-ready" data-choice-key="tv-build-order"> <b>Bundle with the next install</b> <span class="rec">recommended</span><span class="t">The speed fixes and any approved motion work join the staged build; I install when you say the TV is free.</span></label>
-<label class="opt"><input required type="radio" name="tv-build-order" value="separate" data-choice-key="tv-build-order"> <b>Install the speed fixes on their own first</b><span class="t">A quick build for steps 2(a) and 2(b) only, installed as soon as it is ready if you free the TV.</span></label>
-<textarea aria-label="Notes for 6. When should these land on the TV?" name="tv-build-order-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<p class="muted small">Method, raw numbers and files: <code>data/tv-spike-motion-speed/report.md</code>. Nothing was changed in the app or on the server. The box was left on the Movies tab.</p>
-<script>
-{JS}
-document.querySelectorAll('form.decision').forEach(form=>{{form.addEventListener('submit',event=>{{event.preventDefault();const key=form.dataset.lavishQuestion;const answer=new FormData(form).get(key);const status=form.querySelector('[role=status]');if(!answer){{status.textContent='Pick an option first.';return;}}if(!window.lavish||!window.lavish.queuePrompt){{status.textContent='Open this page in the live review board to queue an answer.';return;}}const note=form.querySelector('textarea').value.trim();const label=form.querySelector('h3').textContent;window.lavish.queuePrompt(label+': '+answer+(note?'\\n'+note:''),{{tag:'choice',text:label+': '+answer,element:form,queueKey:key,data:{{question:key,answer:answer,note:note}}}});status.textContent='Queued. Press Send to Agent in the review toolbar.';}});}});
-</script></main></body></html>'''
-
-os.makedirs(ASSETS, exist_ok=True)
-src = os.path.join(HERE, 'tv-motion-speed')
-for f in os.listdir(src):
-    shutil.copyfile(os.path.join(src, f), ASSETS + f)
-    os.chmod(ASSETS + f, 0o660)
-with open(OUT, 'w') as fh:
-    fh.write(page)
-os.chmod(OUT, 0o660)
-print(OUT, len(page))

data/tv-v2/motion-2026-11-06/delta.json

@@ -1,56 +0,0 @@
-{
-  "specRevision": 6,
-  "direction": "A — As recommended",
-  "approvedReference": "https://pages.justinvisser.org/wolfskin/tv-motion-speed.html",
-  "frozenInputs": ["index.html", "proto.css", "proto.js", "build_page.py", "tv-motion-speed/"],
-  "checksums": "SHA256SUMS",
-  "stagePx": [1920, 1080],
-  "density": 2,
-  "skeleton": {
-    "fill": "#1b1b25",
-    "alpha": [0.55, 1, 0.55],
-    "cycleMs": 1400,
-    "halfCycleEasing": [0.42, 0, 0.58, 1],
-    "layerScope": "one layer per shelf or bounded header block; no per-card stagger",
-    "shimmer": false,
-    "focusable": false
-  },
-  "art": {
-    "networkRevealMs": 160,
-    "memoryDiskLocalRevealMs": 0,
-    "loaders": ["WolfskinImages", "upstream CoilConfig"],
-    "requestUrlChanges": false
-  },
-  "hero": {
-    "backdropFadeMs": 320,
-    "backdropEasing": [0.65, 0, 0.35, 1],
-    "homeBlendBoundsPx": [1920, 820],
-    "discoverBlendBoundsPx": [1920, 740],
-    "holdPreviousUntilIncomingArtOrFallback": true,
-    "copyOutMs": 120,
-    "copyEntryAtMs": 140,
-    "copyInMs": 200,
-    "copyRisePx": 14
-  },
-  "focus": {
-    "durationMs": 180,
-    "easing": [0.33, 1, 0.68, 1],
-    "captionDelayMs": 60,
-    "captionRisePx": 10,
-    "captionOutMs": 100,
-    "geometry": "unchanged"
-  },
-  "rowEntry": {"durationMs": 180, "risePx": 24, "scope": "one row, never full screen"},
-  "lateSeriesReadiness": {"reservedHeightPx": 56, "fadeMs": 200, "translationPx": 0},
-  "reducedMotion": {
-    "sources": ["Compose window MotionDurationScale == 0", "LocalReducedMotion host flag"],
-    "maximumFadeMs": 80,
-    "pulse": false,
-    "translation": false,
-    "scrollAnimation": false
-  },
-  "nativeFrames": "https://pages.justinvisser.org/wolfskin/tv-motion-build/",
-  "onDeviceAcceptance": {"homeJankyPercentMaximum": 39.6, "homeP90MsMaximum": 65, "lateSeriesLayoutShiftPx": 0},
-  "deviceAccess": "not performed by this worker",
-  "specification": "../../tv-spec/spec.md"
-}

data/tv-v2/motion-2026-11-06/index.html

@@ -1,483 +0,0 @@
-<!doctype html><html lang="en" data-lavish-annotate="off"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark"><title>Wolfskin TV: faster, quieter, smoother</title><style>
-:root{color-scheme:dark;--bg:#07070a;--panel:#13131a;--line:rgba(255,255,255,.1);--fg:#f4f4f6;--muted:rgba(244,244,246,.74);--acc:oklch(78% 0.14 305);--ok:#7ed6a0;--warn:#ffc46b;--bad:#ff8a7a}
-*{box-sizing:border-box}html{-webkit-text-size-adjust:100%}body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,Segoe UI,sans-serif}
-main{max-width:1400px;margin:0 auto;padding:16px 14px 120px}h1{font-size:28px;line-height:1.2;margin:6px 0 6px}h2{font-size:21px;margin:34px 0 8px;color:var(--acc);border-bottom:1px solid var(--line);padding-bottom:4px}
-h3{font-size:17px;margin:20px 0 6px}a{color:var(--acc)}.muted{color:var(--muted)}.small{font-size:13px}p{margin:6px 0}li{margin:3px 0}
-.lead{font-size:17px}.k{color:var(--ok)}.w{color:var(--warn)}.b{color:var(--bad)}
-.tw{overflow-x:auto;margin:8px 0;border:1px solid var(--line);border-radius:10px}table{border-collapse:collapse;width:100%;font-size:14px}
-th,td{padding:6px 9px;border-top:1px solid var(--line);text-align:left;vertical-align:top}thead th{border-top:0;background:#1b1a22;white-space:nowrap}
-td:first-child{font-weight:600}table.num td:not(:first-child){white-space:nowrap}
-.card2{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:12px 16px;margin:10px 0}
-.pair{margin:14px 0 26px}.ph{display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin:0 0 6px}
-.panes{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(380px,100%),1fr));gap:12px}.pane{min-width:0}.lab{font-size:13px;color:var(--muted);margin:0 0 4px}
-.decision{padding:18px 22px;background:#13131a;border:1px solid var(--line);border-radius:14px;margin:14px 0}.decision h3{margin-top:0}
-.opt{display:block;border:1px solid var(--line);border-radius:10px;padding:9px 12px;margin:7px 0;cursor:pointer;background:#100e16}.opt:has(input:checked){background:oklch(26% 0.07 305);border-color:var(--acc)}
-.opt .t{display:block;color:var(--muted);font-size:14px;margin-left:24px}.rec{font-size:12px;color:var(--ok);margin-left:6px}
-textarea{width:100%;min-height:70px;background:#0c0b10;color:var(--fg);border:1px solid var(--line);border-radius:8px;padding:8px;font:inherit;margin-top:6px}
-.tabs{display:flex;gap:6px;flex-wrap:wrap;margin:0 0 6px}
-.tab,button.replay{font:inherit;font-size:13px;border-radius:999px;padding:4px 11px;border:1px solid var(--line);background:#1b1a22;color:var(--fg);cursor:pointer}.tab.on{background:oklch(26% 0.07 305);border-color:var(--acc)}
-button.replay{background:oklch(26% 0.07 305);border-color:var(--acc)}
-form.decision button[type=submit]{font:inherit;font-size:15px;font-weight:600;border-radius:999px;padding:8px 18px;border:1px solid var(--acc);background:oklch(26% 0.07 305);color:var(--fg);cursor:pointer;margin-top:8px}
-form.decision [role=status]{font-size:13px;margin-left:10px;opacity:.8}
-.ctl{position:sticky;top:0;z-index:8;background:#07070aee;backdrop-filter:blur(6px);border-bottom:1px solid var(--line);padding:8px 0;margin:0 0 8px;display:flex;gap:18px;flex-wrap:wrap;align-items:center;font-size:14px}
-.ctl label{display:inline-flex;gap:6px;align-items:center;cursor:pointer}
-ol.plan>li{margin:10px 0}code{font-size:13px;color:oklch(88% 0.08 305)}
-/* Prototype stages: 1920x1080 CSS px, approved tokens from data/tv-v2/focus-2026-11-06 (colors, type, ring, card sizes at Level 2 spacing). */
-.sbox{position:relative;width:100%;aspect-ratio:16/9;overflow:hidden;border-radius:8px;border:1px solid var(--line);background:#000}
-.sbox video{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;display:block}
-.stage{position:absolute;left:0;top:0;width:1920px;height:1080px;transform-origin:0 0;overflow:hidden;background:#07070a;font-family:system-ui,-apple-system,"Segoe UI",Roboto,"Noto Sans",sans-serif;color:#f4f4f6;font-size:28px;line-height:1.3;
- --bg:#07070a;--surface:#13131a;--surface2:#1b1b25;--surface3:#252532;--muted:rgb(244 244 246/.74);--dim:rgb(244 244 246/.56);--accent:oklch(78% 0.14 305);--accent-text:oklch(88% 0.08 305)}
-.stage *{box-sizing:border-box}
-.stage .abs{position:absolute}
-/* nav */
-.stage .nav{position:absolute;left:0;top:0;width:1920px;height:150px;z-index:5;display:flex;align-items:center;gap:12px;padding:44px 96px 0}
-.stage .wm{font-size:36px;font-weight:800;letter-spacing:-.02em;margin-right:40px}.stage .wm b{color:var(--accent)}
-.stage .ni{height:64px;padding:0 26px;border-radius:32px;display:inline-flex;align-items:center;font-size:30px;font-weight:600;color:var(--muted);position:relative}
-.stage .ni.cur{color:#f4f4f6}.stage .ni.cur::after{content:"";position:absolute;left:26px;right:26px;bottom:4px;height:4px;border-radius:2px;background:var(--accent)}
-.stage .ni.f{background:#f4f4f6;color:#0b0b10}.stage .ni.f::after{display:none}
-.stage .nsp{flex:1}.stage .av{width:64px;height:64px;border-radius:50%;display:grid;place-items:center;font-weight:800;color:#0b0b10;font-size:30px;background:#9be38f}
-/* hero */
-.stage .amb{position:absolute;inset:0;background-size:cover;background-position:center;image-rendering:auto}
-.stage .bd{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .scrim{position:absolute;inset:0;background:linear-gradient(90deg,rgb(7 7 10/.92) 0%,rgb(7 7 10/.55) 42%,rgb(7 7 10/0) 70%),linear-gradient(0deg,#07070a 0%,rgb(7 7 10/.6) 26%,rgb(7 7 10/0) 48%)}
-.stage .copy{position:absolute;left:96px;width:1000px}
-.stage .kicker{font-size:26px;font-weight:650;color:var(--accent-text);margin-bottom:10px}
-.stage .ht{font-size:84px;line-height:1.02;font-weight:800;letter-spacing:-.02em;margin:0 0 16px}
-.stage .hm{font-size:28px;color:var(--muted);margin-bottom:14px;min-height:38px;display:flex;gap:22px;align-items:center}
-.stage .ho{font-size:28px;color:var(--muted);margin:0 0 30px;max-width:960px}
-.stage .btns{display:flex;gap:20px}
-.stage .btn{height:76px;padding:0 38px;border-radius:38px;font-size:28px;font-weight:700;display:inline-flex;align-items:center;background:rgb(255 255 255/.14)}
-.stage .btn.pri{background:#f4f4f6;color:#0b0b10}
-.stage .btn.f{box-shadow:0 0 0 2px var(--accent),inset 0 0 0 2px var(--accent);transform:scale(1.05)}
-.stage .rate{display:inline-flex;gap:10px;align-items:center;font-weight:700;color:#f4f4f6}.stage .rate i{width:24px;height:24px;border-radius:50%;background:#e2483a;display:inline-block}
-.stage .rate i.pc{background:#f5c518;border-radius:4px}
-.stage .slot{display:inline-block;height:30px;border-radius:15px;background:rgb(255 255 255/.10)}
-/* rows + cards */
-.stage .sh{position:absolute;left:96px;font-size:34px;font-weight:700}
-.stage .card{position:absolute;border-radius:16px;overflow:hidden;background:var(--surface);background-size:cover;background-position:center}
-.stage .card.poster{width:256px;height:384px}.stage .card.tile{width:400px;height:225px}
-.stage .card .img{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .card .cap{position:absolute;left:0;right:0;bottom:0;padding:14px 18px;background:linear-gradient(rgb(7 7 10/0),rgb(7 7 10/.92));font-size:26px;font-weight:700}
-.stage .ring{box-shadow:0 0 0 2px var(--accent),inset 0 0 0 2px var(--accent),0 18px 40px rgb(0 0 0/.55)}
-.stage .circle{position:absolute;width:200px;height:200px;border-radius:50%;overflow:hidden;background:var(--surface2);display:grid;place-items:center;font-size:44px;font-weight:800;color:var(--dim)}
-.stage .circle .img{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .bar{position:absolute;height:28px;border-radius:14px;background:var(--surface2)}
-.stage .spin{position:absolute;left:940px;top:520px;width:40px;height:40px;border-radius:50%;border:4px solid rgb(155 120 255/.25);border-top-color:oklch(65% 0.2 300);animation:spin .8s linear infinite}
-/* picker */
-.stage .pk{position:absolute;top:290px;left:0;width:1920px;text-align:center;font-size:72px;font-weight:800;letter-spacing:-.02em}
-.stage .person{position:absolute;top:426px;width:220px;height:220px;border-radius:50%;display:grid;place-items:center;font-size:110px;font-weight:800;color:#0b0b10}
-.stage .pname{position:absolute;top:670px;width:220px;text-align:center;font-size:34px;font-weight:700;color:var(--muted)}
-/* replay label */
-.stage .tl{position:absolute;right:14px;bottom:10px;font:22px/1 ui-monospace,Menlo,monospace;background:rgb(0 0 0/.6);padding:6px 8px;border-radius:6px;color:#fff;z-index:20}
-
-/* keyframes */
-@keyframes spin{to{transform:rotate(360deg)}}
-@keyframes fade{from{opacity:0}to{opacity:1}}
-@keyframes fadeout{from{opacity:1}to{opacity:0}}
-@keyframes rise{from{opacity:0;transform:translateY(16px)}to{opacity:1;transform:none}}
-@keyframes breathe{0%,100%{opacity:.55}50%{opacity:1}}
-@keyframes shimmer{from{transform:translateX(-100%)}to{transform:translateX(100%)}}
-@keyframes hide{to{opacity:0;visibility:hidden}}
-@keyframes show{from{opacity:0}to{opacity:1}}
-
-/* anything with .an waits for .play */
-.stage .an{opacity:0}
-.stage.play .an{animation-fill-mode:both}
-.stage .gone{animation-fill-mode:both}
-/* skeleton styles */
-.stage .sk{background:var(--surface2)}
-.stage .sk.breathe{animation:breathe 1.4s ease-in-out infinite}
-.stage .sk.shim{position:relative;overflow:hidden}
-.stage .sk.shim::after{content:"";position:absolute;inset:0;background:linear-gradient(90deg,transparent,rgb(255 255 255/.07),transparent);animation:shimmer 1.3s linear infinite}
-
-/* reduced motion: no movement, short fades only */
-body.rm .stage.play .an{animation-name:fade!important;animation-duration:.08s!important}
-body.rm .stage .sk.breathe,body.rm .stage .sk.shim::after{animation:none}
-body.rm .stage .mv{transition:none!important}
-
-</style></head><body><main>
-<h1>Wolfskin TV: faster, quieter, smoother</h1>
-<p class="lead">Measured on your Xiaomi box with <b>Wolfskin (Opt)</b> 1.1.0-133 and from tank, on 2026-11-06. This page has the options, the plan, and live prototypes of the loading and motion. Each prototype sits next to a recording of the real app doing the same thing today.</p>
-
-<div class="card2"><b>The short version</b><ul>
-<li><b>The biggest wait isn't the app.</b> Two of four cold launches showed a spinner for <b>1.5 s</b>, and the other two showed none. The box looks up <code>jelly.justinvisser.org</code> through AdGuard Private DNS, and an uncached lookup takes <b>0.45–1.35 s</b>. The address only stays cached for 60 s, so the first launch after a minute's pause pays it, and so does the first title page that fetches TMDB art. A small TV-side DNS cache (or one box setting) removes it.</li>
-<li><b>The second biggest is Conductarr.</b> On a title page, the detail, season and "Ready for you" reads take <b>1.1 s, 1.1 s and 2.9 s</b> at the median. Each one re-lists the whole Radarr/Sonarr library on every request, with no cache. A title page can't settle until the slowest arrives (3.4 s on a series). This needs a Conductarr release.</li>
-<li><b>Screens are already quick, but they pop.</b> Home, the grids, Discover and Settings settle in <b>0.2–0.75 s</b>. What makes the wait visible is art and fields arriving in steps, and the layout jumping when a late line lands. That's fixable on the TV alone: fade art in, reserve space for late lines, keep last-known screens, and prefetch.</li>
-<li><b>Frames are slow for two reasons.</b> At the median a frame takes 30–46 ms during moves, where 60 fps needs 16.7 ms. On grid and row scrolls, <b>30–44 %</b> of frames miss. The GPU alone takes 14–21 ms per frame, so motion here has to be cheap: fades, small rises and scale on one layer. No full-screen blur or shimmer sweeps.</li>
-</ul></div>
-
-<div class="ctl"><label><input type="checkbox" id="boxrate"> Play prototypes at the box's frame rate (40 ms per frame, measured)</label><label><input type="checkbox" id="rm"> Reduced motion (fades only, ≤100 ms)</label><span class="muted small">Prototypes loop. "Replay together" restarts the recording and the prototype in step. Counters are ms after the screen first reacts to the key.</span></div>
-
-<h2>1. Where the time goes today</h2>
-<h3>Per screen, from the first frame that reacts to the key until the screen stops changing</h3>
-<p class="muted small">Method: on-device <code>screenrecord</code> (it only emits frames on change), scene-change detection with ffmpeg, logcat (OkHttp and ActivityManager) and Conductarr's own request log for the same seconds. "Settled" is the last visible change. Raw clips and sheets are in <code>data/tv-spike-motion-speed/</code>.</p>
-<div class="tw"><table class="num"><thead><tr><th>Screen</th><th>First content</th><th>Settled</th><th>What arrives late</th><th>Repeat visit</th></tr></thead><tbody><tr><td>Cold start (am start -W TotalTime, 4 runs)</td><td>583 / 538 / 438 / 453 ms to first frame</td><td>picker at +0.3–0.4 s (DNS warm) or <b class="b">+1.65 s</b> (DNS cold)</td><td>Spinner while <code>Users/Me</code> then <code>System/Info/Public</code> run one after the other (ServerRepository.kt:104,107)</td><td>same, bimodal on the 60 s DNS cache</td></tr><tr><td>Who's watching → Home</td><td>hero text 135 ms</td><td>430 ms</td><td>shelf tiles flat grey until 400 ms, then all images pop</td><td>370 ms</td></tr><tr><td>Home → Discover tab</td><td>content 270 ms (dims first)</td><td>700 ms</td><td>posters pop in over 0.4 s</td><td>600 ms</td></tr><tr><td>Movies grid</td><td>230 ms (blank tiles)</td><td>750 ms</td><td>posters fill row by row</td><td>500 ms</td></tr><tr><td>Shows grid</td><td>280 ms</td><td>640 ms</td><td>posters</td><td>—</td></tr><tr><td>Title, movie in library (American Gangster)</td><td>430 ms (text)</td><td><b class="w">2.69 s</b></td><td>backdrop 470 ms; cast portraits 2.7 s (initials until then)</td><td>450 ms total</td></tr><tr><td>Title, Discover pick (Donnie Brasco)</td><td>980 ms (blank skeleton until then)</td><td>1.53 s</td><td>backdrop 1.37 s, cast 1.5 s</td><td>—</td></tr><tr><td>Title, series (Adults)</td><td>620 ms</td><td><b class="b">3.42 s</b></td><td>ratings and "Ready for you · by Mindel" land at 3.4 s and push the overview down</td><td>—</td></tr><tr><td>Person page (Martin Sheen)</td><td>620 ms</td><td>720 ms</td><td>filmography posters</td><td>—</td></tr><tr><td>Back from title / series / person</td><td>260 / 300 / 450 ms</td><td></td><td></td><td></td></tr><tr><td>Settings</td><td>220 ms</td><td>220 ms</td><td>—</td><td></td></tr><tr><td>Coming in sheet</td><td>74 ms</td><td>74 ms (from cache)</td><td>posters refresh silently</td><td></td></tr></tbody></table></div>
-
-<h3>Frame timing per interaction (dumpsys gfxinfo, ART status <code>speed</code>)</h3>
-<div class="tw"><table class="num"><thead><tr><th>Interaction</th><th>Frames</th><th>Janky</th><th>p50</th><th>p90</th><th>p99</th><th>Main thread slow / GPU slow</th></tr></thead><tbody><tr><td>Home rows scroll (down 7, up 6, right 5), run 1 / 2</td><td>149 / 115</td><td>38.9 % / 34.8 %</td><td>44 / 46 ms</td><td>69 / 65</td><td>89 / 101</td><td>43 / 52 · 27 / 35</td></tr><tr><td>Movies grid scroll (down 8, up 8), run 1 / 2</td><td>180 / 159</td><td>43.9 % / 32.1 %</td><td>30 / 30 ms</td><td>53 / 46</td><td>93 / 73</td><td>30 / 69 · 20 / 48</td></tr><tr><td>Discover scroll</td><td>146</td><td>30.1 %</td><td>34 ms</td><td>57</td><td>73</td><td>34 / 35</td></tr><tr><td>Tab switch ×4</td><td>158</td><td>18.4 %</td><td>28 ms</td><td>65</td><td>150</td><td>15 / 29</td></tr><tr><td>Title open + back ×3</td><td>103</td><td>33.0 %</td><td>48 ms</td><td>113</td><td>150</td><td>29 / 34</td></tr><tr><td>Who's watching → Home</td><td>15</td><td>53.3 %</td><td>61 ms</td><td>117</td><td>133</td><td>7 / 8</td></tr><tr><td>Open title (movie, first time)</td><td>20</td><td>60.0 %</td><td>57 ms</td><td>150</td><td>200</td><td>9 / 12</td></tr><tr><td>Back from person</td><td>12</td><td>75.0 %</td><td>93 ms</td><td>150</td><td>150</td><td>8 / 9</td></tr></tbody></table></div>
-<p class="muted small">Frame phases on the Shows grid (framestats, 68 frames): record p50 0.5 / p90 10.3 ms, GPU issue p50 4.3 / p90 8.9 ms, GPU complete p50 <b>14.3</b> / p90 <b>21.2</b> ms, total p50 25.6 / p90 41.4 ms. The app renders at 1920×1080 and the box outputs 3840×2160 at 59.94 Hz. Today's grid is worse than the earlier Opt measurement (17.7 % janky), which was taken before the spacing and focus-ring builds.</p>
-
-<h3>Network, from tank (10 runs each; cold = new connection, warm = kept-alive)</h3>
-<div class="tw"><table class="num"><thead><tr><th>Call</th><th>Bytes</th><th>Cold p50 / p95</th><th>Warm p50 / p95</th><th>Cache headers</th></tr></thead><tbody><tr><td>Jellyfin UserViews (called 4–5× per launch)</td><td>2.3 KB</td><td>65 / 166 ms</td><td>46 / 51 ms</td><td>none</td></tr><tr><td>Home Resume (20)</td><td>1.4 KB</td><td>58 / 66</td><td>30 / 41</td><td>none</td></tr><tr><td>Home NextUp (20)</td><td>6.2 KB</td><td>71 / 91</td><td>47 / 52</td><td>none</td></tr><tr><td>Home Items/{{id}} per series (sequential)</td><td>4.0 KB</td><td>43 / 60</td><td>24 / 28</td><td>none</td></tr><tr><td>Home library shelf (20)</td><td>18.7 KB</td><td>85 / 116</td><td>74 / 84</td><td>none</td></tr><tr><td>Movies grid page (200)</td><td>51 KB</td><td>68 / 148</td><td>61 / 64</td><td>none</td></tr><tr><td>Title episodes with MediaSources + People</td><td><b class="w">96.8 KB</b></td><td>142 / 185</td><td>122 / 169</td><td>none</td></tr><tr><td>Title episodes, lean fields</td><td>6.5 KB</td><td>26 / 65</td><td>11 / 12</td><td>none</td></tr><tr><td>Grid poster, no size (today, LibraryReadFacade.kt:86)</td><td><b class="b">626 KB</b></td><td>26 / 30</td><td>8 / 9</td><td>max-age 1 y, immutable, ETag</td></tr><tr><td>Grid poster fillWidth 256×384 q96</td><td>31.6 KB</td><td>19 / 131</td><td>2 / 4</td><td>same</td></tr><tr><td>Grid poster 256×384 q80 WebP</td><td>11.2 KB</td><td>19 / 118</td><td>1 / 2</td><td>same</td></tr><tr><td>Backdrop 1280 q96 / q80 WebP</td><td>91 / 31 KB</td><td>19 / 25</td><td>2 / 2</td><td>same</td></tr><tr><td>TMDB poster w780 (today, ConductarrProjection.kt:9)</td><td>131 KB</td><td>128 / 144</td><td>49 / 70</td><td>max-age 1 y</td></tr><tr><td>TMDB poster w342 / w185</td><td>41 / 15 KB</td><td>100 / 76</td><td>31 / 30</td><td>max-age 1 y</td></tr></tbody></table></div>
-<p class="muted small">Box-side DNS (ping timing, 6 samples 70 s apart): uncached <code>jelly.justinvisser.org</code> 490–1390 ms, <code>wolfskin-tv</code> 460–490 ms, <code>image.tmdb.org</code> 60–1170 ms; cached 40–50 ms. The box uses Private DNS <code>dns.adguard.com</code>. The LAN resolver 192.168.1.2 answers uncached names in 136–160 ms and cached in 0 ms. The A record behind both hosts has a 60 s TTL. Cold launches 1 and 3 were more than 60 s after the previous lookup, and 2 and 4 were within it.</p>
-<h3>Conductarr TV routes, server-side (Conductarr request log, 22 h, 200/304)</h3>
-<div class="tw"><table class="num"><thead><tr><th>Route</th><th>n</th><th>p50</th><th>p95</th><th>Body p50</th><th>Why</th></tr></thead><tbody><tr><td>activity/titles/{{tmdb}}/{{type}} (Ready for you)</td><td>45</td><td><b class="b">2856 ms</b></td><td>5002 ms</td><td>1.7 KB</td><td>Re-reads the held title twice, the Seerr requests and a Jellyfin GET per episode; no cache (activity/detail.go:21, request_evidence.go:45, users.go:262). The 5002 ms p95 is most likely the TV giving up: its read timeout is 5 s (ConductarrSession.kt:53), so on the slowest titles the line never appears</td></tr><tr><td>catalogue/titles/{{tmdb}}/{{type}} (detail)</td><td>51</td><td><b class="b">1198 ms</b></td><td>3217 ms</td><td>11.9 KB</td><td>Held-title read lists every Arr library unpaged, then Seerr details, then ratings; sequential (catalogue/detail.go:14-17, library_detail.go:81)</td></tr><tr><td>catalogue/tv/{{tmdb}}/seasons/{{n}}</td><td>76 / 17 (304)</td><td>1084 / 2282 ms</td><td>2664 ms</td><td>1 KB</td><td>Same held-title read; a 304 still renders and hashes the full body first (read_validators.go)</td></tr><tr><td>…/ratings</td><td>265</td><td>147 ms</td><td>449 ms</td><td>0.5 KB</td><td>6 h server cache, 300 titles</td></tr><tr><td>…/enrichment · …/related · …/cast</td><td>46 · 42 · 26</td><td>103 · 124 · 33 ms</td><td>465 · 261 · 78</td><td>3 · 14 · 12.5 KB</td><td>enrichment uncached</td></tr><tr><td>recommendations feed</td><td>42</td><td>16 ms</td><td>40 ms</td><td><b class="w">204 KB, uncompressed</b></td><td>no gzip/br on the TV door (Caddyfile.base:316-333, serve.go:140)</td></tr><tr><td>activity (polled every 30 s)</td><td>713 × 304</td><td>52 ms</td><td>83 ms</td><td>62.5 KB when 200</td><td></td></tr><tr><td>operator · profiles · dismissals · options · display</td><td></td><td>12–25 ms</td><td>30–93 ms</td><td></td><td>cheap; display is called ≈1 400×/day, once per poster</td></tr></tbody></table></div>
-<p class="muted small">Every TV request also costs Conductarr an uncached Jellyfin <code>/Users/Me</code> to check the token (clients/jellyfin/token.go:42). Every authenticated response is <code>Cache-Control: no-store</code> (authority.go:32). The TV client revalidates with its own ETag store instead.</p>
-
-<h3>Caches the app has today</h3>
-<div class="tw"><table class=""><thead><tr><th>Cache</th><th>Where</th><th>Behaviour</th><th>Observed</th></tr></thead><tbody><tr><td>Wolfskin image loader (Coil 3)</td><td>WolfskinImages.kt:46-61</td><td>64 MiB memory, 128 MiB disk, 4 parallel reads, crossfade off</td><td>repeat visits paint art from memory; first grid visit downloads 626 KB per poster (no size)</td></tr><tr><td>Upstream Wholphin image loader</td><td>CoilConfig.kt:80-101</td><td>separate memory + 200 MB disk</td><td>a second copy of the same art in memory</td></tr><tr><td>Conductarr JSON</td><td>FileCacheStore, noBackupFilesDir/conductarr</td><td>saved copy shown first, then revalidated with ETag; no memory layer</td><td>title re-open: every ON_OPEN route re-fetched (cast 304, detail 875 ms again)</td></tr><tr><td>Home, library, title, person snapshots</td><td>filesDir/wolfskin-home, -library-cache, -title</td><td>disk JSON, painted first</td><td>repeat visits 370–500 ms instead of 430–750</td></tr><tr><td>HTTP cache (OkHttp)</td><td>none</td><td>—</td><td>Jellyfin JSON never cached; images rely on Coil only</td></tr><tr><td>DNS</td><td>system only</td><td>60 s TTL through Private DNS</td><td>1.5 s launch spinner when expired</td></tr></tbody></table></div>
-
-<h2>2. Load states</h2>
-<p>Today: a spinner on launch, flat grey blocks on Home, the grids and title pages, and a blank title page until Conductarr answers on Discover picks. Images snap in because crossfade is off in both loaders. Nothing shows a "loading" sentence; that rule already holds.</p>
-<div class="tw"><table class=""><thead><tr><th>Option</th><th>Expected gain (measured basis)</th><th>Effort</th><th>Risk</th><th>What you would see</th><th>Ships in</th></tr></thead><tbody><tr><td>Picker from the saved people list, verify in the background</td><td>Removes the 1.5 s spinner on every DNS-cold launch (2 of 4 measured)</td><td>S</td><td>Low. A revoked session must still land on the recovery picker</td><td>The launcher fades straight into Who's watching</td><td>TV</td></tr><tr><td>Shaped skeletons that breathe (opacity only, staggered)</td><td>No speed change; replaces the flat grey and spinner states</td><td>S</td><td>Low. One alpha layer per row</td><td>Card-shaped tiles gently pulsing until the art lands</td><td>TV</td></tr><tr><td>Art fades in (120–160 ms) instead of popping</td><td>Removes the pop on every first visit</td><td>XS</td><td>Low. Keep it off for memory-cache hits so repeat visits stay instant</td><td>Posters settle instead of flickering in</td><td>TV</td></tr><tr><td>Reserve space for late fields (ratings, Ready for you, genres, overview)</td><td>No layout jump at 3.4 s on series pages</td><td>S</td><td>Low</td><td>The line fades into a gap that was already there</td><td>TV</td></tr><tr><td>Title page paints what the card already knew</td><td>First content 430–980 ms → about 60 ms</td><td>M</td><td>Medium. Card data must match detail (year, runtime, ratings)</td><td>Title, year, ratings and Play at once, over a colour wash of the poster</td><td>TV</td></tr><tr><td>Shimmer sweep skeletons</td><td>None</td><td>S</td><td><b class="w">High on this GPU</b>: a moving gradient over every card, every frame</td><td>Light sweeps across the tiles. Not recommended</td><td>TV</td></tr></tbody></table></div>
-<h3>See it: launch</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today, DNS cold (2 of 4 launches): 1.5 s spinner</p><div class="sbox"><video src="tv-motion-speed/before-launch-spinner.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">Today, DNS warm</p><div class="sbox"><video src="tv-motion-speed/before-launch-fast.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">After: no spinner, people from the saved list</p><div class="sbox" id="p-launch" data-scene="launch" data-lead="180"></div></div></div></div>
-<h3>See it: skeleton styles</h3>
-<p class="muted small">Pick a style. Content lands at 900 ms in each, about the Movies grid's first visit.</p>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today: Movies grid, first visit</p><div class="sbox"><video src="tv-motion-speed/before-movies-grid.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">Options</p><div class="tabs" data-variants="p-skel"></div><div class="sbox" id="p-skel" data-scene="skeleton" data-lead="140"></div></div></div></div>
-
-<h2>3. Motion and transitions</h2>
-<p>Today's motion tokens: focus scale 1.08 over 140 ms, ring and caption fades of 140 ms, a nav blob spring, and 160–180 ms row scrolls. There are no screen transitions or hero cross-fades, and reduced motion is defined but nothing reads it (WolfskinTokens.kt:218). At 30–46 ms per frame, a 140 ms tween is drawn in 3–4 frames. Tick <b>box frame rate</b> at the top to see that.</p>
-<div class="tw"><table class=""><thead><tr><th>Option</th><th>Expected gain (measured basis)</th><th>Effort</th><th>Risk</th><th>What you would see</th><th>Ships in</th></tr></thead><tbody><tr><td>Staged reveal on screen entry (hero copy rises 16 px, rows rise 24 px, staggered 30–40 ms, 180 ms ease-out)</td><td>Perceived: art arrives into motion instead of popping. Cost: translate + alpha on one layer per row</td><td>S</td><td>Low. Stagger must not delay focus</td><td>Home and Discover settle like a curtain rather than tiles snapping</td><td>TV</td></tr><tr><td>Hero cross-fade (backdrop 320 ms, copy hands off)</td><td>Removes the hard cut when the hero changes</td><td>S</td><td>Medium. Two 1080p bitmaps for 320 ms; the GPU is already at 14–21 ms/frame, so fade the backdrop only and keep the scrim static</td><td>The next pick dissolves in</td><td>TV</td></tr><tr><td>Focus: 180 ms ease-out, caption rises 10 px</td><td>Same frame cost as today; the curve hides dropped frames better</td><td>XS</td><td>Low</td><td>Focus glides rather than ticks</td><td>TV</td></tr><tr><td>Title entry: grid fades 160 ms, page builds from the poster colour</td><td>Hides the 470 ms backdrop fetch</td><td>M</td><td>Medium (see load states)</td><td>No black gap between grid and title</td><td>TV</td></tr><tr><td>Shared-element poster → title sheet</td><td>None measurable</td><td>L</td><td><b class="w">High</b>. Compose shared elements across NavHost destinations on this GPU; the movie page has no poster sheet when a backdrop exists</td><td>The card flies into place. Not recommended now</td><td>TV</td></tr><tr><td>Honour reduced motion (system animator scale 0 or a Wolfskin toggle)</td><td>Accessibility</td><td>S</td><td>Low</td><td>Fades only, ≤100 ms; the toggle at the top shows it</td><td>TV</td></tr></tbody></table></div>
-<h3>See it: Who's watching → Home</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today: grey tiles, then art pops at 400 ms</p><div class="sbox"><video src="tv-motion-speed/before-home-enter.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">After</p><div class="sbox" id="p-home" data-scene="home" data-lead="200"></div></div></div></div>
-<h3>See it: tab switch and row reveal (Home → Discover)</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today</p><div class="sbox"><video src="tv-motion-speed/before-discover-tab.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">After</p><div class="sbox" id="p-tab" data-scene="tab" data-lead="150"></div></div></div></div>
-<h3>See it: title page entry</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today: American Gangster, first open (cast at 2.7 s)</p><div class="sbox"><video src="tv-motion-speed/before-title-movie.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">Today: Donnie Brasco from Discover, blank until 980 ms</p><div class="sbox"><video src="tv-motion-speed/before-title-discover.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">After: Apocalypse Now from the same grid</p><div class="sbox" id="p-title" data-scene="title" data-lead="170"></div></div></div></div>
-<h3>See it: a late line on a series page</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today: Adults, the readiness line lands at 3.4 s and pushes the text down</p><div class="sbox"><video src="tv-motion-speed/before-title-series.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">After</p><div class="tabs" data-variants="p-series"></div><div class="sbox" id="p-series" data-scene="series" data-lead="150"></div></div></div></div>
-<h3>See it: focus move</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button><span class="muted small">Tick box frame rate to compare at 25 fps.</span></div>
-<div class="panes"><div class="pane"><p class="lab">Today, real grid</p><div class="sbox"><video src="tv-motion-speed/before-movies-grid.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">Focus along a row</p><div class="tabs" data-variants="p-focus"></div><div class="sbox" id="p-focus" data-scene="focus" data-lead="0"></div></div></div></div>
-<h3>See it: hero cross-fade</h3>
-<div class="pair"><div class="ph"><button type="button" class="replay">Replay together</button></div>
-<div class="panes"><div class="pane"><p class="lab">Today (Discover hero)</p><div class="sbox"><video src="tv-motion-speed/before-discover-tab.webm" muted loop playsinline autoplay preload="auto"></video></div></div><div class="pane"><p class="lab">Hero advances</p><div class="tabs" data-variants="p-hero"></div><div class="sbox" id="p-hero" data-scene="hero" data-lead="0"></div></div></div></div>
-
-<h2>4. Caching</h2>
-<div class="tw"><table class=""><thead><tr><th>Option</th><th>Expected gain (measured basis)</th><th>Effort</th><th>Risk</th><th>What you would see</th><th>Ships in</th></tr></thead><tbody><tr><td>Persisted DNS answers (OkHttp Dns: serve the last address at once, refresh behind)</td><td>Removes 0.45–1.35 s on launch and on the first TMDB image after any 60 s pause</td><td>S</td><td>Low. Fall back to the system lookup if the cached address fails</td><td>No spinner on launch; first cast photos in ≈0.6 s instead of 2.7 s [inference: DNS is the cast delay]</td><td>TV</td></tr><tr><td>Warm the connections at process start (Jellyfin, Conductarr door, TMDB) in parallel</td><td>Overlaps DNS + TLS with the 450 ms first frame</td><td>XS</td><td>Low</td><td>Same as above, smaller</td><td>TV</td></tr><tr><td>Memory layer over the Conductarr disk cache</td><td>Skips disk read and JSON decode on back and re-open (title re-open settles at 450 ms today; ~250 expected) [inference]</td><td>S</td><td>Low</td><td>Back and re-open feel instant</td><td>TV</td></tr><tr><td>Stale-while-revalidate for ON_OPEN title routes (skip refetch if validated in the last 5 min)</td><td>Re-opening a title stops costing the server 875–2 900 ms</td><td>S</td><td>Low. Requests and readiness may be 5 min old; keep requests on FORCE</td><td>Nothing visible; less churn</td><td>TV</td></tr><tr><td>Prefetch the focused card's title page (detail JSON + backdrop) after 350 ms of dwell</td><td>Title first content 430 ms → about 60 ms; backdrop already decoded</td><td>M</td><td>Medium. Bandwidth: at most one title per dwell; cancel on move</td><td>Opening a title is instant</td><td>TV</td></tr><tr><td>Pre-decode last-known Home art while Who's watching is up</td><td>Home settles at 430 ms → about 250 ms with no pops</td><td>S</td><td>Low. Memory: 6 backdrops ≈ 21 MiB of the 64 MiB</td><td>Home appears whole</td><td>TV</td></tr><tr><td>One image loader instead of two</td><td>Frees a second memory cache (Coil default ≈ 25 % of the heap) [inference]</td><td>M</td><td>Medium. Upstream screens use their own</td><td>Fewer re-downloads after big screens</td><td>TV</td></tr><tr><td>OkHttp HTTP cache for Jellyfin JSON</td><td>Small. Jellyfin sends no cache headers, so only conditional revalidation is possible</td><td>S</td><td>Low</td><td>Nothing visible</td><td>TV</td></tr></tbody></table></div>
-
-<h2>5. Backend retrieval</h2>
-<div class="tw"><table class=""><thead><tr><th>Option</th><th>Expected gain (measured basis)</th><th>Effort</th><th>Risk</th><th>What you would see</th><th>Ships in</th></tr></thead><tbody><tr><td>Cache the held-title read in Conductarr (Arr library list, queue, history) for 30–60 s, shared across routes</td><td>Title detail 1.2 s → ≈0.1 s, season 1.1 s → ≈0.1 s, readiness 2.9 s → <1 s [inference from the code path]</td><td>M</td><td>Medium. Freshness of "Ready" after an import; invalidate on Arr webhook (already received)</td><td>Series pages settle in under a second; no late line</td><td>Conductarr release</td></tr><tr><td>Readiness: drop the duplicate held-title read and the per-episode Jellyfin GETs</td><td>The 5 s tail on readiness</td><td>M</td><td>Medium</td><td>"Ready for you" appears with the page</td><td>Conductarr release</td></tr><tr><td>Compress the TV door (Caddy <code>encode zstd gzip</code>)</td><td>Feed 204 KB → ~25–35 KB [inference: JSON typically 6–8×], activity 62 KB → ~8 KB</td><td>XS</td><td>Low</td><td>Discover opens a little faster on Wi-Fi</td><td>Caddy change (server-docs)</td></tr><tr><td>304 before rendering (keep a per-route version, not a hash of the full body)</td><td>Season 304 2.3 s → ms</td><td>M</td><td>Medium</td><td>Nothing visible except speed</td><td>Conductarr release</td></tr><tr><td>Cache the token check (<code>/Users/Me</code>) for 60 s per token</td><td>Removes a Jellyfin round trip from every TV request (~10–40 ms each, 6–10 per title page)</td><td>S</td><td>Low. Revocation lag 60 s</td><td>Nothing visible</td><td>Conductarr release</td></tr><tr><td>Batch display reads (one call for a row of posters)</td><td>≈1 400 display calls/day → a few dozen</td><td>M</td><td>Low</td><td>Coming in and Discover rows fill together</td><td>Conductarr release + TV</td></tr><tr><td>Size the grid posters (<code>fillWidth=256&fillHeight=384&quality=80&format=Webp</code>)</td><td>626 KB → 11 KB per poster (57×); 85 films 53 MB → 1 MB</td><td>XS</td><td>Low</td><td>Movies and Shows fill at once on first visit</td><td>TV</td></tr><tr><td>Ask TMDB for w342 posters, not w780</td><td>131 KB → 41 KB per Discover poster</td><td>XS</td><td>Low. 342 px for a 256 px card</td><td>Discover rows fill sooner</td><td>TV</td></tr><tr><td>Lean episode fields (drop MediaSources/MediaStreams/People from the list; fetch them on Play)</td><td>96.8 KB → 6.5 KB per season, 142 → 26 ms</td><td>S</td><td>Medium. The episode row shows file chips</td><td>Series pages settle sooner</td><td>TV</td></tr><tr><td>Fewer launch calls: UserViews 4–5× and LiveTv/Recordings/Folders 2× per launch</td><td>≈250 ms of serial calls</td><td>S</td><td>Low</td><td>Nothing visible</td><td>TV</td></tr></tbody></table></div>
-
-<h2>6. Kotlin and Compose</h2>
-<div class="tw"><table class=""><thead><tr><th>Option</th><th>Expected gain (measured basis)</th><th>Effort</th><th>Risk</th><th>What you would see</th><th>Ships in</th></tr></thead><tbody><tr><td>Library load re-emits the full list per 200-item page and re-sorts each time (LibraryReadFacade.kt:96, LibraryGridState.kt:99)</td><td>Grid first visit; matters more as the library grows</td><td>S</td><td>Low</td><td>Grid appears in one step</td><td>TV</td></tr><tr><td>Hoist the Regex in titleFallbackBackground / titleAmbientBackground (TitleArtwork.kt:152,167)</td><td>Draw-time cost per card</td><td>XS</td><td>Low</td><td>—</td><td>TV</td></tr><tr><td>Discover reads firstVisibleItemIndex in composition (DiscoverScreen.kt:107) → derivedStateOf</td><td>Fewer recompositions while scrolling Discover (34 of 44 janky frames were UI-thread)</td><td>XS</td><td>Low</td><td>Smoother Discover scroll</td><td>TV</td></tr><tr><td>NavBar label colour read in composition (NavBar.kt:86) → draw-phase</td><td>Tab switch frames</td><td>XS</td><td>Low</td><td>—</td><td>TV</td></tr><tr><td>WolfskinImages.loader() is @Synchronized and called in composition</td><td>Lock on every poster recomposition</td><td>XS</td><td>Low</td><td>—</td><td>TV</td></tr><tr><td>Cut full-screen layers: hero blur (RenderEffect) + two full-screen gradient scrims + ambient</td><td>GPU 14–21 ms/frame is the floor today; pre-blurred tiny art and one combined scrim drawn once</td><td>M</td><td>Medium. Must match the approved frames</td><td>Smoother scroll on Home and Discover</td><td>TV</td></tr><tr><td>Keys and contentType</td><td>Already done everywhere</td><td>—</td><td>—</td><td>—</td><td></td></tr></tbody></table></div>
-
-<h2>7. Baseline profile</h2>
-<p>Today: a hand seed of 6 lines (<code>app/src/optimized/baselineProfiles/baseline-prof.txt</code>), no generator and no Macrobenchmark. The box is at <code>speed</code> only because it was forced with <code>cmd package compile</code>. Every new install starts at <code>verify</code> (interpreted/JIT) until background dexopt runs.</p>
-<div class="tw"><table class="num"><thead><tr><th>State (same box, earlier tv-perf run)</th><th>Cold start</th><th>Home scroll janky / p50 / p90</th><th>Movies grid</th></tr></thead><tbody><tr><td>Opt just installed (verify)</td><td>0.5–1.0 s</td><td>51.4 % / 65 / 117 ms</td><td>—</td></tr><tr><td>Opt after forced AOT (speed)</td><td>0.39–0.44 s</td><td>29.2 % / 38 / 61 ms</td><td>17.7 % / 19 / 36 ms</td></tr></tbody></table></div>
-<p><b>Expected from a recorded profile</b> (Baseline Profile Gradle plugin plus one UiAutomator journey through picker, Home, Discover, the grids, a title and a person page): a fresh install behaves like the AOT row from the first launch. That is roughly −40 % janky frames on Home scroll and up to half a second off cold start, for every build the second mate installs. It does <b>not</b> change steady state on a box already at <code>speed</code>. Effort M: the journey can run on an emulator in the build container; the box itself isn't needed. Risk low.</p>
-
-<h2>8. Recommended plan</h2>
-<ol class="plan">
-<li><b>DNS and launch (TV, S, ~1 day).</b> Persisted DNS answers plus parallel connection warm-up at process start. Show the picker from saved people and check the session in the background. <i>Prove it:</i> 6 cold launches spaced &gt;60 s apart, picker at ≤0.5 s every time (today 1.65 s in half); first cast photos on a new title ≤1 s.</li>
-<li><b>Image sizes (TV, XS, hours).</b> Sized WebP grid posters, TMDB w342, lean episode fields. <i>Prove it:</i> first Movies visit settles ≤400 ms (today 750); tank payload table.</li>
-<li><b>Load states and motion (TV, M, 2–3 days, against your pick on this page).</b> Breathing shaped skeletons, art fade-in for network loads only, reserved late-line slots, staged reveal, hero cross-fade, reduced motion. <i>Prove it:</i> recordings like the ones above, no layout change after first content, gfxinfo janky no worse than today.</li>
-<li><b>Prefetch and memory cache (TV, M, 2 days).</b> Dwell prefetch of title pages, a memory layer over the Conductarr cache, pre-decoded Home art behind the picker. <i>Prove it:</i> title first content ≤100 ms and Home settled ≤250 ms.</li>
-<li><b>Conductarr release (M–L, 2–4 days):</b> held-title cache with webhook invalidation, readiness without duplicate reads or per-episode GETs, 304 before render, token-check cache. <b>Caddy</b>: compress the TV door. <i>Prove it:</i> the route table above for 24 h, with detail, season and readiness p50 ≤200 ms and p95 ≤600 ms, and the feed on the wire ≤40 KB.</li>
-<li><b>Baseline profile (TV build, M, 1–2 days).</b> Recorded journey profile. <i>Prove it:</i> fresh install without a forced compile, Home scroll janky ≤30 %, cold start ≤0.5 s.</li>
-<li><b>Frame cost (TV, M, 2–3 days).</b> The Compose fixes in section 6 and fewer full-screen layers. <i>Prove it:</i> Home and grid scroll janky ≤20 %, GPU p90 ≤16 ms in framestats.</li>
-</ol>
-<p><b>Total:</b> about 2 weeks of TV work and 3–4 days for a Conductarr release. Steps 1–2 alone remove the two waits you can feel today (the launch spinner and grids filling slowly), in about a day and a half.</p>
-<p class="muted small">A box-side alternative to step 1's DNS part: switch the box's Private DNS from <code>dns.adguard.com</code> to Automatic, so it uses the LAN resolver (136–160 ms uncached, 0 ms cached). That changes the whole box, not just Wolfskin, so it's your call; the TV-side fix works either way.</p>
-<h2>9. Your picks (all of them on one page)</h2>
-<p class="muted">Six decisions. Each locks the moment you send it and the build lanes start on it. Nothing here touches the TV while you are playing.</p>
-<form class="decision" data-decision-key="tv-motion-speed-direction" data-lavish-question="tv-motion-speed-direction"><h3>1. Load-state and motion direction</h3>
-<p class="muted">Decides plan step 3 (skeletons and motion). The prototypes above show each part.</p>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="recommended" data-choice-key="tv-motion-speed-direction"> <b>A · As recommended</b> <span class="rec">recommended</span><span class="t">Breathing shaped skeletons, art fades in only when it came from the network, reserved space for late lines, hero cross-fade, reduced-motion safe.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="flat" data-choice-key="tv-motion-speed-direction"> <b>B · Same, but flat skeletons</b><span class="t">Still card-shaped, no pulse. The calmest option.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="shimmer" data-choice-key="tv-motion-speed-direction"> <b>C · Same, but shimmer skeletons</b><span class="t">A light sweep across the tiles. Costs GPU on this box every frame while loading.</span></label>
-<label class="opt"><input required type="radio" name="tv-motion-speed-direction" value="changes" data-choice-key="tv-motion-speed-direction"> <b>D · Different</b><span class="t">Say what in the note: a prototype to change, a speed, an option to drop.</span></label>
-<textarea aria-label="Notes for 1. Load-state and motion direction" name="tv-motion-speed-direction-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-speed-quick-fixes" data-lavish-question="tv-speed-quick-fixes"><h3>2. The two quick speed fixes (about a day and a half, TV only)</h3>
-<p class="muted">(a) DNS cache with stale-serve plus a picker painted from saved people, so the launch spinner goes away; (b) sized WebP grid posters, smaller TMDB art, lean episode fields, so grids fill fast. Both ship in the next TV build.</p>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="go" data-choice-key="tv-speed-quick-fixes"> <b>Go, start now</b> <span class="rec">recommended</span><span class="t">Two small lanes, merged and staged for the next install.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="a-only" data-choice-key="tv-speed-quick-fixes"> <b>Only (a), the launch spinner</b><span class="t">Leave the image sizing for later.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="b-only" data-choice-key="tv-speed-quick-fixes"> <b>Only (b), the image sizes</b><span class="t">Leave the DNS cache for later.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-quick-fixes" value="later" data-choice-key="tv-speed-quick-fixes"> <b>Not now</b><span class="t">Skip until after the motion work.</span></label>
-<textarea aria-label="Notes for 2. The two quick speed fixes (about a day and a half, TV only)" name="tv-speed-quick-fixes-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-box-dns" data-lavish-question="tv-box-dns"><h3>3. Change the box Private DNS (your call, system setting)</h3>
-<p class="muted">Today the box uses dns.adguard.com: an uncached lookup costs 450 to 1350 ms. Automatic uses the LAN resolver (136 to 160 ms uncached, 0 ms cached). It changes DNS for the whole box, not just Wolfskin. I do it with ADB only when the TV is free and you say so; the TV-side fix in 2(a) works either way.</p>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="leave" data-choice-key="tv-box-dns"> <b>Leave it as it is</b> <span class="rec">recommended</span><span class="t">The TV-side cache covers the launch spinner.</span></label>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="automatic" data-choice-key="tv-box-dns"> <b>Switch to Automatic</b><span class="t">I change it when you free the TV and show before and after timings.</span></label>
-<label class="opt"><input required type="radio" name="tv-box-dns" value="ask" data-choice-key="tv-box-dns"> <b>Ask me when the TV is free</b><span class="t">Decide then.</span></label>
-<textarea aria-label="Notes for 3. Change the box Private DNS (your call, system setting)" name="tv-box-dns-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-speed-later-steps" data-lavish-question="tv-speed-later-steps"><h3>4. Later plan steps to queue (TV, after the build above)</h3>
-<p class="muted">Prefetch and memory cache (title pages, 2 days); recorded Baseline Profile (1 to 2 days); frame cost and Compose fixes (2 to 3 days). Each has its own proof target in section 8.</p>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="all" data-choice-key="tv-speed-later-steps"> <b>Queue all three in that order</b> <span class="rec">recommended</span><span class="t">They follow the motion work, one lane at a time.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="prefetch" data-choice-key="tv-speed-later-steps"> <b>Only prefetch and memory cache</b><span class="t">Skip the profile and frame work for now.</span></label>
-<label class="opt"><input required type="radio" name="tv-speed-later-steps" value="none" data-choice-key="tv-speed-later-steps"> <b>None yet</b><span class="t">Revisit after you have seen the motion build on the TV.</span></label>
-<textarea aria-label="Notes for 4. Later plan steps to queue (TV, after the build above)" name="tv-speed-later-steps-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-conductarr-retrieval" data-lavish-question="tv-conductarr-retrieval"><h3>5. Conductarr title-read speed-up (needs a Conductarr release)</h3>
-<p class="muted">Held-title cache with Arr webhook invalidation, readiness without duplicate reads or per-episode calls, 304 before render, token-check cache, compression on the TV door. 3 to 4 days, plus a release and a server-docs update. Title pages are slow because of this (readiness p50 2.9 s).</p>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="scope" data-choice-key="tv-conductarr-retrieval"> <b>Scope it first, then I decide</b> <span class="rec">recommended</span><span class="t">A short scout writes the exact change list and risks for a release; nothing ships.</span></label>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="go" data-choice-key="tv-conductarr-retrieval"> <b>Go: build it and release it</b><span class="t">You are giving the word to build and release Conductarr when it is green.</span></label>
-<label class="opt"><input required type="radio" name="tv-conductarr-retrieval" value="later" data-choice-key="tv-conductarr-retrieval"> <b>Not now</b><span class="t">Skip until after the TV-side wins.</span></label>
-<textarea aria-label="Notes for 5. Conductarr title-read speed-up (needs a Conductarr release)" name="tv-conductarr-retrieval-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<form class="decision" data-decision-key="tv-build-order" data-lavish-question="tv-build-order"><h3>6. When should these land on the TV?</h3>
-<p class="muted">You said you will not be using the TV during this session.</p>
-<label class="opt"><input required type="radio" name="tv-build-order" value="as-ready" data-choice-key="tv-build-order"> <b>Bundle with the next install</b> <span class="rec">recommended</span><span class="t">The speed fixes and any approved motion work join the staged build; I install when you say the TV is free.</span></label>
-<label class="opt"><input required type="radio" name="tv-build-order" value="separate" data-choice-key="tv-build-order"> <b>Install the speed fixes on their own first</b><span class="t">A quick build for steps 2(a) and 2(b) only, installed as soon as it is ready if you free the TV.</span></label>
-<textarea aria-label="Notes for 6. When should these land on the TV?" name="tv-build-order-note" placeholder="Optional note"></textarea><p><button type="submit">Queue this answer</button> <span role="status" aria-live="polite"></span></p></form>
-<p class="muted small">Method, raw numbers and files: <code>data/tv-spike-motion-speed/report.md</code>. Nothing was changed in the app or on the server. The box was left on the Movies tab.</p>
-<script>
-// Wolfskin TV motion prototypes. One clock per stage drives Web Animations; "box rate" quantises the clock
-// to the measured frame time on the Xiaomi box (p50 40 ms while moving, data/tv-spike-motion-speed/raw/gfx-*),
-// so the same motion can be watched at 60 fps and at the rate the box actually draws today.
-(() => {
-const A = 'tv-motion-speed/';
-const BOX_MS = 40;
-const EASE = 'cubic-bezier(.25,.1,.25,1)', OUT = 'cubic-bezier(.33,1,.68,1)', INOUT = 'cubic-bezier(.65,0,.35,1)';
-const POSTERS = [
-  ['American Gangster', '2007 · 2h 36m'], ['Annie Hall', '1977 · 1h 33m'], ['Apocalypse Now', '1979 · 2h 27m'],
-  ['Arrival', '2016 · 1h 56m'], ['Avatar: The Last Airbender', '2026 · 1h 52m'], ['Bohemian Rhapsody', '2018 · 2h 15m'],
-  ['Braveheart', '1995 · 2h 58m'], ['Citizen Kane', '1941 · 1h 59m'], ['Spirited Away', '2001 · 2h 5m'],
-  ['12 Years a Slave', '2013 · 2h 14m'], ['A Bronx Tale', '1993 · 2h 1m'], ['All the Money in the World', '2017 · 2h 13m'],
-];
-const poster = i => `${A}p${i + 1}.webp`;
-const html = (s) => { const t = document.createElement('template'); t.innerHTML = s.trim(); return t.content.firstChild; };
-
-function nav(cur, focus) {
-  const items = ['Home', 'Discover', 'Movies', 'Shows'];
-  return `<div class="nav"><span class="wm">Wolf<b>skin</b></span>${items.map((n, i) => `<span class="ni ${i === cur ? 'cur' : ''} ${i === focus ? 'f' : ''}">${n}</span>`).join('')}<span class="nsp"></span><span class="av">S</span></div>`;
-}
-function rate(rt, pc) { return `<span class="rate"><i></i>${rt}</span><span class="rate"><i class="pc"></i>${pc}</span>`; }
-function heroCopy(o) {
-  return `<div class="copy" style="bottom:${o.bottom || 330}px"><div class="kicker">${o.kicker}</div><div class="ht">${o.title}</div><div class="hm">${o.meta}</div>${o.ov ? `<div class="ho">${o.ov}</div>` : ''}<div class="btns">${o.btns}</div></div>`;
-}
-
-// ---------- scenes: build(stage, T, v) where v is the selected variant ----------
-const SCENES = {
-  // 1. launch -> Who's watching
-  launch: { len: 1400, variants: { after: 'After: people from the saved list' }, build(s, T) {
-    s.append(html(`<div class="abs" style="inset:0;background:url(${A}launcher.webp) center/cover"></div>`));
-    const bg = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a"></div>`));
-    T.a(bg, [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    const pk = s.appendChild(html(`<div class="abs" style="inset:0"><div class="abs" style="left:96px;top:60px;font-size:36px;font-weight:800">Wolf<b style="color:var(--accent)">skin</b></div><div class="pk">Who’s watching?</div>
-      ${[['J', '#64c3ff', 'justin', 540], ['M', '#ffa47a', 'mindel', 850], ['S', '#9be38f', 'shared', 1160]].map(([l, c, n, x]) => `<div class="person ${n === 'shared' ? 'ring' : ''}" style="left:${x}px;background:${c}">${l}</div><div class="pname" style="left:${x}px">${n}</div>`).join('')}</div>`));
-    T.a(pk, [{ opacity: 0 }, { opacity: 1 }], 450, 160);
-  } },
-
-  // 2. picker -> Home
-  home: { len: 1100, variants: { after: 'After: last Home painted from disk, art pre-decoded' }, build(s, T) {
-    const home = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${A}b2t.webp);filter:blur(30px);transform:scale(1.1)"></div>
-      <div class="bd" style="background-image:url(${A}b2.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '▸ Continue watching', title: 'Arrival', meta: '2016 · 1h 56m · 38 min left ' + rate('94%', '82%'), ov: 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military to determine whether they come in peace or are a threat.', btns: '<span class="btn pri f">▶ Resume</span><span class="btn">ⓘ Details</span>', bottom: 340 })}
-      <div class="sh" style="top:780px">Next up</div>
-      ${[3, 4, 1, 2].map((b, i) => `<div class="card tile" style="left:${96 + i * 440}px;top:850px"><div class="img" style="background-image:url(${A}b${b}.webp)"></div><div class="cap">${['American Gangster', 'Bohemian Rhapsody', 'Apocalypse Now', 'Arrival'][i]}</div></div>`).join('')}
-      ${nav(0)}</div>`));
-    const picker = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a;z-index:10"><div class="pk">Who’s watching?</div>
-      ${[['J', '#64c3ff', 'justin', 540], ['M', '#ffa47a', 'mindel', 850], ['S', '#9be38f', 'shared', 1160]].map(([l, c, n, x]) => `<div class="person ${n === 'shared' ? 'ring' : ''}" style="left:${x}px;background:${c}">${l}</div><div class="pname" style="left:${x}px">${n}</div>`).join('')}</div>`));
-    T.a(picker, [{ opacity: 1 }, { opacity: 0 }], 0, 140);
-    T.a(home.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 40, 120);
-    T.a(home.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 120, 220, INOUT);
-    T.a(home.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 60, 180, OUT);
-    T.a(home.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 120, 160);
-    home.querySelectorAll('.card').forEach((c, i) => {
-      T.a(c, [{ opacity: 0, transform: 'translateY(24px)' }, { opacity: 1, transform: 'none' }], 140 + i * 40, 180, OUT);
-    });
-  } },
-
-  // 3. skeleton styles on a poster grid
-  skeleton: { len: 2200, variants: { breathe: 'Breathe (pick)', flat: 'Flat blocks (today)', shimmer: 'Shimmer sweep', spinner: 'Spinner (today, launch)' }, build(s, T, v) {
-    s.append(html(nav(2)));
-    s.append(html(`<div class="abs" style="left:96px;top:150px;font-size:72px;font-weight:800;letter-spacing:-.02em">Movies <span style="font-size:30px;font-weight:500;color:var(--muted)">85 films</span></div>`));
-    const cells = [];
-    for (let r = 0; r < 2; r++) for (let c = 0; c < 6; c++) cells.push([96 + c * 296, 330 + r * 460, r * 6 + c]);
-    if (v === 'spinner') { const sp = s.appendChild(html('<div class="spin"></div>')); T.a(sp, [{ opacity: 1 }, { opacity: 0 }], 900, 120); }
-    cells.forEach(([x, y, i]) => {
-      if (v !== 'spinner') {
-        const sk = s.appendChild(html(`<div class="card poster sk ${v === 'breathe' ? 'breathe' : v === 'shimmer' ? 'shim' : ''}" style="left:${x}px;top:${y}px;${v === 'breathe' ? `animation-delay:${(i % 6) * 90}ms` : ''}"></div>`));
-        T.a(sk, [{ opacity: 1 }, { opacity: 0 }], 900 + i * 25, 160);
-      }
-      const c = s.appendChild(html(`<div class="card poster" style="left:${x}px;top:${y}px;background-image:url(${poster(i)})"></div>`));
-      T.a(c, [{ opacity: 0 }, { opacity: 1 }], 900 + i * 25, 160);
-    });
-  } },
-
-  // 4. tab switch: Home -> Discover, rows reveal
-  tab: { len: 1100, variants: { after: 'After: last Discover painted, rows rise, art fades' }, build(s, T) {
-    const disc = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="bd" style="background-image:url(${A}b4.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '✦ For you', title: 'Bohemian Rhapsody', meta: 'Movie · 2018 · Drama, Music ' + rate('60%', '85%'), ov: 'Singer Freddie Mercury, guitarist Brian May, drummer Roger Taylor and bass guitarist John Deacon take the music world by storm.', btns: '<span class="btn">ⓘ Details</span>', bottom: 520 })}
-      <div class="sh" style="top:600px">Movies for you</div>
-      ${[6, 7, 8, 9, 10, 11].map((p, i) => `<div class="card poster" style="left:${96 + i * 296}px;top:670px"><div class="img" style="background-image:url(${poster(p)})"></div></div>`).join('')}
-      </div>`));
-    const home = s.appendChild(html(`<div class="abs" style="inset:0"><div class="bd" style="background-image:url(${A}b2.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '▸ Continue watching', title: 'Arrival', meta: '2016 · 1h 56m · 38 min left', ov: 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military.', btns: '<span class="btn pri">▶ Resume</span><span class="btn">ⓘ Details</span>', bottom: 340 })}</div>`));
-    const n = s.appendChild(html(nav(1, 1)));
-    T.a(home, [{ opacity: 1 }, { opacity: 0 }], 0, 200, EASE);
-    T.a(disc.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 0, 240, INOUT);
-    T.a(disc.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 80, 180, OUT);
-    T.a(disc.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 140, 160);
-    disc.querySelectorAll('.card').forEach((c, i) => T.a(c, [{ opacity: 0, transform: 'translateY(24px)' }, { opacity: 1, transform: 'none' }], 160 + i * 30, 180, OUT));
-  } },
-
-  // 5. title page entry from the Movies grid
-  title: { len: 1600, variants: { after: 'After: what the card knew, at once' }, build(s, T) {
-    const page = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${poster(2)});filter:blur(60px) saturate(1.2) brightness(.55);transform:scale(1.2)"></div>
-      <div class="bd" style="background-image:url(${A}b1.webp)"></div><div class="scrim"></div>
-      <div class="copy" style="bottom:360px"><div class="kicker">✓ Movie · In your library</div><div class="ht">Apocalypse Now</div>
-        <div class="hm">1979 · 2h 27m ${rate('91%', '94%')} <span class="late" style="color:var(--muted)">Drama, War</span></div>
-        <div class="ho late2" style="min-height:76px">At the height of the Vietnam war, Captain Benjamin Willard is sent on a dangerous mission that, officially, “does not exist, nor will it ever exist.”</div>
-        <div class="btns"><span class="btn pri f">▶ Play</span><span class="btn">⋯</span><span class="btn">Add for someone</span></div></div>
-      <div class="sh" style="top:830px">Cast</div>
-      ${[0, 1, 2, 3, 4, 5, 6].map(i => `<div class="circle" style="left:${96 + i * 244}px;top:900px"><span class="sk breathe abs" style="inset:0;border-radius:50%;animation-delay:${i * 90}ms"></span><div class="img" style="background-image:url(${A}c${i + 1}.webp)"></div></div>`).join('')}
-      ${nav(2)}</div>`));
-    const grid = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a">${nav(2)}
-      <div class="abs" style="left:96px;top:150px;font-size:72px;font-weight:800;letter-spacing:-.02em">Movies <span style="font-size:30px;font-weight:500;color:var(--muted)">85 films</span></div>
-      ${[0, 1, 2, 3, 4, 5].map(i => `<div class="card poster ${i === 2 ? 'ring' : ''}" style="left:${96 + i * 296}px;top:330px;background-image:url(${poster(i)});${i === 2 ? 'transform:scale(1.08)' : ''}"></div>`).join('')}
-      ${[6, 7, 8, 9, 10, 11].map((p, i) => `<div class="card poster" style="left:${96 + i * 296}px;top:790px;background-image:url(${poster(p)})"></div>`).join('')}</div>`));
-    T.a(grid, [{ opacity: 1 }, { opacity: 0 }], 0, 160);
-    T.a(page.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    T.a(page.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 40, 180, OUT);
-    T.a(page.querySelector('.late'), [{ opacity: 0 }, { opacity: 1 }], 430, 160);
-    T.a(page.querySelector('.late2'), [{ opacity: 0 }, { opacity: 1 }], 430, 160);
-    T.a(page.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 470, 280, INOUT);
-    T.a(page.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 120, 160);
-    page.querySelectorAll('.circle').forEach((c, i) => {
-      T.a(c, [{ opacity: 0, transform: 'translateY(20px)' }, { opacity: 1, transform: 'none' }], 140 + i * 30, 180, OUT);
-      T.a(c.querySelector('.img'), [{ opacity: 0 }, { opacity: 1 }], 620 + i * 40, 160);
-    });
-  } },
-
-  // 6. series title: late readiness line
-  series: { len: 4000, variants: { tv: 'TV-only: slot reserved, fades in at 3.4 s', conductarr: 'With the Conductarr cache: arrives ≈0.4 s' }, build(s, T, v) {
-    const late = v === 'conductarr' ? 380 : 3400;
-    const page = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${A}s1t.webp);filter:blur(30px);transform:scale(1.1)"></div>
-      <div class="bd" style="background-image:url(${A}s1.webp)"></div><div class="scrim"></div>
-      <div class="copy" style="bottom:430px"><div class="kicker">✓ Series · In your library · Watched</div><div class="ht">Adults</div>
-        <div class="hm">2025 · 2 seasons · Comedy <span class="lr">${rate('88%', '93%')}</span></div>
-        <div class="hm lr2" style="color:var(--ok,#9be38f);font-size:26px">✓ Ready for you · by Mindel</div>
-        <div class="ho" style="min-height:76px">A group of twenty-somethings in New York trying to be good people, despite being neither “good” nor “people” yet.</div>
-        <div class="btns"><span class="btn pri f">▶ Play S1 E1</span><span class="btn">⋯</span><span class="btn">Seasons</span></div></div>
-      <div class="abs" style="left:96px;top:790px;display:flex;gap:16px"><span class="btn" style="height:56px;font-size:24px;background:var(--accent-soft,#2a1f3d)">Season 1</span><span class="btn" style="height:56px;font-size:24px">Season 2</span></div>
-      ${[0, 1, 2, 3].map(i => `<div class="card tile sk breathe" style="left:${96 + i * 440}px;top:880px;animation-delay:${i * 90}ms"><div class="img" style="background-image:url(${A}${i % 2 ? 's1' : 'e1'}.webp)"></div></div>`).join('')}
-      ${nav(3)}</div>`));
-    T.a(page.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 0, 180, OUT);
-    T.a(page.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    T.a(page.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 620, 280, INOUT);
-    T.a(page.querySelector('.lr'), [{ opacity: 0 }, { opacity: 1 }], late, 200);
-    T.a(page.querySelector('.lr2'), [{ opacity: 0 }, { opacity: 1 }], late, 200);
-    page.querySelectorAll('.card .img').forEach((c, i) => T.a(c, [{ opacity: 0 }, { opacity: 1 }], 700 + i * 40, 160));
-  } },
-
-  // 7. focus move along a row
-  focus: { len: 3000, variants: { after: 'Proposed: 180 ms ease-out, caption rises', today: 'Today: 140 ms, caption cross-fade' }, build(s, T, v) {
-    s.append(html(nav(2)));
-    s.append(html(`<div class="sh" style="top:250px">Movies for you</div>`));
-    const dur = v === 'today' ? 140 : 180, ease = v === 'today' ? EASE : OUT;
-    const cards = [0, 1, 2, 3, 4, 5].map(i => s.appendChild(html(`<div class="card poster" style="left:${96 + i * 296}px;top:330px;background-image:url(${poster(i + 6)})"></div>`)));
-    const caps = [0, 1, 2, 3, 4, 5].map(i => s.appendChild(html(`<div class="abs" style="left:${96 + i * 296}px;top:740px;width:520px"><div style="font-size:30px;font-weight:700">${POSTERS[i + 6][0]}</div><div style="font-size:26px;color:var(--muted)">${POSTERS[i + 6][1]}</div></div>`)));
-    const step = 600;
-    cards.forEach((c, i) => {
-      const on = i * step, off = (i + 1) * step;
-      const up = [{ transform: 'scale(1)', boxShadow: '0 0 0 0 transparent' }, { transform: 'scale(1.08)', boxShadow: '0 0 0 2px oklch(78% 0.14 305), inset 0 0 0 2px oklch(78% 0.14 305), 0 18px 40px rgb(0 0 0/.55)' }];
-      if (i > 0) T.a(c, up, on, dur, ease); else T.a(c, [up[1], up[1]], 0, 1);
-      if (i < 4) T.a(c, [up[1], up[0]], off, dur, ease);
-      const capIn = v === 'today' ? [{ opacity: 0 }, { opacity: 1 }] : [{ opacity: 0, transform: 'translateY(10px)' }, { opacity: 1, transform: 'none' }];
-      if (i > 0) T.a(caps[i], capIn, on + (v === 'today' ? 0 : 60), dur, ease); else T.a(caps[i], [{ opacity: 1 }, { opacity: 1 }], 0, 1);
-      if (i < 4) T.a(caps[i], [{ opacity: 1 }, { opacity: 0 }], off, v === 'today' ? dur : 100, ease);
-      if (i > 4) caps[i].style.opacity = 0;
-    });
-  } },
-
-  // 8. hero crossfade (Discover hero advances)
-  hero: { len: 2600, variants: { after: 'Proposed: 320 ms backdrop cross-fade, copy hand-off', today: 'Today: cut' }, build(s, T, v) {
-    const mk = (b, t, meta, ov) => s.appendChild(html(`<div class="abs hero" style="inset:0"><div class="bd" style="background-image:url(${A}b${b}.webp)"></div><div class="scrim"></div>${heroCopy({ kicker: '✦ For you', title: t, meta, ov, btns: '<span class="btn">ⓘ Details</span>', bottom: 520 })}</div>`));
-    const b = mk(2, 'Arrival', 'Movie · 2016 · Drama, Sci-Fi ' + rate('94%', '82%'), 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military to determine whether they come in peace or are a threat.');
-    const a = mk(1, 'Apocalypse Now', 'Movie · 1979 · Drama, War ' + rate('91%', '94%'), 'At the height of the Vietnam war, Captain Benjamin Willard is sent on a dangerous mission that, officially, does not exist.');
-    s.append(html(nav(1)));
-    s.append(html(`<div class="abs" style="left:96px;top:600px;font-size:34px;font-weight:700">Movies for you</div>`));
-    [0, 1, 2, 3, 4, 5].map(i => s.append(html(`<div class="card poster" style="left:${96 + i * 296}px;top:670px;background-image:url(${poster(i)})"></div>`)));
-    const at = 900;
-    if (v === 'today') { T.a(a, [{ opacity: 1 }, { opacity: 0 }], at, 1); return; }
-    T.a(a.querySelector('.copy'), [{ opacity: 1 }, { opacity: 0 }], at, 120, EASE);
-    T.a(a.querySelector('.bd'), [{ opacity: 1 }, { opacity: 0 }], at, 320, INOUT);
-    T.a(a.querySelector('.scrim'), [{ opacity: 1 }, { opacity: 1 }], at, 320);
-    T.a(a, [{ opacity: 1 }, { opacity: 0 }], at + 300, 20);
-    T.a(b.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(14px)' }, { opacity: 1, transform: 'none' }], at + 140, 200, OUT);
-  } },
-};
-
-// ---------- player ----------
-const players = [];
-let boxRate = false;
-function makePlayer(box) {
-  const name = box.dataset.scene, sc = SCENES[name];
-  const lead = +(box.dataset.lead || 300);
-  let variant = box.dataset.variant || Object.keys(sc.variants)[0];
-  let anims = [], t0 = 0, raf = 0, stage, label;
-  const total = () => lead + sc.len + 1400;
-  function build() {
-    box.querySelectorAll('.stage').forEach(e => e.remove());
-    stage = html('<div class="stage"></div>'); box.appendChild(stage);
-    label = stage.appendChild(html('<div class="tl">0 ms</div>'));
-    anims = [];
-    const rm = document.body.classList.contains('rm');
-    const seen = new WeakSet();
-    const T = { a(el, kf, start, dur, easing = EASE, opt = {}) {
-      let k = kf, d = dur;
-      if (rm) { k = kf.map(f => { const g = { ...f }; delete g.transform; return g; }); d = Math.min(dur, 100); }
-      // only an element's first animation fills backwards; later ones on the same element must not override it while waiting
-      const fill = seen.has(el) ? 'forwards' : 'both'; seen.add(el);
-      const an = el.animate(k, { delay: lead + start, duration: Math.max(1, d), easing, fill, ...opt });
-      an.pause(); anims.push(an);
-    } };
-    sc.build(stage, T, variant);
-    fit();
-  }
-  function fit() { if (stage) stage.style.transform = `scale(${box.clientWidth / 1920})`; }
-  function tick(now) {
-    let t = now - t0;
-    if (t > total()) { t0 = now; t = 0; }
-    const q = boxRate ? Math.floor(t / BOX_MS) * BOX_MS : t;
-    for (const an of anims) an.currentTime = q;
-    label.textContent = `${Math.max(0, Math.round(q - lead))} ms`;
-    raf = requestAnimationFrame(tick);
-  }
-  function start() { cancelAnimationFrame(raf); build(); t0 = performance.now(); raf = requestAnimationFrame(tick); }
-  function stop() { cancelAnimationFrame(raf); raf = 0; }
-  new ResizeObserver(fit).observe(box);
-  new IntersectionObserver(es => es.forEach(e => { if (e.isIntersecting) { if (!raf) start(); } else stop(); }), { rootMargin: '100px' }).observe(box);
-  const p = { box, start, setVariant(v) { variant = v; start(); }, rebuild: start };
-  players.push(p);
-  return p;
-}
-
-document.querySelectorAll('.sbox[data-scene]').forEach(makePlayer);
-document.querySelectorAll('[data-variants]').forEach(bar => {
-  const p = players.find(x => x.box.id === bar.dataset.variants);
-  const sc = SCENES[p.box.dataset.scene];
-  Object.entries(sc.variants).forEach(([k, label], i) => {
-    const b = document.createElement('button'); b.type = 'button'; b.className = 'tab' + (i === 0 ? ' on' : ''); b.textContent = label;
-    b.onclick = () => { bar.querySelectorAll('.tab').forEach(x => x.classList.toggle('on', x === b)); p.setVariant(k); };
-    bar.appendChild(b);
-  });
-});
-document.querySelectorAll('button.replay').forEach(b => b.addEventListener('click', () => {
-  const pair = b.closest('.pair');
-  pair.querySelectorAll('video').forEach(v => { v.currentTime = 0; v.play().catch(() => {}); });
-  players.filter(p => pair.contains(p.box)).forEach(p => p.start());
-}));
-const rate_ = document.getElementById('boxrate');
-if (rate_) rate_.addEventListener('change', () => { boxRate = rate_.checked; });
-const rm = document.getElementById('rm');
-if (rm) {
-  if (matchMedia('(prefers-reduced-motion: reduce)').matches) { rm.checked = true; document.body.classList.add('rm'); }
-  rm.addEventListener('change', () => { document.body.classList.toggle('rm', rm.checked); players.forEach(p => p.rebuild()); });
-}
-document.body.dataset.ready = '1';
-})();
-
-document.querySelectorAll('form.decision').forEach(form=>{form.addEventListener('submit',event=>{event.preventDefault();const key=form.dataset.lavishQuestion;const answer=new FormData(form).get(key);const status=form.querySelector('[role=status]');if(!answer){status.textContent='Pick an option first.';return;}if(!window.lavish||!window.lavish.queuePrompt){status.textContent='Open this page in the live review board to queue an answer.';return;}const note=form.querySelector('textarea').value.trim();const label=form.querySelector('h3').textContent;window.lavish.queuePrompt(label+': '+answer+(note?'\n'+note:''),{tag:'choice',text:label+': '+answer,element:form,queueKey:key,data:{question:key,answer:answer,note:note}});status.textContent='Queued. Press Send to Agent in the review toolbar.';});});
-</script></main></body></html>

data/tv-v2/motion-2026-11-06/proto.css

@@ -1,72 +0,0 @@
-/* Prototype stages: 1920x1080 CSS px, approved tokens from data/tv-v2/focus-2026-11-06 (colors, type, ring, card sizes at Level 2 spacing). */
-.sbox{position:relative;width:100%;aspect-ratio:16/9;overflow:hidden;border-radius:8px;border:1px solid var(--line);background:#000}
-.sbox video{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;display:block}
-.stage{position:absolute;left:0;top:0;width:1920px;height:1080px;transform-origin:0 0;overflow:hidden;background:#07070a;font-family:system-ui,-apple-system,"Segoe UI",Roboto,"Noto Sans",sans-serif;color:#f4f4f6;font-size:28px;line-height:1.3;
- --bg:#07070a;--surface:#13131a;--surface2:#1b1b25;--surface3:#252532;--muted:rgb(244 244 246/.74);--dim:rgb(244 244 246/.56);--accent:oklch(78% 0.14 305);--accent-text:oklch(88% 0.08 305)}
-.stage *{box-sizing:border-box}
-.stage .abs{position:absolute}
-/* nav */
-.stage .nav{position:absolute;left:0;top:0;width:1920px;height:150px;z-index:5;display:flex;align-items:center;gap:12px;padding:44px 96px 0}
-.stage .wm{font-size:36px;font-weight:800;letter-spacing:-.02em;margin-right:40px}.stage .wm b{color:var(--accent)}
-.stage .ni{height:64px;padding:0 26px;border-radius:32px;display:inline-flex;align-items:center;font-size:30px;font-weight:600;color:var(--muted);position:relative}
-.stage .ni.cur{color:#f4f4f6}.stage .ni.cur::after{content:"";position:absolute;left:26px;right:26px;bottom:4px;height:4px;border-radius:2px;background:var(--accent)}
-.stage .ni.f{background:#f4f4f6;color:#0b0b10}.stage .ni.f::after{display:none}
-.stage .nsp{flex:1}.stage .av{width:64px;height:64px;border-radius:50%;display:grid;place-items:center;font-weight:800;color:#0b0b10;font-size:30px;background:#9be38f}
-/* hero */
-.stage .amb{position:absolute;inset:0;background-size:cover;background-position:center;image-rendering:auto}
-.stage .bd{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .scrim{position:absolute;inset:0;background:linear-gradient(90deg,rgb(7 7 10/.92) 0%,rgb(7 7 10/.55) 42%,rgb(7 7 10/0) 70%),linear-gradient(0deg,#07070a 0%,rgb(7 7 10/.6) 26%,rgb(7 7 10/0) 48%)}
-.stage .copy{position:absolute;left:96px;width:1000px}
-.stage .kicker{font-size:26px;font-weight:650;color:var(--accent-text);margin-bottom:10px}
-.stage .ht{font-size:84px;line-height:1.02;font-weight:800;letter-spacing:-.02em;margin:0 0 16px}
-.stage .hm{font-size:28px;color:var(--muted);margin-bottom:14px;min-height:38px;display:flex;gap:22px;align-items:center}
-.stage .ho{font-size:28px;color:var(--muted);margin:0 0 30px;max-width:960px}
-.stage .btns{display:flex;gap:20px}
-.stage .btn{height:76px;padding:0 38px;border-radius:38px;font-size:28px;font-weight:700;display:inline-flex;align-items:center;background:rgb(255 255 255/.14)}
-.stage .btn.pri{background:#f4f4f6;color:#0b0b10}
-.stage .btn.f{box-shadow:0 0 0 2px var(--accent),inset 0 0 0 2px var(--accent);transform:scale(1.05)}
-.stage .rate{display:inline-flex;gap:10px;align-items:center;font-weight:700;color:#f4f4f6}.stage .rate i{width:24px;height:24px;border-radius:50%;background:#e2483a;display:inline-block}
-.stage .rate i.pc{background:#f5c518;border-radius:4px}
-.stage .slot{display:inline-block;height:30px;border-radius:15px;background:rgb(255 255 255/.10)}
-/* rows + cards */
-.stage .sh{position:absolute;left:96px;font-size:34px;font-weight:700}
-.stage .card{position:absolute;border-radius:16px;overflow:hidden;background:var(--surface);background-size:cover;background-position:center}
-.stage .card.poster{width:256px;height:384px}.stage .card.tile{width:400px;height:225px}
-.stage .card .img{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .card .cap{position:absolute;left:0;right:0;bottom:0;padding:14px 18px;background:linear-gradient(rgb(7 7 10/0),rgb(7 7 10/.92));font-size:26px;font-weight:700}
-.stage .ring{box-shadow:0 0 0 2px var(--accent),inset 0 0 0 2px var(--accent),0 18px 40px rgb(0 0 0/.55)}
-.stage .circle{position:absolute;width:200px;height:200px;border-radius:50%;overflow:hidden;background:var(--surface2);display:grid;place-items:center;font-size:44px;font-weight:800;color:var(--dim)}
-.stage .circle .img{position:absolute;inset:0;background-size:cover;background-position:center}
-.stage .bar{position:absolute;height:28px;border-radius:14px;background:var(--surface2)}
-.stage .spin{position:absolute;left:940px;top:520px;width:40px;height:40px;border-radius:50%;border:4px solid rgb(155 120 255/.25);border-top-color:oklch(65% 0.2 300);animation:spin .8s linear infinite}
-/* picker */
-.stage .pk{position:absolute;top:290px;left:0;width:1920px;text-align:center;font-size:72px;font-weight:800;letter-spacing:-.02em}
-.stage .person{position:absolute;top:426px;width:220px;height:220px;border-radius:50%;display:grid;place-items:center;font-size:110px;font-weight:800;color:#0b0b10}
-.stage .pname{position:absolute;top:670px;width:220px;text-align:center;font-size:34px;font-weight:700;color:var(--muted)}
-/* replay label */
-.stage .tl{position:absolute;right:14px;bottom:10px;font:22px/1 ui-monospace,Menlo,monospace;background:rgb(0 0 0/.6);padding:6px 8px;border-radius:6px;color:#fff;z-index:20}
-
-/* keyframes */
-@keyframes spin{to{transform:rotate(360deg)}}
-@keyframes fade{from{opacity:0}to{opacity:1}}
-@keyframes fadeout{from{opacity:1}to{opacity:0}}
-@keyframes rise{from{opacity:0;transform:translateY(16px)}to{opacity:1;transform:none}}
-@keyframes breathe{0%,100%{opacity:.55}50%{opacity:1}}
-@keyframes shimmer{from{transform:translateX(-100%)}to{transform:translateX(100%)}}
-@keyframes hide{to{opacity:0;visibility:hidden}}
-@keyframes show{from{opacity:0}to{opacity:1}}
-
-/* anything with .an waits for .play */
-.stage .an{opacity:0}
-.stage.play .an{animation-fill-mode:both}
-.stage .gone{animation-fill-mode:both}
-/* skeleton styles */
-.stage .sk{background:var(--surface2)}
-.stage .sk.breathe{animation:breathe 1.4s ease-in-out infinite}
-.stage .sk.shim{position:relative;overflow:hidden}
-.stage .sk.shim::after{content:"";position:absolute;inset:0;background:linear-gradient(90deg,transparent,rgb(255 255 255/.07),transparent);animation:shimmer 1.3s linear infinite}
-
-/* reduced motion: no movement, short fades only */
-body.rm .stage.play .an{animation-name:fade!important;animation-duration:.08s!important}
-body.rm .stage .sk.breathe,body.rm .stage .sk.shim::after{animation:none}
-body.rm .stage .mv{transition:none!important}

data/tv-v2/motion-2026-11-06/proto.js

@@ -1,251 +0,0 @@
-// Wolfskin TV motion prototypes. One clock per stage drives Web Animations; "box rate" quantises the clock
-// to the measured frame time on the Xiaomi box (p50 40 ms while moving, data/tv-spike-motion-speed/raw/gfx-*),
-// so the same motion can be watched at 60 fps and at the rate the box actually draws today.
-(() => {
-const A = 'tv-motion-speed/';
-const BOX_MS = 40;
-const EASE = 'cubic-bezier(.25,.1,.25,1)', OUT = 'cubic-bezier(.33,1,.68,1)', INOUT = 'cubic-bezier(.65,0,.35,1)';
-const POSTERS = [
-  ['American Gangster', '2007 · 2h 36m'], ['Annie Hall', '1977 · 1h 33m'], ['Apocalypse Now', '1979 · 2h 27m'],
-  ['Arrival', '2016 · 1h 56m'], ['Avatar: The Last Airbender', '2026 · 1h 52m'], ['Bohemian Rhapsody', '2018 · 2h 15m'],
-  ['Braveheart', '1995 · 2h 58m'], ['Citizen Kane', '1941 · 1h 59m'], ['Spirited Away', '2001 · 2h 5m'],
-  ['12 Years a Slave', '2013 · 2h 14m'], ['A Bronx Tale', '1993 · 2h 1m'], ['All the Money in the World', '2017 · 2h 13m'],
-];
-const poster = i => `${A}p${i + 1}.webp`;
-const html = (s) => { const t = document.createElement('template'); t.innerHTML = s.trim(); return t.content.firstChild; };
-
-function nav(cur, focus) {
-  const items = ['Home', 'Discover', 'Movies', 'Shows'];
-  return `<div class="nav"><span class="wm">Wolf<b>skin</b></span>${items.map((n, i) => `<span class="ni ${i === cur ? 'cur' : ''} ${i === focus ? 'f' : ''}">${n}</span>`).join('')}<span class="nsp"></span><span class="av">S</span></div>`;
-}
-function rate(rt, pc) { return `<span class="rate"><i></i>${rt}</span><span class="rate"><i class="pc"></i>${pc}</span>`; }
-function heroCopy(o) {
-  return `<div class="copy" style="bottom:${o.bottom || 330}px"><div class="kicker">${o.kicker}</div><div class="ht">${o.title}</div><div class="hm">${o.meta}</div>${o.ov ? `<div class="ho">${o.ov}</div>` : ''}<div class="btns">${o.btns}</div></div>`;
-}
-
-// ---------- scenes: build(stage, T, v) where v is the selected variant ----------
-const SCENES = {
-  // 1. launch -> Who's watching
-  launch: { len: 1400, variants: { after: 'After: people from the saved list' }, build(s, T) {
-    s.append(html(`<div class="abs" style="inset:0;background:url(${A}launcher.webp) center/cover"></div>`));
-    const bg = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a"></div>`));
-    T.a(bg, [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    const pk = s.appendChild(html(`<div class="abs" style="inset:0"><div class="abs" style="left:96px;top:60px;font-size:36px;font-weight:800">Wolf<b style="color:var(--accent)">skin</b></div><div class="pk">Who’s watching?</div>
-      ${[['J', '#64c3ff', 'justin', 540], ['M', '#ffa47a', 'mindel', 850], ['S', '#9be38f', 'shared', 1160]].map(([l, c, n, x]) => `<div class="person ${n === 'shared' ? 'ring' : ''}" style="left:${x}px;background:${c}">${l}</div><div class="pname" style="left:${x}px">${n}</div>`).join('')}</div>`));
-    T.a(pk, [{ opacity: 0 }, { opacity: 1 }], 450, 160);
-  } },
-
-  // 2. picker -> Home
-  home: { len: 1100, variants: { after: 'After: last Home painted from disk, art pre-decoded' }, build(s, T) {
-    const home = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${A}b2t.webp);filter:blur(30px);transform:scale(1.1)"></div>
-      <div class="bd" style="background-image:url(${A}b2.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '▸ Continue watching', title: 'Arrival', meta: '2016 · 1h 56m · 38 min left ' + rate('94%', '82%'), ov: 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military to determine whether they come in peace or are a threat.', btns: '<span class="btn pri f">▶ Resume</span><span class="btn">ⓘ Details</span>', bottom: 340 })}
-      <div class="sh" style="top:780px">Next up</div>
-      ${[3, 4, 1, 2].map((b, i) => `<div class="card tile" style="left:${96 + i * 440}px;top:850px"><div class="img" style="background-image:url(${A}b${b}.webp)"></div><div class="cap">${['American Gangster', 'Bohemian Rhapsody', 'Apocalypse Now', 'Arrival'][i]}</div></div>`).join('')}
-      ${nav(0)}</div>`));
-    const picker = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a;z-index:10"><div class="pk">Who’s watching?</div>
-      ${[['J', '#64c3ff', 'justin', 540], ['M', '#ffa47a', 'mindel', 850], ['S', '#9be38f', 'shared', 1160]].map(([l, c, n, x]) => `<div class="person ${n === 'shared' ? 'ring' : ''}" style="left:${x}px;background:${c}">${l}</div><div class="pname" style="left:${x}px">${n}</div>`).join('')}</div>`));
-    T.a(picker, [{ opacity: 1 }, { opacity: 0 }], 0, 140);
-    T.a(home.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 40, 120);
-    T.a(home.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 120, 220, INOUT);
-    T.a(home.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 60, 180, OUT);
-    T.a(home.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 120, 160);
-    home.querySelectorAll('.card').forEach((c, i) => {
-      T.a(c, [{ opacity: 0, transform: 'translateY(24px)' }, { opacity: 1, transform: 'none' }], 140 + i * 40, 180, OUT);
-    });
-  } },
-
-  // 3. skeleton styles on a poster grid
-  skeleton: { len: 2200, variants: { breathe: 'Breathe (pick)', flat: 'Flat blocks (today)', shimmer: 'Shimmer sweep', spinner: 'Spinner (today, launch)' }, build(s, T, v) {
-    s.append(html(nav(2)));
-    s.append(html(`<div class="abs" style="left:96px;top:150px;font-size:72px;font-weight:800;letter-spacing:-.02em">Movies <span style="font-size:30px;font-weight:500;color:var(--muted)">85 films</span></div>`));
-    const cells = [];
-    for (let r = 0; r < 2; r++) for (let c = 0; c < 6; c++) cells.push([96 + c * 296, 330 + r * 460, r * 6 + c]);
-    if (v === 'spinner') { const sp = s.appendChild(html('<div class="spin"></div>')); T.a(sp, [{ opacity: 1 }, { opacity: 0 }], 900, 120); }
-    cells.forEach(([x, y, i]) => {
-      if (v !== 'spinner') {
-        const sk = s.appendChild(html(`<div class="card poster sk ${v === 'breathe' ? 'breathe' : v === 'shimmer' ? 'shim' : ''}" style="left:${x}px;top:${y}px;${v === 'breathe' ? `animation-delay:${(i % 6) * 90}ms` : ''}"></div>`));
-        T.a(sk, [{ opacity: 1 }, { opacity: 0 }], 900 + i * 25, 160);
-      }
-      const c = s.appendChild(html(`<div class="card poster" style="left:${x}px;top:${y}px;background-image:url(${poster(i)})"></div>`));
-      T.a(c, [{ opacity: 0 }, { opacity: 1 }], 900 + i * 25, 160);
-    });
-  } },
-
-  // 4. tab switch: Home -> Discover, rows reveal
-  tab: { len: 1100, variants: { after: 'After: last Discover painted, rows rise, art fades' }, build(s, T) {
-    const disc = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="bd" style="background-image:url(${A}b4.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '✦ For you', title: 'Bohemian Rhapsody', meta: 'Movie · 2018 · Drama, Music ' + rate('60%', '85%'), ov: 'Singer Freddie Mercury, guitarist Brian May, drummer Roger Taylor and bass guitarist John Deacon take the music world by storm.', btns: '<span class="btn">ⓘ Details</span>', bottom: 520 })}
-      <div class="sh" style="top:600px">Movies for you</div>
-      ${[6, 7, 8, 9, 10, 11].map((p, i) => `<div class="card poster" style="left:${96 + i * 296}px;top:670px"><div class="img" style="background-image:url(${poster(p)})"></div></div>`).join('')}
-      </div>`));
-    const home = s.appendChild(html(`<div class="abs" style="inset:0"><div class="bd" style="background-image:url(${A}b2.webp)"></div><div class="scrim"></div>
-      ${heroCopy({ kicker: '▸ Continue watching', title: 'Arrival', meta: '2016 · 1h 56m · 38 min left', ov: 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military.', btns: '<span class="btn pri">▶ Resume</span><span class="btn">ⓘ Details</span>', bottom: 340 })}</div>`));
-    const n = s.appendChild(html(nav(1, 1)));
-    T.a(home, [{ opacity: 1 }, { opacity: 0 }], 0, 200, EASE);
-    T.a(disc.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 0, 240, INOUT);
-    T.a(disc.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 80, 180, OUT);
-    T.a(disc.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 140, 160);
-    disc.querySelectorAll('.card').forEach((c, i) => T.a(c, [{ opacity: 0, transform: 'translateY(24px)' }, { opacity: 1, transform: 'none' }], 160 + i * 30, 180, OUT));
-  } },
-
-  // 5. title page entry from the Movies grid
-  title: { len: 1600, variants: { after: 'After: what the card knew, at once' }, build(s, T) {
-    const page = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${poster(2)});filter:blur(60px) saturate(1.2) brightness(.55);transform:scale(1.2)"></div>
-      <div class="bd" style="background-image:url(${A}b1.webp)"></div><div class="scrim"></div>
-      <div class="copy" style="bottom:360px"><div class="kicker">✓ Movie · In your library</div><div class="ht">Apocalypse Now</div>
-        <div class="hm">1979 · 2h 27m ${rate('91%', '94%')} <span class="late" style="color:var(--muted)">Drama, War</span></div>
-        <div class="ho late2" style="min-height:76px">At the height of the Vietnam war, Captain Benjamin Willard is sent on a dangerous mission that, officially, “does not exist, nor will it ever exist.”</div>
-        <div class="btns"><span class="btn pri f">▶ Play</span><span class="btn">⋯</span><span class="btn">Add for someone</span></div></div>
-      <div class="sh" style="top:830px">Cast</div>
-      ${[0, 1, 2, 3, 4, 5, 6].map(i => `<div class="circle" style="left:${96 + i * 244}px;top:900px"><span class="sk breathe abs" style="inset:0;border-radius:50%;animation-delay:${i * 90}ms"></span><div class="img" style="background-image:url(${A}c${i + 1}.webp)"></div></div>`).join('')}
-      ${nav(2)}</div>`));
-    const grid = s.appendChild(html(`<div class="abs" style="inset:0;background:#07070a">${nav(2)}
-      <div class="abs" style="left:96px;top:150px;font-size:72px;font-weight:800;letter-spacing:-.02em">Movies <span style="font-size:30px;font-weight:500;color:var(--muted)">85 films</span></div>
-      ${[0, 1, 2, 3, 4, 5].map(i => `<div class="card poster ${i === 2 ? 'ring' : ''}" style="left:${96 + i * 296}px;top:330px;background-image:url(${poster(i)});${i === 2 ? 'transform:scale(1.08)' : ''}"></div>`).join('')}
-      ${[6, 7, 8, 9, 10, 11].map((p, i) => `<div class="card poster" style="left:${96 + i * 296}px;top:790px;background-image:url(${poster(p)})"></div>`).join('')}</div>`));
-    T.a(grid, [{ opacity: 1 }, { opacity: 0 }], 0, 160);
-    T.a(page.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    T.a(page.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 40, 180, OUT);
-    T.a(page.querySelector('.late'), [{ opacity: 0 }, { opacity: 1 }], 430, 160);
-    T.a(page.querySelector('.late2'), [{ opacity: 0 }, { opacity: 1 }], 430, 160);
-    T.a(page.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 470, 280, INOUT);
-    T.a(page.querySelector('.sh'), [{ opacity: 0 }, { opacity: 1 }], 120, 160);
-    page.querySelectorAll('.circle').forEach((c, i) => {
-      T.a(c, [{ opacity: 0, transform: 'translateY(20px)' }, { opacity: 1, transform: 'none' }], 140 + i * 30, 180, OUT);
-      T.a(c.querySelector('.img'), [{ opacity: 0 }, { opacity: 1 }], 620 + i * 40, 160);
-    });
-  } },
-
-  // 6. series title: late readiness line
-  series: { len: 4000, variants: { tv: 'TV-only: slot reserved, fades in at 3.4 s', conductarr: 'With the Conductarr cache: arrives ≈0.4 s' }, build(s, T, v) {
-    const late = v === 'conductarr' ? 380 : 3400;
-    const page = s.appendChild(html(`<div class="abs" style="inset:0">
-      <div class="amb" style="background-image:url(${A}s1t.webp);filter:blur(30px);transform:scale(1.1)"></div>
-      <div class="bd" style="background-image:url(${A}s1.webp)"></div><div class="scrim"></div>
-      <div class="copy" style="bottom:430px"><div class="kicker">✓ Series · In your library · Watched</div><div class="ht">Adults</div>
-        <div class="hm">2025 · 2 seasons · Comedy <span class="lr">${rate('88%', '93%')}</span></div>
-        <div class="hm lr2" style="color:var(--ok,#9be38f);font-size:26px">✓ Ready for you · by Mindel</div>
-        <div class="ho" style="min-height:76px">A group of twenty-somethings in New York trying to be good people, despite being neither “good” nor “people” yet.</div>
-        <div class="btns"><span class="btn pri f">▶ Play S1 E1</span><span class="btn">⋯</span><span class="btn">Seasons</span></div></div>
-      <div class="abs" style="left:96px;top:790px;display:flex;gap:16px"><span class="btn" style="height:56px;font-size:24px;background:var(--accent-soft,#2a1f3d)">Season 1</span><span class="btn" style="height:56px;font-size:24px">Season 2</span></div>
-      ${[0, 1, 2, 3].map(i => `<div class="card tile sk breathe" style="left:${96 + i * 440}px;top:880px;animation-delay:${i * 90}ms"><div class="img" style="background-image:url(${A}${i % 2 ? 's1' : 'e1'}.webp)"></div></div>`).join('')}
-      ${nav(3)}</div>`));
-    T.a(page.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(16px)' }, { opacity: 1, transform: 'none' }], 0, 180, OUT);
-    T.a(page.querySelector('.amb'), [{ opacity: 0 }, { opacity: 1 }], 0, 160);
-    T.a(page.querySelector('.bd'), [{ opacity: 0 }, { opacity: 1 }], 620, 280, INOUT);
-    T.a(page.querySelector('.lr'), [{ opacity: 0 }, { opacity: 1 }], late, 200);
-    T.a(page.querySelector('.lr2'), [{ opacity: 0 }, { opacity: 1 }], late, 200);
-    page.querySelectorAll('.card .img').forEach((c, i) => T.a(c, [{ opacity: 0 }, { opacity: 1 }], 700 + i * 40, 160));
-  } },
-
-  // 7. focus move along a row
-  focus: { len: 3000, variants: { after: 'Proposed: 180 ms ease-out, caption rises', today: 'Today: 140 ms, caption cross-fade' }, build(s, T, v) {
-    s.append(html(nav(2)));
-    s.append(html(`<div class="sh" style="top:250px">Movies for you</div>`));
-    const dur = v === 'today' ? 140 : 180, ease = v === 'today' ? EASE : OUT;
-    const cards = [0, 1, 2, 3, 4, 5].map(i => s.appendChild(html(`<div class="card poster" style="left:${96 + i * 296}px;top:330px;background-image:url(${poster(i + 6)})"></div>`)));
-    const caps = [0, 1, 2, 3, 4, 5].map(i => s.appendChild(html(`<div class="abs" style="left:${96 + i * 296}px;top:740px;width:520px"><div style="font-size:30px;font-weight:700">${POSTERS[i + 6][0]}</div><div style="font-size:26px;color:var(--muted)">${POSTERS[i + 6][1]}</div></div>`)));
-    const step = 600;
-    cards.forEach((c, i) => {
-      const on = i * step, off = (i + 1) * step;
-      const up = [{ transform: 'scale(1)', boxShadow: '0 0 0 0 transparent' }, { transform: 'scale(1.08)', boxShadow: '0 0 0 2px oklch(78% 0.14 305), inset 0 0 0 2px oklch(78% 0.14 305), 0 18px 40px rgb(0 0 0/.55)' }];
-      if (i > 0) T.a(c, up, on, dur, ease); else T.a(c, [up[1], up[1]], 0, 1);
-      if (i < 4) T.a(c, [up[1], up[0]], off, dur, ease);
-      const capIn = v === 'today' ? [{ opacity: 0 }, { opacity: 1 }] : [{ opacity: 0, transform: 'translateY(10px)' }, { opacity: 1, transform: 'none' }];
-      if (i > 0) T.a(caps[i], capIn, on + (v === 'today' ? 0 : 60), dur, ease); else T.a(caps[i], [{ opacity: 1 }, { opacity: 1 }], 0, 1);
-      if (i < 4) T.a(caps[i], [{ opacity: 1 }, { opacity: 0 }], off, v === 'today' ? dur : 100, ease);
-      if (i > 4) caps[i].style.opacity = 0;
-    });
-  } },
-
-  // 8. hero crossfade (Discover hero advances)
-  hero: { len: 2600, variants: { after: 'Proposed: 320 ms backdrop cross-fade, copy hand-off', today: 'Today: cut' }, build(s, T, v) {
-    const mk = (b, t, meta, ov) => s.appendChild(html(`<div class="abs hero" style="inset:0"><div class="bd" style="background-image:url(${A}b${b}.webp)"></div><div class="scrim"></div>${heroCopy({ kicker: '✦ For you', title: t, meta, ov, btns: '<span class="btn">ⓘ Details</span>', bottom: 520 })}</div>`));
-    const b = mk(2, 'Arrival', 'Movie · 2016 · Drama, Sci-Fi ' + rate('94%', '82%'), 'Taking place after alien crafts land around the world, an expert linguist is recruited by the military to determine whether they come in peace or are a threat.');
-    const a = mk(1, 'Apocalypse Now', 'Movie · 1979 · Drama, War ' + rate('91%', '94%'), 'At the height of the Vietnam war, Captain Benjamin Willard is sent on a dangerous mission that, officially, does not exist.');
-    s.append(html(nav(1)));
-    s.append(html(`<div class="abs" style="left:96px;top:600px;font-size:34px;font-weight:700">Movies for you</div>`));
-    [0, 1, 2, 3, 4, 5].map(i => s.append(html(`<div class="card poster" style="left:${96 + i * 296}px;top:670px;background-image:url(${poster(i)})"></div>`)));
-    const at = 900;
-    if (v === 'today') { T.a(a, [{ opacity: 1 }, { opacity: 0 }], at, 1); return; }
-    T.a(a.querySelector('.copy'), [{ opacity: 1 }, { opacity: 0 }], at, 120, EASE);
-    T.a(a.querySelector('.bd'), [{ opacity: 1 }, { opacity: 0 }], at, 320, INOUT);
-    T.a(a.querySelector('.scrim'), [{ opacity: 1 }, { opacity: 1 }], at, 320);
-    T.a(a, [{ opacity: 1 }, { opacity: 0 }], at + 300, 20);
-    T.a(b.querySelector('.copy'), [{ opacity: 0, transform: 'translateY(14px)' }, { opacity: 1, transform: 'none' }], at + 140, 200, OUT);
-  } },
-};
-
-// ---------- player ----------
-const players = [];
-let boxRate = false;
-function makePlayer(box) {
-  const name = box.dataset.scene, sc = SCENES[name];
-  const lead = +(box.dataset.lead || 300);
-  let variant = box.dataset.variant || Object.keys(sc.variants)[0];
-  let anims = [], t0 = 0, raf = 0, stage, label;
-  const total = () => lead + sc.len + 1400;
-  function build() {
-    box.querySelectorAll('.stage').forEach(e => e.remove());
-    stage = html('<div class="stage"></div>'); box.appendChild(stage);
-    label = stage.appendChild(html('<div class="tl">0 ms</div>'));
-    anims = [];
-    const rm = document.body.classList.contains('rm');
-    const seen = new WeakSet();
-    const T = { a(el, kf, start, dur, easing = EASE, opt = {}) {
-      let k = kf, d = dur;
-      if (rm) { k = kf.map(f => { const g = { ...f }; delete g.transform; return g; }); d = Math.min(dur, 100); }
-      // only an element's first animation fills backwards; later ones on the same element must not override it while waiting
-      const fill = seen.has(el) ? 'forwards' : 'both'; seen.add(el);
-      const an = el.animate(k, { delay: lead + start, duration: Math.max(1, d), easing, fill, ...opt });
-      an.pause(); anims.push(an);
-    } };
-    sc.build(stage, T, variant);
-    fit();
-  }
-  function fit() { if (stage) stage.style.transform = `scale(${box.clientWidth / 1920})`; }
-  function tick(now) {
-    let t = now - t0;
-    if (t > total()) { t0 = now; t = 0; }
-    const q = boxRate ? Math.floor(t / BOX_MS) * BOX_MS : t;
-    for (const an of anims) an.currentTime = q;
-    label.textContent = `${Math.max(0, Math.round(q - lead))} ms`;
-    raf = requestAnimationFrame(tick);
-  }
-  function start() { cancelAnimationFrame(raf); build(); t0 = performance.now(); raf = requestAnimationFrame(tick); }
-  function stop() { cancelAnimationFrame(raf); raf = 0; }
-  new ResizeObserver(fit).observe(box);
-  new IntersectionObserver(es => es.forEach(e => { if (e.isIntersecting) { if (!raf) start(); } else stop(); }), { rootMargin: '100px' }).observe(box);
-  const p = { box, start, setVariant(v) { variant = v; start(); }, rebuild: start };
-  players.push(p);
-  return p;
-}
-
-document.querySelectorAll('.sbox[data-scene]').forEach(makePlayer);
-document.querySelectorAll('[data-variants]').forEach(bar => {
-  const p = players.find(x => x.box.id === bar.dataset.variants);
-  const sc = SCENES[p.box.dataset.scene];
-  Object.entries(sc.variants).forEach(([k, label], i) => {
-    const b = document.createElement('button'); b.type = 'button'; b.className = 'tab' + (i === 0 ? ' on' : ''); b.textContent = label;
-    b.onclick = () => { bar.querySelectorAll('.tab').forEach(x => x.classList.toggle('on', x === b)); p.setVariant(k); };
-    bar.appendChild(b);
-  });
-});
-document.querySelectorAll('button.replay').forEach(b => b.addEventListener('click', () => {
-  const pair = b.closest('.pair');
-  pair.querySelectorAll('video').forEach(v => { v.currentTime = 0; v.play().catch(() => {}); });
-  players.filter(p => pair.contains(p.box)).forEach(p => p.start());
-}));
-const rate_ = document.getElementById('boxrate');
-if (rate_) rate_.addEventListener('change', () => { boxRate = rate_.checked; });
-const rm = document.getElementById('rm');
-if (rm) {
-  if (matchMedia('(prefers-reduced-motion: reduce)').matches) { rm.checked = true; document.body.classList.add('rm'); }
-  rm.addEventListener('change', () => { document.body.classList.toggle('rm', rm.checked); players.forEach(p => p.rebuild()); });
-}
-document.body.dataset.ready = '1';
-})();

docker/README.md

@@ -11,11 +11,7 @@ make test       # app default/debug suite plus wolfskin-design JVM/capture suite
 make apk-debug  # default debug, no secrets; MPV stub and no extra codec decoders
 ```
 
-Offline JVM tests use instrumented Android 9, 11 and 14 SDK jars. Cache preparation
+APKs remain under `app/build/outputs/apk/default/{release,debug}/`. Debug builds
-resolves each SDK independently; putting all three versions in one Gradle
-configuration selects only the newest and prevents older-SDK tests from starting.
-
-APKs remain under `app/build/outputs/apk/default/{release,debug,optimized}/`. Debug builds
 are not playback-complete and must not be distributed as releases. Upstream's
 `.github/workflows` and dependency version catalog are unchanged; release builds
 use the catalog's exact Wholphin extension version (currently `0.2.4`). Do not
@@ -31,175 +27,6 @@ Upstream enables JVM unit tests only for debug variants; there is no
 `testDefaultReleaseUnitTest` task. `make test` uses the closest default-flavor
 task without changing upstream's test configuration.
 
-## Household update channel
-
-The household assembly remains `defaultOptimized`: R8/resource shrinking,
-non-debuggable, baseline profiles, pinned playback extensions and no debug
-fixtures. Its installation identity is `org.justinvisser.wolfskin.tv.opt`.
-The persistent external Android debug keystore is now the **household signing
-authority**, not a disposable development key. Certificate SHA-256:
-`182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d`.
-Never print/copy that keystore into artifacts or regenerate it for a release.
-The household wrapper fails if it is missing; protect and escrow the original.
-
-Same package + same signer + strictly higher Android versionCode allows an
-in-place upgrade retaining Jellyfin logins, databases and preferences. Never
-uninstall, clear data, change identity or replace the key as an update recovery
-step. An older ephemeral signer is a separate, owner-approved migration gate;
-this change does not prove the TV's installed signer or retained-login behavior.
-
-The dedicated public distribution repository is
-`justinzeus/wolfskin-tv-updates`; its default API is
-`https://git.justinvisser.org/api/v1/repos/justinzeus/wolfskin-tv-updates/releases/latest`.
-Repository creation and each actual publication are separate owner gates.
-Neither command creates a repository. Source remains in `justinzeus/wolfskin`.
-Initialize the distribution repository's default branch (for example with a
-README) before its first draft; Forgejo needs a commit on which to create a
-distribution tag. That tag is not the source tag in the separate source repo.
-The old production package keeps its old release API and parser. Only the Opt
-package migrates the exact old default saved URL; intentional custom URLs remain.
-Installed-release notes use the household channel too.
-
-### Build, inspect and reserve a code
-
-```sh
-make tv-release VERSION=1.1.1 VERSION_CODE=100001 \
-  TV_RELEASE_DIR=/var/tmp/wolfskin-tv-release-1.1.1
-# Prerequisites only: no build, tag, ledger mutation or publication.
-make tv-release VERSION=1.1.1 VERSION_CODE=100001 \
-  TV_RELEASE_DIR=/var/tmp/wolfskin-tv-release-dry TV_RELEASE_FLAGS=--dry-run
-```
-
-Required: a clean committed source checkout, the existing persistent key, native
-package credentials through the existing secret mount, no local AAR overrides,
-and an explicit code above the committed ledgers at HEAD and freshly fetched
-`origin/main`, plus every local consumed-code reservation. Fetch failure refuses
-the build, including a dry-run. Known Opt code 65 seeds the ledger; old production
-code 28 and Wholphin code 62 belong to different packages. Proposed first household
-code 100001 exceeds all three. No household code derives from tag counts.
-Only `make tv-release` produces an installable household release; direct optimized
-Gradle builds bypass reservation and must never be installed on the household box.
-
-The builder inspects final signed APKs with aapt2/apksigner and checks package,
-version/code, signer, non-debuggable flag, minimum SDK, native ABI inventory,
-fixture exclusion and both dexopt profiles. It emits four standalone APKs:
-`Wolfskin-armeabi-v7a.apk`, `Wolfskin-arm64-v8a.apk`, `Wolfskin-x86_64.apk`,
-and universal `Wolfskin.apk`; plus `wolfskin-update.json`, `RELEASE-NOTES.md`
-and `SHA256SUMS`. Hashes and sizes come from final signed bytes. Universal
-32-bit x86 is not MPV-complete and is not a supported playback ABI.
-
-Manifest schema 1 contains `packageId`, `versionName`, `versionCode`,
-`publishedAt` (UTC ISO-8601), immutable `sourceCommit`, `sourceTag`,
-`signerSha256`, and `assets[]` with `abi`, `name`, `bytes`, `sha256`, `minSdk`.
-All ABI outputs share one code/signer/identity. The local source tag is
-`pwolfskin-opt-v<VERSION>`; the distribution tag is `wolfskin-opt-v<VERSION>`.
-Before building, the code is consumed in the local Git ref
-`refs/wolfskin-tv/version-codes/<code>`. This survives discarding a working-tree
-ledger append or checking out an older source commit. A failed real build also
-consumes its code: use a higher code rather than deleting the reservation.
-After successful packaging the builder appends the code to the tracked ledger.
-Commit that reservation and explicitly push the source tag before distribution;
-new producer checkouts obtain the committed floor by fetching `origin/main`.
-An existing output directory is refused to preserve previous evidence.
-
-Keep `private/` private: build/dependency logs, R8 mapping/effective configuration,
-APK metadata/certificate inspection and native/ZIP inventory. Publication uploads
-only the seven named public files, never that directory, credentials or keys.
-Review release notes and corresponding-source/native links before promotion.
-
-### Explicit draft publication
-
-```sh
-make tv-publish TV_RELEASE_DIR=/var/tmp/wolfskin-tv-release-1.1.1 \
-  TV_PUBLISH_FLAGS=--dry-run
-# Only after owner approval to upload:
-make tv-publish TV_RELEASE_DIR=/var/tmp/wolfskin-tv-release-1.1.1
-# Only after owner approval to publish the verified draft (use its printed id):
-make tv-publish TV_RELEASE_DIR=/var/tmp/wolfskin-tv-release-1.1.1 \
-  TV_PUBLISH_FLAGS='--draft-id <id> --promote'
-make tv-tooling-test
-```
-
-The publisher reads git's credential helper into process memory, not arguments,
-logs or files. It creates a draft, uploads all public files, then downloads and
-hashes their bytes while still draft. Existing matching drafts can be resumed
-and reverified. Upload/verification failures remain draft. Promotion requires
-the explicit flag; then anonymous latest/asset hash checks must pass. A failed
-post-promotion check attempts withdrawal to draft and reports failure, not
-success. Cross-origin credential forwarding and non-HTTPS URLs are refused.
-
-Before creating/resuming a draft and immediately before promotion, the publisher
-anonymously reads latest and its manifest. The bundle code must be strictly newer.
-Only a latest 404 followed by a successful empty release list permits a first
-release; other errors fail closed. A channel advance during upload leaves the
-verified upload draft rather than publishing an equal or lower code.
-`--test-server` permits only a loopback HTTP fake Forgejo; production defaults
-cannot be redirected to a different repository by a CLI repository argument.
-Dry-run never fetches a credential or makes publication requests.
-
-### Client trust and installation
-
-`UpdateController` is the process-scoped UI contract with `StateFlow` state,
-shared auto-check preference, refreshed PackageManager installed version and
-explicit check/download/cancel/install/retry/resume actions. Its capture fake
-does not perform real operations. Classic Opt update controls use that same
-controller; the old package retains its original updater.
-
-`release: StateFlow<UpdateUiState.Available?>` retains version, size, localized
-date and release notes through download, Ready and installation cancellation.
-Verified records persist notes as an optional `releaseNotes` field alongside
-the manifest; existing manifest-only records remain readable. `Failed.operation`
-is `UpdateOperation.Check`, `Download` or `Install`, never inferred from message text.
-Permission and handoff dismissals restore verified Ready without discarding its
-APK. Installer ownership is tracked separately from the visible state, so a
-dismissed but active system session still blocks a duplicate handoff. Calling
-`install()` from PermissionNeeded resolves and opens the permission settings again.
-
-The client uses a dedicated anonymous OkHttp client, validating every redirect:
-HTTPS, no URL user-info, no cookies/Jellyfin token/repository credential.
-Loopback HTTP is available only through the test transport constructor flag.
-It selects armeabi-v7a first when supported, then remaining device ABIs and
-a universal fallback, subject to minSdk. Universal fallback is limited to
-the channel's supported playback ABIs: armeabi-v7a, arm64-v8a and x86_64.
-It cannot make an unsupported processor compatible. Empty-release-list success
-is distinct from a latest-endpoint 404, authorization failure, invalid metadata
-or up-to-date code.
-
-Downloads are app-private. Retry starts a new truncated partial rather than
-concatenating unvalidated ranges; cancel and process recreation discard partials.
-Length, SHA-256, APK PackageManager package/version/current signer and manifest
-signer must agree before Ready. Restoring Ready re-hashes/re-inspects the APK.
-Checksum files on the same server are not an independent trust authority:
-the installed Android signer is the installation boundary.
-
-EOF never starts installation. Install requires a separate OK, per-package
-unknown-app permission and a confirmation-required PackageInstaller session.
-The bytes streamed into that session are checked again against the manifest length
-and hash; any mismatch abandons the session before commit and discards invalid Ready.
-Returning from permission settings requires another explicit Install press.
-Denial, cancellation and missing system handlers retain the verified download.
-No broad FileProvider, public Downloads write, silent install or automatic
-uninstall is involved. PackageManager is re-read on return; a successful callback
-is not proof that the running process is the new version. Real OEM confirmation,
-process replacement and retained-login acceptance remain device-walk gates.
-
-
-### Full-suite test diagnostics
-
-The Gradle daemon heap (`org.gradle.jvmargs` in `gradle.properties`) is separate
-from the forked test-worker heap. The default test worker uses 512 MiB; changing
-the daemon's `-Xmx` does not increase it. A larger worker heap did not resolve
-the person-picker fixture's missing Compose snapshot notifications.
-
-Gradle 9.8.2 runs previously failed test classes first on the next invocation.
-An immediate green `make test` rerun can therefore hide an order-sensitive
-failure rather than prove a fix. For comparisons, clear only generated binary
-test-result history (`build/test-results/<task>/binary` in each module) before
-each run and record actual class-start order; XML file listing order is not
-execution order. Keep worker heap and parallelism unchanged between samples.
-`PersonPickerSessionTest` must also pass late in the full app JVM, not just alone
-or promoted to the front by previous failures.
-
 ## Saved-person launch and DNS
 
 Launch restores an unprotected saved Jellyfin login from local storage before
@@ -246,22 +73,20 @@ wait for either response. The minified SDK log tag is not stable across builds.
 
 The `optimized` build type inherits `release`: R8 optimization/minification,
 resource shrinking, non-debuggable code, dependency consumer keep rules and
-dependency baseline profiles. Its package (`org.justinvisser.wolfskin.tv.opt`),
+dependency baseline profiles. It changes only signing (the Android debug key),
-launcher label (`Wolfskin (Opt)`) and persistent signer remain unchanged. It is
+package (`org.justinvisser.wolfskin.tv.opt`) and launcher label (`Wolfskin (Opt)`).
-the household release assembly, with plain versionName `1.1.1` and an explicit
+The launcher icon/banner and release-compatible version name are unchanged:
-monotonic versionCode; source commit identity is recorded separately.
+the shared upgrade/updater parser rejects extra suffixes such as `-opt`.
-`make apk` remains the old `org.justinvisser.wolfskin.tv` production assembly and
+`make apk` remains the clean, release-key-signed production build. Debug and
-release signer. It must never publish to the household channel.
+optimized containers share the persistent debug key described below; release
+signing is unchanged.
 
-For build-only diagnostics, build all four outputs through the container wrapper
+Build all four default-flavor outputs in one invocation through the container
-with a deliberately non-release code. **Direct optimized builds must never be
+wrapper, without a release keystore. On a host whose Gradle cache already holds
-installed on the household box or published.** Use `make tv-release` for every
+the pinned native extensions and their metadata:
-household installation. On a host whose Gradle cache already holds the pinned
-native extensions and their metadata:
 
 ```sh
 bash docker/gradle.sh optimized --offline \
-  -PtvVersion=1.1.1 -PtvVersionCode=1 \
   -PWholphinExtensionsUsername=JustinZeus \
   -PWholphinExtensionsPassword=unused \
   :app:assembleDefaultOptimized
@@ -274,8 +99,7 @@ through the existing `ORG_GRADLE_PROJECT_WholphinExtensionsUsername` and
 or securely seeded cached artifacts. No release signing inputs are needed.
 Without native extension configuration, the existing dependency selection uses
 the MPV stub and omits ffmpeg/AV1, just like `make apk-debug`; that is not a
-playback-complete comparison. Inspect native libraries for diagnostic evidence;
+playback-complete comparison. Inspect native libraries before installing.
-do not install these direct-build APKs on the household box.
 
 Outputs are in `app/build/outputs/apk/default/optimized/`: universal, arm64-v8a,
 armeabi-v7a and x86_64. Keep
@@ -345,15 +169,6 @@ not the working tree. An uncommitted merge still builds with the old version nam
 Neither an upstream merge nor its validation build authorizes a release or TV
 installation.
 
-## Upstream v1.1.1 integration
-
-The patch release makes manual Seerr setup available when the optional companion
-plugin is absent: setup is marked ready immediately rather than remaining pending.
-With the plugin installed, an empty settings response or a failed settings read
-still reaches the existing ready-state fallback; plugin URL prefill is unchanged.
-There are no new Room migrations (schema remains 41), player, layout, session,
-DNS/client, dependency, branding or signing changes relative to v1.1.0.
-
 ## Wolfskin shell
 
 Wolfskin UI lives in `app/src/wolfskin/java`, beside upstream source. The signed-in
@@ -689,9 +504,9 @@ Down clamps a short final title row before entering the separate Try again / Sho
 more row; an empty slot cannot activate recovery. An unavailable library hides
 its unknown item count.
 
-Library titles and compact subtitles remain visible at rest, with one-line,
+Caption separators use 40% of the existing muted colour's alpha. The rail follows
-card-width ellipsis rather than a 640 px focused caption. The letter rail uses
+the locked prototype CSS: bold 24 px letters, with the focused letter bold 28 px,
-bold 24 px letters, with the focused letter bold 28 px.
+overriding the spec table's generic caption style for this component.
 Library and Settings header initials use the muted colour over the person's fill;
 navigation and picker avatars retain their dark initials.
 
@@ -735,35 +550,12 @@ Title shelves reserve vertical drawing room for the scaled ring.
 Before scaling the stroke, ring-to-neighbour clearances round to 28/22/16 px
 for poster/tile/wide cards; including stroke scale they are 27.6/21.8/16.1 px.
 
-Cards use the approved option-B bottom state line instead of a separate inset
+Poster progress uses the independent 18 px title-card inset, not caption spacing:
-resume bar: watched is 3 px accent; resume is 6 px proportional accent over
+the track remains 220 px wide on a 256 px poster. Library focus-follow restarts
-`color.progressTrack`; unwatched and Discover have no line. Opaque background
+when the effective column count, focused row or header geometry changes, retaining
-backs the entire strip, including its bottom 2 px and the 2 px separator above
+deep focus across live snapshots that add or remove the letter rail.
-the fill. Artwork is clipped out of the backing band before painting it so
+`LibrarySpacingRegressionTest` renders both progress geometry and the unchanged
-rounded-corner antialiasing cannot leak poster pixels into the lowest row.
+focused index across the 199↔200-title boundary.
-The separately drawn focus ring stays above the line.
-
-Film subtitles are year + duration + a 24 px watched check, episode subtitles
-are their own duration + check, and series subtitles are year + check with no
-single runtime. Resuming cards have no check. The poster caption band remains
-96 px; Home poster captions are focus-only. Home landscapes retain titles on
-the art and reserve 64 px for focused metadata below it, making wide/tile shelf
-pitches 522/441 px; poster shelves remain 632 px and grids remain 524 px.
-Loading rows reserve the same blank caption bands and share one pulse layer;
-only art-sized blocks are painted, with no title/subtitle placeholder pills.
-
-`CardBottomPixelTest` samples full native bottom rows on four real posters at
-rest and individually focused, including white Annie Hall and dark Locke.
-`CardGeometryTest` measures 210/327 px caption fitting, card-width titles,
-24 px checks, row pitches, pinned rows and ring clearances to 0.1 px, and checks
-that every reserved loading-caption pixel remains background-coloured.
-`CardCaptionMotionTest` checks visible native glyph pixels when a still-focused
-caption changes title directly or while moving across a Home shelf.
-The [native option-B proof gallery](https://pages.justinvisser.org/wolfskin/tv-card-meta-build/)
-contains the same illustrative watch-state data as the approved frames and
-records renderer/fixture artifacts; unapproved design changes block merge.
-`LibrarySpacingRegressionTest` retains the deep focused index across the
-199↔200-title letter-rail boundary.
 
 `LibraryCaptureTest.spacingShowsFirstFocused`,
 `HomeCaptureTest.spacingNextUpFirstFocused` and
@@ -820,29 +612,15 @@ retain the approved frames except for the requested feedback changes:
 - Every Discover heading uses a 104 px band, including a 60 px title-to-card
   gap. Home heading geometry is unchanged.
 - Hero/backdrop decoding is bounded to 1920×1080; upright hero sheets request
-  420×630. The shared request builder replaces conflicting Jellyfin size/encoding
+  420×630. The shared request builder removes conflicting Jellyfin size caps,
-  parameters: cards use WebP quality 80, while hero backdrops/sheets retain JPEG
+  preserves tags and quality 96, and selects a suitable TMDB tier. The 64 MiB
-  quality 96. Poster/tile/wide/episode requests are 256×384, 400×225, 544×306 and
+  memory cache, 128 MiB disk cache and four image-read limit remain unchanged.
-  400×280; Jellyfin fill preserves aspect ratio before the UI crops. Tags and
-  authentication query parameters remain intact. TMDB uses w342 for posters and
-  portraits, w780 for landscape cards and w1280 for hero backdrops, never original.
-  Lossy WebP decoding is guaranteed below minSdk 23; API 28+ additionally checks
-  decoder support and requests JPEG if WebP is unavailable. The 64 MiB memory
-  cache, 128 MiB disk cache and four image-read limit remain unchanged.
 
 `HomeViewportTest` covers short/long poster, tile and wide rows, both row
 directions, first focus and native Back from the actual title surface. Native
 proof records real Bear season-three metadata through the title read facade;
 the proof-only harness is not part of the shipped tests or APK.
 
-Episode lists request only ProviderIds and Overview. Next up reads only identity,
-then hydrates the selected playback target through the existing single-item read,
-including when Next up is empty. Media sources/streams and cast remain on detail
-reads for header track/version controls. Performer credits omit media sources,
-streams and ParentId but retain People because their cards show character roles.
-Movies/Shows grids retain ProviderIds and DateCreated; server-side SortName
-ordering does not require returning SortName on every item.
-
 
 ## Title pages and people
 
@@ -1118,12 +896,14 @@ Jellyfin read by the selected person's saved Jellyfin user ID, so a lost
 Conductarr operator or a renamed household profile does not hide that user's
 own library. A different saved user ID still fails closed.
 
-`make test` keeps the native capture checks for rendered font sizes and visible
+`make test` runs `OwnedSourceAuditTest` through the design module's JVM suite.
-surface behavior, plus generated-token drift checks. Styling uses generated
+It scans the owned Kotlin sources in `wolfskin-design/src/main/java` and
-tokens rather than raw dimensions. The source-regex wording/style audit was
+`app/src/wolfskin`, rejecting untokened `.dp`/`.sp` conversions and numeric Color
-removed: source spelling is not a consumer-visible behavior contract.
+constructors outside generated tokens, token font sizes below 12 sp, raw
-`LibraryProgressiveSurfaceTest` captures the usable first chunk while the final
+household library labels, and page-counter/navigation wording. Its negative
-read is still suspended.
+cases plant each violation independently. Existing native capture checks also
+verify rendered font sizes and wording. `LibraryProgressiveSurfaceTest` captures
+the usable first chunk while the final read is still suspended.
 
 ## Toolchain and disk use
 
@@ -1170,46 +950,23 @@ the checkout when building on another host, for example:
 WOLFSKIN_DEBUG_KEYSTORE="$HOME/.local/share/wolfskin-signing/debug.keystore" make apk-debug
 ```
 
-For ordinary debug builds only, the wrapper creates a missing key once using
+The wrapper creates a missing key once using the build image's `keytool`: RSA
-the build image's `keytool`: RSA 2048, 10,000-day validity, alias
+2048, 10,000-day validity, alias `androiddebugkey`, store/key passwords `android`,
-`androiddebugkey`, store/key passwords `android`, subject `CN=Android Debug`.
+and subject `CN=Android Debug`. The containing directory is mode `0700`, the
-Household and optimized modes require the existing key and refuse generation.
+file mode `0600`. Existing keys are reused, never regenerated; generation errors
-The directory is mode `0700`, the file mode `0600`; existing keys are reused.
+abort the build rather than falling back to an ephemeral container key.
-Generation errors abort rather than falling back to an ephemeral container key.
 The file is bind-mounted read-only at `/tmp/.android/debug.keystore`, with
 `ANDROID_USER_HOME=/tmp/.android`, for every non-release Gradle container.
 Keep and back up this file across clean builds, disposable worktrees, container
 rebuilds and Gradle cache resets. Never commit it. The standard debug passwords
-are public; the private key is nevertheless the permanent household signing
+are public; this key is for local debug/optimized builds, not release signing.
-authority. It is distinct from the old production package's release signer.
 
-### Preserve household TV data
+**One-time reinstall:** the first build with the stable key still needs one
-
+uninstall+reinstall on the box because the signer changes once; later ones
-Normal household updates use the in-app verified download and explicit Android
+install in place with `adb install -r`, retaining sign-ins and settings.
-confirmation, preserving the same package and persistent signer. A separately
+The initial uninstall removes app data, so sign in again once after that switch.
-authorized bootstrap may use operator `adb install -r`; that is not a substitute
+Deleting/replacing the persistent key or choosing a different override changes
-for the in-app update acceptance walk. The certificate SHA-256 is:
+the signer again and requires another reinstall.
-
-```text
-182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d
-```
-
-Never run `adb uninstall`, `pm uninstall` or `pm clear`, or switch signers on
-the household box: clearing/removing the app deletes saved people, sign-ins
-and settings, and a different signer cannot update the existing app in place.
-Do not delete or replace the persistent key. If an uninstall is unavoidable,
-use `adb uninstall -k <package>` to keep app data, then reinstall the same
-package with the same signer.
-
-The manifest sets `android:hasFragileUserData="true"` so Android 10+ can offer
-a **keep app data** choice during interactive uninstall. Choose it when
-available; older Android versions ignore the attribute. This is a retention
-prompt, not an automatic backup or a guarantee against data clearing.
-
-An operator can compare `dumpsys package <pkg>` before and after an in-place
-update: `firstInstallTime` must remain unchanged. The in-app service checks
-package, current signer, checksum and higher code; real-device timestamp and
-retained-login proof remain a separate operator walk, not a JVM-test claim.
 
 
 ## Release credentials

docker/gradle.sh

@@ -45,10 +45,6 @@ else
     signing_directory=$(dirname "$debug_keystore")
     mkdir -p "$signing_directory"
     chmod 700 "$signing_directory"
-    if [[ ( $mode == household || $mode == optimized ) && ! -s $debug_keystore ]]; then
-        printf 'Household signing key is required; refusing to generate an identity\n' >&2
-        exit 1
-    fi
     if [[ ! -e $debug_keystore ]]; then
         temporary_directory=$(mktemp -d "$signing_directory/.debug-keystore.XXXXXX")
         trap 'rm -rf -- "$temporary_directory"' EXIT
@@ -70,15 +66,5 @@ else
     chmod 600 "$debug_keystore"
     arguments+=(--env ANDROID_USER_HOME=/tmp/.android
         --mount "type=bind,src=$debug_keystore,dst=/tmp/.android/debug.keystore,readonly")
-    if [[ $mode == household ]]; then
-        [[ -s $secrets/github-packages-token ]] || { printf 'Missing native package credential\n' >&2; exit 1; }
-        arguments+=(--mount "type=bind,src=$secrets/github-packages-token,dst=/run/native-token,readonly")
-        docker run "${arguments[@]}" "$image" bash -euc '
-            export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
-            export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/native-token)
-            exec ./gradlew "$@"
-        ' bash "${gradle_arguments[@]}" "$@"
-    else
     docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
-    fi
 fi

docker/test_tv_publish.py

@@ -1,371 +0,0 @@
-"""Exercise the release CLI against a local Forgejo-shaped HTTP server."""
-
-import email.parser
-import email.policy
-import hashlib
-import json
-import os
-import subprocess
-import sys
-import tempfile
-import threading
-import unittest
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-from typing import Any
-from unittest.mock import patch
-
-from tv_publish import REQUIRED, Forge
-from tv_release import PACKAGE, SIGNER
-
-
-class FakeForge:
-    """Draft assets require authentication; anonymous reads work only after promotion."""
-
-    def __init__(self) -> None:
-        self.release: dict[str, Any] = {}
-        self.assets: dict[str, bytes] = {}
-        self.events: list[tuple[str, bool]] = []
-        self.corrupt_draft = False
-        self.corrupt_public = False
-        self.redirect_url: str | None = None
-        self.published_code: int | None = None
-        self.channel_manifest: dict[str, Any] = {}
-        self.latest_status = 200
-        self.release_list: list[dict[str, Any]] = []
-        self.latest_reads = 0
-        self.advance_before_promote: int | None = None
-        fixture = self
-
-        class Handler(BaseHTTPRequestHandler):
-            def log_message(self, format: str, *args: Any) -> None:
-                pass
-
-            def respond(self, value: Any, code: int = 200) -> None:
-                data = value if isinstance(value, bytes) else json.dumps(value).encode()
-                self.send_response(code)
-                self.send_header("Content-Length", str(len(data)))
-                self.end_headers()
-                self.wfile.write(data)
-
-            def do_POST(self) -> None:
-                authenticated = bool(self.headers.get("Authorization"))
-                fixture.events.append(("POST " + self.path, authenticated))
-                if not authenticated:
-                    self.respond({}, 401)
-                    return
-                data = self.rfile.read(int(self.headers["Content-Length"]))
-                if self.path.endswith("/releases"):
-                    fixture.release = json.loads(data) | {"id": 17, "assets": []}
-                    self.respond(fixture.release)
-                else:
-                    name = urllib.parse.parse_qs(
-                        urllib.parse.urlsplit(self.path).query
-                    )["name"][0]
-                    message = email.parser.BytesParser(
-                        policy=email.policy.default
-                    ).parsebytes(
-                        b"Content-Type: "
-                        + self.headers["Content-Type"].encode()
-                        + b"\r\n\r\n"
-                        + data
-                    )
-                    fixture.assets[name] = next(message.iter_parts()).get_payload(
-                        decode=True
-                    )
-                    asset = {
-                        "name": name,
-                        "browser_download_url": fixture.base + "/assets/" + name,
-                        "size": len(fixture.assets[name]),
-                    }
-                    fixture.release["assets"].append(asset)
-                    self.respond(asset)
-
-            def do_PATCH(self) -> None:
-                fixture.events.append(
-                    ("PATCH", bool(self.headers.get("Authorization")))
-                )
-                fixture.release.update(
-                    json.loads(self.rfile.read(int(self.headers["Content-Length"])))
-                )
-                self.respond(fixture.release)
-
-            def do_GET(self) -> None:
-                authenticated = bool(self.headers.get("Authorization"))
-                fixture.events.append(("GET " + self.path, authenticated))
-                if fixture.redirect_url:
-                    self.send_response(302)
-                    self.send_header("Location", fixture.redirect_url)
-                    self.end_headers()
-                    return
-                if self.path.startswith("/assets/"):
-                    if fixture.release["draft"] and not authenticated:
-                        self.respond({}, 404)
-                        return
-                    data = fixture.assets[self.path.removeprefix("/assets/")]
-                    corrupt = (
-                        fixture.corrupt_draft
-                        if fixture.release["draft"]
-                        else fixture.corrupt_public
-                    )
-                    self.respond(data + b"corrupt" if corrupt else data)
-                elif self.path == "/channel/wolfskin-update.json":
-                    self.respond(
-                        fixture.channel_manifest
-                        | {"versionCode": fixture.published_code}
-                    )
-                elif self.path.endswith("/latest"):
-                    fixture.latest_reads += 1
-                    if (
-                        fixture.latest_reads == 2
-                        and fixture.advance_before_promote is not None
-                    ):
-                        fixture.published_code = fixture.advance_before_promote
-                    if fixture.latest_status != 200:
-                        self.respond({}, fixture.latest_status)
-                    elif fixture.release and not fixture.release["draft"]:
-                        self.respond(fixture.release)
-                    elif fixture.published_code is not None:
-                        self.respond(
-                            {
-                                "id": 9,
-                                "assets": [
-                                    {
-                                        "name": "wolfskin-update.json",
-                                        "browser_download_url": fixture.base
-                                        + "/channel/wolfskin-update.json",
-                                    }
-                                ],
-                            }
-                        )
-                    else:
-                        self.respond({}, 404)
-                elif urllib.parse.urlsplit(self.path).path.endswith("/releases"):
-                    self.respond(fixture.release_list)
-                else:
-                    self.respond(fixture.release)
-
-        self.server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
-        self.base = f"http://127.0.0.1:{self.server.server_port}"
-        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
-        self.thread.start()
-
-    def close(self) -> None:
-        """Release fixture resources after each independent publication scenario."""
-        self.server.shutdown()
-        self.server.server_close()
-        self.thread.join()
-
-
-class PublishTest(unittest.TestCase):
-    """Permanent tests assert safety transitions and real uploaded bytes, not script wording."""
-
-    def setUp(self) -> None:
-        self.temporary = tempfile.TemporaryDirectory()
-        self.directory = Path(self.temporary.name)
-        self.forge = FakeForge()
-        self.addCleanup(self.forge.close)
-        self.addCleanup(self.temporary.cleanup)
-        assets = []
-        for abi in ("armeabi-v7a", "arm64-v8a", "x86_64", "universal"):
-            name = "Wolfskin.apk" if abi == "universal" else f"Wolfskin-{abi}.apk"
-            data = f"fixture APK bytes for {abi}".encode()
-            (self.directory / name).write_bytes(data)
-            assets.append(
-                {
-                    "name": name,
-                    "abi": abi,
-                    "bytes": len(data),
-                    "sha256": hashlib.sha256(data).hexdigest(),
-                    "minSdk": 23,
-                }
-            )
-        manifest = {
-            "schemaVersion": 1,
-            "packageId": PACKAGE,
-            "versionName": "1.1.1",
-            "versionCode": 100001,
-            "publishedAt": "2026-11-07T12:00:00Z",
-            "sourceCommit": "a" * 40,
-            "sourceTag": "pwolfskin-opt-v1.1.1",
-            "signerSha256": SIGNER,
-            "assets": assets,
-        }
-        self.forge.channel_manifest = manifest
-        (self.directory / "wolfskin-update.json").write_text(json.dumps(manifest))
-        (self.directory / "RELEASE-NOTES.md").write_text("Fixture release notes")
-        self.checksums()
-
-    def checksums(self) -> None:
-        """Hash fixture files after deliberately constructing or mutating the bundle."""
-        (self.directory / "SHA256SUMS").write_text(
-            "".join(
-                f"{hashlib.sha256((self.directory / name).read_bytes()).hexdigest()}  {name}\n"
-                for name in sorted(REQUIRED - {"SHA256SUMS"})
-            )
-        )
-
-    def cli(self, *flags: str) -> subprocess.CompletedProcess[str]:
-        """Drive the real CLI and real git credential-helper protocol with a fake credential."""
-        environment = os.environ | {
-            "GIT_CONFIG_COUNT": "2",
-            "GIT_CONFIG_KEY_0": "credential.helper",
-            "GIT_CONFIG_VALUE_0": "",
-            "GIT_CONFIG_KEY_1": "credential.helper",
-            "GIT_CONFIG_VALUE_1": "!printf 'username=fixture\npassword=fixture-secret\n'",
-        }
-        result = subprocess.run(
-            [
-                sys.executable,
-                str(Path(__file__).with_name("tv_publish.py")),
-                "--directory",
-                str(self.directory),
-                "--test-server",
-                self.forge.base,
-                *flags,
-            ],
-            capture_output=True,
-            text=True,
-            env=environment,
-            timeout=30,
-            check=False,
-        )
-        self.assertNotIn("fixture-secret", result.stdout + result.stderr)
-        return result
-
-    def test_dry_run_never_requests_or_fetches_credentials(self) -> None:
-        result = self.cli("--dry-run", "--promote")
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertEqual([], self.forge.events)
-
-    def test_draft_then_explicit_promotion_reverifies_all_bytes(self) -> None:
-        result = self.cli()
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertTrue(self.forge.release["draft"])
-        self.assertEqual(REQUIRED, set(self.forge.assets))
-        self.assertTrue(
-            all(
-                not auth
-                for path, auth in self.forge.events
-                if "/latest" in path or "?limit=" in path
-            )
-        )
-        result = self.cli("--draft-id", "17", "--promote")
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertFalse(self.forge.release["draft"])
-        for name, data in self.forge.assets.items():
-            self.assertEqual((self.directory / name).read_bytes(), data)
-
-    def test_corrupt_uploaded_bytes_remain_draft(self) -> None:
-        self.forge.corrupt_draft = True
-        result = self.cli("--promote")
-        self.assertNotEqual(0, result.returncode)
-        self.assertTrue(self.forge.release["draft"])
-        self.assertFalse(any(event == "PATCH" for event, _ in self.forge.events))
-
-    def test_failed_anonymous_verification_withdraws_promoted_release(self) -> None:
-        self.forge.corrupt_public = True
-        result = self.cli("--promote")
-        self.assertNotEqual(0, result.returncode)
-        self.assertTrue(self.forge.release["draft"])
-        self.assertEqual(2, sum(event == "PATCH" for event, _ in self.forge.events))
-
-    def test_invalid_local_checksum_never_creates_draft(self) -> None:
-        (self.directory / "Wolfskin.apk").write_bytes(b"tampered")
-        result = self.cli()
-        self.assertNotEqual(0, result.returncode)
-        self.assertEqual([], self.forge.events)
-
-    def test_manifest_size_mismatch_never_creates_draft(self) -> None:
-        path = self.directory / "wolfskin-update.json"
-        manifest = json.loads(path.read_text())
-        manifest["assets"][0]["bytes"] += 1
-        path.write_text(json.dumps(manifest))
-        self.checksums()
-        result = self.cli()
-        self.assertNotEqual(0, result.returncode)
-        self.assertEqual([], self.forge.events)
-
-    def test_empty_manifest_asset_set_never_creates_draft(self) -> None:
-        path = self.directory / "wolfskin-update.json"
-        manifest = json.loads(path.read_text())
-        manifest["assets"] = []
-        path.write_text(json.dumps(manifest))
-        self.checksums()
-        result = self.cli()
-        self.assertNotEqual(0, result.returncode)
-        self.assertEqual([], self.forge.events)
-
-    def test_credential_helper_tracing_is_disabled(self) -> None:
-        trace = self.directory / "credential.trace"
-        with patch.dict(os.environ, {"GIT_TRACE": str(trace)}):
-            result = self.cli()
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertFalse(trace.exists())
-
-    def test_equal_and_lower_bundle_codes_never_create_a_draft(self) -> None:
-        for published_code in (100001, 100002):
-            with self.subTest(published_code=published_code):
-                self.forge.published_code = published_code
-                result = self.cli("--promote")
-                self.assertNotEqual(0, result.returncode)
-                self.assertEqual({}, self.forge.release)
-        self.assertTrue(all(not auth for _, auth in self.forge.events))
-
-    def test_newer_bundle_reads_live_manifest_anonymously(self) -> None:
-        self.forge.published_code = 100000
-        result = self.cli()
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertTrue(self.forge.release["draft"])
-        live_reads = [
-            auth
-            for path, auth in self.forge.events
-            if path.endswith("/latest") or path.startswith("GET /channel/")
-        ]
-        self.assertTrue(live_reads)
-        self.assertFalse(any(live_reads))
-
-    def test_channel_advance_during_upload_prevents_promotion(self) -> None:
-        self.forge.advance_before_promote = 100001
-        result = self.cli("--promote")
-        self.assertNotEqual(0, result.returncode)
-        self.assertTrue(self.forge.release["draft"])
-        self.assertFalse(any(path == "PATCH" for path, _ in self.forge.events))
-
-    def test_empty_channel_404_permits_first_draft(self) -> None:
-        result = self.cli()
-        self.assertEqual(0, result.returncode, result.stderr)
-        self.assertTrue(self.forge.release["draft"])
-        self.assertIn(
-            (
-                "GET /api/v1/repos/justinzeus/wolfskin-tv-updates/releases?limit=1",
-                False,
-            ),
-            self.forge.events,
-        )
-
-    def test_missing_latest_with_nonempty_channel_is_not_first_release(self) -> None:
-        self.forge.release_list = [{"id": 9}]
-        result = self.cli()
-        self.assertNotEqual(0, result.returncode)
-        self.assertEqual({}, self.forge.release)
-
-    def test_refused_live_channel_never_creates_draft(self) -> None:
-        self.forge.latest_status = 403
-        result = self.cli()
-        self.assertNotEqual(0, result.returncode)
-        self.assertEqual({}, self.forge.release)
-
-    def test_authenticated_redirect_never_reaches_another_origin(self) -> None:
-        other = FakeForge()
-        self.addCleanup(other.close)
-        self.forge.redirect_url = other.base + "/asset"
-        forge = Forge(self.forge.base, "Basic fixture-authorization", test_server=True)
-        with self.assertRaises(ValueError):
-            forge.verify(self.forge.base + "/redirect", "0" * 64, authenticated=True)
-        self.assertEqual([], other.events)
-
-
-if __name__ == "__main__":
-    unittest.main()

docker/test_tv_release.py

@@ -1,159 +0,0 @@
-"""Exercise source cleanliness, monotonic codes and fail-closed signing prerequisites."""
-
-import contextlib
-import io
-import os
-import subprocess
-import tempfile
-import unittest
-from pathlib import Path
-from unittest.mock import patch
-
-import tv_release
-
-
-class ReleaseInputTest(unittest.TestCase):
-    """Use a disposable Git fixture, never a build or a real signing key."""
-
-    def setUp(self) -> None:
-        self.temporary = tempfile.TemporaryDirectory()
-        self.addCleanup(self.temporary.cleanup)
-        self.root = Path(self.temporary.name) / "source"
-        self.root.mkdir()
-        (self.root / "docker").mkdir()
-        (self.root / "docker/tv-version-codes").write_text("65 installed-opt\n")
-        self.git("init", "--quiet")
-        self.git("add", "docker/tv-version-codes")
-        self.git(
-            "-c",
-            "user.name=Fixture",
-            "-c",
-            "user.email=fixture@example.invalid",
-            "commit",
-            "--quiet",
-            "-m",
-            "Record used code",
-        )
-        self.remote = Path(self.temporary.name) / "origin.git"
-        subprocess.run(
-            ["git", "init", "--bare", "--quiet", str(self.remote)], check=True
-        )
-        self.git("remote", "add", "origin", str(self.remote))
-        self.git("push", "--quiet", "origin", "HEAD:main")
-        self.previous_root = tv_release.ROOT
-        tv_release.ROOT = self.root
-        self.addCleanup(setattr, tv_release, "ROOT", self.previous_root)
-
-    def git(self, *args: str) -> str:
-        """Run the isolated source fixture's actual Git commands."""
-        return subprocess.check_output(["git", *args], cwd=self.root, text=True).strip()
-
-    def test_new_code_identifies_clean_source(self) -> None:
-        self.assertEqual(
-            self.git("rev-parse", "HEAD"), tv_release.validate_inputs("1.1.1", 100001)
-        )
-
-    def test_reused_and_lower_codes_are_rejected(self) -> None:
-        for code in (1, 64, 65):
-            with self.subTest(code=code), self.assertRaises(ValueError):
-                tv_release.validate_inputs("1.1.1", code)
-
-    def test_dirty_source_is_rejected(self) -> None:
-        (self.root / "untracked").write_text("not part of the source commit")
-        with self.assertRaises(ValueError):
-            tv_release.validate_inputs("1.1.1", 100001)
-
-    def test_unparseable_version_and_invalid_codes_are_rejected(self) -> None:
-        for version, code in (
-            ("1.1.1-opt", 100001),
-            ("1.1.1", 0),
-            ("1.1.1", 2100000001),
-        ):
-            with (
-                self.subTest(version=version, code=code),
-                self.assertRaises(ValueError),
-            ):
-                tv_release.validate_inputs(version, code)
-
-    def test_missing_signing_key_never_generates_identity(self) -> None:
-        key = Path(self.temporary.name) / "absent-key"
-        with (
-            patch.dict(os.environ, {"WOLFSKIN_DEBUG_KEYSTORE": str(key)}),
-            self.assertRaises(ValueError),
-        ):
-            tv_release.release(
-                "1.1.1", 100001, Path(self.temporary.name) / "output", True
-            )
-        self.assertFalse(key.exists())
-
-    def test_dry_run_never_builds_tags_or_mutates_ledger(self) -> None:
-        key = Path(self.temporary.name) / "fixture-key-presence-only"
-        key.write_bytes(b"not an actual keystore; dry run must not open it")
-        output = Path(self.temporary.name) / "output"
-        with (
-            patch.dict(os.environ, {"WOLFSKIN_DEBUG_KEYSTORE": str(key)}),
-            contextlib.redirect_stdout(io.StringIO()),
-        ):
-            tv_release.release("1.1.1", 100001, output, True)
-        self.assertFalse(output.exists())
-        self.assertEqual("", self.git("tag", "--list"))
-        self.assertEqual(
-            "65 installed-opt\n", (self.root / "docker/tv-version-codes").read_text()
-        )
-        self.assertEqual(
-            "", self.git("for-each-ref", "refs/wolfskin-tv/version-codes/")
-        )
-
-    def test_stale_branch_uses_fetched_main_ledger(self) -> None:
-        stale = self.git("rev-parse", "HEAD")
-        (self.root / "docker/tv-version-codes").write_text(
-            "65 installed-opt\n100001 released\n"
-        )
-        self.git("add", "docker/tv-version-codes")
-        self.git(
-            "-c",
-            "user.name=Fixture",
-            "-c",
-            "user.email=fixture@example.invalid",
-            "commit",
-            "--quiet",
-            "-m",
-            "Reserve published code",
-        )
-        self.git("push", "--quiet", "origin", "HEAD:main")
-        self.git("checkout", "--quiet", "--detach", stale)
-        with self.assertRaises(ValueError):
-            tv_release.validate_inputs("1.1.2", 100001)
-        self.assertEqual(stale, tv_release.validate_inputs("1.1.2", 100002))
-
-    def test_discarding_ledger_append_cannot_reuse_reserved_code(self) -> None:
-        commit = self.git("rev-parse", "HEAD")
-        tv_release.reserve_code(100001, commit)
-        with (self.root / "docker/tv-version-codes").open("a") as ledger:
-            ledger.write("100001 1.1.1 consumed\n")
-        self.git("restore", "docker/tv-version-codes")
-        with self.assertRaises(ValueError):
-            tv_release.validate_inputs("1.1.2", 100001)
-        self.assertEqual(commit, tv_release.validate_inputs("1.1.2", 100002))
-
-    def test_head_reservation_wins_over_older_main(self) -> None:
-        (self.root / "docker/tv-version-codes").write_text(
-            "65 installed-opt\n100002 released\n"
-        )
-        self.git("add", "docker/tv-version-codes")
-        self.git(
-            "-c",
-            "user.name=Fixture",
-            "-c",
-            "user.email=fixture@example.invalid",
-            "commit",
-            "--quiet",
-            "-m",
-            "Reserve newer branch code",
-        )
-        with self.assertRaises(ValueError):
-            tv_release.validate_inputs("1.1.3", 100002)
-
-
-if __name__ == "__main__":
-    unittest.main()

docker/tv-version-codes

@@ -1,3 +0,0 @@
-# Household org.justinvisser.wolfskin.tv.opt codes already used.
-# Append successful tv-release codes; commit this ledger before another release.
-65 installed-opt

docker/tv_publish.py

@@ -1,413 +0,0 @@
-#!/usr/bin/env python3
-"""Upload a verified draft; promote only with explicit --promote owner approval."""
-
-import argparse
-import base64
-import datetime
-import hashlib
-import json
-import os
-import re
-import subprocess
-import urllib.error
-import urllib.parse
-import urllib.request
-import uuid
-from collections.abc import Iterable
-from pathlib import Path
-from typing import Any
-
-SERVER = "https://git.justinvisser.org"
-REPOSITORY = "justinzeus/wolfskin-tv-updates"
-REQUIRED = {
-    "Wolfskin-armeabi-v7a.apk",
-    "Wolfskin-arm64-v8a.apk",
-    "Wolfskin-x86_64.apk",
-    "Wolfskin.apk",
-    "wolfskin-update.json",
-    "RELEASE-NOTES.md",
-    "SHA256SUMS",
-}
-
-
-class ForgeHttpError(RuntimeError):
-    """Retain HTTP status without exposing response bodies or authorization."""
-
-    def __init__(self, method: str, status: int) -> None:
-        super().__init__(f"Forgejo {method} failed: HTTP {status}")
-        self.status = status
-
-
-class NoRedirect(urllib.request.HTTPRedirectHandler):
-    """Validate every redirect before forwarding distribution-tool credentials."""
-
-    def redirect_request(
-        self, req: Any, fp: Any, code: int, msg: str, headers: Any, newurl: str
-    ) -> None:
-        return None
-
-
-class Forge:
-    """Credential-scoped release API; credentials exist only in process memory."""
-
-    def __init__(
-        self, server: str, authorization: str, test_server: bool = False
-    ) -> None:
-        self.server = server.rstrip("/")
-        self.origin = urllib.parse.urlsplit(self.server)
-        self.authorization = authorization
-        self.test_server = test_server
-        self.opener = urllib.request.build_opener(NoRedirect)
-        self.api = self.server + "/api/v1/repos/" + REPOSITORY
-
-    def request(
-        self,
-        method: str,
-        url: str,
-        data: Any = None,
-        content_type: str | None = None,
-        length: int | None = None,
-        authenticated: bool = True,
-    ) -> Any:
-        """Reject cross-origin credential forwarding and non-HTTPS production URLs."""
-        for _ in range(6):
-            parsed = urllib.parse.urlsplit(url)
-            local = self.test_server and parsed.hostname in (
-                "localhost",
-                "127.0.0.1",
-                "::1",
-            )
-            if (
-                parsed.username
-                or parsed.password
-                or (parsed.scheme != "https" and not local)
-            ):
-                raise ValueError(
-                    "Distribution requests require credential-free HTTPS URLs"
-                )
-            if authenticated and (parsed.scheme, parsed.netloc) != (
-                self.origin.scheme,
-                self.origin.netloc,
-            ):
-                raise ValueError(
-                    "Refusing to send release credentials to another origin"
-                )
-            headers = {"Accept": "application/json"}
-            if authenticated:
-                headers["Authorization"] = self.authorization
-            if content_type:
-                headers["Content-Type"] = content_type
-            if length is not None:
-                headers["Content-Length"] = str(length)
-            request = urllib.request.Request(
-                url, data=data, method=method, headers=headers
-            )
-            try:
-                return self.opener.open(request, timeout=60)
-            except urllib.error.HTTPError as error:
-                if method != "GET" or error.code not in (301, 302, 303, 307, 308):
-                    status = error.code
-                    error.close()
-                    raise ForgeHttpError(method, status) from None
-                location = error.headers.get("Location")
-                error.close()
-                if not location:
-                    raise ValueError("Forgejo redirect has no location")
-                url = urllib.parse.urljoin(url, location)
-        raise ValueError("Too many Forgejo redirects")
-
-    def json(
-        self,
-        method: str,
-        path: str,
-        value: dict[str, Any] | None = None,
-        authenticated: bool = True,
-    ) -> Any:
-        """Read or mutate release metadata without exposing HTTP authorization."""
-        data = None if value is None else json.dumps(value).encode()
-        with self.request(
-            method,
-            self.api + path,
-            data,
-            "application/json",
-            authenticated=authenticated,
-        ) as response:
-            return json.load(response)
-
-    def upload(self, release_id: int, file: Path) -> dict[str, Any]:
-        """Stream multipart APK bytes instead of copying a universal APK into memory."""
-        boundary = uuid.uuid4().hex
-        prefix = (
-            f'--{boundary}\r\nContent-Disposition: form-data; name="attachment"; filename="{file.name}"\r\n'
-            "Content-Type: application/octet-stream\r\n\r\n"
-        ).encode()
-        suffix = f"\r\n--{boundary}--\r\n".encode()
-
-        def chunks() -> Iterable[bytes]:
-            yield prefix
-            with file.open("rb") as stream:
-                while chunk := stream.read(1024 * 1024):
-                    yield chunk
-            yield suffix
-
-        url = f"{self.api}/releases/{release_id}/assets?name={urllib.parse.quote(file.name)}"
-        with self.request(
-            "POST",
-            url,
-            chunks(),
-            f"multipart/form-data; boundary={boundary}",
-            len(prefix) + file.stat().st_size + len(suffix),
-        ) as response:
-            return json.load(response)
-
-    def verify(self, url: str, expected: str, authenticated: bool) -> None:
-        """Verify bytes fetched from Forgejo, not only its declared asset size."""
-        with self.request("GET", url, authenticated=authenticated) as response:
-            actual = hashlib.file_digest(response, "sha256").hexdigest()
-        if actual != expected:
-            raise ValueError("Uploaded artifact checksum mismatch")
-
-    def require_newer_code(self, code: int) -> None:
-        """Read the public channel anonymously and fail closed on an uncertain floor."""
-        try:
-            release = self.json("GET", "/releases/latest", authenticated=False)
-        except ForgeHttpError as error:
-            if error.status != 404:
-                raise
-            releases = self.json("GET", "/releases?limit=1", authenticated=False)
-            if releases == []:
-                return
-            raise ValueError("Latest is missing but the channel is not empty") from None
-        assets = [
-            asset
-            for asset in release["assets"]
-            if asset["name"] == "wolfskin-update.json"
-        ]
-        if len(assets) != 1:
-            raise ValueError("Latest release must have exactly one update manifest")
-        with self.request(
-            "GET", assets[0]["browser_download_url"], authenticated=False
-        ) as response:
-            manifest = json.load(response)
-        latest_code = manifest["versionCode"]
-        if (
-            manifest["schemaVersion"] != 1
-            or manifest["packageId"] != "org.justinvisser.wolfskin.tv.opt"
-            or type(latest_code) is not int
-            or not 1 <= latest_code <= 2100000000
-        ):
-            raise ValueError("Invalid live household version identity")
-        if code <= latest_code:
-            raise ValueError(
-                f"Bundle versionCode must exceed live channel code {latest_code}"
-            )
-
-
-def credential(server: str) -> str:
-    """Read git's existing credential helper without secrets in argv, stdout or disk."""
-    parsed = urllib.parse.urlsplit(server)
-    environment = {
-        name: value
-        for name, value in os.environ.items()
-        if not name.startswith("GIT_TRACE")
-        and name not in {"GIT_CURL_VERBOSE", "SHELLOPTS", "BASHOPTS", "BASH_ENV", "ENV"}
-    }
-    environment["GIT_TERMINAL_PROMPT"] = "0"
-    result = subprocess.run(
-        ["git", "credential", "fill"],
-        input=f"protocol={parsed.scheme}\nhost={parsed.netloc}\n\n",
-        text=True,
-        capture_output=True,
-        check=False,
-        env=environment,
-    )
-    if result.returncode:
-        raise RuntimeError("Git credential helper failed; no release created")
-    fields = dict(
-        line.split("=", 1) for line in result.stdout.splitlines() if "=" in line
-    )
-    if not fields.get("password"):
-        raise ValueError("Git credential helper returned no release credential")
-    encoded = base64.b64encode(
-        f"{fields.get('username', '')}:{fields['password']}".encode()
-    ).decode()
-    return "Basic " + encoded
-
-
-def validate_bundle(directory: Path) -> tuple[dict[str, Any], dict[str, str]]:
-    """Require every public asset and verify the local final-byte checksum set."""
-    for name in REQUIRED:
-        if not (directory / name).is_file():
-            raise ValueError(f"Required release asset missing: {name}")
-    hashes: dict[str, str] = {}
-    for line in (directory / "SHA256SUMS").read_text().splitlines():
-        match = re.fullmatch(r"([0-9a-f]{64})  ([A-Za-z0-9_.-]+)", line)
-        if match is None or match[2] in hashes:
-            raise ValueError("Invalid or duplicate SHA256SUMS entry")
-        hashes[match[2]] = match[1]
-    if set(hashes) != REQUIRED - {"SHA256SUMS"}:
-        raise ValueError("Checksum set must cover exactly the public artifacts")
-    for name, expected in hashes.items():
-        with (directory / name).open("rb") as stream:
-            if hashlib.file_digest(stream, "sha256").hexdigest() != expected:
-                raise ValueError(f"Local checksum mismatch: {name}")
-    hashes["SHA256SUMS"] = hashlib.sha256(
-        (directory / "SHA256SUMS").read_bytes()
-    ).hexdigest()
-    manifest = json.loads((directory / "wolfskin-update.json").read_text())
-    if (
-        manifest["schemaVersion"] != 1
-        or manifest["packageId"] != "org.justinvisser.wolfskin.tv.opt"
-    ):
-        raise ValueError("Wrong household manifest identity")
-    if (
-        manifest["signerSha256"]
-        != "182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d"
-    ):
-        raise ValueError("Wrong household signing authority")
-    version = manifest["versionName"]
-    code = manifest["versionCode"]
-    if (
-        not re.fullmatch(r"\d+\.\d+\.\d+", version)
-        or type(code) is not int
-        or not 1 <= code <= 2100000000
-    ):
-        raise ValueError("Invalid household version identity")
-    if (
-        not re.fullmatch(r"[0-9a-f]{40}", manifest["sourceCommit"])
-        or manifest["sourceTag"] != f"pwolfskin-opt-v{version}"
-    ):
-        raise ValueError("Invalid immutable source identity")
-    published = datetime.datetime.fromisoformat(
-        manifest["publishedAt"].replace("Z", "+00:00")
-    )
-    if published.utcoffset() is None:
-        raise ValueError("Publication time must include a timezone")
-    expected_abis = {"armeabi-v7a", "arm64-v8a", "x86_64", "universal"}
-    if (
-        len(manifest["assets"]) != 4
-        or {asset["abi"] for asset in manifest["assets"]} != expected_abis
-    ):
-        raise ValueError("Manifest must describe all four standalone APKs")
-    for asset in manifest["assets"]:
-        expected_name = (
-            "Wolfskin.apk"
-            if asset["abi"] == "universal"
-            else f"Wolfskin-{asset['abi']}.apk"
-        )
-        if asset["name"] != expected_name or asset["minSdk"] < 23:
-            raise ValueError("Invalid APK asset identity or minimum SDK")
-        path = directory / asset["name"]
-        if (
-            hashes.get(path.name) != asset["sha256"]
-            or path.stat().st_size != asset["bytes"]
-        ):
-            raise ValueError("Manifest does not match final APK bytes")
-    return manifest, hashes
-
-
-def publish(
-    directory: Path,
-    server: str,
-    promote: bool,
-    dry_run: bool,
-    test_server: bool = False,
-    draft_id: int | None = None,
-) -> None:
-    """Keep incomplete uploads draft; withdraw a failed promoted release from latest."""
-    manifest, hashes = validate_bundle(directory)
-    version = manifest["versionName"]
-    tag = f"wolfskin-opt-v{version}"
-    if dry_run:
-        print(
-            f"Dry run: draft {REPOSITORY} {tag}; upload and verify {len(hashes)} assets; promote={promote}; no requests or credentials"
-        )
-        return
-    Forge(server, "", test_server).require_newer_code(manifest["versionCode"])
-    forge = Forge(server, credential(server), test_server)
-    if draft_id is None:
-        release = forge.json(
-            "POST",
-            "/releases",
-            {
-                "name": f"v{version}",
-                "tag_name": tag,
-                "body": (directory / "RELEASE-NOTES.md").read_text(),
-                "draft": True,
-                "prerelease": False,
-            },
-        )
-    else:
-        release = forge.json("GET", f"/releases/{draft_id}")
-        if not release["draft"] or release["tag_name"] != tag:
-            raise ValueError("Resume target must be the matching draft release")
-    release_id = release["id"]
-    existing = {asset["name"]: asset for asset in release.get("assets", [])}
-    print(
-        f"Verifying draft release {release_id}; it stays draft on any verification failure"
-    )
-    uploaded: dict[str, str] = {}
-    for name, expected in hashes.items():
-        asset = existing.get(name) or forge.upload(release_id, directory / name)
-        url = asset["browser_download_url"]
-        forge.verify(url, expected, authenticated=True)
-        uploaded[name] = url
-    if not promote:
-        print(
-            "Draft upload verified. Publication requires owner approval and explicit --promote."
-        )
-        return
-    forge.require_newer_code(manifest["versionCode"])
-    try:
-        forge.json("PATCH", f"/releases/{release_id}", {"draft": False})
-        latest = forge.json("GET", "/releases/latest", authenticated=False)
-        if latest["id"] != release_id or latest["tag_name"] != tag:
-            raise ValueError("Anonymous latest does not identify the promoted release")
-        for name, url in uploaded.items():
-            forge.verify(url, hashes[name], authenticated=False)
-    except (ValueError, RuntimeError, OSError, KeyError, TypeError):
-        try:
-            forge.json("PATCH", f"/releases/{release_id}", {"draft": True})
-        except (ValueError, RuntimeError, OSError):
-            raise RuntimeError(
-                "Post-publication verification AND withdrawal failed; release may remain public"
-            ) from None
-        raise RuntimeError(
-            "Post-publication verification failed; release withdrawn to draft"
-        ) from None
-    print(f"Published and anonymously verified {tag}")
-
-
-def main() -> None:
-    """Expose a deliberately separate publication command."""
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--directory", required=True, type=Path)
-    parser.add_argument("--promote", action="store_true")
-    parser.add_argument("--dry-run", action="store_true")
-    parser.add_argument(
-        "--draft-id", type=int, help="Resume and reverify an existing matching draft"
-    )
-    parser.add_argument(
-        "--test-server", help="Local fake Forgejo only; HTTP loopback permitted"
-    )
-    args = parser.parse_args()
-    if args.test_server:
-        parsed = urllib.parse.urlsplit(args.test_server)
-        if parsed.scheme != "http" or parsed.hostname not in (
-            "localhost",
-            "127.0.0.1",
-            "::1",
-        ):
-            parser.error("--test-server is restricted to an HTTP loopback fixture")
-    publish(
-        args.directory.resolve(),
-        args.test_server or SERVER,
-        args.promote,
-        args.dry_run,
-        bool(args.test_server),
-        args.draft_id,
-    )
-
-
-if __name__ == "__main__":
-    main()

docker/tv_release.py

@@ -1,254 +0,0 @@
-#!/usr/bin/env python3
-"""Build and inspect the household assembly without creating a signing identity."""
-
-import argparse
-import datetime
-import hashlib
-import json
-import os
-import re
-import shutil
-import subprocess
-import zipfile
-from pathlib import Path
-
-PACKAGE = "org.justinvisser.wolfskin.tv.opt"
-SIGNER = "182bac72e292b9ea4d3d4e6383f92eb2161fa28ba5afcff0337cb7d5a9d5341d"
-ABIS = ("armeabi-v7a", "arm64-v8a", "x86_64", "universal")
-ROOT = Path(__file__).resolve().parent.parent
-
-
-def run(*arguments: str) -> str:
-    """Run a checked command whose arguments contain no credentials."""
-    return subprocess.check_output(arguments, cwd=ROOT, text=True).strip()
-
-
-def digest(path: Path) -> str:
-    """Hash final artifact bytes without loading an APK into memory."""
-    with path.open("rb") as stream:
-        return hashlib.file_digest(stream, "sha256").hexdigest()
-
-
-def validate_inputs(version: str, code: int) -> str:
-    """Require a clean immutable source and a code newer than the tracked history."""
-    if not re.fullmatch(r"\d+\.\d+\.\d+", version) or not 1 <= code <= 2100000000:
-        raise ValueError("Supply a plain VERSION and a positive Android VERSION_CODE")
-    if run("git", "status", "--porcelain"):
-        raise ValueError(
-            "Release source must be clean, including the version-code ledger"
-        )
-    commit = run("git", "rev-parse", "HEAD")
-    run(
-        "git",
-        "fetch",
-        "--no-tags",
-        "origin",
-        "refs/heads/main:refs/remotes/origin/main",
-    )
-    used = []
-    for reference in (commit, "refs/remotes/origin/main"):
-        if run("git", "ls-tree", "--name-only", reference, "docker/tv-version-codes"):
-            ledger = run("git", "show", f"{reference}:docker/tv-version-codes")
-            used.extend(
-                int(line.split()[0])
-                for line in ledger.splitlines()
-                if line and not line.startswith("#")
-            )
-    reservations = run(
-        "git",
-        "for-each-ref",
-        "--format=%(refname:strip=3)",
-        "refs/wolfskin-tv/version-codes/",
-    )
-    used.extend(int(value) for value in reservations.splitlines())
-    if code <= max(used):
-        raise ValueError(f"VERSION_CODE must exceed reserved maximum {max(used)}")
-    if list((ROOT / "app/libs").glob("*.aar")):
-        raise ValueError("Local AAR overrides are forbidden for household releases")
-    return commit
-
-
-def reserve_code(code: int, commit: str) -> None:
-    """Keep a consumed code reserved even if its working-tree ledger append is discarded."""
-    run("git", "update-ref", f"refs/wolfskin-tv/version-codes/{code}", commit, "")
-
-
-def inspect_apk(path: Path, version: str, code: int, abi: str, proof: Path) -> int:
-    """Verify identity, final signature, optimization and playback-complete native inventory."""
-    image = os.environ.get("WOLFSKIN_BUILD_IMAGE", "wolfskin-build:sdk37-jdk21")
-    mount = f"type=bind,src={path.parent},dst=/artifacts,readonly"
-    base = (
-        "docker",
-        "run",
-        "--rm",
-        "--platform",
-        "linux/amd64",
-        "--mount",
-        mount,
-        image,
-    )
-    badging = run(*base, "aapt2", "dump", "badging", f"/artifacts/{path.name}")
-    certificate = run(
-        *base,
-        "apksigner",
-        "verify",
-        "--verbose",
-        "--print-certs",
-        f"/artifacts/{path.name}",
-    )
-    proof.write_text(badging + "\n" + certificate + "\n")
-    package = re.search(
-        r"package: name='([^']+)' versionCode='(\d+)' versionName='([^']+)'", badging
-    )
-    if package is None or package.groups() != (PACKAGE, str(code), version):
-        raise ValueError(f"Wrong APK identity: {path.name}")
-    fingerprints = re.findall(
-        r"Signer #\d+ certificate SHA-256 digest: ([0-9a-fA-F]+)", certificate
-    )
-    if fingerprints != [SIGNER]:
-        raise ValueError(f"Wrong household signer: {path.name}")
-    if "application-debuggable" in badging:
-        raise ValueError("Household APK must not be debuggable")
-    minimum = re.search(r"sdkVersion:'(\d+)'", badging)
-    if minimum is None:
-        raise ValueError("APK minimum SDK is missing")
-    with zipfile.ZipFile(path) as archive:
-        names = archive.namelist()
-        for profile in ("assets/dexopt/baseline.prof", "assets/dexopt/baseline.profm"):
-            if profile not in names:
-                raise ValueError(f"Missing optimized profile: {profile}")
-        if any(
-            name.startswith(("assets/wolfskin-", "assets/library/")) for name in names
-        ):
-            raise ValueError("Debug fixtures leaked into the household assembly")
-        for target in ABIS[:-1] if abi == "universal" else (abi,):
-            libraries = [name for name in names if name.startswith(f"lib/{target}/")]
-            for component in ("mpv", "ffmpeg", "av1"):
-                if not any(component in name.lower() for name in libraries):
-                    raise ValueError(f"Missing native {component} for {target}")
-        proof.with_suffix(".inventory").write_text("\n".join(names) + "\n")
-    return int(minimum.group(1))
-
-
-def release(version: str, code: int, output: Path, dry_run: bool) -> None:
-    """Produce named APKs, inspected metadata, checksums and source-linked release notes."""
-    commit = validate_inputs(version, code)
-    tag = f"pwolfskin-opt-v{version}"
-    key = Path(
-        os.environ.get(
-            "WOLFSKIN_DEBUG_KEYSTORE",
-            "/root/.treehouse/firstmate-7bab20/2/firstmate/data/signing/debug.keystore",
-        )
-    )
-    if not key.is_file() or key.stat().st_size == 0:
-        raise ValueError(
-            "Existing household signing key required; never generate a replacement"
-        )
-    if output.exists():
-        raise ValueError("Release output must not exist; preserve previous proof")
-    if dry_run:
-        print(
-            f"Dry run: source {commit}; defaultOptimized {version} code {code}; four APKs, manifest, notes and SHA256SUMS; no build, tag or publication"
-        )
-        return
-    existing = run("git", "tag", "--list", tag)
-    if existing and run("git", "rev-parse", f"{tag}^{{commit}}") != commit:
-        raise ValueError("Source tag already identifies another commit")
-    reserve_code(code, commit)
-    output.mkdir(parents=True)
-    private = output / "private"
-    private.mkdir(mode=0o700)
-    with (private / "build.log").open("w") as log:
-        subprocess.run(
-            [
-                "bash",
-                "docker/gradle.sh",
-                "household",
-                f"-PtvVersion={version}",
-                f"-PtvVersionCode={code}",
-                "assembleDefaultOptimized",
-                ":app:dependencies",
-                "--configuration",
-                "defaultOptimizedRuntimeClasspath",
-            ],
-            cwd=ROOT,
-            check=True,
-            stdout=log,
-            stderr=subprocess.STDOUT,
-        )
-    assets: list[dict[str, object]] = []
-    for abi in ABIS:
-        suffix = "" if abi == "universal" else f"-{abi}"
-        source = (
-            ROOT
-            / f"app/build/outputs/apk/default/optimized/Wholphin-default-optimized-{version}-{code}{suffix}.apk"
-        )
-        target = output / f"Wolfskin{suffix}.apk"
-        shutil.copyfile(source, target)
-        minimum = inspect_apk(target, version, code, abi, private / f"{abi}.inspection")
-        assets.append(
-            {
-                "abi": abi,
-                "name": target.name,
-                "bytes": target.stat().st_size,
-                "sha256": digest(target),
-                "minSdk": minimum,
-            }
-        )
-    mapping = ROOT / "app/build/outputs/mapping/defaultOptimized"
-    shutil.copytree(mapping, private / "mapping")
-    manifest = {
-        "schemaVersion": 1,
-        "packageId": PACKAGE,
-        "versionName": version,
-        "versionCode": code,
-        "publishedAt": datetime.datetime.now(datetime.UTC)
-        .isoformat()
-        .replace("+00:00", "Z"),
-        "sourceCommit": commit,
-        "sourceTag": tag,
-        "signerSha256": SIGNER,
-        "assets": assets,
-    }
-    (output / "wolfskin-update.json").write_text(json.dumps(manifest, indent=2) + "\n")
-    source = f"https://git.justinvisser.org/justinzeus/wolfskin/src/tag/{tag}"
-    (output / "RELEASE-NOTES.md").write_text(
-        f"# Wolfskin TV {version}\n\nIn-app verified household updates with explicit Android confirmation.\n\n"
-        f"Package `{PACKAGE}`, code {code}, signer SHA-256 `{SIGNER}`.\n"
-        "Same-package, same-signer upgrades retain app data; never uninstall or clear data to update. "
-        "An earlier ephemeral signer needs a separately authorized migration, not an automatic reinstall.\n\n"
-        "Android 6 (API 23) or later. Standalone armeabi-v7a, arm64-v8a and x86_64 APKs; "
-        "universal fallback. 32-bit x86 is not MPV-complete and is unsupported for playback. "
-        "MPV, ffmpeg and AV1 extensions: pinned Wholphin extensions 0.2.4.\n\n"
-        f"GPL-2.0-only; Wolfskin derives from Wholphin by damontecres and contributors. "
-        f"Corresponding source: [{commit}]({source}); "
-        f"[source archive](https://git.justinvisser.org/justinzeus/wolfskin/archive/{tag}.tar.gz).\n"
-        "[Upstream Wholphin](https://github.com/damontecres/wholphin), "
-        "[native extension source 0.2.4](https://github.com/damontecres/wholphin-extensions/tree/v0.2.4).\n"
-    )
-    files = sorted(path for path in output.iterdir() if path.is_file())
-    (output / "SHA256SUMS").write_text(
-        "".join(f"{digest(path)}  {path.name}\n" for path in files)
-    )
-    if not existing:
-        run("git", "tag", tag, commit)
-    with (ROOT / "docker/tv-version-codes").open("a") as ledger:
-        ledger.write(f"{code} {version} {commit}\n")
-    print(
-        f"Release packaged at {output}; commit the code ledger and push source tag {tag} before distribution. Nothing published."
-    )
-
-
-def main() -> None:
-    """Expose the make tv-release build contract."""
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--version", required=True)
-    parser.add_argument("--version-code", required=True, type=int)
-    parser.add_argument("--output", type=Path, required=True)
-    parser.add_argument("--dry-run", action="store_true")
-    args = parser.parse_args()
-    release(args.version, args.version_code, args.output.resolve(), args.dry_run)
-
-
-if __name__ == "__main__":
-    main()

wolfskin-design/build.gradle.kts

@@ -19,18 +19,13 @@ android {
 }
 kotlin.compilerOptions.jvmTarget = JvmTarget.JVM_11
 
+val robolectricSdk by configurations.creating {
+    isCanBeResolved = true
+    isCanBeConsumed = false
+    isTransitive = false
+}
 val cacheRobolectricSdk by tasks.registering(Copy::class) {
-    val versions = listOf(
+    from(robolectricSdk)
-        "9-robolectric-4913185-2-i7",
-        "11-robolectric-6757853-i7",
-        "14-robolectric-10818077-i7",
-    )
-    // One configuration would evict the older SDKs through version conflict resolution.
-    from(versions.map { version ->
-        project.configurations.detachedConfiguration(
-            project.dependencies.create("org.robolectric:android-all-instrumented:$version"),
-        ).apply { isTransitive = false }
-    })
     into(layout.buildDirectory.dir("robolectric-sdk"))
 }
 
@@ -55,6 +50,9 @@ tasks.withType<Test>().configureEach {
 }
 
 dependencies {
+    robolectricSdk("org.robolectric:android-all-instrumented:9-robolectric-4913185-2-i7")
+    robolectricSdk("org.robolectric:android-all-instrumented:11-robolectric-6757853-i7")
+    robolectricSdk("org.robolectric:android-all-instrumented:14-robolectric-10818077-i7")
     implementation(platform(libs.androidx.compose.bom))
     implementation(libs.androidx.compose.ui)
     implementation(libs.androidx.tv.material)

wolfskin-design/generate_tokens.py

@@ -32,7 +32,6 @@ def render_tokens(tokens: dict) -> tuple[str, str]:
         "// Generated by generate_tokens.py; edit the JSON sources instead.",
         "package org.justinvisser.wolfskin.design",
         "",
-        "import androidx.compose.animation.core.CubicBezierEasing",
         "import androidx.compose.ui.graphics.Color as ComposeColor",
         "import androidx.compose.ui.text.TextStyle",
         "import androidx.compose.ui.text.font.FontWeight",
@@ -72,10 +71,6 @@ def render_tokens(tokens: dict) -> tuple[str, str]:
             elif kind == "duration":
                 lines.append(f"        const val {name} = {int(value.removesuffix('ms'))}")
                 css.append(f"  --{group_name}-{name}: {value};")
-            elif kind == "cubicBezier":
-                points = ", ".join(f"{number(point)}f" for point in value)
-                lines.append(f"        val {name} = CubicBezierEasing({points})")
-                css.append(f"  --{group_name}-{name}: cubic-bezier({', '.join(map(str, value))});")
             elif kind == "transition" and value.get("type") == "spring":
                 lines.append(f"        const val {name}DampingRatio = {number(value['dampingRatio'])}f")
                 lines.append(f"        const val {name}Stiffness = {number(value['stiffness'])}f")

wolfskin-design/home-tokens.json

@@ -114,6 +114,12 @@
       "dp": 18.0,
       "source": "locked index.html:94-165,180-198,1014-1029,1276-1289"
     },
+    "captionWidth": {
+      "$type": "dimension",
+      "px": 640,
+      "dp": 320.0,
+      "source": "locked index.html:94-165,180-198,1014-1029,1276-1289"
+    },
     "plateTop": {
       "$type": "dimension",
       "px": 14,
@@ -234,6 +240,18 @@
       "dp": 30.0,
       "source": "locked index.html:94-165,180-198,1014-1029,1276-1289"
     },
+    "progressInset": {
+      "$type": "dimension",
+      "px": 18,
+      "dp": 9.0,
+      "source": "locked index.html:94-165,180-198,1014-1029,1276-1289"
+    },
+    "progressBottom": {
+      "$type": "dimension",
+      "px": 10,
+      "dp": 5.0,
+      "source": "locked index.html:94-165,180-198,1014-1029,1276-1289"
+    },
     "endTop": {
       "$type": "dimension",
       "px": 40,
@@ -298,6 +316,7 @@
     "savedPadding": { "$type": "dimension", "px": 20, "dp": 10.0, "source": "locked index.html:87" },
     "savedGap": { "$type": "dimension", "px": 10, "dp": 5.0, "source": "locked index.html:87" },
     "savedIcon": { "$type": "dimension", "px": 28, "dp": 14.0, "source": "locked index.html:88" },
-    "savedRadius": { "$type": "dimension", "px": 28, "dp": 14.0, "source": "locked index.html:87" }
+    "savedRadius": { "$type": "dimension", "px": 28, "dp": 14.0, "source": "locked index.html:87" },
+    "posterProgressBottom": { "$type": "dimension", "px": 12, "dp": 6.0, "source": "locked index.html:138-140" }
   }
 }

wolfskin-design/shell-tokens.json

@@ -367,6 +367,9 @@
     "chipGap": {"$type":"dimension","px":16,"dp":8,"source":"index.html:184-185"},
     "chipTop": {"$type":"dimension","px":16,"dp":8,"source":"index.html:184"},
     "chipIcon": {"$type":"dimension","px":26,"dp":13,"source":"index.html:185"},
+    "captionWidth": {"$type":"dimension","px":640,"dp":320,"source":"index.html:151"},
+    "captionSeparatorOpacity": {"$type":"number","$value":0.4,"source":"index.html:1207; spec 4.4"},
+    "captionFactsGap": {"$type":"dimension","px":18,"dp":9,"source":"index.html:154"},
     "badgeIcon": {"$type":"dimension","px":28,"dp":14,"source":"index.html:142"},
     "plateTop": {"$type":"dimension","px":14,"dp":7,"source":"index.html:162"},
     "plateSide": {"$type":"dimension","px":16,"dp":8,"source":"index.html:162"},

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/Caption.kt

@@ -1,34 +1,72 @@
 package org.justinvisser.wolfskin.design
 
 import androidx.compose.animation.core.Animatable
+import androidx.compose.animation.core.CubicBezierEasing
 import androidx.compose.animation.core.tween
 import androidx.compose.foundation.layout.Column
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.text.TextStyle
 import androidx.tv.material3.Text
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.ui.draw.clipToBounds
+import androidx.compose.ui.layout.Layout
+import androidx.compose.ui.unit.constrainHeight
 
-/** Captions rise inside the reserved band without changing measured geometry. */
+/** Captions fade without moving the reserved band under the focused poster. */
 @Composable
-fun Caption(title: String, facts: String, visible: Boolean, modifier: Modifier = Modifier) {
+fun Caption(title: String, facts: String, visible: Boolean, modifier: Modifier = Modifier, accentLastFact: Boolean = false, accentFirstFact: Boolean = false,
+    titleStyle: TextStyle = WolfskinTokens.Type.button, factsStyle: TextStyle = WolfskinTokens.Type.caption,
+    titleOverflow: TextOverflow = TextOverflow.Ellipsis) {
     val alpha = remember(title, facts) { Animatable(0f) }
-    val entryProgress = remember(title, facts) { mutableFloatStateOf(0f) }
+    LaunchedEffect(alpha, visible) {
-    val reduced = reducedMotion()
+        alpha.animateTo(if (visible) 1f else 0f, tween(WolfskinTokens.Motion.fast, easing = CubicBezierEasing(.25f, .1f, .25f, 1f)))
-    val rise = with(androidx.compose.ui.platform.LocalDensity.current) { WolfskinTokens.Motion.captionRise.toPx() }
+    }
-    LaunchedEffect(alpha, visible, reduced) {
+    Column(modifier.graphicsLayer { this.alpha = alpha.value }) {
-        if (visible && !reduced) kotlinx.coroutines.delay(WolfskinTokens.Motion.captionDelay.toLong())
+        Text(title, color = WolfskinTokens.Color.fg, style = titleStyle, modifier = Modifier.exactLineBox(titleStyle), maxLines = 1, overflow = titleOverflow)
-        alpha.animateTo(if (visible) 1f else 0f, tween(motionDuration(if (visible) WolfskinTokens.Motion.focusMove else WolfskinTokens.Motion.captionOut, reduced), easing = WolfskinTokens.Motion.easeOut)) {
+        CaptionFacts(facts, accentFirstFact, accentLastFact, factsStyle)
-            if (visible) entryProgress.floatValue = value
+    }
+}
+
+/** CSS flex facts: only coloured role/ownership spans shrink; ordinary facts and dots keep their width. */
+@Composable
+private fun CaptionFacts(facts: String, accentFirst: Boolean, accentLast: Boolean, style: TextStyle) {
+    val parts = remember(facts) { facts.split("   ·   ") }
+    val muted = WolfskinTokens.Color.muted
+    val colour = WolfskinTokens.Color.accentText
+    Layout(
+        content = {
+            parts.forEachIndexed { index, part ->
+                val accented = (index == 0 && accentFirst) || (index == parts.lastIndex && accentLast)
+                Text(part, color = if (accented) colour else muted, style = style, modifier = Modifier.exactLineBox(style), maxLines = 1, overflow = TextOverflow.Clip)
+                if (index != parts.lastIndex) Text("·", color = muted.copy(alpha = muted.alpha * WolfskinTokens.Library.captionSeparatorOpacity), style = style, modifier = Modifier.exactLineBox(style))
+            }
+        },
+        modifier = Modifier.fillMaxWidth().clipToBounds(),
+    ) { children, constraints ->
+        val gap = WolfskinTokens.Library.captionFactsGap.roundToPx()
+        val basis = IntArray(children.size)
+        var fixed = gap * (children.size - 1).coerceAtLeast(0)
+        var flexible = 0
+        fun shrinks(index: Int) = (index == 0 && accentFirst) || (index == children.lastIndex && accentLast)
+        children.forEachIndexed { index, child ->
+            val width = child.maxIntrinsicWidth(constraints.maxHeight)
+            basis[index] = width
+            if (shrinks(index)) flexible += width else fixed += width
+        }
+        val available = (constraints.maxWidth - fixed).coerceAtLeast(0)
+        val ratio = if (flexible > available) available.toFloat() / flexible else 1f
+        val measured = children.mapIndexed { index, child ->
+            val width = if (shrinks(index)) (basis[index] * ratio).toInt() else basis[index]
+            child.measure(constraints.copy(minWidth = 0, maxWidth = width, minHeight = 0))
+        }
+        layout(constraints.maxWidth, constraints.constrainHeight(measured.maxOfOrNull { it.height } ?: 0)) {
+            var x = 0
+            measured.forEach { child -> child.placeRelative(x, 0); x += child.width + gap }
         }
-    }
-    val titleStyle = WolfskinTokens.Type.button
-    val factsStyle = WolfskinTokens.Type.caption
-    Column(modifier.graphicsLayer { this.alpha = alpha.value; translationY = if (reduced) 0f else rise * (1f - entryProgress.floatValue) }) {
-        Text(title, color = WolfskinTokens.Color.fg, style = titleStyle, modifier = Modifier.exactLineBox(titleStyle), maxLines = 1, overflow = TextOverflow.Ellipsis)
-        Text(facts, color = WolfskinTokens.Color.muted, style = factsStyle, modifier = Modifier.exactLineBox(factsStyle), maxLines = 1, overflow = TextOverflow.Ellipsis)
     }
 }

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/CardCaption.kt

@@ -1,81 +0,0 @@
-package org.justinvisser.wolfskin.design
-
-import androidx.compose.animation.core.Animatable
-import androidx.compose.animation.core.tween
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.size
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.mutableFloatStateOf
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clipToBounds
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.layout.Layout
-import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.Constraints
-import androidx.compose.ui.res.painterResource
-import androidx.tv.material3.Icon
-import androidx.tv.material3.Text
-import org.justinvisser.wolfskin.design.WolfskinTokens.CardMetadata as M
-import org.justinvisser.wolfskin.design.WolfskinTokens.Color as C
-
-/** Card-width titles never displace runtime or watched metadata into a neighbouring slot. */
-@Composable
-fun CardCaption(title: String, year: Int?, duration: String?, watched: Boolean, focused: Boolean,
-    modifier: Modifier = Modifier, focusOnly: Boolean = false, showTitle: Boolean = true) {
-    val transition = if (focusOnly) {
-        val alpha = remember(title) { Animatable(0f) }
-        val entryProgress = remember(title) { mutableFloatStateOf(0f) }
-        val reduced = reducedMotion()
-        val rise = with(LocalDensity.current) { WolfskinTokens.Motion.captionRise.toPx() }
-        LaunchedEffect(alpha, focused, reduced) {
-            if (focused && !reduced) kotlinx.coroutines.delay(WolfskinTokens.Motion.captionDelay.toLong())
-            alpha.animateTo(if (focused) 1f else 0f, tween(motionDuration(if (focused) WolfskinTokens.Motion.focusMove else WolfskinTokens.Motion.captionOut, reduced), easing = WolfskinTokens.Motion.easeOut)) {
-                if (focused) entryProgress.floatValue = value
-            }
-        }
-        Modifier.graphicsLayer {
-            this.alpha = alpha.value
-            translationY = if (reduced) 0f else rise * (1f - entryProgress.floatValue)
-        }
-    } else Modifier
-    Column(modifier.then(transition)) {
-        if (showTitle) {
-            val style = if (focused || focusOnly) M.titleFocus else M.titleRest
-            Text(title, color = if (focused || focusOnly) C.fg else C.muted, style = style,
-                modifier = Modifier.fillMaxWidth().exactLineBox(style), maxLines = 1, overflow = TextOverflow.Ellipsis)
-        }
-        CardMetadata(year, duration, watched)
-    }
-}
-
-/** Measured gaps tighten before any fixed-size year, runtime or check can be clipped. */
-@Composable
-fun CardMetadata(year: Int?, duration: String?, watched: Boolean, modifier: Modifier = Modifier) {
-    Layout(content = {
-        if (year != null) Text(year.toString(), color = C.muted, style = M.subtitle, modifier = Modifier.exactLineBox(M.subtitle), maxLines = 1)
-        if (duration != null) Text(duration, color = C.muted, style = M.subtitle, modifier = Modifier.exactLineBox(M.subtitle), maxLines = 1)
-        if (watched) Icon(painterResource(R.drawable.card_watched_check), "Watched", Modifier.size(M.check), tint = C.muted)
-    }, modifier = modifier.fillMaxWidth().clipToBounds()) { children, constraints ->
-        val sizes = IntArray(children.size) { children[it].maxIntrinsicWidth(constraints.maxHeight) }
-        val gaps = (children.size - 1).coerceAtLeast(0)
-        val textWidth = sizes.sum()
-        val gap = when {
-            textWidth + gaps * M.gap.roundToPx() <= constraints.maxWidth -> M.gap.roundToPx()
-            textWidth + gaps * M.compactGap.roundToPx() <= constraints.maxWidth -> M.compactGap.roundToPx()
-            else -> M.minimumGap.roundToPx()
-        }
-        val measured = Array(children.size) { children[it].measure(Constraints.fixedWidth(sizes[it])) }
-        val height = with(this) { M.subtitle.lineHeight.toPx().toInt() }
-        layout(constraints.maxWidth, height) {
-            var left = 0
-            measured.forEach { child ->
-                child.placeRelative(left, (height - child.height) / 2)
-                left += child.width + gap
-            }
-        }
-    }
-}

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/DiscoverArtwork.kt

@@ -56,17 +56,12 @@ fun DiscoverArtwork(path: String?, modifier: Modifier, poster: Boolean = false,
             if (upright) WolfskinTokens.Image.heroPosterRequestWidth else WolfskinTokens.Image.heroRequestWidth,
             if (upright) WolfskinTokens.Image.heroPosterRequestHeight else WolfskinTokens.Image.heroRequestHeight, upright)
     }
-    val heroReady = LocalHeroArtReady.current
+    if (painter != null) Image(painter, null, modifier, contentScale = ContentScale.Crop, colorFilter = filter)
-    if (painter != null) {
-        androidx.compose.runtime.SideEffect { heroReady?.invoke() }
-        Image(painter, null, modifier, contentScale = ContentScale.Crop, colorFilter = filter)
-    }
     else AsyncImage(
         model = request,
         imageLoader = WolfskinImages.loader(context),
         contentDescription = null, modifier = modifier, contentScale = ContentScale.Crop, colorFilter = filter,
         onError = { onError() },
-        onSuccess = { heroReady?.invoke() },
     )
 }
 
@@ -75,11 +70,7 @@ fun DiscoverArtwork(path: String?, modifier: Modifier, poster: Boolean = false,
 fun DiscoverBackdrop(title: DiscoverTitle, detail: Boolean = false, modifier: Modifier = Modifier) {
     val failed = remember(title.poster, title.backdrop) { androidx.compose.runtime.mutableStateOf(false) }
     Box(modifier.size(WolfskinTokens.Shell.stageWidth, WolfskinTokens.Shell.stageHeight).clipToBounds().background(C.surface3)) {
-        if (failed.value || (title.poster == null && title.backdrop == null)) {
+        if (failed.value || (title.poster == null && title.backdrop == null)) HomeAmbient(Modifier.fillMaxSize().testTag("discover-missing-art"))
-            val heroReady = LocalHeroArtReady.current
-            androidx.compose.runtime.SideEffect { heroReady?.invoke() }
-            HomeAmbient(Modifier.fillMaxSize().testTag("discover-missing-art"))
-        }
         else if (title.posterOnly) {
             DiscoverArtwork(title.poster, Modifier.offset(-D.ambientInset, -D.ambientInset)
                 .wrapContentSize(Alignment.TopStart, unbounded = true)

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/DiscoverScreen.kt

@@ -32,7 +32,7 @@ import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalDensity
-import androidx.compose.ui.unit.IntOffset
+import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.tv.material3.Text
@@ -73,8 +73,8 @@ fun DiscoverScreen(state: DiscoverState, modifier: Modifier = Modifier) {
         return
     }
     if (state.snapshot.status == DiscoverStatus.Loading) {
-        LaunchedEffect(state) { if (!shell.navFocused) shell.focusNav(shell.currentTab) }
+        val loading = remember(state) { LibraryGridState("Discover", emptyList(), catalogue = true).apply { status = LibraryStatus.Loading } }
-        DiscoverLoading(modifier)
+        LibraryScreen(shell, loading, modifier, offlineArt = LocalDiscoverArt.current, registerFocus = false)
         return
     }
     val density = LocalDensity.current
@@ -104,9 +104,7 @@ fun DiscoverScreen(state: DiscoverState, modifier: Modifier = Modifier) {
         }
     }
     Box(modifier.fillMaxSize().testTag("discover-screen")) {
-        if (state.hasHero && state.service == null && list.firstVisibleItemIndex == 0) state.hero?.let { title ->
+        if (state.hasHero && state.service == null && list.firstVisibleItemIndex == 0) state.hero?.let { DiscoverBackdrop(it, modifier = Modifier.graphicsLayer { translationY = -list.firstVisibleItemScrollOffset.toFloat() }) }
-            HeroArtCrossfade(title.key, title, L.row_phero, Modifier.offset { IntOffset(0, -list.firstVisibleItemScrollOffset) }) { DiscoverBackdrop(it) }
-        }
         LazyColumn(state = list, contentPadding = PaddingValues(bottom = (WolfskinTokens.Shell.stageHeight - L.pinnedLine - heights.last()).coerceAtLeast(D.frameBottomMin)), modifier = Modifier.fillMaxSize()) {
             item(key = "discover-header", contentType = if (state.hasHero && state.service == null) "hero" else "header") {
                 if (state.hasHero && state.service == null) DiscoverHero(state) else LibraryHeader(state.shell.person, state.service?.name ?: "Discover", if (state.service != null) "General interest" else "")
@@ -134,23 +132,22 @@ fun DiscoverScreen(state: DiscoverState, modifier: Modifier = Modifier) {
 @Composable
 private fun DiscoverHero(state: DiscoverState) {
     val title = state.hero ?: return
-    HeroCopyHandoff(title.key, title) { copy ->
     Column(Modifier.fillMaxWidth().height(L.row_phero).padding(start = L.safeSide, bottom = L.heroCopyBottom), verticalArrangement = Arrangement.Bottom) {
         Row(horizontalArrangement = Arrangement.spacedBy(WolfskinTokens.Card.posterGap), verticalAlignment = Alignment.CenterVertically) {
             Glyph("seerr", C.accentText, Modifier.size(L.buttonIcon))
             Text(if (state.snapshot.status == DiscoverStatus.Ready) "For you" else "Trending", color = C.accentText, style = DiscoverType.label)
         }
         Spacer(Modifier.height(D.heroKickerGap))
-        Text(copy.title, Modifier.width(L.heroCopyWidth).testTag("discover-hero-title-box").discoverLineBox(DiscoverType.hero), color = C.fg, style = DiscoverType.hero, maxLines = 2, overflow = TextOverflow.Ellipsis)
+        Text(title.title, Modifier.width(L.heroCopyWidth).testTag("discover-hero-title-box").discoverLineBox(DiscoverType.hero), color = C.fg, style = DiscoverType.hero, maxLines = 2, overflow = TextOverflow.Ellipsis)
         Spacer(Modifier.height(D.heroTitleGap))
         Row(Modifier.height(D.heroFactsHeight), horizontalArrangement = Arrangement.spacedBy(D.heroFactsGap), verticalAlignment = Alignment.CenterVertically) {
-            Text("${copy.typeWord}${copy.year?.let { " · $it" }.orEmpty()}", color = C.muted, style = DiscoverType.body)
+            Text("${title.typeWord}${title.year?.let { " · $it" }.orEmpty()}", color = C.muted, style = DiscoverType.body)
-            if (copy.genres.isNotEmpty()) Text(copy.genres.take(2).joinToString(", "), color = C.muted, style = DiscoverType.body)
+            if (title.genres.isNotEmpty()) Text(title.genres.take(2).joinToString(", "), color = C.muted, style = DiscoverType.body)
-            if (state.isSignedIn) DiscoverRatings(copy.ratings)
+            if (state.isSignedIn) DiscoverRatings(title.ratings)
-            if (state.shell.person.key in copy.heldBy) Text("In your library", color = C.accentText, style = DiscoverType.body)
+            if (state.shell.person.key in title.heldBy) Text("In your library", color = C.accentText, style = DiscoverType.body)
         }
         Spacer(Modifier.height(D.heroMetaGap))
-        Text(copy.overview, Modifier.width(L.heroOverviewMax), color = C.muted, style = DiscoverType.body, maxLines = 2, overflow = TextOverflow.Ellipsis)
+        Text(title.overview, Modifier.width(L.heroOverviewMax), color = C.muted, style = DiscoverType.body, maxLines = 2, overflow = TextOverflow.Ellipsis)
         Spacer(Modifier.height(D.heroOverviewGap))
         Row(verticalAlignment = Alignment.CenterVertically) {
             DiscoverButton("Details", state.contentFocused && state.focusedRow == 0, "about") { state.openTitle(title) }
@@ -161,7 +158,6 @@ private fun DiscoverHero(state: DiscoverState) {
             }
         }
     }
-    }
 }
 
 @Composable

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/DiscoverShelf.kt

@@ -55,7 +55,7 @@ fun DiscoverShelf(state: DiscoverState, lane: DiscoverLane, row: Int) {
         LazyRow(state = cards, userScrollEnabled = false,
             contentPadding = PaddingValues(start = L.safeSide, end = WolfskinTokens.Shell.stageWidth - L.safeSide - (K.posterW * slots + K.posterGap * (slots - 1)), top = K.posterGap, bottom = K.posterGap),
             horizontalArrangement = Arrangement.spacedBy(K.posterGap),
-            modifier = Modifier.offset(y = D.shelfHeadingBand - K.posterGap).height(height + (if (services) WolfskinTokens.Shell.zero else K.posterCaptionBand) + K.posterGap * 2).skeletonPulse(lane.pending).rowReveal(lane.id, !lane.pending)) {
+            modifier = Modifier.offset(y = D.shelfHeadingBand - K.posterGap).height(height + K.posterGap * 2)) {
             if (services) itemsIndexed(state.snapshot.services, key = { _, service -> "service:${service.id}" }, contentType = { _, _ -> "entry" }) { index, service ->
                 Box(Modifier.size(K.entryW, K.entryH).focusScale(active && index == column, WolfskinTokens.Focus.scaleCard)
                     .focusRing(active && index == column, WolfskinTokens.Radius.card, WolfskinTokens.Focus.ringCardRing, FocusLift.Card)
@@ -66,7 +66,7 @@ fun DiscoverShelf(state: DiscoverState, lane: DiscoverLane, row: Int) {
                 }
             } else if (lane.pending) {
                 items(slots, key = { "pending:$it" }) {
-                    PosterCaptionSkeleton()
+                    Box(Modifier.size(K.posterW, K.posterH).background(C.surface3, RoundedCornerShape(WolfskinTokens.Radius.card)))
                 }
             } else {
                 itemsIndexed(lane.titles, key = { _, item -> item.key }, contentType = { _, _ -> "poster" }) { index, item ->
@@ -80,16 +80,15 @@ fun DiscoverShelf(state: DiscoverState, lane: DiscoverLane, row: Int) {
                 }
             }
         }
-        if (!services && !lane.pending) {
+        if (!services && active && !lane.pending) {
             val item = lane.titles.getOrNull(column)
-            val captionModifier = Modifier.offset(L.safeSide + K.posterPitch * (column - first), D.shelfHeadingBand + K.posterH + L.captionOffset).width(K.posterW)
+            Caption(
-            if (item != null) {
+                item?.title ?: if (lane.tail == DiscoverTail.SeeAll) "See all ${lane.title}" else if (lane.tail == DiscoverTail.Retry) "Try again" else "Show more",
-                val card = item.libraryCard(state)
+                if (item != null) buildDiscoverCaptionFacts(item, state, lane.hidden) else if (lane.tail == DiscoverTail.SeeAll) "${lane.total} titles" else if (lane.tail == DiscoverTail.Retry) "${lane.title} stopped loading" else "The last read only repeated titles",
-                CardCaption(item.title, card.year, card.duration, false, active, captionModifier, focusOnly = true)
+                true, Modifier.offset(L.safeSide + K.posterPitch * (column - first), D.shelfHeadingBand + K.posterH + L.captionOffset).width(WolfskinTokens.Library.captionWidth),
-            } else Caption(
+                accentFirstFact = lane.hidden,
-                if (lane.tail == DiscoverTail.SeeAll) "See all ${lane.title}" else if (lane.tail == DiscoverTail.Retry) "Try again" else "Show more",
+                accentLastFact = item != null && (item.heldBy.isNotEmpty() || state.requests[item.key].orEmpty().isNotEmpty()),
-                if (lane.tail == DiscoverTail.SeeAll) "${lane.total} titles" else if (lane.tail == DiscoverTail.Retry) "${lane.title} stopped loading" else "The last read only repeated titles",
+            )
-                active, captionModifier)
         }
     }
 }
@@ -109,3 +108,7 @@ internal fun DiscoverTailCard(lane: DiscoverLane, focused: Boolean, onClick: ()
     else CatalogueRecoveryCard(lane.tail == DiscoverTail.Retry, focused, onClick)
 }
 
+internal fun buildDiscoverCaptionFacts(title: DiscoverTitle, state: DiscoverState, hidden: Boolean): String {
+    val card = title.libraryCard(state)
+    return (if (hidden) "Hidden from your picks   ·   " else "") + card.facts(true)
+}

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/DiscoverState.kt

@@ -156,8 +156,7 @@ class DiscoverState(
     }
 
     private fun moveRow(direction: Int) {
-        var target = focusedRow + direction
+        val target = focusedRow + direction
-        while (target in firstShelf until rowCount && lanes[target - firstShelf].pending) target += direction
         if (target < if (hasHero) 0 else 1) { shell.focusNav(shell.currentTab); return }
         if (target >= rowCount) return
         val key = when (target) { 0 -> "phero"; 1 -> "dchips"; else -> lanes[target - firstShelf].id }

wolfskin-design/src/main/java/org/justinvisser/wolfskin/design/Focus.kt

@@ -1,5 +1,6 @@
 package org.justinvisser.wolfskin.design
 
+import androidx.compose.animation.core.CubicBezierEasing
 import androidx.compose.animation.core.animateFloatAsState
 import androidx.compose.animation.core.tween
 import androidx.compose.runtime.Composable
@@ -25,10 +26,9 @@ import androidx.compose.ui.unit.Dp
 /** Only transforms animate: focus never changes measured geometry. */
 @Composable
 fun Modifier.focusScale(focused: Boolean, scale: Float): Modifier {
-    val reduced = reducedMotion()
     val animated by animateFloatAsState(
         if (focused) scale else 1f,
-        tween(if (reduced) 0 else WolfskinTokens.Motion.focusMove, easing = WolfskinTokens.Motion.easeOut),
+        tween(WolfskinTokens.Motion.fast, easing = CubicBezierEasing(.25f, .1f, .25f, 1f)),
         label = "focus-scale",
     )
     return graphicsLayer { scaleX = animated; scaleY = animated }
@@ -40,9 +40,8 @@ enum class FocusLift { None, Card, Button }
 /** Every focus ring straddles the surface edge above content, without a background gap. */
 @Composable
 fun Modifier.focusRing(focused: Boolean, radius: Dp, width: Dp, lift: FocusLift = FocusLift.None): Modifier {
-    val reduced = reducedMotion()
     val ringAlpha by animateFloatAsState(if (focused) 1f else 0f,
-        tween(motionDuration(WolfskinTokens.Motion.focusMove, reduced), easing = WolfskinTokens.Motion.easeOut), label = "focus-ring")
+        tween(WolfskinTokens.Motion.fast, easing = CubicBezierEasing(.25f, .1f, .25f, 1f)), label = "focus-ring")
     val shadow = if (lift == FocusLift.None) this else {
         val shape = remember(radius) { RoundedCornerShape(radius) }
         val density = LocalDensity.current