Merge pull request #272 from JMR-dev/fix/102-picker-back-press-overshoot

Stop the picker dismissal destroying MainActivity, and census what actually turns legs red (#102)

.github/scripts/e2e-report-shape-test.sh

@@ -184,6 +184,46 @@ out="$(run_report "$root")"
 assert_contains "same-line annotation removed: counts 2, so it was worth 1" "$out" \
   "  baseline DEVIATION: the tree carries 2 tests marked \`@FailsOnEmulatorApi37\` but the baseline says 3 — update FAILS_ON_EMULATOR_API37_BASELINE"
 
+# ---------------------------------------------------------------------------
+# 4. A run the abort truncated, with fewer failures than the baseline: NOT a deviation.
+#
+# `expected` comes from `Starting N tests`, printed before anything can abort, so it still
+# answers "is the marked set the size the baseline says". `failed` is a tally of what actually
+# ran, and on a truncated run the tests after the abort never start. Measured on 2026-09-05, two
+# api37-debug dispatches of the same four marked tests: 4/4/4 and then 4/3/3. Announcing the
+# second as "one now passes" is the wrong reading, and #120 is the standing lesson about a notice
+# that is wrong often enough to be skimmed past.
+# ---------------------------------------------------------------------------
+root="$(make_root "$FIXTURE_DIR" 3)"
+cat > "$root/gradle.log" <<'TRUNCATED'
+> Task :app:connectedDebugAndroidTest
+Starting 3 tests on test(AVD) - 16
+There was 2 failure(s).
+Test run failed to complete. Expected 3 tests, received 2. onError: commandError=false message=INSTRUMENTATION_ABORTED: System has crashed.
+TRUNCATED
+out="$(run_report "$root")"
+assert_contains "truncated run: the truncation is reported"  "$out" '  completed cleanly: no'
+assert_absent   "truncated run: the short failure count is not a deviation" "$out" 'tests failed, the baseline is'
+# And the match line has to say what actually happened rather than repeat the baseline: PR #245's
+# advisory leg printed `failed: 4` three lines above `matches (5 expected, 5 failed)`.
+assert_contains "truncated run: the match line does not claim the baseline's failure count" "$out" \
+  '  baseline: matches (3 expected; 2 of 3 failed, on a run the abort truncated — not compared)'
+
+# ---------------------------------------------------------------------------
+# 5. The same short failure count on a run that finished IS a deviation.
+#
+# The pair is the point: case 4 must not have bought its quiet by disabling the check outright.
+# ---------------------------------------------------------------------------
+root="$(make_root "$FIXTURE_DIR" 3)"
+cat > "$root/gradle.log" <<'CLEAN'
+> Task :app:connectedDebugAndroidTest
+Starting 3 tests on test(AVD) - 16
+There was 2 failure(s).
+CLEAN
+out="$(run_report "$root")"
+assert_contains "clean run, short by one: the deviation fires" "$out" \
+  '2 tests failed, the baseline is 3'
+
 echo
 if [ "$failures" -eq 0 ]; then
   echo "e2e-report-shape-test.sh: all checks passed"

.github/scripts/e2e-report-shape.sh

@@ -252,8 +252,22 @@ if [ -n "$baseline" ]; then
     if [ "$expected" != "unknown" ] && [ "$expected" != "$baseline" ]; then
       deviations+=("the runner started $expected tests, the baseline is $baseline")
     fi
+    # `expected` is compared on every run and `failed` only on a run that finished, and the
+    # difference is the truncation this file already records rather than compares. `expected`
+    # comes from `Starting N tests`, which is printed before anything can abort, so it answers
+    # "is the marked set the size the baseline says" whatever happens afterwards. `failed` is a
+    # tally of what actually ran: on a truncated run the tests after the abort never start, so
+    # comparing it to the baseline announces a deviation about the framework dying rather than
+    # about the test list. Measured on 2026-09-05, two api37-debug dispatches of the same four
+    # marked tests: 4/4/4 and then 4/3/3, the second having lost the last test to the abort.
+    # Announcing that as "one now passes" is exactly the wrong reading, and #120 is the standing
+    # lesson about a notice that is wrong often enough to be skimmed past.
     if [ "$failed" != "unknown" ] && [ "$failed" != "$baseline" ]; then
-      deviations+=("$failed tests failed, the baseline is $baseline — every test carrying the marker is expected to fail on this image, so fewer means one now passes and more means a new one joined")
+      if [ "$completed" = "**no**" ]; then
+        echo "::debug::$failed of $baseline marked tests failed, on a run the abort truncated — not compared"
+      else
+        deviations+=("$failed tests failed, the baseline is $baseline — every test carrying the marker is expected to fail on this image, so fewer means one now passes and more means a new one joined")
+      fi
     fi
   fi
   if [ -n "$marked" ] && [ "$marked" != "$baseline" ]; then
@@ -283,7 +297,16 @@ if [ -n "$failed_names" ]; then
 fi
 if [ "$advisory" = "yes" ]; then
   if [ "${#deviations[@]}" -eq 0 ]; then
-    echo "  baseline: matches ($baseline expected, $baseline failed)"
+    # Two spellings, because one of them would be a lie half the time. `$baseline expected,
+    # $baseline failed` is only true of a run that finished; on a truncated one `failed` is a
+    # tally of the tests that got to run before the framework died, and printing the baseline in
+    # its place claims a number nobody measured. Seen on PR #245's advisory leg, which reported
+    # `failed: 4` three lines above `matches (5 expected, 5 failed)`.
+    if [ "$failed" != "unknown" ] && [ "$failed" != "$baseline" ]; then
+      echo "  baseline: matches ($baseline expected; $failed of $baseline failed, on a run the abort truncated — not compared)"
+    else
+      echo "  baseline: matches ($baseline expected, $baseline failed)"
+    fi
   else
     printf '  baseline DEVIATION: %s\n' "${deviations[@]}"
   fi

.github/scripts/e2e-run.sh

@@ -52,40 +52,72 @@ WEDGE_TIMEOUT=1200
 # the same shape as E2E_EXTRA_GRADLE_ARGS below. The other four E2E legs run byte-identical
 # commands with it unset.
 #
-# WHY IT RUNS HERE, BEFORE THE LOGCAT STREAM: `adb shell stop` ends the `adb logcat` started
-# below, and nothing restarts it, so a disable performed after that point would cost this leg
-# its whole diagnostic story for the part of the run that matters. Everything this function
-# counts comes from `adb logcat -d -b crash`, which is a fresh read each time and independent
-# of the stream.
+# WHY IT RUNS HERE, BEFORE THE LOGCAT STREAM: it is a 45-second wait, and the stream below is
+# meant to cover the suite rather than the wait. Everything this function counts comes from
+# `adb logcat -d -b crash`, a fresh read each time and independent of the stream. (The original
+# reason was stronger and no longer applies: `adb shell stop` would have ended the streamed
+# `adb logcat` and nothing restarts it. There is no `stop` here any more -- see below.)
 #
-# WHAT IT IS FOR: the android-37.x images abort surfaceflinger from RegionSamplingThread inside
-# their own gralloc mapper (docs/api-37-emulator-crash.md). surfaceflinger is a critical service,
-# so init SIGKILLs zygote with it and the framework restarts under the run -- Gradle then reports
+# WHAT IT IS FOR -- AND THE NAME IS NOW WRONG, WHICH IS WHY THIS PARAGRAPH IS LONG.
+# The android-37.x images abort surfaceflinger from RegionSamplingThread inside their own gralloc
+# mapper (docs/api-37-emulator-crash.md). surfaceflinger is a critical service, so init SIGKILLs
+# zygote with it and the framework restarts under the run -- Gradle then reports
 # `cmd: Can't find service: package` and `Starting 0 tests`. RegionSamplingThread exists only
-# because SystemUI registers a nav-bar luma-sampling listener, so removing the package removes
-# the whole chain. Measured cadence of those kills: 20-90 s apart, median 60-70 s, three to five
-# in a four-minute window -- fast enough that install and instrumentation start-up do not fit
-# inside one gap.
+# because SystemUI registers a nav-bar luma-sampling listener, so this was written to remove the
+# package and with it the whole chain. Measured cadence of those kills on `-gpu host`: 20-90 s
+# apart, median 60-70 s, three to five in a four-minute window.
+#
+# **THE DISABLE HALF OF THAT HAS NEVER WORKED, AND THE QUIET WINDOW IS WHAT THE LEG ACTUALLY
+# GETS.** Measured 2026-09-05, two ways that agree:
+#
+#   - On CI, in the gating leg of run 34006456986: `pm disable-user` is accepted at 02:28:37.9 and
+#     `com.android.systemui` really is in `pm list packages -d` at 02:29:33 -- and SystemUI is
+#     started anyway at 02:28:39.5 and again at 02:28:52.3, the second of which (pid 4275) is
+#     alive for the whole instrumentation run, logging `WindowManagerShell ...
+#     app=com.android.systemui` minutes after this function prints its final line.
+#   - Locally on android-37.0, with the package verified disabled before AND after a deliberate
+#     `stop; start`: `com.android.systemui` comes up 3 s after `system_server` regardless.
+#
+# So `pm disable-user --user 0 com.android.systemui` does not stop SystemUI starting on this
+# image, whatever else happens. The name `E2E_DISABLE_SYSTEM_UI` and the name of this function are
+# kept because the matrix row, both workflows and two documents refer to them, and a rename would
+# touch all of that to no benefit -- read this comment, not the name.
+#
+# WHAT IS LEFT IS LOAD-BEARING, so do not delete the function as dead weight. It is the 45-second
+# window with zero new `hasReadColorBufferDma` aborts. The boot-time aborts land close together --
+# 02:28:18 and 02:28:43 in that same run -- and the wait is what puts instrumentation (02:32:42)
+# after them rather than inside one. That is what stops a leg reporting `Starting 0 tests`, and it
+# is why the three-round retry stays.
+#
+# THE `pm disable-user` CALL STAYS TOO, for a narrower reason than it was written for: every green
+# leg and every measurement quoted anywhere about this row was taken with it applied and SystemUI
+# running. Removing it would change the configuration the numbers came from, which is not a change
+# to make while fixing a flake.
+#
+# AND THE FRAMEWORK RESTART IS GONE, having been measured to be worse than nothing. It was written
+# as `adb shell stop; adb shell start`, which are root-only; adbd is not root, so every leg printed
+# `Must be root` twice and restarted nothing. Adding `adb root` made it real, and api37-debug run
+# 34010167885 is what that looks like: `pm disable-user` reports success, the stop lands ~2 s later
+# and kills system_server before PackageManager has flushed its delayed write of package
+# restrictions, so the state is gone on the way back up -- `NOT DISABLED after the restart`, three
+# rounds, `final state: SystemUI STILL ENABLED`, and the leg then reported `expected: 0,
+# received: 0`. A 15 s pause before the stop does make the state survive (bisected locally), and it
+# still does not help, because of the two measurements above. So the restart is removed rather than
+# repaired: it cost the leg every test it had, and there is nothing for it to buy.
 #
 # NOTHING HERE TRUSTS A COMMAND'S OWN REPORT, and that is not paranoia: of four runs of an
 # earlier one-shot version, one (32646029143) reported `new state: disabled-user` and then
-# started SystemUI eight more times, with ten more aborts. `pm disable-user` can be accepted by
-# a system_server that is SIGKILLed before the state is written, and `pm disable-user` does not
-# retract SystemUI's existing region-sampling registration either -- by the time boot completes
-# it has already registered, so only a framework restart brings back a SystemUI-less
-# surfaceflinger. Hence: disable, take the framework DOWN and confirm system_server is really
-# gone (an earlier probe asked `service check` 0.3 s after `stop` and got `found` from the
-# system_server that was still exiting, so its wait was not a wait), bring it back, verify the
-# package against `pm list packages -d`, and require a 45 s window with zero new aborts.
-# Three rounds, because one is not reliable and the failure is silent.
+# started SystemUI eight more times. So this reports what `pm list packages -d` says AND what
+# `pidof` says, side by side, rather than one line implying both.
 # ---------------------------------------------------------------------------
 count_aborts() { adb logcat -d -b crash 2> /dev/null | grep -c 'hasReadColorBufferDma'; }
 systemui_disabled() { adb shell pm list packages -d 2> /dev/null | grep -q 'com.android.systemui'; }
+systemui_pid() { adb shell pidof com.android.systemui 2> /dev/null | tr -d '\r\n'; }
 
 disable_region_sampling() {
-  local round=1 i out before after
+  local round=1 i out pid before after
   while [ "$round" -le 3 ]; do
-    echo "--- SystemUI disable, round $round ---"
+    echo "--- round $round ---"
     for i in $(seq 1 10); do
       out="$(adb shell pm disable-user --user 0 com.android.systemui 2>&1 | tr -d '\r')"
       echo "  pm attempt $i: $out"
@@ -93,36 +125,20 @@ disable_region_sampling() {
       sleep 5
     done
 
-    echo "  restarting the framework"
-    adb shell stop
-    for i in $(seq 1 20); do
-      [ -z "$(adb shell pidof system_server 2> /dev/null | tr -d '\r\n')" ] && break
-      sleep 2
-    done
-    echo "  system_server down after ~$((i * 2)) s"
-    adb shell start
-    for i in $(seq 1 30); do
-      if adb shell service check package 2> /dev/null | grep -q ': found' \
-        && adb shell service check activity 2> /dev/null | grep -q ': found' \
-        && [ -n "$(adb shell pidof system_server 2> /dev/null | tr -d '\r\n')" ]; then
-        echo "  services back after ~$((i * 5)) s"
-        break
-      fi
-      sleep 5
-    done
-
     if systemui_disabled; then
-      echo "  verified: com.android.systemui is in pm list packages -d"
+      echo "  pm list packages -d: com.android.systemui is in it"
     else
-      echo "  NOT DISABLED after the restart -- the package state did not survive"
-      round=$((round + 1))
-      continue
+      echo "  pm list packages -d: com.android.systemui is NOT in it"
     fi
+    # Printed next to the line above precisely because the two disagree on this image, and a
+    # reader who sees only the first will believe something that is not true.
+    pid="$(systemui_pid)"
+    echo "  com.android.systemui pid: ${pid:-none} (expected: a pid -- see the header)"
 
     before="$(count_aborts)"
     sleep 45
     after="$(count_aborts)"
-    echo "  abort rate, SystemUI disabled: $((after - before)) new in 45 s (total ${after:-0})"
+    echo "  aborts: $((after - before)) new in 45 s (total ${after:-0})"
     [ "$((after - before))" -eq 0 ] && break
     echo "  still aborting after round $round"
     round=$((round + 1))
@@ -131,16 +147,16 @@ disable_region_sampling() {
   # A warning rather than an exit. If the disable did not take, the run is about to report
   # `Starting 0 tests` and fail on its own -- and it will do so with the logcat, the crash
   # buffer and the diagnostics attached, which is more useful than dying here with none of it.
-  if systemui_disabled; then
-    echo "  final state: SystemUI disabled"
+  if [ "$((after - before))" -eq 0 ]; then
+    echo "  final state: 45 s with no new aborts -- the suite starts here"
   else
-    echo "::warning::E2E api${LABEL}: SystemUI is still enabled -- expect INSTRUMENTATION_ABORTED"
+    echo "::warning::E2E api${LABEL}: still aborting after three rounds -- expect INSTRUMENTATION_ABORTED"
   fi
   return 0
 }
 
 if [ "${E2E_DISABLE_SYSTEM_UI:-}" = "1" ]; then
-  echo "::group::E2E api${LABEL} -- removing the region-sampling listener"
+  echo "::group::E2E api${LABEL} -- waiting out the boot-time gralloc aborts"
   disable_region_sampling
   echo "::endgroup::"
 fi

.github/workflows/api37-debug.yml

@@ -28,6 +28,15 @@ name: API 37 debug
 #   - It does not fork .github/scripts/e2e-run.sh. That script owns the FAILED-vs-WEDGED
 #     split, the SIGQUIT thread dump and the streamed logcat, and it is the copy CI
 #     exercises every day. This calls it, exactly as status_check.yml does.
+#
+#     The SystemUI disable below is the exception, and it is a real one: this workflow
+#     drives it from its own probe step so `disable_system_ui` can be turned off for a
+#     dispatch, where the real leg gets it through `E2E_DISABLE_SYSTEM_UI`. Two copies of
+#     that logic therefore exist and must be changed together. **This instrument is also
+#     what established that the disable half of it does nothing** -- run 34010167885, in
+#     which making its framework restart real cost the leg every test it had. Read
+#     .github/scripts/e2e-run.sh's header for the measurements; the restart is gone from
+#     both copies and what remains is the 45-second quiet window.
 #   - It does not change status_check.yml. If a configuration here turns out to work,
 #     the change to the real matrix is proposed separately.
 #
@@ -291,45 +300,30 @@ jobs:
                 sleep 5
               done
 
-              # pm disable-user does not retract SystemUI's existing region-sampling
-              # registration -- by the time boot completes it has already registered. Only a
-              # framework restart brings back a SystemUI-less SurfaceFlinger. See
-              # disable_region_sampling in tools/local-emulator/run-e2e.sh.
-              echo "  restarting the framework"
-              adb shell stop
-              for i in $(seq 1 20); do
-                [ -z "$(adb shell pidof system_server 2> /dev/null | tr -d '\r\n')" ] && break
-                sleep 2
-              done
-              echo "  system_server down after $((i * 2)) s"
-              adb shell start
-              for i in $(seq 1 30); do
-                if adb shell service check package 2> /dev/null | grep -q ': found' \
-                  && adb shell service check activity 2> /dev/null | grep -q ': found' \
-                  && [ -n "$(adb shell pidof system_server 2> /dev/null | tr -d '\r\n')" ]; then
-                  echo "  services back after $((i * 5)) s"
-                  break
-                fi
-                sleep 5
-              done
-
+              # NO FRAMEWORK RESTART. There was one here, and making it work (it needed
+              # `adb root`) is what proved the whole disable is ineffective on this image:
+              # SystemUI starts anyway, measured on CI and locally, and the restart itself
+              # loses the package state to PackageManager's delayed write and leaves the leg
+              # reporting `Starting 0 tests`. e2e-run.sh's header carries the measurements.
+              # What is left, and what is load-bearing, is the quiet window below.
               if systemui_disabled; then
-                echo "  verified: com.android.systemui is in pm list packages -d"
+                echo "  pm list packages -d: com.android.systemui is in it"
               else
-                echo "  NOT DISABLED after the restart -- the package state did not survive"
-                round=$((round + 1))
-                continue
+                echo "  pm list packages -d: com.android.systemui is NOT in it"
               fi
+              # Beside it, because the two disagree on this image and the first line alone
+              # reads as a claim about the process that is not true.
+              echo "  com.android.systemui pid: $(adb shell pidof com.android.systemui 2> /dev/null | tr -d '\r\n')"
 
               before="$(count_aborts)"
               sleep 45
               after="$(count_aborts)"
-              echo "--- abort rate, SystemUI disabled: $((after - before)) new in 45 s (total ${after:-0}) ---"
+              echo "--- aborts: $((after - before)) new in 45 s (total ${after:-0}) ---"
               [ "$((after - before))" -eq 0 ] && break
               echo "  still aborting after round $round"
               round=$((round + 1))
             done
-            systemui_disabled && echo "final state: SystemUI disabled" || echo "final state: SystemUI STILL ENABLED -- expect Starting 0 tests"
+            systemui_disabled && echo "final state: com.android.systemui is disabled in pm (it still runs)" || echo "final state: com.android.systemui is not even disabled in pm"
           fi
 
           echo "--- crash buffer (tail 60) ---"

.github/workflows/status_check.yml

@@ -254,31 +254,33 @@ jobs:
             api-level: "36"
           # API 37, and it is NOT the same device as the four rows above it.
           #
-          # CAVEAT, read this before trusting a green here: this leg runs with
-          # SystemUI disabled and the framework restarted under it. No other leg
-          # and no Pixel run uses that configuration. It is defensible only because
-          # nothing THIS LEG RUNS touches system UI -- Media3, FFmpeg and
-          # WorkManager tests -- and because the alternative is no CI coverage of
-          # the level this app targets. **Anything that ever does depend on system
-          # UI must not trust this row.** E2E_DISABLE_SYSTEM_UI is what does it;
-          # .github/scripts/e2e-run.sh explains the mechanism and why every step of
-          # it is verified rather than assumed.
+          # THE CAVEAT THAT USED TO BE HERE IS WITHDRAWN, 2026-09-05, and the
+          # withdrawal is good news. It said this leg "runs with SystemUI disabled
+          # and the framework restarted under it", that no other leg or Pixel run
+          # uses that configuration, and that anything depending on system UI must
+          # not trust this row. **None of that was ever true.** Measured: the
+          # framework restart is two root-only adb commands that answered `Must be
+          # root` on every leg ever run, and `pm disable-user` does not stop SystemUI
+          # starting on this image anyway -- in run 34006456986 the package is
+          # verified disabled at 02:29:33 and SystemUI (pid 4275) is up from 02:28:52
+          # for the whole run. So this row's device configuration is the same as the
+          # other four's, and a green here means what a green on 33-36 means.
           #
-          # "this leg" and not "this suite", since 2026-08-24, and the difference is
-          # now load-bearing: SafPickerRoundTripTest DOES touch system UI. It drives
-          # DocumentsUI and rotates the display, and both reach the gralloc mapper
-          # this image aborts in -- disabling SystemUI removes the IDLE trigger, not
-          # those. Measured per method on android-37.0: the ROTATION test takes the
-          # framework down (INSTRUMENTATION_ABORTED) and carries
-          # @FailsOnEmulatorApi37, so notAnnotation below keeps it off this row; the
-          # PICKER test passes and runs here like anything else. A rotation rebuilds
-          # every surface at once, and starting another app's activity does not.
+          # E2E_DISABLE_SYSTEM_UI still exists and still runs, because what it
+          # actually buys is a 45-second window with no new gralloc aborts before the
+          # suite starts -- the boot-time ones land close together and instrumentation
+          # has to begin after them, not between them. The name is stale and kept:
+          # read .github/scripts/e2e-run.sh's header, which carries the measurements.
           #
-          # So this row does now run one test that depends on system UI, and the
-          # caveat above still applies to it: a green here is not evidence the picker
-          # works on a device with SystemUI running -- the Pixel release check is.
-          # docs/api-37-emulator-crash.md has the per-method measurements, and the
-          # correction that produced them.
+          # notAnnotation below keeps seven tests off this row. SafPickerRoundTripTest's
+          # PICKER test was measured on 2026-08-24 as passing here and was left on the
+          # leg; four gating logcats read on 2026-09-05 show it aborting system_server
+          # from the task-snapshot path on every single run, pass or fail, which is what
+          # had been failing unrelated PRs (#108). All FOUR of that class's tests now
+          # carry the marker -- the two saves through the picker (#226, #250) joined on
+          # 2026-09-06 by inheritance rather than measurement, since they open the same picker.
+          # docs/api-37-emulator-crash.md has the timings and the correction, and
+          # FailsOnEmulatorApi37.kt has why the third one cannot be measured here.
           #
           # api-level must be a POINT release. A bare 37 is not an SDK package and
           # fails during setup, which cost a run to discover. `37.0` is the choice
@@ -288,9 +290,12 @@ jobs:
           # docs/api-37-emulator-crash.md measures 37.0 rev 6 and 37.1 rev 8 side
           # by side, so pinning 37.0 is a decision, not a constraint.
           #
-          # notAnnotation removes the three tests that do not pass on this image; they
+          # notAnnotation removes the seven tests that cannot be RUN on this image; they
           # run in the advisory job below, off the same marker so they cannot end up
-          # in both or neither. docs/api-37-emulator-crash.md has the measurements.
+          # in both or neither. "Cannot be run" rather than "do not pass" is deliberate:
+          # four fail outright, one of those aborts the framework on its way down, and on
+          # the advisory leg the three picker tests behind it never report at all.
+          # docs/api-37-emulator-crash.md has the measurements.
           - label: "37"
             api-level: "37.0"
             disable-system-ui: "1"

CLAUDE.md

@@ -76,17 +76,56 @@ days. Read it as the current answer, and see the git history if you need the old
   `angle_indirect` and `swangle_indirect` all boot, while `auto`, `off`, `guest` and
   `swiftshader_indirect` do not. `docs/local-emulator.md` has the evidence and the per-API renderer
   table.
-- **CI runs API 37, and it gates.** The matrix is 33/34/35/36/37. **Three** of the 60 instrumented
-  tests cannot pass on that image, for two unrelated reasons: two Media3 hardware transcodes fail
-  inside the emulator's own `c2.goldfish.h264.decoder`, and one SAF test takes the framework down
-  when it rotates the display. All three carry `@FailsOnEmulatorApi37` and run in a separate
-  `continue-on-error` job; the gating leg runs the other 57.
+- **CI runs API 37, and it gates.** The matrix is 33/34/35/36/37. **Seven** of the 72 instrumented
+  tests cannot be *run* on that image, for three measured reasons and two inherited: three Media3
+  tests fail inside the emulator's own `c2.goldfish.h264.decoder`, one SAF test takes the framework
+  down when it rotates the display, and its sibling — the SAF picker round trip — aborts
+  `system_server` from the task-snapshot path whether it passes or not. The sixth, that class's
+  two saves through the picker (#226 and #250), carry the marker because they open the same picker
+  and a second DocumentsUI dialog on top of it — **not** because either has ever been observed here. It cannot be:
+  the rotation test runs first and takes the framework down, so all five advisory runs at the
+  previous baseline reported `expected: 6, received: 4, failed: 4`, and the four were the three
+  Media3 tests plus the rotation — runs 34041156680, 34041593697, 34042397320, 34043502322 and
+  34045105857. **No picker test has ever reported on the advisory leg**, which is a correction to
+  what the marker's own KDoc used to say. All seven carry `@FailsOnEmulatorApi37` and run in a
+  separate `continue-on-error` job; the gating leg runs the other **65**. That figure had been 64
+  three times running — 69−5, 70−6 and 71−7 are all 64 — which is exactly how this paragraph went
+  stale unnoticed, because the one number a reader checks against a run had not moved while the
+  suite grew twice underneath it. #254 is the first change since to move it, by adding a test and
+  no marker.
+
+  **These two numbers move with the suite and are derived, not remembered.** `grep -cE
+  '^\s*@Test' ` over `app/src/androidTest` is the first; the second is that minus the marker
+  count `.github/scripts/e2e-report-shape.sh` greps. Cross-check against any run's shape rather
+  than trusting the sentence: a leg below 37 reports the first as `expected`, and the API 37
+  gating leg reports the second.
+
+  **That third reason is why "cannot pass" became "cannot be run" on 2026-09-05.** Four gating
+  runs were read logcat-first — 34006456986, 34001744574, 34001377499 and the green 34002313300 —
+  and each carries exactly two `hasReadColorBufferDma` aborts before the suite (surfaceflinger,
+  during boot and the SystemUI disable) and exactly **one** during it: `system_server`, thread
+  `TaskSnapshotPer`, always inside the picker test's window, and nothing else in the gating set
+  reached the mapper at all. Whether the leg went red was luck — one run passed the test and lost
+  the leg anyway with `failed: 0`, another passed it 0.6 s after the abort and went green. That is
+  #108, it cost roughly a third of the gating legs over the wave-4 landings (#190), and a marker
+  is what it needed. `docs/api-37-emulator-crash.md` has the timings.
+
+  **A second thing came out of those logcats, and it withdraws a caveat rather than adding one.**
+  The API 37 row was documented as the one leg running "with SystemUI disabled and the framework
+  restarted under it", which nothing else does. Neither half was ever happening: `adb shell stop`
+  and `start` are root-only and answered `Must be root` on every leg ever run, and `pm
+  disable-user` does not stop SystemUI starting on this image anyway — measured on CI and locally,
+  with and without a real restart. **So this row's device configuration is the same as the other
+  four's, and a green here means what a green at 33–36 means.** `E2E_DISABLE_SYSTEM_UI` is kept
+  under its now-stale name because what it really buys is a 45-second window with no new gralloc
+  aborts before the suite starts, which is load-bearing; `.github/scripts/e2e-run.sh`'s header is
+  where that is written down.
 
   That job is still called `E2E API 37 Media3 hardware transcode (advisory)`, which no longer
   describes everything in it. The name is kept deliberately — it is not a required context and
   people have learned to look for it — so **read the marker, not the name**, for what it holds.
   **It is red on every PR, by design**: do not read it as your change breaking something, and do
-  not read a green run as evidence those three tests pass.
+  not read a green run as evidence those seven tests pass.
   `docs/api-37-emulator-crash.md` has the measurements.
 
   **That instruction is also why nobody looks, so the job now reports its own shape** — expected,
@@ -106,9 +145,20 @@ days. Read it as the current answer, and see the git history if you need the old
   is gradle never returning, so the log it left says nothing about it.
 
 Still true, and the reason the advisory job is not simply deleted: **API 37 needs a manual check on
-the Pixel 10 Pro XL before each release.** Those three tests are the one thing CI cannot answer
+the Pixel 10 Pro XL before each release.** Those seven tests are the one thing CI cannot answer
 for.
 
+**When a gating leg goes red on a diff that cannot explain it, read `docs/ci-failure-modes.md`
+before anything else.** It is the census of all 129 gating failures in the repo's history against
+1489 leg-attempts, with a per-mode disposition, and it is what closed #102. Three things from it
+that are easy to get wrong and expensive: **count per leg-attempt, never per run** — a re-run to
+green replaces the conclusion, so counting runs sees about 40% of the failures; **every mode has
+its own denominator**, because the API 37 row filters seven tests out and some tests are younger
+than the window; and **a re-run destroys the log** — `gh run view --job <id> --log` resolves by run
+and serves the latest attempt, so capture evidence before retrying, or read the attempt through
+`gh api /repos/.../actions/jobs/{job_id}/logs`. The artifacts do survive, one per attempt under the
+same name; `gh run download` takes the newest, which is the wrong one.
+
 On a device or emulator, build only the ABI it can execute:
 
 ```bash
@@ -311,7 +361,7 @@ install for code that can never run — and on API 37 the full APK does not fit
   when a fix is for something intermittent.
 
   **Every number above is `testDebugUnitTest` only, and on 2026-09-05 the instrumented suite got its
-  first read for that reason** — `docs/e2e-read-findings.md`, entries **E1-E6**, tickets
+  first read for that reason** — `docs/e2e-read-findings.md`, entries **E1-E7**, tickets
   **#223-#230**. Four waves had been steered by a figure that **cannot see `app/src/androidTest` at
   all**, so nothing had ever asked what those 60 device tests pin, only that they were green.
 
@@ -332,9 +382,81 @@ install for code that can never run — and on API 37 the full APK does not fit
   without the pin they would fail loudly; `HardwareFallbackTest`'s are about the *output*, so it
   passes quietly. **Prefer asserting the path over asserting the artefact** where the two differ.
 
-  The read was a triage, not a test push, and five of its six findings are prose rather than code —
+  The read was a triage, not a test push, and six of its seven findings are prose rather than code —
   the suite itself is in good shape. What had drifted is its self-description.
 
+  **Working the tickets then found the thing the read could not: one production defect.** #238 —
+  joining files picked through the system picker failed outright on the stream-copy path. The
+  concat demuxer whitelists protocols separately from `-safe 0`, and `ffkitsaf` was not on the
+  list; only `STREAM_COPY` feeds it a list file, and every existing join test passed
+  `Uri.fromFile`, so **the one broken combination was the only one a user could reach**. Not a
+  missed line and not an unasserted value — two covered things no test put together, which is the
+  gap shape a coverage number is worst at.
+
+  **E7 is the other reusable result**, because it re-scoped its own ticket. A real
+  `DocumentsProvider` cannot be reached without the picker: an unprotected one is refused at
+  install, instrumentation runs in the app's uid so the test APK's identity is no help, and shell
+  identity is denied too — each denial naming `ACTION_OPEN_DOCUMENT`. So #226 has no cheap headless
+  half. But the *input* bridge needs no documents provider at all, which is what kept #225 headless
+  and is how #238 surfaced.
+
+  **The 2026-09-06 re-check found that the read's own last PR had re-introduced the drift the read
+  was about**, and that is the entry worth carrying forward. #226 moved the suite 69 -> 70 and the
+  markers 5 -> 6 and changed neither the count in this file, the marker's KDoc, nor the two
+  comments in `status_check.yml`. **The gating figure is what hid it**: 69 - 5 and 70 - 6 are both
+  64, so the one number a reader checks against a run had not moved — which is precisely why the
+  paragraph above says to derive these rather than remember them. Worse, two KDoc claims in the new
+  test described a draft rather than the code: it says MP3 was chosen so the setup could not depend
+  on the device's codecs, while the code converts at the default `MP4_H265`/`FAST` and therefore
+  routes on `canEncode(H265)` — the *negation* of the stated reason. **That is E1 and E3's failure
+  mode, committed by the wave that found it.** All of it is fixed; the standing item is **#250**,
+  because #226 proved D4's premise and never drove its delete arm.
+
+- **Nothing is committed or pushed until the local gate is green, at every supported API level.**
+  Source work (`app/src/main`) needs the unit tests **and** the instrumented tests passing on every
+  level; test work (`app/src/test`, `app/src/androidTest`) needs the whole suite passing on every
+  level. `tools/git-hooks/local-gate.sh` enforces it as `pre-commit` and `pre-push`; wire it up once
+  with `git config core.hooksPath tools/git-hooks`.
+
+  33-36 run the whole suite on emulators. **API 37 cannot be run on an emulator on this host at
+  all** — not "is red", *cannot run*: measured 2026-09-06, the image logs `3 new surfaceflinger
+  aborts in 45 s (want 0)` and then the APK install itself fails with `Can't find service:
+  package`, because the framework is gone before Gradle installs anything. `Starting 0 tests`. So
+  the hook runs API 37 on the **attached Pixel 10 Pro XL** when it is there, and says plainly that
+  the level is uncovered when it is not — CI's gating leg being what answers for it then. It never
+  claims five levels having run four.
+
+  **It runs shellcheck and actionlint too, at CI's exact pins** — shellcheck over
+  `git ls-files '*.sh'`, actionlint over the workflows, the same digests and the same file sets
+  that leg uses. actionlint is not an afterthought to shellcheck but the other half of the same
+  hole: much of this repo's bash lives in workflow `run:` blocks, which `'*.sh'` does not match at
+  all. That gap was found the hard way: the gate checked ktlint,
+  detekt and Android lint, so a new `.sh` file was precisely the case where it passed and CI still
+  went red, and the first file it could not check was itself. **The digest is read out of
+  `status_check.yml` rather than copied** — two copies drift, and the symptom of that drift is the
+  gate passing while CI fails, which is the one thing this check exists to prevent.
+
+  The sweep is cached under the hash of the **`app/src` subtree**, not the whole repo tree. Keying
+  it on the whole tree was the first cut and it was wrong: editing a comment in `CLAUDE.md` threw
+  away a sweep of byte-identical application code and re-ran forty minutes of emulators to prove
+  nothing, which is how a gate teaches people to resent it. Any change under `app/src` still
+  invalidates it, and the JVM gate runs unconditionally. **There is deliberately no skip
+  variable**, and `--no-verify` needs the repo owner's say-so each time rather than being reached
+  for when the gate is inconvenient.
+
+  **What that keying cannot see is `bin/`.** The classifier matches `app/src/main/*` and
+  `app/src/{test,androidTest}/*` and nothing else, so a commit that replaces only the committed
+  FFmpeg AAR — a *different native binary* under every instrumented test — invalidates no cache and
+  sweeps nothing, while the JVM gate that does run cannot execute FFmpeg at all. #254 is where that
+  was noticed, and it did not hit it: the AAR and the `app/src` change that needs it are one commit,
+  so the sweep ran. An AAR rebuilt on its own would not be, and should be committed alongside
+  something under `app/src` or swept by hand.
+
+  Why it is worth tens of minutes a commit: the alternative was measured on 2026-09-06, when one PR
+  spent several gating legs learning one leg at a time what a sweep answers in one pass — and the
+  failing leg **moved** between runs (API 35 red then green, API 34 green then red). One leg at a
+  time that reads as someone else's flake; as a sweep it is one signal.
+
 - **Testable code is not done until it is tested.** If a piece is unit testable, it gets unit
   tests before it counts as done. If it is e2e testable, it gets e2e tests. Both clauses apply —
   a change that is both needs both.

README.md

@@ -48,6 +48,8 @@ Everything Media3 structurally cannot do:
 
 - Containers outside MP4/WebM/Ogg/WAV/AAC — MKV, MOV, AVI, FLV, MPEG-TS, WMV/ASF
 - **MP3 output** — Android has no MP3 encoder at any version; this is a platform gap
+- **Ogg Vorbis output** — the same gap: Android has no Vorbis encoder either. Encoded with
+  `libvorbis`, which the bundled build carries since #254
 - GIF and image sequences
 - Input codecs with no platform decoder on the device
 - CRF and 2-pass rate control, for the quality tier

app/src/androidTest/AndroidManifest.xml

@@ -42,6 +42,28 @@
                 <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
             </intent-filter>
         </provider>
+
+        <!--
+          A PLAIN provider, for the ffkitsaf bridge on the success path.
+
+          FFmpegKitConfig.getSafParameterForRead is on every real user conversion and was on no
+          passing test: they all pass Uri.fromFile, which takes the other arm. Only its failure
+          side was covered, by UnopenableUriTest naming an authority that does not exist.
+
+          The documents provider above cannot serve this. Any DOCUMENTS_PROVIDER must hold
+          MANAGE_DOCUMENTS or the platform refuses to install it, instrumentation runs in the
+          target app's process and so carries the app's uid, and the resulting denial says what
+          is actually required: access obtained through ACTION_OPEN_DOCUMENT. That means a picker,
+          and the flake it brings. See issue #226.
+
+          The bridge does not need a documents provider. It opens a descriptor through the
+          resolver and hands FFmpeg a saf: path, so any readable content:// URI exercises it, and
+          an ordinary provider is allowed to be exported without a permission.
+        -->
+        <provider
+            android:name="org.libremediaconverter.saf.FixtureContentProvider"
+            android:authorities="org.libremediaconverter.test.content"
+            android:exported="true" />
     </application>
 
 </manifest>

app/src/androidTest/java/org/libremediaconverter/FailsOnEmulatorApi37.kt

@@ -1,7 +1,7 @@
 package org.libremediaconverter
 
 /**
- * Marks an instrumented test that does not pass on the `android-37.x` **emulator** system images.
+ * Marks an instrumented test that cannot be run on the `android-37.x` **emulator** system images.
  *
  * This is a marker, not a skip. Nothing reads it except CI, and CI reads it twice — once with
  * `notAnnotation` to build the gating API 37 leg, and once with `annotation` to build the advisory
@@ -9,6 +9,24 @@ package org.libremediaconverter
  * That is the whole reason there is one annotation rather than a pair of test lists: two lists
  * drift, and the drift is silent in both directions (a test that runs nowhere reads as green).
  *
+ * **"Cannot be run" covers three things now, and it covered only the first until 2026-09-05.**
+ * Four of the seven carriers simply fail: three Media3 tests die in the image's own
+ * `c2.goldfish.h264.decoder`, and the SAF rotation test takes the framework down with it. The
+ * fifth — `SafPickerRoundTripTest.pickingAFileThroughTheSystemPickerFillsInTheFileCard` —
+ * **passes about half the time and aborts `system_server` every time**, which is worse for a
+ * gating leg than an honest failure: it fails the leg from the teardown, with no failing test to
+ * point at (#108). The wording was widened rather than the test excused; that test's own KDoc has
+ * the four-run measurement.
+ *
+ * **The sixth and seventh are the new third thing: they are marked by inheritance, not by
+ * measurement.** `SafPickerRoundTripTest.aSaveWritesToTheDocumentTheSystemPickerCreated` (#226)
+ * and `.aFailedSaveDeletesTheDocumentItCouldNotWrite` (#250) each open the same picker and then a
+ * second DocumentsUI dialog on top of it, so they sit on the same task-snapshot path their sibling
+ * was marked for. Neither has ever been observed at API 37 either way — see the measurement under
+ * [FAILS_ON_EMULATOR_API37_BASELINE], which is why they cannot be. Marking them was the
+ * conservative choice, and **the trigger for revisiting it is the rotation test, not themselves**:
+ * while that one truncates the advisory run, nothing downstream of it can report.
+ *
  * It says only what has been measured: **on the emulator, at API 37.** The same tests pass on a
  * physical Pixel 10 Pro XL at API 37 and at API 33–36 on the same runner under the same renderer,
  * so this must never be read as "this test is allowed to fail at API 37" — only as "the API 37
@@ -17,7 +35,7 @@ package org.libremediaconverter
  *
  * Removing it is the goal, and the trigger is written down: a new API 37.x system image, or an
  * ATD image for 37. Delete the annotation from the tests, and the advisory job goes empty and
- * the gating one grows by two.
+ * the gating one grows by [FAILS_ON_EMULATOR_API37_BASELINE].
  *
  * **How many tests carry it is committed below**, as [FAILS_ON_EMULATOR_API37_BASELINE], and the
  * advisory job checks the run against it. Adding or removing a marker means changing that number
@@ -37,10 +55,38 @@ annotation class FailsOnEmulatorApi37
  * keep printing with nothing to compare to, so it announces that it could not read the baseline
  * rather than falling quiet. If you see that notice, this line is what it means.
  *
- * **One number, both checks, and that is what the marker means.** A test carrying it cannot pass
- * on this image, so the count is simultaneously how many the advisory leg runs and how many fail.
- * A *smaller* failure count is the interesting direction: it means one of them now passes, which
- * is the trigger the KDoc above names for deleting the annotation.
+ * **One number, both checks, and that is what the marker was meant to mean.** A test carrying it
+ * cannot be run on this image, so the count is meant to be simultaneously how many the advisory
+ * leg runs and how many fail. A *smaller* failure count is the interesting direction: it means one
+ * of them now passes, which is the trigger the KDoc above names for deleting the annotation.
+ * **Since 2026-09-06 the second half no longer holds in practice** — the run truncates before
+ * three of the seven start, which the last paragraph below measures. `expected` still holds, and it is the
+ * field that catches a marker added without changing this number.
+ *
+ * **The picker tests are the ones to read that sentence carefully for, and the reason changed
+ * on 2026-09-06.** `pickingAFileThroughTheSystemPickerFillsInTheFileCard` was marked on
+ * 2026-09-05 for aborting `system_server` rather than for failing (#108), and on the gating leg
+ * it passed two runs of four. It was recorded here as *failing* on the advisory leg, behind the
+ * rotation test — measured, `api37-debug.yml` run 34008889182, `expected: 4, received: 4,
+ * failed: 4`, in the order Media3, Media3, rotation, picker. (Those dispatches predate the third
+ * Media3 marker, so their totals are four rather than six.)
+ *
+ * **But a second dispatch of the identical configuration reported 4/3/3**, having lost the last
+ * test to the abort rather than to anything about the test list, and that is why
+ * `e2e-report-shape.sh` compares `failed` only on a run that finished. `expected` is compared
+ * always — it comes from `Starting N tests`, which is printed before anything can abort, so it is
+ * the field that answers "is the marked set the size this number says". Read a *clean* run
+ * reporting fewer failures than this as one of them now passing; read a truncated one as the
+ * framework having died, which is this job's normal.
+ *
+ * **That is no longer what happens, and the difference is that neither picker test reports at
+ * all.** The rotation test truncates the run before them: **all five** advisory runs at the
+ * previous baseline of six — 34041156680, 34041593697, 34042397320, 34043502322 and 34045105857 —
+ * report `expected: 6, received: 4, failed: 4`, and the four are the three Media3 tests plus the
+ * rotation. #250 adds a third picker test behind the same wall, so expect `expected: 7,
+ * received: 4`. So the advisory leg currently answers for
+ * four of its six, and the comparison below is unaffected only because `failed` is not compared
+ * on a truncated run. Read it as **unmeasured**, not as passing or failing.
  *
  * So: adding or removing a [FailsOnEmulatorApi37] means changing this number, in this file, in
  * the same diff. The report says so on the run itself if you forget — it prints the tree's own
@@ -52,4 +98,4 @@ annotation class FailsOnEmulatorApi37
  * `INSTRUMENTATION_ABORTED`, so the count is a number taken from a partial run. The report
  * records the truncation next to the counts for that reason.
  */
-const val FAILS_ON_EMULATOR_API37_BASELINE = 3
+const val FAILS_ON_EMULATOR_API37_BASELINE = 7

app/src/androidTest/java/org/libremediaconverter/convert/Media3EngineTest.kt

@@ -7,6 +7,10 @@ import androidx.media3.common.MimeTypes
 import androidx.media3.common.util.UnstableApi
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
 import org.junit.After
@@ -14,6 +18,7 @@ import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -262,6 +267,92 @@ class Media3EngineTest {
         }
     }
 
+    /**
+     * Cancelling a *running* export stops it, completing #224's third engine.
+     *
+     * The two FFmpeg engines were done first (`ad2a75d`, `d293646`); this is
+     * `Media3Engine.transcode`'s `invokeOnCancellation`, which posts `transformer.cancel()` onto the
+     * engine's own `HandlerThread` because `cancel()` has the same single-thread requirement as
+     * `start()`.
+     *
+     * ## Why the assertion is the output file here, and was not for FFmpeg
+     *
+     * The FFmpeg side could not use the file: `invokeOnCancellation` unlinks it, and on POSIX ffmpeg
+     * keeps writing to the unlinked inode, so the path stays gone whether or not the cancel landed.
+     * It asserted the session's return code instead.
+     *
+     * `Media3Engine` deletes nothing — the partial is `ConversionWorker`'s to clean up — so the file
+     * *is* the evidence. An export that was cancelled leaves no moov atom, so `MediaExtractor`
+     * either finds no video track or refuses the file outright with
+     * `IOException: Failed to instantiate extractor` — measured, and both mean interrupted. One
+     * that ran to completion leaves a playable HEVC file, which is the only outcome treated as a
+     * miss. The wait before
+     * reading it is deliberately several times the length of the export, so a *non*-cancelled export
+     * has certainly finished by then: the failure direction is "the file became valid", never "we
+     * did not wait long enough".
+     *
+     * ## Why it retries
+     *
+     * Same reason as the other two, measured there: the committed fixture is 3 s at 320x240 and the
+     * export outruns a naive cancel on a loaded runner. An attempt whose export finished before the
+     * cancel landed has tested nothing, so it is a miss and is retried; only exhausting
+     * [CANCEL_ATTEMPTS] fails. With `transformer.cancel()` removed every attempt produces a playable
+     * file, so the mutation still bites — it just takes five tries to say so.
+     *
+     * Progress having been reported is what proves the export really started, so a miss is
+     * distinguishable from an export that never ran at all — which matters on the API 37 image,
+     * where the decoder is what fails.
+     */
+    @Test
+    @FailsOnEmulatorApi37
+    fun cancellingARunningExportStopsIt(): Unit = runBlocking {
+        val outcomes = mutableListOf<String>()
+
+        repeat(CANCEL_ATTEMPTS) { attempt ->
+            val partial = File(context.cacheDir, "cancelled_export_$attempt.mp4").apply { delete() }
+
+            val job = launch(Dispatchers.IO) {
+                engine.transcode(
+                    input = Uri.fromFile(input),
+                    output = partial,
+                    request = ConversionRequest(OutputFormat.MP4_H265.spec),
+                )
+            }
+
+            // The muxer creating the file is proof the export really started, and it is the
+            // earliest such proof available -- earlier than the first progress tick.
+            withTimeout(TIMEOUT_MS) {
+                while (!partial.exists() && job.isActive) delay(POLL_MS)
+            }
+            val started = partial.exists()
+            job.cancelAndJoin()
+
+            if (!started) {
+                // The export failed before writing anything. That is not a cancellation result
+                // either way, so it is not allowed to pass as one.
+                outcomes += "attempt $attempt never produced an output file to cancel"
+                return@repeat
+            }
+
+            // Several times the export's own length, so a cancel that did not land has certainly
+            // finished. The failure direction is "the file became playable", never "too soon".
+            delay(SETTLE_MS)
+
+            // A cancelled export reports itself two ways and both mean the same thing: no video
+            // track, or MediaExtractor refusing the file outright with "Failed to instantiate
+            // extractor" because there is no moov atom to read. Only a *playable* file is a miss.
+            val video = runCatching { videoMimeTypeOf(partial) }.getOrNull()
+            partial.delete()
+            if (video == null) return@runBlocking
+            outcomes += "attempt $attempt produced a playable $video"
+        }
+
+        fail(
+            "never interrupted a running export in $CANCEL_ATTEMPTS attempts, so either every " +
+                "export finished first or cancellation does not reach the transformer: $outcomes",
+        )
+    }
+
     private fun videoMimeTypeOf(file: File): String? {
         val extractor = MediaExtractor()
         try {
@@ -280,6 +371,19 @@ class Media3EngineTest {
     private companion object {
         const val TIMEOUT_SECONDS = 120L
 
+        /** Bounds the wait for the muxer to create the file; a hang here is a defect. */
+        const val TIMEOUT_MS = 30_000L
+        const val POLL_MS = 25L
+
+        /**
+         * How long to let a *failed* cancel finish. Several times the export's own length, so
+         * "the file is not playable" cannot mean "not yet".
+         */
+        const val SETTLE_MS = 10_000L
+
+        /** See the KDoc: a miss is the loaded-runner case, not a defect. */
+        const val CANCEL_ATTEMPTS = 5
+
         /**
          * Short on purpose. Nothing is decoded or encoded on this path — the builder refuses the
          * input outright — so anything approaching this is a hang, which is what the test is

app/src/androidTest/java/org/libremediaconverter/convert/ReattachOnLaunchTest.kt

@@ -13,6 +13,7 @@ import androidx.work.WorkManager
 import androidx.work.Worker
 import androidx.work.WorkerParameters
 import androidx.work.workDataOf
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
@@ -27,7 +28,10 @@ import org.junit.runner.RunWith
 import org.libremediaconverter.join.JoinState
 import org.libremediaconverter.join.JoinViewModel
 import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.model.ConversionRequest
 import org.libremediaconverter.model.Engine
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
 import org.libremediaconverter.work.ConcatWorker
 import org.libremediaconverter.work.ConversionWorker
 import org.libremediaconverter.work.JobTags
@@ -64,6 +68,26 @@ class EchoWorker(context: Context, params: WorkerParameters) : Worker(context, p
  * path, foreground service included — into a synchronous test double, depending on class order.
  */
 @UnstableApi
+/**
+ * A [SoftwareTranscoder] that holds the worker in [WorkInfo.State.RUNNING] until released.
+ *
+ * Declared here rather than in `FakeFailures` because it is the only test that needs a job to stay
+ * live on demand, and the shape is specific to that: the others fake a *failure*, this fakes
+ * *duration*.
+ */
+private class BlockingTranscoder(private val released: CompletableDeferred<Unit>) : SoftwareTranscoder {
+    override suspend fun run(
+        request: ConversionRequest,
+        inputPath: String,
+        output: File,
+        durationMs: Long,
+        onProgress: (Int) -> Unit,
+    ) {
+        released.await()
+        output.writeBytes(ByteArray(1_024))
+    }
+}
+
 @RunWith(AndroidJUnit4::class)
 class ReattachOnLaunchTest {
 
@@ -75,7 +99,13 @@ class ReattachOnLaunchTest {
     fun clearTheQueue() = emptyQueueAndStaging()
 
     @After
-    fun leaveNothingBehind() = emptyQueueAndStaging()
+    fun leaveNothingBehind() {
+        // The suite runs without Android Test Orchestrator, so every class shares one process and
+        // a swapped seam outlives the class that set it. Only one test here swaps one, but a
+        // BlockingTranscoder left in place would hang the next class that converts anything.
+        ConversionDependencies.reset()
+        emptyQueueAndStaging()
+    }
 
     /**
      * The claim the whole fix rests on, checked against the production request builder rather
@@ -261,6 +291,69 @@ class ReattachOnLaunchTest {
         return request.id
     }
 
+    /**
+     * Reattaching to a conversion that is **running right now**, which nothing had ever driven.
+     *
+     * This class covers a job that finished, one whose staged file is gone, an ambiguous pair, one
+     * still queued, and one the user cancelled. [Reattachment.rank] gives
+     * [WorkInfo.State.RUNNING] the **highest** rank of all — "live work outranks a finished result
+     * because a running job is holding a foreground service" — and no test on either source set
+     * ever produced one. `ReattachmentTest` exercises the ranking as a pure function over
+     * fabricated snapshots; what was missing is a ViewModel meeting a real running job.
+     *
+     * It is also the likeliest reattachment there is: the user starts a conversion, leaves, and
+     * comes back while it is still going.
+     *
+     * ## Why the engine is a fake here, and why that is not a weakening
+     *
+     * The job has to still be running when the ViewModel is built, and every real conversion in
+     * this suite finishes in about a second — racing that is what made the cancellation tests flaky
+     * enough to need retries (#224). A [SoftwareTranscoder] that blocks until released removes the
+     * race outright: the job is `RUNNING` for exactly as long as the test wants.
+     *
+     * Nothing about reattachment depends on which engine is transcoding. What is under test is the
+     * tag query, [Reattachment.choose] over live WorkManager state, and `observe` mapping it to
+     * [ConversionState.Converting] — all of which run identically whatever is doing the work.
+     *
+     * ## What this does not do, and cannot (#230)
+     *
+     * It does not kill the process. `docs/defect-audit.md` D3/D13 record that `am kill` refuses a
+     * process holding a foreground service, and there is a more basic obstacle: **instrumentation
+     * runs in the app's own process**, so any route that really killed it would take the test
+     * runner with it and there would be nothing left to assert with. A relaunch-and-observe test
+     * needs two instrumentation runs, which the runner does not provide.
+     *
+     * So process death stays device-manual, and this is the closest observable analogue: a fresh
+     * ViewModel, with no memory of the work, meeting a job that is genuinely mid-flight.
+     */
+    @Test
+    fun reattachesToAConversionThatIsStillRunning(): Unit = runBlocking {
+        val released = CompletableDeferred<Unit>()
+        ConversionDependencies.software = { BlockingTranscoder(released) }
+
+        val request = ConversionWorker.request(
+            inputUri = Uri.fromFile(stage("running_input.mp3")),
+            displayName = RUNNING_NAME,
+            sizeBytes = RUNNING_SIZE,
+            spec = OutputFormat.MP3.spec,
+            quality = QualityTier.FAST,
+        )
+        workManager.enqueue(request).result.get()
+
+        // Deterministic: the worker cannot finish until this test lets it.
+        withTimeout(TIMEOUT_MS) {
+            workManager.getWorkInfoByIdFlow(request.id).first { it?.state == WorkInfo.State.RUNNING }
+        }
+
+        val reattached = awaitConversion<ConversionState.Converting>()
+
+        assertEquals(RUNNING_NAME, reattached.input.displayName)
+        assertEquals(RUNNING_SIZE, reattached.input.sizeBytes)
+
+        released.complete(Unit)
+        workManager.cancelWorkById(request.id).result.get()
+    }
+
     /**
      * Enqueues a job that stays [WorkInfo.State.ENQUEUED]. The delay is what holds it there: it
      * is long enough that nothing can run it during a test, and it is cancelled either way.
@@ -326,5 +419,9 @@ class ReattachOnLaunchTest {
          * against WorkManager's database, so this is generous rather than tuned.
          */
         const val SETTLE_MS = 5_000L
+
+        /** Read back off the job's tags by the reattaching ViewModel, so both have to survive. */
+        const val RUNNING_NAME = "still_running.mp3"
+        const val RUNNING_SIZE = 4_242L
     }
 }

app/src/androidTest/java/org/libremediaconverter/fallback/HardwareFallbackTest.kt

@@ -12,11 +12,17 @@ import kotlinx.coroutines.withTimeout
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.libremediaconverter.codec.AndroidDeviceCodecs
+import org.libremediaconverter.model.ConversionRequest
+import org.libremediaconverter.model.ConversionRouter
+import org.libremediaconverter.model.Engine
 import org.libremediaconverter.model.OutputFormat
 import org.libremediaconverter.model.QualityTier
+import org.libremediaconverter.model.VideoCodec
 import org.libremediaconverter.work.ConversionWorker
 import java.io.File
 
@@ -34,6 +40,47 @@ import java.io.File
  * hand — a regression test that silently skips is worse than no test, because the count
  * still reads as coverage.
  *
+ * ## Why this skips on emulators, and why that is the honest answer (#223)
+ *
+ * **This test used to pass everywhere while proving nothing.** Two independent facts stop the
+ * fallback happening on an emulator, and both were measured rather than reasoned:
+ *
+ *  1. **The router never sends the job to Media3.** A Fast MP4/H.265 job goes to the hardware path
+ *     only when `device.canEncode(H265)`, and emulators expose no hardware encoder — every leg of
+ *     run `34004304566` logged
+ *     `Routing sample_h264_444.mp4 -> ... via FFMPEG (NO_HARDWARE_ENCODER)`. The whole test
+ *     finished in 448 ms, which is not long enough to fail an export and then re-encode.
+ *  2. **Forcing it to Media3 does not help either, which is the part that settles it.** Pinning
+ *     `ConversionDependencies.deviceCodecs` to [DeviceCodecs.PERMISSIVE] — the trick
+ *     [ForcedFailureTest] uses — makes the router choose Media3, and the export then *succeeds*.
+ *     Measured on a local API 34 emulator: `MediaCodecInfo` logs
+ *     `NoSupport [codec.profileLevel, avc1.F4000C, video/avc]` for **both**
+ *     `c2.goldfish.h264.decoder` and `c2.android.avc.decoder`, and ExoPlayer allocates the
+ *     goldfish decoder anyway, which decodes the file regardless of the profile it declares.
+ *     `c2.android.hevc.encoder` then encodes the result and the job reports `MEDIA3`.
+ *
+ * So the class KDoc above — "Media3 fails partway through the export on every device" — **is not
+ * true of the emulator images**, and no amount of routing pressure makes this fixture force a
+ * fallback there. The emulator cannot answer this question, so the test says so out loud instead
+ * of passing.
+ *
+ * That is why the gate is [assumeTrue] on the *production* premise (`canEncode(H265)`) rather than
+ * a pinned profile: pinning would also swap in software codecs, which is not the path a real
+ * device takes and is what made the forced run succeed. **This is now the third permanent skip**;
+ * the other two are [org.libremediaconverter.bench.RealMediaBenchmark]'s.
+ *
+ * `ForcedFailureTest.hardwareFailureFallsBackToSoftware` still covers the fallback *wiring* on
+ * every leg, with an `ExplodingHardware` double. What only a device with a real hardware encoder
+ * can show is two real engines disagreeing about a real file, and that is what this is for.
+ *
+ * ## Why the assertion is a pair
+ *
+ * `KEY_ENGINE_USED` is `FFMPEG` whether the fallback fired **or** the router went straight there,
+ * so asserting it alone would not have caught any of the above. The premise is asserted
+ * separately: [ConversionRouter.route] chooses `MEDIA3` for this request on this device. Static
+ * routing wanted hardware, the runtime result was software — together, and only together, that is
+ * the fallback.
+ *
  * The fixture was produced with x264, which the host toolchain cannot do (Fedora's
  * ffmpeg ships openh264, which is Constrained Baseline only):
  *
@@ -66,6 +113,15 @@ class HardwareFallbackTest {
 
     @Test
     fun aFileMedia3CannotDecodeStillConvertsViaFfmpeg(): Unit = runBlocking {
+        // See "Why this skips on emulators" on the class. Without a real hardware encoder the
+        // router never chooses Media3, and forcing it makes the export succeed instead of fail --
+        // so there is no fallback to observe and a green run would mean nothing.
+        assumeTrue(
+            "no hardware HEVC encoder, so the router cannot choose Media3 and there is no " +
+                "fallback to exercise",
+            AndroidDeviceCodecs.get().canEncode(VideoCodec.H265),
+        )
+
         val request = ConversionWorker.request(
             inputUri = Uri.fromFile(input),
             displayName = SAMPLE,
@@ -75,6 +131,19 @@ class HardwareFallbackTest {
             // the tier where the fallback has to rescue the conversion.
             quality = QualityTier.FAST,
         )
+        // The premise, asserted rather than assumed: this request is one the router wants to send
+        // to hardware on this device. Without it the test is green whether the fallback fired or
+        // the job never went near Media3, which is exactly how #223 stayed invisible.
+        val decision = ConversionRouter.route(
+            ConversionRequest(OutputFormat.MP4_H265.spec, quality = QualityTier.FAST),
+            AndroidDeviceCodecs.get(),
+        )
+        assertEquals(
+            "this test only means something if the router sends this job to Media3",
+            Engine.MEDIA3,
+            decision.engine,
+        )
+
         workManager.enqueue(request).result.get()
 
         val terminal = withTimeout(TIMEOUT_MS) {
@@ -88,6 +157,14 @@ class HardwareFallbackTest {
             terminal?.state,
         )
 
+        // The outcome. Paired with the routing assertion above this is the fallback and nothing
+        // else: hardware was chosen, software is what ran.
+        assertEquals(
+            "the router chose Media3, so a successful job must have fallen back to FFmpeg",
+            Engine.FFMPEG.name,
+            terminal?.outputData?.getString(ConversionWorker.KEY_ENGINE_USED),
+        )
+
         val out = File(terminal!!.outputData.getString(ConversionWorker.KEY_OUTPUT_PATH)!!)
         assertTrue("no output produced", out.exists() && out.length() > 0)
         out.delete()

app/src/androidTest/java/org/libremediaconverter/ffmpeg/FFmpegEngineTest.kt

@@ -4,10 +4,20 @@ import android.media.MediaExtractor
 import android.media.MediaFormat
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
+import com.arthenica.ffmpegkit.FFmpegKit
+import com.arthenica.ffmpegkit.FFmpegSession
+import com.arthenica.ffmpegkit.ReturnCode
+import com.arthenica.ffmpegkit.SessionState
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -76,6 +86,25 @@ class FFmpegEngineTest {
         }
     }
 
+    /**
+     * Channels per track, or 0 for a track that does not declare any.
+     *
+     * Read out of the container rather than assumed from the request, because the thing worth
+     * catching is an encoder that quietly changed the channel count on the way through — which is
+     * exactly what a stereo-only encoder does to this class's mono fixture.
+     */
+    private fun channelCounts(file: File): List<Int> {
+        val extractor = MediaExtractor()
+        return try {
+            extractor.setDataSource(file.absolutePath)
+            (0 until extractor.trackCount).map {
+                extractor.getTrackFormat(it).getInteger(MediaFormat.KEY_CHANNEL_COUNT, 0)
+            }
+        } finally {
+            extractor.release()
+        }
+    }
+
     // --- the formats that justify bundling FFmpeg at all -------------------
 
     @Test
@@ -113,6 +142,11 @@ class FFmpegEngineTest {
     fun encodesFlacLosslessAudio() {
         val out = convert(OutputFormat.FLAC)
         assertTrue("no FLAC produced", out.exists() && out.length() > 0)
+        // "fLaC", the native FLAC stream marker. Without this the test passed on any non-empty
+        // file, so a builder arm emitting the wrong encoder into a .flac name shipped green
+        // (#228) -- the same shape the five assertions above already guard against.
+        val magic = out.inputStream().use { String(it.readNBytes(4), Charsets.US_ASCII) }
+        assertEquals("fLaC", magic)
     }
 
     @Test
@@ -127,6 +161,219 @@ class FFmpegEngineTest {
     fun encodesOpus() {
         val out = convert(OutputFormat.OPUS)
         assertTrue("no Opus produced", out.exists() && out.length() > 0)
+        // OutputFormat.OPUS is Container.OGG, so the file is an Ogg stream: "OggS" (#228).
+        // Deliberately the container marker rather than the codec -- it is what the other
+        // container-level assertions in this class check, and it is four bytes at offset 0.
+        val magic = out.inputStream().use { String(it.readNBytes(4), Charsets.US_ASCII) }
+        assertEquals("OggS", magic)
+    }
+
+    /**
+     * The first execution, ever, of the Vorbis encode arm — and the reason it needed one.
+     *
+     * `FFmpegCommandBuilder` carried `-c:a libvorbis` from the day it was written and nothing
+     * could ask for it: no preset produced `AudioCodec.VORBIS` and `ContainerCapabilities` left it
+     * out of the encodable set, so the arm was unreachable from both ends (#254). It was also
+     * **wrong**: `--enable-libvorbis` was in neither `bin/README.md`'s configure line nor
+     * `tools/ffmpeg/build-ffmpeg.sh`, and `libvorbis` was not among the encoder names in the
+     * shipped `libavcodec.so`. The first user to pick Ogg Vorbis would have got "Unknown encoder
+     * 'libvorbis'". #254 rebuilt the AAR with `--enable-libvorbis`; **this test is the only thing
+     * in the repo that can tell whether that rebuild actually included it**, because a wrong
+     * ffmpeg-kit `--enable-*` name is ignored silently and the JVM cannot tell a real encoder name
+     * from a fictional one.
+     *
+     * ## Why the container magic is not enough here
+     *
+     * `encodesOpus` above stops at `OggS`, and for that test it is sufficient. Here it would be
+     * **vacuous**: Vorbis and Opus are both Ogg streams, so this ticket's acceptance mutation —
+     * pointing the arm at `libopus` — produces a file with byte-identical first four bytes.
+     * Measured, not assumed: `-c:a libopus -b:a 128k -f ogg` on this class's own fixture writes
+     * `OggS` too. So the assertion has to reach the track, and `MediaExtractor` reporting
+     * `audio/vorbis` against `audio/opus` is what separates them.
+     *
+     * Asserted as the whole track list rather than as "contains Vorbis", which also pins that the
+     * `-vn` from the audio-only path really dropped the video: a stray video track would fail here
+     * rather than pass an `any { ... }` check.
+     *
+     * ## The channel count is the second claim, and it is not decoration
+     *
+     * `sample_h264.mp4` is **mono** — one AAC channel — and that is what makes this assertion
+     * bite. FFmpeg's in-tree `vorbis` encoder is stereo-only, so building on it forces `-ac 2` and
+     * silently upmixes every mono source, a compromise this app makes in no other arm. That
+     * compromise is the reason #254 rebuilt the binary rather than shipping the in-tree encoder,
+     * so re-adding `-ac 2` has to redden something: it reddens this.
+     */
+    @Test
+    fun encodesOggVorbisThroughAnEncoderTheBundledBinaryActuallyHas() {
+        val out = convert(OutputFormat.OGG_VORBIS)
+        assertTrue("no Ogg produced", out.exists() && out.length() > 0)
+
+        val magic = out.inputStream().use { String(it.readNBytes(4), Charsets.US_ASCII) }
+        assertEquals("OggS", magic)
+        assertEquals(
+            "expected a lone Vorbis track -- an Opus one would carry the same OggS magic",
+            listOf(MediaFormat.MIMETYPE_AUDIO_VORBIS),
+            trackMimes(out),
+        )
+        assertEquals(
+            "the fixture is mono and libvorbis takes any channel count, so nothing may upmix it",
+            listOf(1),
+            channelCounts(out),
+        )
+    }
+
+    /**
+     * The percentage itself, which every other test in this class computes and none of them reads.
+     *
+     * `FFmpegEngine` derives progress as `stats.time / durationMs * 100`, and the statistics
+     * callback runs on every conversion here — but every call site omits `onProgress`, so until
+     * this test nothing on any source set had ever looked at the number (#229). #196 covered the
+     * *worker's* progress lambda, and did it with a fake engine that reports whatever the test
+     * tells it to; `ProgressNotificationTest` covers throttling the same way. The arithmetic was
+     * the one part with no reader.
+     *
+     * ## Why the duration is deliberately wrong
+     *
+     * `sample_h264.mp4` is exactly 3.000 s, and this passes **30 s** as the duration. So the
+     * conversion still encodes the whole clip, `stats.time` still climbs to about 3000 ms, and the
+     * reported percentage tops out around **10** rather than 100.
+     *
+     * That is what makes the assertion bite. A range check alone is worthless here: replacing
+     * `percent` with a constant `0` satisfies "every value is in 0..100" and "the values never go
+     * backwards", and so does a list of `[0, 100]`. Pinning the *band* rejects every constant, and
+     * — because the band is a tenth of the way up — it also rejects an implementation that ignores
+     * `durationMs`, which would report ~100 for the same run.
+     *
+     * The bound is deliberately loose (5..25 for an expected 10). The last statistics callback can
+     * land slightly before the final frame, so the peak is "about 3000 ms of a claimed 30 000",
+     * not exactly it.
+     */
+    @Test
+    fun progressIsReportedAsAFractionOfTheDurationItWasGiven() {
+        val seen = mutableListOf<Int>()
+        val out = outputFor("out_progress.mp4")
+        runBlocking {
+            engine.run(
+                request = ConversionRequest(spec = OutputFormat.MP4_H264.spec, quality = QualityTier.BEST),
+                inputPath = input.absolutePath,
+                output = out,
+                // Ten times the fixture's real 3 s. See the KDoc.
+                durationMs = 30_000,
+                onProgress = { percent -> seen += percent },
+            )
+        }
+
+        assertTrue("the statistics callback never reported progress", seen.isNotEmpty())
+        assertTrue("progress out of range: $seen", seen.all { it in 0..100 })
+        assertEquals("progress went backwards: $seen", seen.sorted(), seen)
+        // The band. Rejects any constant, and rejects ignoring durationMs (which would read ~100).
+        val peak = seen.max()
+        assertTrue(
+            "3 s of media against a claimed 30 s should peak near 10%, got $peak from $seen",
+            peak in 5..25,
+        )
+    }
+
+    /**
+     * Cancelling a *running* conversion actually stops the native session.
+     *
+     * Nothing on any source set did this before (#224). Every `cancel` in `app/src/androidTest` is
+     * `WorkManager.cancelWorkById` against work that is **queued or already finished** — the two in
+     * `ReattachOnLaunchTest` cancel a job carrying a one-hour initial delay, and one immediately
+     * after enqueue. On the JVM, `WorkerCancellationTest` and `HardwareFallbackTest`'s cancellation
+     * case drive a `SoftwareTranscoder` double that records the call. No test had ever asked a real
+     * native session to stop. This is `docs/defect-audit.md` **D10**'s forcing condition.
+     *
+     * It is the one path where cancelling wrong is silently expensive rather than loudly broken: a
+     * missed `FFmpegKit.cancel` leaves the native process encoding to completion while the UI says
+     * the job is cancelled, and nothing reports the battery and thermal cost.
+     *
+     * ## Why the assertion is the session's return code, not the output file
+     *
+     * The obvious assertion — the partial output is gone — **cannot fail**, so it would have been a
+     * vacuous test. `invokeOnCancellation` deletes the path, and on POSIX unlinking a file ffmpeg
+     * still holds open leaves ffmpeg writing to the unlinked inode; the path stays gone whether or
+     * not the cancel ever reached the session. Deleting `FFmpegKit.cancel` and keeping
+     * `output.delete()` passes that check every time.
+     *
+     * What distinguishes them is the session's own verdict: a cancelled session ends with the
+     * cancel return code, a completed one ends successfully. That is a fact about the session
+     * rather than about timing, so it is read *after* waiting for the session to leave
+     * [SessionState.RUNNING] rather than at a fixed delay.
+     *
+     * ## Why it cancels on RUNNING rather than on the first progress callback
+     *
+     * Measured. Cancelling from the first `onProgress` was tried first and **failed on a local API
+     * 34 emulator with `state=COMPLETED rc=0`** — every committed fixture is 2-3 s at 320x240, and
+     * the encode finishes before the first statistics callback has been delivered and acted on. The
+     * progress callback proves the session is running, but arrives too late to interrupt anything.
+     * `FFmpegKit.listSessions` shows the session [SessionState.RUNNING] far earlier.
+     *
+     * ## Why it retries, which is the part that took two attempts to get right
+     *
+     * Waiting for `RUNNING` is not on its own enough. With `MP4_H265` at [QualityTier.BEST] this
+     * passed four consecutive local runs and all five CI legs, then failed on the API 34 and 35 legs
+     * of the next PR with `state=COMPLETED rc=0`. Nothing had changed: on a loaded runner the thread
+     * that observed `RUNNING` can be descheduled long enough for a short encode to finish before it
+     * calls `cancel`. A longer timeout does not help — the wait already succeeded.
+     *
+     * Two changes together, because neither is sufficient:
+     *
+     *  - **A slower encode.** `WEBM_VP9` at `BEST` is the slowest thing this builder emits:
+     *    `libvpx-vp9 -crf 31 -b:v 0`, with `-deadline realtime` added **only** on
+     *    [QualityTier.FAST]. Probed on an API 34 emulator, that session is still `RUNNING` at 1 s
+     *    and finished by 2 s, against well under a second for x265 `-preset medium`.
+     *  - **Retrying the attempt.** An attempt whose session finished before the cancel landed has
+     *    not tested anything, so it is not a failure — it is a miss, and it is retried. Only
+     *    exhausting [CANCEL_ATTEMPTS] is a failure, and its message says which case it hit.
+     *
+     * That keeps the mutation honest: with `FFmpegKit.cancel` removed **every** attempt ends
+     * `COMPLETED`, so the test still fails — it just takes [CANCEL_ATTEMPTS] tries to say so.
+     *
+     * The session is identified by diffing against the ids present before each attempt, because
+     * this class has already produced eight of them by the time this executes.
+     */
+    @Test
+    fun cancellingARunningConversionCancelsTheNativeSession(): Unit = runBlocking {
+        val outcomes = mutableListOf<String>()
+
+        repeat(CANCEL_ATTEMPTS) { attempt ->
+            val before = FFmpegKit.listSessions().map { it.getSessionId() }.toSet()
+            val out = outputFor("out_cancelled_$attempt.webm")
+
+            val job = launch(Dispatchers.IO) {
+                engine.run(
+                    // The slowest target this builder emits -- see the KDoc. Not decoration:
+                    // with a faster one this loses the race on a loaded CI runner.
+                    request = ConversionRequest(spec = OutputFormat.WEBM_VP9.spec, quality = QualityTier.BEST),
+                    inputPath = input.absolutePath,
+                    output = out,
+                    durationMs = 3_000,
+                )
+            }
+
+            val ours = withTimeout(TIMEOUT_MS) {
+                var found: FFmpegSession? = null
+                while (found == null) {
+                    found = FFmpegKit.listSessions().firstOrNull { it.getSessionId() !in before }
+                    if (found == null) delay(POLL_MS)
+                }
+                found
+            }
+            job.cancelAndJoin()
+            withTimeout(TIMEOUT_MS) {
+                while (ours.getState() == SessionState.RUNNING) delay(POLL_MS)
+            }
+
+            if (ReturnCode.isCancel(ours.getReturnCode())) return@runBlocking
+            // The encode beat us to it. That attempt proved nothing either way, so try again.
+            outcomes += "state=${ours.getState()} rc=${ours.getReturnCode()}"
+        }
+
+        fail(
+            "never interrupted a running session in $CANCEL_ATTEMPTS attempts, so either every " +
+                "encode finished first or cancellation does not reach it: $outcomes",
+        )
     }
 
     // --- the quality tier the GPL licence was taken for --------------------
@@ -166,4 +413,19 @@ class FFmpegEngineTest {
         }.exceptionOrNull()
         assertTrue("expected an FFmpegException, got $failure", failure is FFmpegEngine.FFmpegException)
     }
+
+    private companion object {
+        /** Generous: it bounds a hang, and every wait here normally settles in well under a second. */
+        const val TIMEOUT_MS = 30_000L
+        const val POLL_MS = 50L
+
+        /**
+         * How many times to try to catch the session mid-encode.
+         *
+         * Each miss costs about the length of one VP9 encode -- a second or two -- and a miss is
+         * the loaded-runner case rather than a defect. Five is enough that exhausting them means
+         * cancellation is not reaching the session, which is what the failure message says.
+         */
+        const val CANCEL_ATTEMPTS = 5
+    }
 }

app/src/androidTest/java/org/libremediaconverter/join/ConcatEngineTest.kt

@@ -5,17 +5,29 @@ import android.media.MediaFormat
 import android.net.Uri
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
+import com.arthenica.ffmpegkit.FFmpegKit
+import com.arthenica.ffmpegkit.FFmpegSession
+import com.arthenica.ffmpegkit.ReturnCode
+import com.arthenica.ffmpegkit.SessionState
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.libremediaconverter.convert.MediaProbe
 import org.libremediaconverter.convert.StagingNames
 import org.libremediaconverter.ffmpeg.ConcatEngine
+import org.libremediaconverter.ffmpeg.FFmpegEngine
 import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.work.ConcatWorker
 import java.io.File
 
 /**
@@ -50,6 +62,82 @@ class ConcatEngineTest {
         (staged + listOf(clipA, clipB, clipMismatched)).forEach { it.delete() }
     }
 
+    /**
+     * Cancelling a *running* join actually stops the native session.
+     *
+     * The `FFmpegEngine` half of #224 landed first (PR #236); this is the same gap in
+     * [ConcatEngine]. Before these two, no test on any source set had ever asked a real native
+     * session to stop — every `cancel` in `app/src/androidTest` targets WorkManager entries that
+     * are queued or already finished.
+     *
+     * ## Two things carried over from the conversion side, both measured there
+     *
+     * **The assertion is the session's return code.** A cancelled session ends with the cancel
+     * code, a completed one does not. The alternative — checking the output file — is even less
+     * available here than it was for conversions: [ConcatEngine] does not delete its output on
+     * cancellation at all. Its `invokeOnCancellation` is `FFmpegKit.cancel(...)` and nothing else,
+     * where [org.libremediaconverter.ffmpeg.FFmpegEngine]'s also deletes the partial. Whether that
+     * asymmetry is deliberate is a separate question from this test, which is why this asserts the
+     * thing that is true of both.
+     *
+     * **The cancel is triggered on [SessionState.RUNNING], not on progress.** `ConcatWorker`
+     * publishes no progress at all, so there is no callback to hang it on even in principle — but
+     * the conversion side established the deeper reason: the committed clips are 2 s at 320x240 and
+     * the encode outruns a callback-triggered cancel.
+     *
+     * **And the attempt is retried**, for the reason the conversion side measured the hard way: on
+     * a loaded runner the thread that observed `RUNNING` can be descheduled long enough for a short
+     * encode to finish before it calls `cancel`, which failed two CI legs there. An attempt whose
+     * session finished first has tested nothing, so it is a miss rather than a failure; only
+     * exhausting [CANCEL_ATTEMPTS] fails, and with `FFmpegKit.cancel` removed every attempt misses,
+     * so the mutation still bites.
+     *
+     * The inputs are deliberately the **mismatched** pair, so [ConcatStrategy.REENCODE] is chosen.
+     * A stream copy of two short clips is close to instantaneous and would leave nothing to
+     * interrupt; re-encoding is the case where a user would actually reach for Cancel.
+     *
+     * *Mutation:* drop `FFmpegKit.cancel(session.getSessionId())` from `ConcatEngine`'s
+     * `invokeOnCancellation` — the session runs to completion and this fails.
+     */
+    @Test
+    fun cancellingARunningJoinCancelsTheNativeSession(): Unit = runBlocking {
+        val outcomes = mutableListOf<String>()
+
+        repeat(CANCEL_ATTEMPTS) { attempt ->
+            val before = FFmpegKit.listSessions().map { it.getSessionId() }.toSet()
+            val out = output("cancelled_join_$attempt.mp4")
+
+            val job = launch(Dispatchers.IO) {
+                engine.join(
+                    listOf(Uri.fromFile(clipA), Uri.fromFile(clipMismatched)),
+                    out,
+                    ConcatWorker.DEFAULT_FORMAT,
+                )
+            }
+
+            val ours = withTimeout(TIMEOUT_MS) {
+                var found: FFmpegSession? = null
+                while (found == null) {
+                    found = FFmpegKit.listSessions().firstOrNull { it.getSessionId() !in before }
+                    if (found == null) delay(POLL_MS)
+                }
+                found
+            }
+            job.cancelAndJoin()
+            withTimeout(TIMEOUT_MS) {
+                while (ours.getState() == SessionState.RUNNING) delay(POLL_MS)
+            }
+
+            if (ReturnCode.isCancel(ours.getReturnCode())) return@runBlocking
+            outcomes += "state=${ours.getState()} rc=${ours.getReturnCode()}"
+        }
+
+        fail(
+            "never interrupted a running join in $CANCEL_ATTEMPTS attempts, so either every " +
+                "encode finished first or cancellation does not reach it: $outcomes",
+        )
+    }
+
     private fun copyAsset(name: String): File {
         val out = File(context.cacheDir, name)
         InstrumentationRegistry.getInstrumentation().context.assets
@@ -149,6 +237,55 @@ class ConcatEngineTest {
         )
     }
 
+    /**
+     * A failed join tells the user the return code and what FFmpeg said.
+     *
+     * **This is the device half of #203/#217**, whose PR closed by noting the join legs had not
+     * been run. Running them would not have answered it: nothing on either source set drove a real
+     * join *failure*, so the unified message was asserted only against values a JVM test hands to
+     * `sessionOutcome` directly.
+     *
+     * What is device-only here is that the three reads behind that message work against a real
+     * native session at all — `getReturnCode`, `getFailStackTrace` and `getAllLogsAsString`. If
+     * the log tail came back null or empty on a device, the user would get `Joining failed (1): `
+     * with nothing after the colon and every JVM test would still pass.
+     *
+     * **What this deliberately does not pin is the preference between the two detail sources.** On
+     * an ordinary non-zero return code FFmpegKit reports no fail stack trace, so the stack-trace-
+     * first rule and the log-tail-first rule produce the same text and no assertion here can tell
+     * them apart. That ordering is [SessionOutcomeTest][org.libremediaconverter.ffmpeg.SessionOutcomeTest]'s
+     * job, where both sources can be non-blank at once. Asserting it here would be a test whose
+     * KDoc claims more than it checks — the `probeForConcat` mistake wave 3 caught.
+     *
+     * The failure is forced with an input that does not exist, which the concat demuxer rejects
+     * the same way on every FFmpeg build, rather than with malformed media whose handling varies.
+     */
+    @Test
+    fun aFailedJoinReportsTheReturnCodeAndWhatFFmpegSaid(): Unit = runBlocking {
+        val missing = File(context.cacheDir, "no_such_clip.mp4").also { it.delete() }
+        val out = output("joined_failure.mp4")
+
+        val failure = runCatching {
+            engine.join(listOf(Uri.fromFile(clipA), Uri.fromFile(missing)), out)
+        }.exceptionOrNull()
+
+        assertTrue(
+            "a join over a missing input must fail, got $failure",
+            failure is FFmpegEngine.FFmpegException,
+        )
+        val message = failure?.message.orEmpty()
+        assertTrue(
+            "the message must name the operation and carry the return code, was: '$message'",
+            message.startsWith("Joining failed ("),
+        )
+        // The half a JVM test cannot reach: a real session actually produced detail to show.
+        val detail = message.substringAfter("): ", "")
+        assertTrue(
+            "the message stopped at the return code and told the user nothing, was: '$message'",
+            detail.isNotBlank(),
+        )
+    }
+
     @Test
     fun theListFileIsCleanedUpAfterJoining(): Unit = runBlocking {
         val out = output("joined_cleanup.mp4")
@@ -180,4 +317,13 @@ class ConcatEngineTest {
             a.width != mismatched.width || a.height != mismatched.height,
         )
     }
+
+    private companion object {
+        /** Generous: it bounds a hang, and both waits here normally settle in well under a second. */
+        const val TIMEOUT_MS = 30_000L
+        const val POLL_MS = 50L
+
+        /** See the conversion side: a miss is the loaded-runner case, not a defect. */
+        const val CANCEL_ATTEMPTS = 5
+    }
 }

app/src/androidTest/java/org/libremediaconverter/saf/ContentUriInputTest.kt

@@ -0,0 +1,123 @@
+package org.libremediaconverter.saf
+
+import androidx.media3.common.util.UnstableApi
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.ffmpeg.ConcatEngine
+import org.libremediaconverter.model.Engine
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
+import org.libremediaconverter.work.ConversionWorker
+import java.io.File
+
+/**
+ * A `content://` input reaching FFmpeg successfully, which nothing had ever driven (#225).
+ *
+ * `FFmpegKitConfig.getSafParameterForRead` stands between a SAF grant and the native process, and
+ * it is on **every real user conversion**. Every passing convert and join test in this suite hands
+ * the worker a `Uri.fromFile(...)`, which takes the `uri.path` arm instead — so the bridge was
+ * exercised only on its failure side, by `UnopenableUriTest` naming an authority that does not
+ * exist. That proves the error message, not the bridge.
+ *
+ * ## Why a plain provider rather than the documents one
+ *
+ * [FixtureDocumentsProvider] cannot be reached from the app, measured three ways on an API 34
+ * emulator (#226): a `DOCUMENTS_PROVIDER` declared without `MANAGE_DOCUMENTS` is refused at install
+ * — *"Provider must be protected by MANAGE_DOCUMENTS"*; instrumentation runs in the **target app's
+ * process**, so `Instrumentation.getContext()` still carries the app's uid and is denied; and
+ * `adoptShellPermissionIdentity(MANAGE_DOCUMENTS)` is denied identically. The denial names the only
+ * way in: *"you obtain access using ACTION_OPEN_DOCUMENT or related APIs"*.
+ *
+ * The bridge does not need one. It opens a descriptor through the resolver and hands FFmpeg a
+ * `saf:` path, so any readable `content://` URI exercises it — and [FixtureContentProvider] is an
+ * ordinary provider, which may be exported without a permission. The whole class is headless: no
+ * DocumentsUI, and none of the flake #190 records.
+ *
+ * ## Why MP3
+ *
+ * The bridge lives on the FFmpeg arm, and MP3 is the format the router sends there unconditionally
+ * — no platform encoder exists at any API level, so `ConversionWorkerTest.routesAnMp3JobToFfmpeg…`
+ * relies on the same fact. Choosing a video target would make the engine depend on the device's
+ * codecs, and #223 is what that costs.
+ *
+ * *Mutation:* make `getSafParameterForRead` return `uri.toString()`. FFmpeg cannot open it and both
+ * tests fail; nothing else in either suite notices.
+ */
+@UnstableApi
+@RunWith(AndroidJUnit4::class)
+class ContentUriInputTest {
+
+    private val context = InstrumentationRegistry.getInstrumentation().targetContext
+    private val workManager = WorkManager.getInstance(context)
+
+    @After
+    fun tearDown() {
+        File(context.cacheDir, "conversions").listFiles()?.forEach { it.delete() }
+    }
+
+    @Test
+    fun aContentUriInputConvertsThroughTheSafBridge(): Unit = runBlocking {
+        val input = FixtureContentProvider.uriFor(SAMPLE)
+        val request = ConversionWorker.request(
+            inputUri = input,
+            displayName = SAMPLE,
+            sizeBytes = 0L,
+            spec = OutputFormat.MP3.spec,
+            quality = QualityTier.FAST,
+        )
+        workManager.enqueue(request).result.get()
+
+        val terminal = withTimeout(TIMEOUT_MS) {
+            workManager.getWorkInfoByIdFlow(request.id).first { it != null && it.state.isFinished }
+        }
+
+        val error = terminal?.outputData?.getString(ConversionWorker.KEY_ERROR)
+        assertEquals(
+            "a content:// input must convert, but failed with: $error",
+            WorkInfo.State.SUCCEEDED,
+            terminal?.state,
+        )
+        // The bridge is on the FFmpeg arm only, so this is part of the claim rather than colour.
+        assertEquals(Engine.FFMPEG.name, terminal?.outputData?.getString(ConversionWorker.KEY_ENGINE_USED))
+
+        val out = File(terminal!!.outputData.getString(ConversionWorker.KEY_OUTPUT_PATH)!!)
+        assertTrue("no output produced from a content:// input", out.exists() && out.length() > 0)
+        out.delete()
+    }
+
+    /**
+     * The same bridge on the join path, which has its own copy of the call (`ConcatEngine:36`).
+     *
+     * Driven through the engine rather than `ConcatWorker` because the engine is where the branch
+     * is; the worker adds a foreground service and nothing else this is about.
+     */
+    @Test
+    fun contentUriInputsJoinThroughTheSafBridge(): Unit = runBlocking {
+        val out = File(context.cacheDir, "joined_from_content.mp4").apply { delete() }
+        val result = ConcatEngine(context).join(
+            listOf(FixtureContentProvider.uriFor(CLIP_A), FixtureContentProvider.uriFor(CLIP_B)),
+            out,
+            OutputFormat.MP4_H264,
+        )
+
+        assertTrue("no output produced from content:// inputs", result.output.length() > 0)
+        out.delete()
+    }
+
+    private companion object {
+        const val SAMPLE = "sample_h264.mp4"
+        const val CLIP_A = "clip_a.mp4"
+        const val CLIP_B = "clip_b.mp4"
+        const val TIMEOUT_MS = 300_000L
+    }
+}

app/src/androidTest/java/org/libremediaconverter/saf/FixtureContentProvider.java

@@ -0,0 +1,135 @@
+package org.libremediaconverter.saf;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+import android.os.ParcelFileDescriptor;
+import android.provider.OpenableColumns;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+/**
+ * A plain {@link ContentProvider} serving the committed media fixtures over {@code content://}.
+ *
+ * <p><b>Why this exists alongside {@link FixtureDocumentsProvider}.</b> Every passing convert and
+ * join test hands the worker a {@code Uri.fromFile(...)}, which takes the {@code uri.path} arm and
+ * never touches {@code FFmpegKitConfig.getSafParameterForRead}. That bridge is on 100% of real user
+ * conversions and was on 0% of tested ones; only its failure side was covered, by
+ * {@code UnopenableUriTest} pointing at an authority that does not exist.
+ *
+ * <p><b>Why not the documents provider.</b> It cannot be reached. Measured three ways on an API 34
+ * emulator: a {@code DOCUMENTS_PROVIDER} declared without {@code MANAGE_DOCUMENTS} is refused at
+ * install ("Provider must be protected by MANAGE_DOCUMENTS"); instrumentation runs in the target
+ * app's process, so {@code Instrumentation.getContext()} still carries the app's uid and is denied;
+ * and {@code adoptShellPermissionIdentity(MANAGE_DOCUMENTS)} is denied identically. The denial says
+ * what is required — <i>"you obtain access using ACTION_OPEN_DOCUMENT or related APIs"</i> — so a
+ * documents provider is reachable only through a picker-issued grant. See issue #226.
+ *
+ * <p>The bridge does not need one. {@code getSafParameterForRead} opens a file descriptor through
+ * the resolver and hands FFmpeg a {@code saf:} path; any readable {@code content://} URI exercises
+ * it. An ordinary provider may be exported without a permission, so this one is, and the whole test
+ * stays headless — no DocumentsUI, and none of the flake #190 records.
+ *
+ * <p>Unlike {@link FixtureDocumentsProvider} this may use {@code androidx} and Kotlin freely — it is
+ * loaded into the app process like any other provider, not into the bare test process. It is kept
+ * in Java anyway, next to its sibling, so the two read alike.
+ */
+public final class FixtureContentProvider extends ContentProvider {
+
+    /** Authority. Distinct from the documents provider's, and from anything the app declares. */
+    public static final String AUTHORITY = "org.libremediaconverter.test.content";
+
+    /** Builds a URI for one of this source set's committed assets, e.g. {@code sample_h264.mp4}. */
+    public static Uri uriFor(String assetName) {
+        return new Uri.Builder().scheme("content").authority(AUTHORITY).appendPath(assetName).build();
+    }
+
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    @Override
+    public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {
+        if (!"r".equals(mode)) {
+            throw new FileNotFoundException("this provider is read-only: " + mode);
+        }
+        return ParcelFileDescriptor.open(unpack(assetOf(uri)), ParcelFileDescriptor.MODE_READ_ONLY);
+    }
+
+    /**
+     * Enough of {@link OpenableColumns} for {@code InputQuery.describe} to name and size the input.
+     *
+     * <p>Without these the app reaches the "Size unknown" screen, which is a different test.
+     */
+    @Override
+    public Cursor query(Uri uri, String[] projection, String selection, String[] args, String sort) {
+        String asset = assetOf(uri);
+        File file;
+        try {
+            file = unpack(asset);
+        } catch (FileNotFoundException e) {
+            return null;
+        }
+        MatrixCursor cursor = new MatrixCursor(
+            new String[] {OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE});
+        cursor.newRow().add(OpenableColumns.DISPLAY_NAME, asset).add(OpenableColumns.SIZE, file.length());
+        return cursor;
+    }
+
+    @Override
+    public String getType(Uri uri) {
+        return assetOf(uri).endsWith(".m4a") ? "audio/mp4" : "video/mp4";
+    }
+
+    @Override
+    public Uri insert(Uri uri, ContentValues values) {
+        throw new UnsupportedOperationException("read-only fixture provider");
+    }
+
+    @Override
+    public int delete(Uri uri, String selection, String[] args) {
+        throw new UnsupportedOperationException("read-only fixture provider");
+    }
+
+    @Override
+    public int update(Uri uri, ContentValues values, String selection, String[] args) {
+        throw new UnsupportedOperationException("read-only fixture provider");
+    }
+
+    private static String assetOf(Uri uri) {
+        String asset = uri.getLastPathSegment();
+        return asset == null ? "" : asset;
+    }
+
+    /**
+     * The asset on disk, unpacked the first time anything asks.
+     *
+     * <p>Reported as {@link FileNotFoundException} rather than swallowed: a provider answering with
+     * a zero-byte file would fail the conversion for a reason nothing states.
+     */
+    private File unpack(String asset) throws FileNotFoundException {
+        File file = new File(getContext().getCacheDir(), "provided_" + asset);
+        if (file.length() > 0L) {
+            return file;
+        }
+        try (InputStream source = getContext().getAssets().open(asset);
+                OutputStream sink = new FileOutputStream(file)) {
+            byte[] buffer = new byte[8192];
+            int read;
+            while ((read = source.read(buffer)) != -1) {
+                sink.write(buffer, 0, read);
+            }
+        } catch (IOException e) {
+            throw new FileNotFoundException("could not unpack " + asset + ": " + e);
+        }
+        return file;
+    }
+}

app/src/androidTest/java/org/libremediaconverter/saf/FixtureDocumentsProvider.java

@@ -104,6 +104,17 @@ public final class FixtureDocumentsProvider extends DocumentsProvider {
     private static final String ROOT_DOCUMENT_ID = "root";
     private static final String FIXTURE_DOCUMENT_ID = "root/" + FIXTURE_DISPLAY_NAME;
 
+    /**
+     * Prefix for documents this provider CREATES, as opposed to the one it serves for reading.
+     *
+     * <p>Two namespaces rather than one so a destination can never be confused with the fixture.
+     * The fixture is read-only and must stay that way for the picker tests; a destination is
+     * writable and deletable, which is what {@code PublishToRealSafDestinationTest} needs.
+     */
+    public static final String DESTINATION_PREFIX = "dest/";
+
+    /** Document ids {@link #deleteDocument} was called with, newest last. Cleared by {@link #reset}. */
+
     /** Already in this source set, and already a real H.264 MP4 the engines can open. */
     private static final String FIXTURE_ASSET = "sample_h264.mp4";
 
@@ -147,7 +158,7 @@ public final class FixtureDocumentsProvider extends DocumentsProvider {
             .add(Root.COLUMN_TITLE, ROOT_TITLE)
             .add(Root.COLUMN_SUMMARY, "Instrumentation fixture")
             .add(Root.COLUMN_MIME_TYPES, FIXTURE_MIME_TYPE)
-            .add(Root.COLUMN_FLAGS, Root.FLAG_LOCAL_ONLY)
+            .add(Root.COLUMN_FLAGS, Root.FLAG_LOCAL_ONLY | Root.FLAG_SUPPORTS_CREATE)
             .add(Root.COLUMN_ICON, android.R.drawable.ic_menu_gallery);
         return cursor;
     }
@@ -159,6 +170,8 @@ public final class FixtureDocumentsProvider extends DocumentsProvider {
             addDirectoryRow(cursor);
         } else if (FIXTURE_DOCUMENT_ID.equals(documentId)) {
             addFixtureRow(cursor);
+        } else if (documentId != null && documentId.startsWith(DESTINATION_PREFIX)) {
+            addDestinationRow(cursor, documentId);
         } else {
             throw new FileNotFoundException("no such document: " + documentId);
         }
@@ -178,10 +191,63 @@ public final class FixtureDocumentsProvider extends DocumentsProvider {
     @Override
     public ParcelFileDescriptor openDocument(String documentId, String mode, CancellationSignal signal)
             throws FileNotFoundException {
-        if (!FIXTURE_DOCUMENT_ID.equals(documentId)) {
+        if (FIXTURE_DOCUMENT_ID.equals(documentId)) {
+            return ParcelFileDescriptor.open(fixtureFile(), ParcelFileDescriptor.MODE_READ_ONLY);
+        }
+        if (documentId == null || !documentId.startsWith(DESTINATION_PREFIX)) {
             throw new FileNotFoundException("no such document: " + documentId);
         }
-        return ParcelFileDescriptor.open(fixtureFile(), ParcelFileDescriptor.MODE_READ_ONLY);
+        int flags = "r".equals(mode)
+            ? ParcelFileDescriptor.MODE_READ_ONLY
+            : ParcelFileDescriptor.MODE_READ_WRITE | ParcelFileDescriptor.MODE_TRUNCATE;
+        return ParcelFileDescriptor.open(destinationFile(documentId), flags);
+    }
+
+    /**
+     * Creates a real, empty file and reports the document id for it.
+     *
+     * <p><b>Empty is the whole point, and this provider does not get to decide it.</b> The premise
+     * under test in {@code PublishToRealSafDestinationTest} is what <i>DocumentsUI</i> hands back
+     * from {@code ACTION_CREATE_DOCUMENT}, and {@code OutputPublisher.destinationIsKnownEmpty}
+     * authorises its cleanup delete only on a positive zero. This creates the file and writes
+     * nothing to it, which is what the SAF contract documents; the test asserts what actually came
+     * back rather than trusting either side.
+     */
+    @Override
+    public String createDocument(String parentDocumentId, String mimeType, String displayName)
+            throws FileNotFoundException {
+        if (!ROOT_DOCUMENT_ID.equals(parentDocumentId)) {
+            throw new FileNotFoundException("cannot create in: " + parentDocumentId);
+        }
+        String documentId = DESTINATION_PREFIX + displayName;
+        File file = destinationFile(documentId);
+        try {
+            if (!file.createNewFile() && !file.exists()) {
+                throw new FileNotFoundException("could not create: " + documentId);
+            }
+        } catch (IOException e) {
+            throw new FileNotFoundException("could not create " + documentId + ": " + e);
+        }
+        return documentId;
+    }
+
+    @Override
+    public void deleteDocument(String documentId) throws FileNotFoundException {
+        if (documentId == null || !documentId.startsWith(DESTINATION_PREFIX)) {
+            throw new FileNotFoundException("refusing to delete: " + documentId);
+        }
+        destinationFile(documentId).delete();
+    }
+
+    /** Removes created destinations. The process outlives one class. */
+    public static void reset(File filesDir) {
+        File dir = new File(filesDir, "destinations");
+        File[] children = dir.listFiles();
+        if (children != null) {
+            for (File child : children) {
+                child.delete();
+            }
+        }
     }
 
     private void addDirectoryRow(MatrixCursor cursor) {
@@ -189,10 +255,32 @@ public final class FixtureDocumentsProvider extends DocumentsProvider {
             .add(Document.COLUMN_DOCUMENT_ID, ROOT_DOCUMENT_ID)
             .add(Document.COLUMN_DISPLAY_NAME, ROOT_TITLE)
             .add(Document.COLUMN_MIME_TYPE, Document.MIME_TYPE_DIR)
-            .add(Document.COLUMN_FLAGS, 0)
+            .add(Document.COLUMN_FLAGS, Document.FLAG_DIR_SUPPORTS_CREATE)
             .add(Document.COLUMN_SIZE, null);
     }
 
+    private void addDestinationRow(MatrixCursor cursor, String documentId) throws FileNotFoundException {
+        File file = destinationFile(documentId);
+        if (!file.exists()) {
+            throw new FileNotFoundException("no such document: " + documentId);
+        }
+        cursor.newRow()
+            .add(Document.COLUMN_DOCUMENT_ID, documentId)
+            .add(Document.COLUMN_DISPLAY_NAME, documentId.substring(DESTINATION_PREFIX.length()))
+            .add(Document.COLUMN_MIME_TYPE, FIXTURE_MIME_TYPE)
+            .add(Document.COLUMN_FLAGS, Document.FLAG_SUPPORTS_DELETE | Document.FLAG_SUPPORTS_WRITE)
+            .add(Document.COLUMN_SIZE, file.length())
+            .add(Document.COLUMN_LAST_MODIFIED, file.lastModified());
+    }
+
+    private File destinationFile(String documentId) throws FileNotFoundException {
+        File dir = new File(getContext().getFilesDir(), "destinations");
+        if (!dir.isDirectory() && !dir.mkdirs()) {
+            throw new FileNotFoundException("could not make the destinations directory");
+        }
+        return new File(dir, documentId.substring(DESTINATION_PREFIX.length()));
+    }
+
     private void addFixtureRow(MatrixCursor cursor) throws FileNotFoundException {
         File file = fixtureFile();
         cursor.newRow()

app/src/androidTest/java/org/libremediaconverter/saf/SafPickerRoundTripTest.kt

@@ -1,12 +1,20 @@
 package org.libremediaconverter.saf
 
+import android.Manifest
 import android.app.UiAutomation
+import android.content.Context
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.provider.DocumentsContract
+import android.provider.OpenableColumns
 import androidx.compose.ui.test.ComposeTimeoutException
+import androidx.compose.ui.test.assertIsEnabled
 import androidx.compose.ui.test.assertTextEquals
 import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
 import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
 import androidx.media3.common.util.UnstableApi
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
@@ -19,15 +27,27 @@ import androidx.test.uiautomator.Configurator
 import androidx.test.uiautomator.StaleObjectException
 import androidx.test.uiautomator.UiDevice
 import androidx.test.uiautomator.Until
+import androidx.work.WorkManager
 import org.junit.After
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.libremediaconverter.FailsOnEmulatorApi37
 import org.libremediaconverter.MainActivity
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.OutputPublisher
 import org.libremediaconverter.ui.TestTags
+import java.io.File
+import java.io.OutputStream
 import java.util.concurrent.atomic.AtomicInteger
+import java.util.regex.Pattern
 
 /**
  * Choosing a file, through the real system picker, and still having it after a rotation.
@@ -207,6 +227,8 @@ import java.util.concurrent.atomic.AtomicInteger
  * driven there at all. That is why this gap survived as long as it did.
  * `tools/local-emulator/run-e2e.sh` runs API 33-36 on the development host, and both tests pass
  * there: **59 / 0 / 0 / 2 at API 33 and again at API 36**, whole suite, 2026-08-24.
+ * (Since #223 the skip column reads 3 on an emulator — `HardwareFallbackTest` now announces
+ * that it cannot run without a hardware HEVC encoder rather than passing vacuously.)
  *
  * ### Why only the rotation test carries [FailsOnEmulatorApi37]
  *
@@ -239,12 +261,96 @@ import java.util.concurrent.atomic.AtomicInteger
  * file".** That is what API 33 through 36 are for, and they answer it.
  */
 @UnstableApi
+/**
+ * Reads what SAF handed back, then publishes for real.
+ *
+ * The premise `OutputPublisher.destinationIsKnownEmpty` depends on has only ever been asserted
+ * against a fake built to match it — `OutputPublisherPublishTest` writes `ByteArray(0)` into
+ * `FakeSafProvider` before each case, under a comment stating this is how `CreateDocument` behaves.
+ * This records what stock DocumentsUI actually produced, at the moment `publish` sees it and before
+ * a byte is written, and then lets the real copy proceed. See #226.
+ */
+private class RecordingPublisher(private val app: Context) : OutputPublisher(app) {
+
+    override fun publish(staged: File, destination: Uri) {
+        seenDestination = destination
+        seenIsDocumentUri = DocumentsContract.isDocumentUri(app, destination)
+        seenSizeBefore = app.contentResolver
+            .query(destination, arrayOf(OpenableColumns.SIZE), null, null, null)
+            ?.use { row ->
+                val column = row.getColumnIndex(OpenableColumns.SIZE)
+                if (column >= 0 && row.moveToFirst() && !row.isNull(column)) row.getLong(column) else null
+            }
+        // Read before the copy: the ViewModel deletes the staged file once publish returns.
+        savedBytes = staged.readBytes()
+        super.publish(staged, destination)
+    }
+
+    /**
+     * Refuses the write when [failOpen] is set, which is the forcing condition for #250.
+     *
+     * Returning null rather than throwing is deliberate: it is the arm `publish`'s
+     * `?: error("Could not open destination for writing")` exists for, and `openDestination`'s
+     * own KDoc says a provider that is present and declines is the half no fake can produce on
+     * demand. The size probe in `publish` has already run by the time this is reached, so
+     * `destinationWasEmpty` is true and `deletePartialOutput` is reached with the document
+     * genuinely empty — which is the whole point.
+     */
+    override fun openDestination(destination: Uri): OutputStream? =
+        if (failOpen) null else super.openDestination(destination)
+
+    companion object {
+        var savedBytes: ByteArray = ByteArray(0)
+        var seenDestination: Uri? = null
+        var seenIsDocumentUri: Boolean? = null
+        var seenSizeBefore: Long? = null
+
+        /**
+         * Makes the next `publish` refuse to open its destination.
+         *
+         * A flag rather than a second publisher because `ConversionDependencies.publisher` is one
+         * seam and there is no orchestrator: every test in this process shares the instance the
+         * `init` block installed. [reset] clears it in teardown, so a test that sets it cannot
+         * leak a refusing publisher into the next class.
+         */
+        var failOpen: Boolean = false
+
+        fun reset() {
+            savedBytes = ByteArray(0)
+            seenDestination = null
+            seenIsDocumentUri = null
+            seenSizeBefore = null
+            failOpen = false
+        }
+    }
+}
+
 @RunWith(AndroidJUnit4::class)
 class SafPickerRoundTripTest {
 
+    /**
+     * Installs [RecordingPublisher] before the Activity exists.
+     *
+     * `ConversionViewModel` resolves its publisher through `ConversionDependencies` **at
+     * construction**, and the Compose rule launches `MainActivity` as part of the rule chain —
+     * which wraps `@Before`, so `@Before` is already too late. JUnit constructs the test instance
+     * before it evaluates the rules, so an initialiser is early enough, and it needs no
+     * `@BeforeClass` (this class's companion is private, and JUnit wants a public static there).
+     *
+     * Harmless for the other two tests: neither saves, so `publish` is never called and the
+     * subclass behaves exactly like `OutputPublisher`. `restoreOrientation` puts the seam back.
+     */
+    init {
+        RecordingPublisher.reset()
+        ConversionDependencies.publisher = { RecordingPublisher(it) }
+    }
+
     @get:Rule
     val composeRule = createAndroidComposeRule<MainActivity>()
 
+    private val context: Context =
+        InstrumentationRegistry.getInstrumentation().targetContext
+
     private val device: UiDevice =
         UiDevice.getInstance(InstrumentationRegistry.getInstrumentation())
 
@@ -258,6 +364,71 @@ class SafPickerRoundTripTest {
     /** Counts [MainActivity] creations from the moment [watchForRecreation] is called. */
     private val recreations = AtomicInteger()
 
+    /**
+     * Holds `POST_NOTIFICATIONS`, so tapping Convert cannot open a window this test has to fight.
+     *
+     * ## What this replaces, and why the replacement is not a smaller wait
+     *
+     * Until #268 the tap was followed by `dismissThePermissionDialog`, which waited for
+     * `com.google.android.permissioncontroller` to appear and pressed back on it. That is a
+     * *foreign, focused window* in the middle of the one step this class most needs to be
+     * deterministic, and it is what mechanism B of #268 was: on the API 35 leg of run 34146936252
+     * the tap landed — `START u0 {act=android.content.pm.action.REQUEST_PERMISSIONS ...
+     * GrantPermissionsActivity}` at 17:38:30.516 — back was pressed at 17:38:32.479, and no
+     * `ConversionWorker` was ever enqueued in the five minutes that followed. A back press goes to
+     * whichever window holds *input* focus, and `Until.hasObject` answers about the accessibility
+     * tree, which can carry the dialog's nodes before it has the focus; a back that arrives one
+     * window early lands on `MainActivity` and finishes it, which is a screen no `waitUntil` can
+     * wait for the return of.
+     *
+     * ## Why holding the permission removes the window rather than making it less likely
+     *
+     * `ConverterScreen` wires Convert to `requestNotifications.launch(POST_NOTIFICATIONS)`, and
+     * `ActivityResultContracts.RequestPermission.getSynchronousResult` returns
+     * `SynchronousResult(true)` — *without starting anything* — when
+     * `checkSelfPermission` already answers `PERMISSION_GRANTED`. So with the permission held there
+     * is no `GrantPermissionsActivity`, no foreign window, no back press, and nothing this test
+     * injects can finish the Activity. That is the whole chain, and [holdTheNotificationPermission]
+     * asserts its one premise rather than assuming it.
+     *
+     * ## The KDoc this contradicts, and the measurement that settles it
+     *
+     * `convertToTheDefaultFormat` used to say granting "was tried first and did not take —
+     * `GrantPermissionsActivity` appeared anyway". Re-measured on 2026-09-07, API 34 on this host,
+     * six consecutive runs of this class: logcat carries **zero**
+     * `act=android.content.pm.action.REQUEST_PERMISSIONS` starts and zero `GrantPermissionsActivity`
+     * across all six, and exactly two `WM-SystemJobScheduler: Scheduling work ID` lines per run —
+     * one for each test that converts, so neither Convert tap was lost. Whatever the earlier
+     * attempt did, a `pm grant` issued before the tap does take. The assertion below is what keeps
+     * that from going quietly stale.
+     *
+     * ## Two consequences, both deliberate
+     *
+     * The grant is **not** undone in teardown: revoking a runtime permission restarts the app's
+     * process, which would take the rest of the instrumentation run with it. The suite runs without
+     * Orchestrator, so every class that converts *after* this one now does so with notifications
+     * permitted. That is benign — `ConversionNotifications` builds its channel at
+     * `IMPORTANCE_LOW`, so nothing heads-up over the screen — but it is a real change to the
+     * device state the rest of the run sees, and `NotificationCancelActionTest`'s KDoc is updated
+     * with it.
+     *
+     * And this class no longer takes the denial path. It never asserted anything about it — the
+     * permission is setup for a test whose subject is SAF — and nothing is lost by it: the
+     * callback `ConverterScreen` registers is `{ viewModel.convert() }`, which **ignores its
+     * boolean**, so "converts whichever way the answer goes" is the shape of the code rather than a
+     * branch a test has to choose. `StaleLauncherResultTest` is what pins that callback path.
+     */
+    @Before
+    fun holdTheNotificationPermission() {
+        device.executeShellCommand("pm grant $appPackage ${Manifest.permission.POST_NOTIFICATIONS}")
+        assertEquals(
+            "POST_NOTIFICATIONS is not held, so tapping Convert would open a permission dialog " +
+                "and this class's determinism argument does not hold -- see the KDoc above",
+            PackageManager.PERMISSION_GRANTED,
+            context.checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS),
+        )
+    }
+
     /**
      * Counts a rotation's recreation without asking the Activity anything.
      *
@@ -289,6 +460,10 @@ class SafPickerRoundTripTest {
      */
     @After
     fun restoreOrientation() {
+        // The suite runs without Android Test Orchestrator, so a swapped seam outlives the class.
+        ConversionDependencies.reset()
+        RecordingPublisher.reset()
+        clearFinishedWork()
         ActivityLifecycleMonitorRegistry.getInstance().removeLifecycleCallback(recreationWatcher)
         if (!rotated) return
         device.setOrientationNatural()
@@ -296,7 +471,35 @@ class SafPickerRoundTripTest {
         device.waitForIdle()
     }
 
+    /**
+     * **Marked for API 37 because of what it does to the image, not because it fails there.**
+     *
+     * This is the one place the marker's KDoc phrase "cannot pass on this image" does not fit, and
+     * the distinction is worth keeping rather than smoothing over. Across the four gating API 37
+     * runs whose logcats were read on 2026-09-05 — 34006456986, 34001744574, 34001377499 and the
+     * green 34002313300 — the leg carries exactly two `hasReadColorBufferDma` aborts before the
+     * suite starts (both `surfaceflinger`, during boot and the SystemUI disable) and then exactly
+     * **one** during it. Every time, that one is `system_server` on the `TaskSnapshotPer` thread,
+     * and every time it lands inside this test's window. No other test in the gating set reaches
+     * the mapper at all.
+     *
+     * So this test kills the framework on that image whether it passes or not, and whether the leg
+     * goes red is luck: 34001377499 passed it and lost the leg anyway (`failed: 0`, teardown
+     * broken), 34002313300 passed it 0.6 s after the abort and went green. That is #108, and it is
+     * why the leg was failing on unrelated PRs.
+     *
+     * `docs/api-37-emulator-crash.md` measured this test on 2026-08-24, recorded "passes, 4 aborts
+     * in the window", and concluded that a rotation reaches the mapper where starting DocumentsUI
+     * does not. The aborts were seen; what was not drawn out is that they are this test's own and
+     * are not intermittent.
+     *
+     * The marker is what routes it off the gating leg and into the advisory job beside its
+     * rotation sibling. **It is not a statement about the picker**: the same test passes on API
+     * 33–36 on the same runner and on the Pixel 10 Pro XL, which is where API 37's answer comes
+     * from.
+     */
     @Test
+    @FailsOnEmulatorApi37
     fun pickingAFileThroughTheSystemPickerFillsInTheFileCard() {
         pickTheFixture()
 
@@ -376,6 +579,357 @@ class SafPickerRoundTripTest {
      * are all warm and the only thing being waited on is one screen. That is what keeps the cost
      * of a genuinely absent root bounded — see the class KDoc.
      */
+    /**
+     * The save side of SAF, end to end, against a document stock DocumentsUI created (#226).
+     *
+     * ## What this settles
+     *
+     * `publish` deletes a destination it could not write to — `docs/defect-audit.md` **D4**'s fix,
+     * so a failed save does not leave a truncated file at the name the user chose — but only when
+     * that destination was **positively zero bytes** first. `destinationIsKnownEmpty` is careful
+     * that "I could not tell" never authorises a delete, which is right, and which makes the
+     * precondition load-bearing.
+     *
+     * Until now that precondition was asserted only against a fake built to match it:
+     * `OutputPublisherPublishTest` writes `ByteArray(0)` into `FakeSafProvider` before each case,
+     * under a comment stating this is how `CreateDocument` behaves. **If it is false in production,
+     * D4's fix is inert and every existing test still passes.** [RecordingPublisher] reads what SAF
+     * actually handed over, at the moment `publish` sees it and before a byte is written.
+     *
+     * ## Why it has to go through the app, and through the picker
+     *
+     * Through the **picker** because a `DocumentsProvider` cannot be reached any other way —
+     * measured three ways and recorded as **E7** in `docs/e2e-read-findings.md`: an unprotected one
+     * is refused at install, instrumentation carries the app's uid so the test APK's own identity
+     * is no help, and shell identity is denied too, each denial naming `ACTION_OPEN_DOCUMENT`.
+     *
+     * Through the **app** because the same constraint sinks the obvious alternative. A host
+     * Activity in this source set that owns a `CreateDocument` launcher cannot be started:
+     * `ActivityScenario` refuses with *"Intent in process org.libremediaconverter resolved to
+     * different process org.libremediaconverter.test"*. Instrumentation runs in the target app's
+     * process, so the only Activity available to drive is the app's own — which is also the more
+     * faithful thing to drive.
+     *
+     * ## The conversion is setup, not subject
+     *
+     * Save is only offered on `Converted`, so the test converts first, at the screen's default
+     * `MP4_H265` / `FAST`. That is **not** codec-independent, and this KDoc claimed the opposite
+     * until 2026-09-06: an earlier draft used MP3 for exactly that reason, and the format had to
+     * move for a different constraint the picker imposes — [convertToTheDefaultFormat] has it.
+     * `MP4_H265` at `FAST` reaches `ConversionRouter`'s `canEncode(H265)` gate, so it runs on
+     * FFmpeg on the emulators (no hardware H265) and on Media3 on the Pixel.
+     *
+     * **That is tolerable here, and #223 is the reason it needs saying.** There, the routing
+     * decided whether the *subject* was reached, so a route to FFmpeg made the test pass while
+     * proving nothing. Here the conversion is setup: if it goes the other way and fails, this test
+     * fails loudly on the setup rather than quietly on the assertion. The subject is what `publish`
+     * was handed, which the engine that produced the file does not touch.
+     *
+     * ## Why it carries [FailsOnEmulatorApi37]
+     *
+     * By inheritance, not measurement. It opens the same picker as
+     * [pickingAFileThroughTheSystemPickerFillsInTheFileCard], which was marked for aborting
+     * `system_server` from the task-snapshot path (#108), and then a second DocumentsUI dialog on
+     * top of it. It has never been observed at API 37 either way: the rotation test truncates the
+     * advisory run first, so all four advisory runs at this baseline report
+     * `expected: 6, received: 4` without reaching either picker test. Marking it was the conservative choice and it is
+     * recorded as unmeasured in `FailsOnEmulatorApi37.kt` rather than dressed up as a measurement.
+     */
+    @Test
+    @FailsOnEmulatorApi37
+    fun aSaveWritesToTheDocumentTheSystemPickerCreated() {
+        pickTheFixture()
+        convertToTheDefaultFormat()
+
+        saveThroughTheSystemPicker()
+
+        val destination = RecordingPublisher.seenDestination
+        assertNotNull("publish was never reached, so nothing was saved", destination)
+        assertTrue(
+            "SAF handed back something that is not a document URI, so publish's cleanup can " +
+                "never run and D4's fix is inert: $destination",
+            RecordingPublisher.seenIsDocumentUri == true,
+        )
+        assertEquals(
+            "SAF handed back a document that is not positively empty, so " +
+                "destinationIsKnownEmpty answers false and a failed save keeps its partial file",
+            0L,
+            RecordingPublisher.seenSizeBefore,
+        )
+
+        // And the bytes really arrived, which only the failure side was covered for on a device.
+        val staged = File(context.cacheDir, "conversions")
+        assertArrayEquals(
+            "the destination did not receive what was staged",
+            RecordingPublisher.savedBytes,
+            context.contentResolver.openInputStream(destination!!)!!.use { it.readBytes() },
+        )
+        assertTrue("staging should be empty after a successful save", staged.listFiles().isNullOrEmpty())
+    }
+
+    /**
+     * The other half of D4 (#250): a save that fails deletes the document it could not write.
+     *
+     * ## Why this is separate from the test above
+     *
+     * #226 proved the *premise* — SAF hands back a document reporting exactly zero bytes, so
+     * `destinationIsKnownEmpty` can answer true — and then drove the success path, where the
+     * `catch` is never entered. So `deletePartialOutput` had still never run against a real
+     * `DocumentsProvider`; its only assertions were `OutputPublisherPublishTest`'s, against
+     * `FakeSafProvider` under Robolectric. That is the same "asserted only against a fake built to
+     * match it" shape #226 was filed to break, one layer down.
+     *
+     * ## The forcing condition, and why it is a returned null
+     *
+     * [RecordingPublisher.failOpen] makes `openDestination` return null. `publish` turns that into
+     * `error("Could not open destination for writing")` **after** its size probe has already run,
+     * so the `catch` is reached with `destinationWasEmpty == true` on a document DocumentsUI
+     * created seconds earlier. Nothing is simulated: the URI, the grant, the provider and the
+     * delete are all real.
+     *
+     * Null rather than a throw because `openDestination`'s KDoc says a provider that is present
+     * and declines is the half no fake can produce on demand — so this is also the first time that
+     * arm has been taken against a live provider rather than a stub.
+     *
+     * ## The oracle, and why it is not a recorder inside the provider
+     *
+     * The obvious assertion — have the provider record what `deleteDocument` was called with, and
+     * read it back — **cannot work here, and finding that out is half of what this test cost.**
+     * `FixtureDocumentsProvider` is declared by the test APK and runs in
+     * `org.libremediaconverter.test`; instrumentation runs in the app's process. A `static` in the
+     * provider is therefore a different object from the one a test can see, and the accessor #226
+     * left behind read empty on every run. That is E7's process wall from a third side, after
+     * `ACTION_OPEN_DOCUMENT` and `ActivityScenario`.
+     *
+     * So the oracle is the document, which does cross the boundary because the app holds a URI
+     * grant for it. **This is still the path rather than the artefact**, because the two
+     * assertions are read together: the size query above proves the document *existed and was
+     * empty* moments earlier, and a `content://` document that no longer answers a query is one
+     * something deleted. Nothing else in the app deletes SAF documents.
+     *
+     * The staged file is asserted to **survive**, which is the deliberate other half of that
+     * `catch`: a failed save may leave the staged copy as the only copy of an hour of transcoding,
+     * so `ConversionViewModel` keeps it and puts "Try saving again" on screen.
+     */
+    @Test
+    @FailsOnEmulatorApi37
+    fun aFailedSaveDeletesTheDocumentItCouldNotWrite() {
+        pickTheFixture()
+        convertToTheDefaultFormat()
+
+        RecordingPublisher.failOpen = true
+        saveThroughTheSystemPicker(settlesOn = TestTags.RETRY_SAVE)
+
+        val destination = RecordingPublisher.seenDestination
+        assertNotNull("publish was never reached, so the delete arm was not exercised", destination)
+        assertEquals(
+            "the document was not positively empty, so publish would refuse to delete it",
+            0L,
+            RecordingPublisher.seenSizeBefore,
+        )
+        assertFalse(
+            "publish did not delete the document it could not write: $destination",
+            documentStillExists(destination!!),
+        )
+
+        // The staged copy is kept on purpose -- see ConversionViewModel.save's onFailure.
+        val staged = File(context.cacheDir, "conversions")
+        assertTrue(
+            "a failed save must not delete the staged file; it may be the only copy",
+            staged.listFiles()?.isNotEmpty() == true,
+        )
+    }
+
+    /**
+     * Leaves nothing for the next test's launch to reattach to.
+     *
+     * **In teardown rather than at the end of a test, and that placement is the point.**
+     * `aFailedSaveDeletesTheDocumentItCouldNotWrite` proves that a failed save *keeps* its staged
+     * file — deliberately, since it may be the only copy — so it ends with a finished job and a
+     * live staged file, which is exactly what the app reattaches to on the next launch. Its
+     * sibling then opened on `Converted` with no "Choose file" to tap: measured, as a 30 s timeout
+     * on `converter.chooseFile` in a test that had nothing wrong with it.
+     *
+     * The first fix tapped "Start over" at the end of the test body. That works until the test
+     * fails, and then it does not run at all — measured too, on the mutation run that proved this
+     * suite bites: one real failure became two, and the second looked like an unrelated flake.
+     * **One cause must produce one red test**, so the cleanup belongs where it runs either way.
+     *
+     * **`pruneWork` and not `cancelAllWork`, on design grounds and not on a measurement.** Only
+     * finished work records need to go — that is all the next launch reattaches to — and
+     * `cancelAllWork` additionally cancels live work, which is a wider blast radius than teardown
+     * in a shared process needs. `pruneWork` cannot touch a job that has not run yet.
+     *
+     * `cancelAllWork` was **suspected** of causing an API 35 red here and did not cause it; see
+     * [CONVERSION_TIMEOUT_MS], which did. A local API 35 run with `cancelAllWork` passed, and the
+     * logcat showed the conversion encoding rather than cancelled. The narrower call is kept
+     * because it is the right one, not because it fixed anything.
+     */
+    private fun clearFinishedWork() {
+        WorkManager.getInstance(context).pruneWork()
+        File(context.cacheDir, "conversions").listFiles()?.forEach { it.delete() }
+    }
+
+    /** Whether [destination] still answers a metadata query. A deleted document does not. */
+    private fun documentStillExists(destination: Uri): Boolean = runCatching {
+        context.contentResolver
+            .query(destination, arrayOf(OpenableColumns.SIZE), null, null, null)
+            ?.use { it.moveToFirst() } ?: false
+    }.getOrDefault(false)
+
+    /**
+     * Runs the conversion, leaving the screen on `Converted`.
+     *
+     * **The format is left at its default, and that is a constraint rather than laziness.**
+     * `ConverterScreen` registers `CreateDocument` with the *output's* MIME type, and
+     * [FixtureDocumentsProvider] advertises `Root.COLUMN_MIME_TYPES` of `video/mp4` — deliberately,
+     * so the picker's MIME filter has a mutation with a shape. DocumentsUI honours that on the save
+     * side too: choosing MP3 makes the destination type `audio/mpeg`, and the fixture root is then
+     * filtered out of the save dialog entirely. Measured, as *"the create-document dialog never
+     * showed LMC R38 fixtures"*. The default `MP4_H265` produces `video/mp4` and the root is
+     * offered.
+     *
+     * **The notification permission is held rather than dismissed**, which is #268's mechanism B
+     * and is argued in [holdTheNotificationPermission]. The short version: `RequestPermission`
+     * starts no Activity at all when the permission is already granted, so the tap below is
+     * followed by no foreign window.
+     *
+     * **Both taps scroll first.** On `Ready` the screen carries a file card, five pickers and then
+     * the button, so Convert is below the fold on a phone. `performClick` on an off-screen node
+     * dispatches at a position that hits nothing and throws nothing, and `assertIsEnabled` passes
+     * either way — the first version of this sat waiting for a `Converted` that could never come.
+     */
+    private fun convertToTheDefaultFormat() {
+        awaitTheProbeHavingLanded()
+
+        composeRule.onNodeWithTag(TestTags.Converter.CONVERT)
+            .performScrollTo()
+            .assertIsEnabled()
+            .performClick()
+
+        requireTheTapToHaveStartedTheJob()
+        awaitNode(TestTags.SAVE_FILE, CONVERSION_TIMEOUT_MS)
+    }
+
+    /**
+     * Blocks until the pick's probe has been rendered, so no relayout can straddle the next tap.
+     *
+     * **This is #268's mechanism A, and the argument is that it becomes impossible rather than
+     * unlikely.** `ConversionViewModel.onInputPicked` writes `_state` exactly twice: once with the
+     * name and size as soon as the metadata query returns, and once more with the probe filled in.
+     * The second write is what grows the file card, which moves everything below it — including the
+     * Convert button. Compose's injection computes the target's centre from the semantics node and
+     * dispatches the touch afterwards; a relayout in that gap hit-tests the stationary coordinate
+     * against the *new* layout, so the down and the up land on whatever moved into the button's old
+     * place. Nothing throws. Measured on the two failing gating legs as the gap between the pick's
+     * FFprobe closing and the tap: 319 ms and 421 ms passed, 46 ms, 98 ms and 124 ms did not.
+     *
+     * A detail row can only be composed from that second write, because `FileCard` renders the rows
+     * exclusively under `input.probe != null`. So once one exists, both of `onInputPicked`'s writes
+     * have landed and been laid out, and every `_state` write still in flight is either landed or
+     * superseded.
+     *
+     * `reattach` has **three** outcomes here, not two. It returns on its `_state.value !is Idle`
+     * guard; or it finds nothing; or — because `pruneWork()` is async and can leave a finished job
+     * unpruned — it passes that guard and starts an `observe()`. This paragraph used to name only
+     * the first two, which was wrong rather than merely incomplete: the third is a live coroutine
+     * with writes ahead of it.
+     *
+     * It is still harmless, and by a different mechanism than the guard. `reattach` reads
+     * `ownership.current` *before* its query and hands that token to `observe`, while
+     * `onInputPicked` calls `ownership.claim()` synchronously on the pick — so by the time a
+     * detail row exists the observation is superseded, and every emission returns at
+     * `stillHeldBy` before it writes. Outside that path `observe` is not started until
+     * `convert()` runs. **The card cannot change height again before the tap**, which is a
+     * different claim from waiting longer.
+     *
+     * The `Container` row specifically, rather than a new "probing finished" tag in `main`, because
+     * this fixture is an MP4 video and that row is already what
+     * [pickingAFileThroughTheSystemPickerFillsInTheFileCard] waits on and asserts. It is a
+     * *presence* wait, which cannot be satisfied by a composition that is momentarily absent — an
+     * absence wait can, and that would tap into nothing.
+     *
+     * **Not in [pickTheFixture].** The rotation test does not tap a Compose affordance in this
+     * window at all, and the picker test already makes this exact wait its own assertion. Putting
+     * it here keeps a broken read grant reddening one test with the message that explains it.
+     */
+    private fun awaitTheProbeHavingLanded() {
+        awaitNode(TestTags.Converter.detailRow(CONTAINER_LABEL))
+    }
+
+    /**
+     * Fails fast if the Convert tap started nothing, instead of waiting out the conversion budget.
+     *
+     * **A diagnostic, not the synchronisation** — [awaitTheProbeHavingLanded] is what makes the tap
+     * land, and this cannot rescue a tap that did not. It exists because of what a lost tap used to
+     * look like: `ComposeTimeoutException`, 300000 ms for `action.saveFile`, five minutes after a
+     * screen that had never left `Ready`, which names the save affordance and says nothing about
+     * the tap two steps earlier. Every #268 failure was read from logcat rather than from the
+     * message, and this is the message it should have had.
+     *
+     * The condition is monotonic and needs no budget of its own: `convert()` sets `Converting`
+     * synchronously, and `Ready` is the only state that renders a Convert button, so once the tag
+     * is gone it stays gone. [APP_TIMEOUT_MS] rather than a new constant, because "the app should
+     * have reacted by now" is exactly what that number already means here.
+     */
+    private fun requireTheTapToHaveStartedTheJob() {
+        val tag = TestTags.Converter.CONVERT
+        try {
+            composeRule.waitUntil("the Convert tap left the Ready screen", APP_TIMEOUT_MS) {
+                // A composition that is momentarily absent throws, and must read as "not yet"
+                // rather than as "the button is gone" -- see awaitNode.
+                runCatching { composeRule.onAllNodesWithTag(tag).fetchSemanticsNodes().isEmpty() }
+                    .getOrDefault(false)
+            }
+        } catch (timeout: ComposeTimeoutException) {
+            throw AssertionError(
+                "the Convert tap did not start a conversion: $tag is still on screen " +
+                    "${APP_TIMEOUT_MS}ms after it was clicked, so the screen never left Ready",
+                timeout,
+            )
+        }
+    }
+
+    /**
+     * Taps Save and drives the create-document dialog into the fixture root.
+     *
+     * Retried whole, for the reason [pickTheFixture] documents: a dialog that came up unreadable
+     * cannot be recovered from inside, and a fresh one is the only answer.
+     */
+    private fun saveThroughTheSystemPicker(settlesOn: String = TestTags.Converter.CONVERT_ANOTHER) {
+        var missing: BySelector? = null
+        repeat(PICK_ATTEMPTS) { attempt ->
+            requireAReadableScreen()
+            composeRule.onNodeWithTag(TestTags.SAVE_FILE).performClick()
+            missing = walkTheSaveDialog(
+                if (attempt == 0) PICKER_TIMEOUT_MS else REOPENED_TIMEOUT_MS,
+            )
+            if (missing == null) {
+                // The node that says the save has *finished*, either way. Waiting on the success
+                // one when the save is meant to fail would time out on a test that is working.
+                awaitNode(settlesOn, SAVE_TIMEOUT_MS)
+                return
+            }
+            dismissThePicker()
+        }
+        throw AssertionError(
+            "the create-document dialog never showed $missing, in $PICK_ATTEMPTS separate " +
+                "dialogs (the last one left ${device.currentPackageName} in front)",
+        )
+    }
+
+    /** Into the fixture root, then Save. Returns the selector never found, or null. */
+    private fun walkTheSaveDialog(timeoutMs: Long): BySelector? {
+        val picker = By.pkg(DOCUMENTS_UI_PACKAGE)
+        val root = By.text(FixtureDocumentsProvider.ROOT_TITLE)
+        return when {
+            device.wait(Until.hasObject(picker), timeoutMs) != true -> picker
+            !tapPickerNode(root, timeoutMs, ifAbsent = ::openTheRootsDrawer) -> root
+            !tapPickerNode(SAVE_BUTTON, timeoutMs) -> SAVE_BUTTON
+            else -> null
+        }
+    }
+
     private fun pickTheFixture() {
         var missing: BySelector? = null
         repeat(PICK_ATTEMPTS) { attempt ->
@@ -424,6 +978,8 @@ class SafPickerRoundTripTest {
     private fun requireAReadableScreen() {
         val app = By.pkg(appPackage)
         if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) == true) return
+        // The return value is deliberately dropped here: the wait on the next line IS the re-probe
+        // that dismissThePicker had to be given, so there is nothing for it to gate.
         dismissASystemErrorDialog()
         if (device.wait(Until.hasObject(app), READABLE_TIMEOUT_MS) == true) return
         unlockTheDevice()
@@ -464,14 +1020,21 @@ class SafPickerRoundTripTest {
      * would click whatever system window happened to be there. `aerr_wait` first: it dismisses the
      * dialog and leaves the offending app alone, which is the polite answer when the app is not
      * ours. Back is not tried — `BaseErrorDialog` swallows key events.
+     *
+     * **Returns whether it clicked anything, and the caller has to care.** Dismissing the dialog
+     * changes the window focus, so every reading taken before this ran is stale afterwards —
+     * which is the whole of #102's `MainActivity`-destroyed mode. [requireAReadableScreen] already
+     * re-probes after calling this; [dismissThePicker] could not, because it had no way to know
+     * whether there had been anything to dismiss.
      */
-    private fun dismissASystemErrorDialog() {
+    private fun dismissASystemErrorDialog(): Boolean {
         for (id in ERROR_DIALOG_BUTTONS) {
             val button = device.findObject(By.res(id)) ?: continue
             button.click()
             device.waitForIdle()
-            return
+            return true
         }
+        return false
     }
 
     /**
@@ -602,6 +1165,54 @@ class SafPickerRoundTripTest {
      * It is also why this counts backs rather than pressing a fixed number of them. One back is
      * enough from Recent and two are needed from inside the root, but a third from Recent would
      * finish `MainActivity` and take the rest of the test with it.
+     *
+     * **That hazard was reached, and the guard above is why it could be** (#102). A system
+     * app-error dialog is a fullscreen `system_server` window, so it takes the focus away from
+     * `MainActivity` too — [awaitAppFocus] cannot tell "the picker is still up" from "a dialog is
+     * on top of an app that is already in front". Measured on the API 35 gating leg of run
+     * `34161043035` attempt 1, which is #269's own head:
+     *
+     * ```
+     * 20:59:35.689  UiObject2: Clicking on (927, 2274)      <- iteration 2's dismissal, on button1
+     * 20:59:36.033  MainActivity RESUMED                    <- so the picker is gone, by our hand
+     * 20:59:36.350  VRI[PickActivity]: visibilityChanged ... newVisibility=false
+     * 20:59:37.068  UiDevice: Pressing back button.         <- iteration 2 presses anyway
+     * 20:59:41.094  UiDevice: Retrieving node ... [RES='android:id/aerr_wait']
+     * 20:59:41.169  Input channel object 'Application Not Responding:
+     *                 com.google.android.apps.nexuslauncher' was disposed
+     * 20:59:41.713  UiDevice: Pressing back button.         <- iteration 3
+     * 20:59:41.754  TopTaskTracker: onTaskMovedToFront: ... NexusLauncherActivity
+     * 20:59:42.278  MainActivity DESTROYED
+     * ```
+     *
+     * Read the first two lines before the rest, because they are the part that is easy to get
+     * wrong: **the picker did not close on its own — this function closed it**, on iteration 2,
+     * when [dismissASystemErrorDialog] fell through to `android:id/button1` and clicked what was
+     * almost certainly DocumentsUI's own positive button (#271). From `20:59:36.033` onwards there
+     * was nothing left to back out of. Iteration 2 pressed back regardless, iteration 3 dismissed
+     * the launcher's ANR dialog — #93's occluder, still ambient on these runners, and the only
+     * remaining reason the focus read false — and pressed again, and that press finished
+     * `MainActivity`. Every later `onActivity` in the test then threw
+     * `NullPointerException: Cannot run onActivity since Activity has been destroyed already`.
+     *
+     * **With the re-read below, iteration 2 returns** — the app is focused within a second of the
+     * `button1` click — and iterations 2 and 3 never press at all.
+     *
+     * **So the reading is retaken after the dialog goes, and only then.** This removes a back
+     * press sent on a stale reading; it does not retry one, and it does not make the dismissal
+     * more tolerant. A picker that really is in front still leaves the app unfocused, so the press
+     * still happens and a genuinely stuck picker still fails here. On the ordinary path — no
+     * dialog — nothing is re-read and nothing is waited on, which is why the check is behind the
+     * `&&`. [requireAReadableScreen] has always re-probed after dismissing a dialog; this is the
+     * same rule in the one place that did not follow it.
+     *
+     * **It cannot be proved by re-running**, and that is worth saying rather than glossing: the
+     * launcher ANR is ambient and unreproducible on demand, so a green sweep is not evidence. What
+     * the fix rests on is the trace above: the launcher comes to the front 41 ms after a back press
+     * that this change does not send, and the Activity is destroyed 565 ms after that.
+     *
+     * **[forceStopThePicker] is the escalation after the presses, and it exists because a back
+     * press is not always deliverable.** See its own KDoc for the measurement.
      */
     private fun dismissThePicker() {
         repeat(BACK_PRESSES) {
@@ -610,21 +1221,60 @@ class SafPickerRoundTripTest {
             // so a back aimed at the picker lands on the dialog and nothing moves. Measured --
             // API 34 of run 32813885120 exhausted all four presses with `android` in front, which
             // is that dialog, while the launcher it belonged to went on ANRing behind everything.
-            dismissASystemErrorDialog()
+            //
+            // And re-read the focus if one was dismissed: the dialog is itself a reason the
+            // reading above can be false, so a press sent on it can land on an app that is
+            // already in front. See the KDoc -- that is how MainActivity got destroyed.
+            if (dismissASystemErrorDialog() && awaitAppFocus()) return
             device.pressBack()
         }
         // The check after the last press, and not a spare one: `repeat` presses on its final
         // iteration too, so without this a dismissal that worked on the last press would still be
         // reported as a failure to close.
+        if (awaitAppFocus()) return
+        forceStopThePicker()
         if (!awaitAppFocus()) {
             throw AssertionError(
-                "the system picker would not close: after $BACK_PRESSES back presses the app " +
-                    "still does not have the window focus, and ${device.currentPackageName} is " +
-                    "in front. What could be seen: " + describeWindows(),
+                "the system picker would not close: after $BACK_PRESSES back presses and a " +
+                    "force-stop of $DOCUMENTS_UI_PACKAGE the app still does not have the window " +
+                    "focus, and ${device.currentPackageName} is in front. What could be seen: " +
+                    describeWindows(),
             )
         }
     }
 
+    /**
+     * Kills the picker's process, for when no back press can reach it.
+     *
+     * **The failure this exists for cannot be answered with input, and that is the whole point.**
+     * Measured on the gating API 37 legs of runs 34006456986 and 34001744574, which fail this way
+     * and whose logcats say the same thing in the same order. `UiObject2.click()` on the fixture's
+     * root is injected at the node's centre and the framework discards it —
+     * `InputDispatcher: No new touched window at (539.0, 525.0) in display 0` — because
+     * `PickActivity` has published accessibility nodes but has no touchable window there yet.
+     * `click()` cannot see that and returns normally, so the walk goes on to wait out
+     * [PICKER_TIMEOUT_MS] for a fixture that was never navigated to. By the time this function's
+     * caller starts pressing back, WindowManager is still saying
+     * `no window has focus but ...PickActivity may eventually add a window when it finishes
+     * starting up` — and goes on saying it for another 63 s. Every one of the four presses is
+     * dropped, and DocumentsUI ANRs on `Input dispatching timed out`.
+     *
+     * So the picker is in front, unreachable by key or by touch, and [pickTheFixture]'s whole
+     * point — that a second `PickActivity` rebuilds every window and list in it — is unreachable
+     * with it. `am force-stop` goes around input entirely: `UiAutomation` runs shell commands as
+     * uid 2000, which holds `FORCE_STOP_PACKAGES`, so the picker's process is killed, its
+     * activity leaves the task it was launched into, and `MainActivity` — the activity below it in
+     * that same task — is resumed with the focus.
+     *
+     * **Only on the failure path**, after every back press has been spent, so a picker that closes
+     * the ordinary way never reaches this and is not altered by it. If the framework itself is
+     * gone, this cannot help either, and the caller still reports what it could see.
+     */
+    private fun forceStopThePicker() {
+        device.executeShellCommand("am force-stop $DOCUMENTS_UI_PACKAGE")
+        device.waitForIdle()
+    }
+
     /** True once [MainActivity] has the window focus, false if it does not take it in time. */
     private fun awaitAppFocus(): Boolean = try {
         composeRule.waitUntil("the app has the window focus back", FOCUS_TIMEOUT_MS) {
@@ -727,9 +1377,36 @@ class SafPickerRoundTripTest {
         }
     }
 
-    private fun awaitNode(tag: String) {
-        composeRule.waitUntil("a node tagged $tag exists", APP_TIMEOUT_MS) {
-            composeRule.onAllNodesWithTag(tag).fetchSemanticsNodes().isNotEmpty()
+    /**
+     * Waits for [tag], treating "the app has no composition right now" as *not yet* rather than
+     * as a failure.
+     *
+     * `fetchSemanticsNodes` **throws** `IllegalStateException: No compose hierarchies found in the
+     * app` when nothing is attached at that instant, and `waitUntil` propagates it on the first
+     * poll instead of waiting out the deadline. This class spends much of its time with another
+     * app in front — the picker and the create-document dialog, and until #268 the permission
+     * dialog too — so there is always a window where the app is coming back and has no composition
+     * yet. Before this, that
+     * window was a hard failure: measured on the API 34 leg of run 34057196628, where **both** SAF
+     * tests died that way while the same commit passed API 33, 35, 36 and 37, and the previous
+     * commit passed API 34 and failed 35. A failing leg that moves between runs is #190's
+     * emulator flake, and this is the one place in the class that turned it into a red test.
+     *
+     * **The cost is honest and bounded**: an app that is genuinely gone now fails at the deadline
+     * rather than immediately, so the last composition error is carried into the message to keep
+     * that case diagnosable.
+     */
+    private fun awaitNode(tag: String, timeoutMs: Long = APP_TIMEOUT_MS) {
+        var lastError: Throwable? = null
+        try {
+            composeRule.waitUntil("a node tagged $tag exists", timeoutMs) {
+                runCatching { composeRule.onAllNodesWithTag(tag).fetchSemanticsNodes().isNotEmpty() }
+                    .onFailure { lastError = it }
+                    .getOrDefault(false)
+            }
+        } catch (timeout: ComposeTimeoutException) {
+            val note = lastError?.let { "; last composition error: ${it.message}" } ?: ""
+            throw AssertionError("waited ${timeoutMs}ms for a node tagged $tag$note", timeout)
         }
     }
 
@@ -743,6 +1420,33 @@ class SafPickerRoundTripTest {
         const val PICKER_TIMEOUT_MS = 30_000L
         const val APP_TIMEOUT_MS = 30_000L
 
+        /**
+         * Bounds a hang, and **the first number here was measured on one API level and wrong on
+         * another.** It read 120 s, on the strength of the whole test taking 11.8 s on the API 34
+         * CI leg (run 34043502322). API 35 is a different machine: on run 34056545386 the fixture's
+         * `libx265 -crf 24 -preset veryfast` encode started at `20:05:26.897` and the next job in
+         * the suite did not appear until `20:07:41.693` — **134.8 s**, so the encode was still
+         * running when the 120 s bound expired and the test failed with the conversion healthy.
+         *
+         * The logcat is what settles it: `ConversionWorker` logs the route and `FFmpegEngine` the
+         * command, and there is no cancel between them. A timeout that fires on a working
+         * conversion is worse than no bound, because it reads as a product failure.
+         *
+         * 300 s is chosen against that 134.8 s, not against API 34's 11.8 s. **Do not re-tighten
+         * it from a fast leg's timing** — the encode is software on every emulator here, and the
+         * spread between images is larger than any margin a single measurement would suggest.
+         */
+        const val CONVERSION_TIMEOUT_MS = 300_000L
+
+        /** The copy is a few kilobytes, but it crosses a provider. */
+        const val SAVE_TIMEOUT_MS = 30_000L
+
+        /**
+         * DocumentsUI's save button. Case-insensitive because the label is "SAVE" on some images
+         * and "Save" on others, and the difference is not what this test is about.
+         */
+        val SAVE_BUTTON: BySelector = By.text(Pattern.compile("save", Pattern.CASE_INSENSITIVE))
+
         /**
          * The same wait once a picker has already come and gone, and shorter for a reason.
          *

app/src/androidTest/java/org/libremediaconverter/work/NotificationCancelActionTest.kt

@@ -0,0 +1,135 @@
+package org.libremediaconverter.work
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.model.OutputFormat
+import org.libremediaconverter.model.QualityTier
+import java.io.File
+import java.util.concurrent.TimeUnit
+
+/**
+ * The Cancel button in the notification shade actually cancels the job.
+ *
+ * `ConversionNotifications.build` attaches one action, wired to
+ * `WorkManager.createCancelPendingIntent(id)`. Before this test `createCancelPendingIntent` had
+ * **no references anywhere outside its own declaration** — no JVM test, no instrumented test
+ * (#227).
+ *
+ * That matters more than an ordinary uncovered line. A conversion runs in a foreground service and
+ * the user is invited to leave the app; once they do, this action is the only way to stop it. If
+ * the `PendingIntent` carries the wrong id, the button does nothing, the notification stays, and
+ * the job runs to completion — with no error, no log, and no screen to look at.
+ *
+ * ## Why this fires the intent rather than reading the shade
+ *
+ * The obvious version asks `NotificationManager.getActiveNotifications()` for id 1001 and taps what
+ * it finds. That was rejected because it would be asserting something about notification
+ * *visibility* rather than about cancellation — and because whether the shade holds the
+ * notification at all is not this class's to know.
+ *
+ * **It used to say `POST_NOTIFICATIONS` is denied throughout, and since #268 that is no longer
+ * true.** `SafPickerRoundTripTest` grants it in `@Before`, so that its Convert tap cannot open a
+ * permission dialog, and a runtime grant cannot be undone in teardown without restarting the app's
+ * process. The suite runs without Orchestrator, so whether this class sees the permission held
+ * depends on class order — which is exactly the reading this test does not do, and the reason it
+ * stays the right shape rather than a reason to change it.
+ *
+ * The `PendingIntent` is the subject; where it is read from is incidental. Building the
+ * notification for a real, live work id and firing its action exercises exactly the thing that can
+ * be wrong — a real `PendingIntent` dispatch reaching real `WorkManager` — and does it the same way
+ * on every API level.
+ *
+ * ## Why the job is delayed rather than running
+ *
+ * A conversion of the committed 3 s fixture finishes in well under a second on an emulator
+ * (`HardwareFallbackTest` completed one in 448 ms), so racing a cancel against a running job would
+ * be flaky in the direction that fails. An initial delay keeps the job reliably `ENQUEUED`, which
+ * is a state `cancelWorkById` acts on identically — what is under test is whether firing the action
+ * reaches WorkManager with the right id, not which state it interrupts.
+ *
+ * *Mutation:* build the `PendingIntent` from `UUID.randomUUID()` instead of the request's id. The
+ * notification looks identical and the job is never cancelled.
+ */
+@UnstableApi
+@RunWith(AndroidJUnit4::class)
+class NotificationCancelActionTest {
+
+    private val context = InstrumentationRegistry.getInstrumentation().targetContext
+    private val workManager = WorkManager.getInstance(context)
+    private lateinit var input: File
+
+    @Before
+    fun setUp() {
+        input = File(context.cacheDir, "cancel_action_sample.mp4")
+        InstrumentationRegistry.getInstrumentation().context.assets
+            .open("sample_h264.mp4")
+            .use { asset -> input.outputStream().use { asset.copyTo(it) } }
+    }
+
+    @After
+    fun tearDown() {
+        input.delete()
+        File(context.cacheDir, "conversions").listFiles()?.forEach { it.delete() }
+    }
+
+    @Test
+    fun theNotificationsCancelActionCancelsThatJob(): Unit = runBlocking {
+        val request = ConversionWorker.request(
+            inputUri = Uri.fromFile(input),
+            displayName = input.name,
+            sizeBytes = input.length(),
+            spec = OutputFormat.MP4_H264.spec,
+            quality = QualityTier.FAST,
+        ).let { base ->
+            // Rebuild with a delay so the job stays ENQUEUED for the whole test. See the KDoc.
+            OneTimeWorkRequestBuilder<ConversionWorker>()
+                .setInputData(base.workSpec.input)
+                .setInitialDelay(1, TimeUnit.HOURS)
+                .build()
+        }
+        workManager.enqueue(request).result.get()
+
+        // The job is queued and waiting, which is the state the cancel has to interrupt.
+        assertEquals(
+            WorkInfo.State.ENQUEUED,
+            withTimeout(TIMEOUT_MS) {
+                workManager.getWorkInfoByIdFlow(request.id).first { it != null }
+            }?.state,
+        )
+
+        val notification = ConversionNotifications(context)
+            .build(request.id, title = input.name, percent = 0, indeterminate = true)
+        val action = notification.actions?.firstOrNull()
+        assertNotNull("the progress notification carries no action to cancel with", action)
+
+        // The whole point: fire it the way the shade would, and see the job stop.
+        action!!.actionIntent.send()
+
+        val terminal = withTimeout(TIMEOUT_MS) {
+            workManager.getWorkInfoByIdFlow(request.id).first { it != null && it.state.isFinished }
+        }
+        assertEquals(
+            "firing the notification's Cancel action must cancel the job it was built for",
+            WorkInfo.State.CANCELLED,
+            terminal?.state,
+        )
+    }
+
+    private companion object {
+        const val TIMEOUT_MS = 30_000L
+    }
+}

app/src/main/java/org/libremediaconverter/convert/Media3Engine.kt

@@ -230,6 +230,12 @@ class Media3Engine(private val context: Context) : HardwareTranscoder {
          * unreachable code buys nothing — but it is an entry waiting on a routing change rather
          * than a live one. `Media3EngineMimeTypesTest` routes all six encodable codecs and asserts
          * which three arrive, so if that set moves, the disagreement fails rather than surprises.
+         *
+         * **Unreachable here is not the same as unreachable.** Since #254 a Vorbis encode is a
+         * thing a user can ask for — `OutputFormat.OGG_VORBIS` — and it is served by
+         * `FFmpegCommandBuilder`, which is the whole point of the router rule above sending it
+         * there. What stays dead is this arm specifically, because `MEDIA3_AUDIO` still excludes
+         * Vorbis: Android has no Vorbis encoder at any API level, exactly as with MP3.
          */
         internal fun audioMimeTypeFor(codec: AudioCodec): String? = when (codec) {
             AudioCodec.AAC -> MimeTypes.AUDIO_AAC

app/src/main/java/org/libremediaconverter/ffmpeg/FFmpegCommandBuilder.kt

@@ -53,6 +53,44 @@ object FFmpegCommandBuilder {
     /** Containers in the ISO base-media family, where HEVC needs the hvc1 brand. */
     private val MP4_FAMILY = setOf(Container.MP4, Container.MOV)
 
+    /**
+     * Ogg Vorbis, through libvorbis.
+     *
+     * ## This named an encoder the binary did not have, for as long as it existed
+     *
+     * These are the exact flags the arm carried before #254, and the arm had never run: `VORBIS`
+     * was absent from `ContainerCapabilities.ENCODABLE_AUDIO` and no `OutputFormat` offered it.
+     * It could not have run either. `--enable-libvorbis` was not in the AAR's configure line, and
+     * `strings` on the shipped `libavcodec.so` named `libx264`, `libx265`, `libvpx`, `libmp3lame`,
+     * `libopus`, `libdav1d`, `libsvtav1` and `libjxl` — no `libvorbis`. The first user to pick Ogg
+     * Vorbis would have got "Unknown encoder 'libvorbis'". #254 rebuilt the AAR with
+     * `--enable-libvorbis` (`bin/README.md` carries the new configure line and checksum) and made
+     * the arm reachable. The flags did not have to change; the binary under them did.
+     *
+     * **Nothing on the JVM can tell a real encoder name from a fictional one**, which is exactly
+     * how that survived four coverage waves. `FFmpegCommandBuilderTest` can only pin that this is
+     * what the builder emits. That `libvorbis` is really in there is proved by `FFmpegEngineTest`'s
+     * `encodesOggVorbisThroughAnEncoderTheBundledBinaryActuallyHas`, on a device, and by nothing
+     * else in this repo.
+     *
+     * Two flags are deliberately *absent*, and both would be forced by FFmpeg's in-tree `vorbis`
+     * encoder — the one the binary already had, and the one a first pass at #254 used:
+     *
+     *  - **no `-strict experimental`**. The in-tree encoder carries `AV_CODEC_CAP_EXPERIMENTAL`
+     *    and libavcodec refuses it without the flag. libvorbis is not experimental.
+     *  - **no `-ac 2`**. The in-tree encoder is stereo-only — *"Current FFmpeg Vorbis encoder only
+     *    supports 2 channels."* — so it would silently upmix a mono source and downmix a surround
+     *    one, a compromise this app makes nowhere else. libvorbis takes any channel count, so mono
+     *    stays mono — the e2e test's fixture is mono and it asserts the output still is.
+     *
+     * `-q:a 5` is libvorbis's classic ~160 kbps setting, and the scale behind it is the third
+     * reason for the rebuild. Over one 3 s clip libvorbis spans 10931..64166 bytes across q0..q10
+     * where the in-tree encoder spans 7549..14645 — so libvorbis at this setting (16429 bytes)
+     * already writes more than the in-tree encoder can at q10, and the knob has somewhere to go
+     * if this app ever exposes it.
+     */
+    private val VORBIS_ARGS = listOf("-c:a", "libvorbis", "-q:a", "5")
+
     fun build(request: ConversionRequest, inputPath: String, outputPath: String): List<String> {
         val plan = CopyPlanner.plan(request.spec, request.probe)
         return buildList {
@@ -185,7 +223,7 @@ object FFmpegCommandBuilder {
             AudioCodec.FLAC -> listOf("-c:a", "flac")
             AudioCodec.PCM -> listOf("-c:a", "pcm_s16le")
             AudioCodec.OPUS -> listOf("-c:a", "libopus", "-b:a", "128k")
-            AudioCodec.VORBIS -> listOf("-c:a", "libvorbis", "-q:a", "5")
+            AudioCodec.VORBIS -> VORBIS_ARGS
             else -> listOf("-c:a", "aac", "-b:a", "192k")
         }
     }

app/src/main/java/org/libremediaconverter/ffmpeg/FFmpegConcatCommand.kt

@@ -35,6 +35,21 @@ object FFmpegConcatCommand {
             add("concat")
             add("-safe")
             add("0")
+            // And -protocol_whitelist permits the *scheme* those paths carry, which is a
+            // separate gate (#238). Every input the user actually picks is a content:// URI --
+            // JoinScreen uses OpenMultipleDocuments -- so ConcatEngine maps it through
+            // FFmpegKitConfig.getSafParameterForRead and writes an `ffkitsaf:` path into the
+            // list file. The concat demuxer applies its own whitelist, defaulting to
+            // "file,crypto,data", and refused every one of them:
+            //
+            //   [ffkitsaf @ ...] Protocol 'ffkitsaf' not on whitelist 'file,crypto,data'!
+            //
+            // This only widens that default. It is on the stream-copy branch alone because it
+            // is the only one that feeds the demuxer a list file -- REENCODE passes each input
+            // with its own -i, where the whitelist does not apply, which is why joining over SAF
+            // worked for mismatched clips and failed for matching ones.
+            add("-protocol_whitelist")
+            add(PROTOCOL_WHITELIST)
             add("-i")
             add(listFile.absolutePath)
             add("-c")
@@ -84,4 +99,12 @@ object FFmpegConcatCommand {
             add(output.absolutePath)
         }
     }
+
+    /**
+     * The concat demuxer's protocol whitelist: FFmpeg's own default, plus ffmpeg-kit's SAF scheme.
+     *
+     * Spelled out rather than appended to an unknown default, because the default is FFmpeg's and
+     * could change under us; naming all four keeps the command self-describing. See #238.
+     */
+    private const val PROTOCOL_WHITELIST = "file,crypto,data,ffkitsaf"
 }

app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt

@@ -7,11 +7,15 @@ package org.libremediaconverter.model
  *
  * "Can MP4 carry AV1?" and "can this app make AV1?" have different answers, and remux is exactly
  * where the difference shows. MP4 carries AV1 and ALAC happily; neither engine here encodes them.
- * Matroska carries Vorbis; nothing in [org.libremediaconverter.ffmpeg.FFmpegCommandBuilder] emits a
- * Vorbis encoder. A single `isValid` boolean would answer one of those questions and give the wrong
+ * Matroska carries VP8; nothing in [org.libremediaconverter.ffmpeg.FFmpegCommandBuilder] emits a
+ * VP8 encoder. A single `isValid` boolean would answer one of those questions and give the wrong
  * error for the other — telling a user "MP4 cannot hold AV1" when the truth is "your AV1 file can be
  * copied into MP4, just not re-encoded to it".
  *
+ * The example used to be Vorbis, and #254 is what stopped it being true — by rebuilding the
+ * bundled FFmpeg, because the Vorbis arm named `libvorbis` and the binary did not carry it. The
+ * gap is a video-only one now.
+ *
  * So the matrix is indexed by mode: [CodecMode.COPY] asks only what the muxer accepts,
  * [CodecMode.ENCODE] additionally asks what this app can encode.
  *
@@ -81,10 +85,28 @@ object ContainerCapabilities {
      */
     private val ENCODABLE_VIDEO = setOf(VideoCodec.H264, VideoCodec.H265, VideoCodec.VP9)
 
-    /** Vorbis is absent for the same reason: nothing here emits a Vorbis encoder. */
+    /**
+     * Audio codecs this app can encode. Every codec any container here carries, as of #254.
+     *
+     * The comment this replaces said "Vorbis is absent for the same reason: nothing here emits a
+     * Vorbis encoder", and it was false as written — `FFmpegCommandBuilder.audioArgs` has had a
+     * Vorbis arm since the builder existed. Its absence from this set was what made that arm
+     * unreachable, and nothing recorded the decision either way. It also hid a second fault: the
+     * arm named `libvorbis`, which was not compiled into the bundled binary, so the format the app
+     * declined to offer was one it could not actually have produced. #254 rebuilt the AAR with
+     * `--enable-libvorbis` and added the codec here in the same change.
+     *
+     * That makes this set equal to the union of [CARRIES_AUDIO], which `ContainerCapabilitiesTest`
+     * now asserts rather than leaving to be noticed. The consequence is that [validateAudio]'s
+     * "this app cannot encode X audio" arm has no reachable input. It stays: the video half of the
+     * same rule is live (VP8 and AV1), and this is where an ALAC or an AC-3 entry would land the
+     * day the matrix carries one. It is F4-shaped — a second line of defence that cannot currently
+     * be provoked — and the set-equality assertion is what turns that from a hope into a check.
+     */
     private val ENCODABLE_AUDIO = setOf(
         AudioCodec.AAC,
         AudioCodec.OPUS,
+        AudioCodec.VORBIS,
         AudioCodec.MP3,
         AudioCodec.FLAC,
         AudioCodec.PCM,

app/src/main/java/org/libremediaconverter/model/OutputFormat.kt

@@ -12,8 +12,19 @@ package org.libremediaconverter.model
  * and without it `.mka`, MP4 is `.mp4` or `.m4a`. That distinction is why they are functions rather
  * than properties.
  *
+ * The extension turned out to depend on a second thing, which is what [audioCodecExtensions] is
+ * for — see its parameter note.
+ *
  * @param ffmpegFormat the `-f` value. Named explicitly rather than left to extension inference,
  *   which is unreliable for MPEG-TS and ASF.
+ * @param audioCodecExtensions per-codec overrides of [audioExtension]. Ogg is the only container
+ *   that needs one, and it is the reason this parameter exists: one Ogg stream can hold Vorbis,
+ *   Opus or FLAC, and RFC 7845 §9 asks for `.opus` on an Ogg that carries Opus alone while
+ *   everything else in an Ogg is a plain `.ogg`. A single container-wide extension cannot say
+ *   both — and it said `opus` for *every* Ogg until [OutputFormat.OGG_VORBIS] existed, which
+ *   would have named a Vorbis file `.opus`. That is the same defect as the `FLAC` preset that
+ *   once declared Matroska with a `.flac` extension, which is what moved these fields onto the
+ *   container in the first place.
  */
 enum class Container(
     val label: String,
@@ -22,6 +33,7 @@ enum class Container(
     private val audioExtension: String,
     private val videoMime: String?,
     private val audioMime: String,
+    private val audioCodecExtensions: Map<AudioCodec, String> = emptyMap(),
 ) {
     MP4("MP4", "mp4", "mp4", "m4a", "video/mp4", "audio/mp4"),
     MOV("MOV", "mov", "mov", "m4a", "video/quicktime", "audio/mp4"),
@@ -32,7 +44,7 @@ enum class Container(
     FLV("FLV", "flv", "flv", "flv", "video/x-flv", "video/x-flv"),
     ASF("WMV/ASF", "asf", "wmv", "wma", "video/x-ms-wmv", "audio/x-ms-wma"),
 
-    OGG("Ogg", "ogg", null, "opus", null, "audio/ogg"),
+    OGG("Ogg", "ogg", null, "ogg", null, "audio/ogg", mapOf(AudioCodec.OPUS to "opus")),
     WAV("WAV", "wav", null, "wav", null, "audio/wav"),
     AAC_ADTS("AAC", "adts", null, "aac", null, "audio/aac"),
     MP3("MP3", "mp3", null, "mp3", null, "audio/mpeg"),
@@ -45,7 +57,17 @@ enum class Container(
     /** Whether this container can hold a video track at all. */
     val canHoldVideo: Boolean get() = videoExtension != null
 
-    fun extensionFor(hasVideo: Boolean): String = if (hasVideo) videoExtension ?: audioExtension else audioExtension
+    /**
+     * The filename extension for an output in this container.
+     *
+     * [audioCodec] takes no default on purpose. A default would let a caller get `.ogg` for an
+     * Opus output by saying nothing, which is exactly the silent-wrong-answer shape the audio
+     * codec argument was added to close.
+     */
+    fun extensionFor(hasVideo: Boolean, audioCodec: AudioCodec): String = when {
+        hasVideo -> videoExtension ?: audioExtension
+        else -> audioCodecExtensions[audioCodec] ?: audioExtension
+    }
 
     fun mimeTypeFor(hasVideo: Boolean): String = if (hasVideo) videoMime ?: audioMime else audioMime
 }
@@ -102,7 +124,7 @@ data class OutputSpec(val container: Container, val videoCodec: VideoCodec, val
             audioCodec.isCopyOrAbsent() &&
             (videoCodec == VideoCodec.COPY || audioCodec == AudioCodec.COPY)
 
-    val extension: String get() = container.extensionFor(hasVideo)
+    val extension: String get() = container.extensionFor(hasVideo, audioCodec)
     val mimeType: String get() = container.mimeTypeFor(hasVideo)
 
     private fun VideoCodec.isCopyOrAbsent() = this == VideoCodec.COPY || this == VideoCodec.NONE
@@ -129,6 +151,19 @@ enum class OutputFormat(val label: String, val spec: OutputSpec) {
     MP3("MP3", OutputSpec(Container.MP3, VideoCodec.NONE, AudioCodec.MP3)),
     M4A_AAC("M4A (AAC)", OutputSpec(Container.MP4, VideoCodec.NONE, AudioCodec.AAC)),
     OPUS("Opus", OutputSpec(Container.OGG, VideoCodec.NONE, AudioCodec.OPUS)),
+
+    /**
+     * The other codec Ogg carries, and the only preset added to make an existing arm reachable.
+     *
+     * `FFmpegCommandBuilder` has emitted a Vorbis encoder since the builder was written, and
+     * nothing could ask for it: no preset produced [AudioCodec.VORBIS] and `ContainerCapabilities`
+     * refused it on the Advanced picker, so the arm was dead in both directions (#254). It was also
+     * naming `libvorbis`, which the bundled FFmpeg did not carry until that same ticket rebuilt it,
+     * so making it reachable meant rebuilding the binary under it. Named for
+     * the container as well as the codec because [OPUS] shares that container and the two produce
+     * differently-named files — `.opus` against `.ogg`.
+     */
+    OGG_VORBIS("Ogg Vorbis", OutputSpec(Container.OGG, VideoCodec.NONE, AudioCodec.VORBIS)),
     FLAC("FLAC", OutputSpec(Container.FLAC, VideoCodec.NONE, AudioCodec.FLAC)),
     WAV("WAV", OutputSpec(Container.WAV, VideoCodec.NONE, AudioCodec.PCM)),
 

app/src/main/java/org/libremediaconverter/work/ConcatWorker.kt

@@ -8,6 +8,7 @@ import androidx.work.CoroutineWorker
 import androidx.work.Data
 import androidx.work.ForegroundInfo
 import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.OutOfQuotaPolicy
 import androidx.work.WorkerParameters
 import androidx.work.hasKeyWithValueOfType
 import androidx.work.workDataOf
@@ -27,6 +28,10 @@ import org.libremediaconverter.model.OutputFormat
  * Progress is not reported. FFmpeg's statistics callback gives a timestamp against a
  * single input's duration, which is meaningless once several files are being
  * concatenated; showing a fabricated percentage would be worse than showing none.
+ *
+ * Enqueued as **expedited** work for the same reasons, and with the same caveats, as
+ * [ConversionWorker] — its class KDoc carries both, and a join is user-initiated in exactly the
+ * way a conversion is.
  */
 @UnstableApi
 class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker(context, params) {
@@ -68,13 +73,10 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
             // which is where a WorkManager restart after process death always begins -- used to
             // throw straight past this catch, taking the retry, the error message and the delete
             // with it. See ConversionWorker.doWork and FailureOutcome.
-            setForeground(
-                ForegroundInfo(
-                    NOTIFICATION_ID,
-                    notifications.build(id, "Joining ${uris.size} files", 0, indeterminate = true),
-                    ConversionForegroundType.current(),
-                ),
-            )
+            //
+            // Posted through getForegroundInfo() rather than built here a second time -- see that
+            // override, and its twin in ConversionWorker.
+            setForeground(getForegroundInfo())
 
             val result = ConversionDependencies.concat(applicationContext).join(uris, staged, format)
             Result.success(
@@ -129,11 +131,29 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
         return publisher.hasSpaceFor(bytes)
     }
 
-    override suspend fun getForegroundInfo(): ForegroundInfo = ForegroundInfo(
-        NOTIFICATION_ID,
-        notifications.build(id, "Joining files", 0, indeterminate = true),
-        ConversionForegroundType.current(),
-    )
+    /**
+     * The notification a starting join posts, and now the only definition of it.
+     *
+     * WorkManager's hook for expedited work, which **will not call this on any device this app
+     * supports** — see [ConversionWorker.getForegroundInfo] for the measurement and for why
+     * `setExpedited` alone would have left these lines exactly as cold as they were. What makes
+     * them live is [doWork] posting this instead of building its own copy.
+     *
+     * It counts the inputs itself rather than being handed the number, so that it is still answerable
+     * before [doWork] has parsed anything — which is the contract WorkManager's own caller wants.
+     * The count is read from the same key, so the two cannot disagree. The `?: 0` arm is
+     * unreachable and named rather than covered: [doWork] refuses a job with no URI array several
+     * lines above this call, and nothing else calls it. It is the shape `docs/coverage-read-findings.md`
+     * calls F4 — a second line of defence that cannot be provoked.
+     */
+    override suspend fun getForegroundInfo(): ForegroundInfo {
+        val inputCount = inputData.getStringArray(KEY_INPUT_URIS)?.size ?: 0
+        return ForegroundInfo(
+            NOTIFICATION_ID,
+            notifications.build(id, joiningTitle(inputCount), 0, indeterminate = true),
+            ConversionForegroundType.current(),
+        )
+    }
 
     companion object {
         /**
@@ -204,6 +224,16 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
          */
         fun outputNameFor(format: OutputFormat): String = "joined.${format.extension}"
 
+        /**
+         * What the progress notification says while a join runs.
+         *
+         * Named once, for the convention #158 established about strings the user can see. It was
+         * two strings until 2026-09-06 — `"Joining N files"` built inline in [doWork] and a
+         * countless `"Joining files"` in [getForegroundInfo] — for one notification that only ever
+         * had one job, and the copy nothing executed was free to drift from the one that did.
+         */
+        fun joiningTitle(inputCount: Int): String = "Joining $inputCount files"
+
         private const val NOTIFICATION_ID = 1002
         private const val TAG = "ConcatWorker"
 
@@ -215,6 +245,10 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
          */
         fun request(inputs: List<Uri>, totalBytes: Long?, format: OutputFormat = DEFAULT_FORMAT) =
             OneTimeWorkRequestBuilder<ConcatWorker>()
+                // Expedited, exactly as ConversionWorker.request is and for the same reasons; that
+                // one's comment and class KDoc carry them. Nothing here sets an initial delay or a
+                // constraint, which is what makes it legal for `build()` to accept.
+                .setExpedited(OutOfQuotaPolicy.RUN_AS_NON_EXPEDITED_WORK_REQUEST)
                 .addTag(JobTags.inputCount(inputs.size))
                 .setInputData(
                     Data.Builder()

app/src/main/java/org/libremediaconverter/work/ConversionWorker.kt

@@ -8,6 +8,7 @@ import androidx.work.CoroutineWorker
 import androidx.work.Data
 import androidx.work.ForegroundInfo
 import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.OutOfQuotaPolicy
 import androidx.work.WorkerParameters
 import androidx.work.hasKeyWithValueOfType
 import androidx.work.workDataOf
@@ -40,8 +41,28 @@ import java.io.File
  * observe. That durability is what makes the six-hour foreground-service timeout
  * recoverable instead of fatal.
  *
- * Expedited work is deliberately *not* used. It maps to JobScheduler expedited jobs
- * with a short quota, which is the wrong shape for a multi-minute transcode.
+ * Enqueued as **expedited** work, with `RUN_AS_NON_EXPEDITED_WORK_REQUEST`. This paragraph said
+ * the opposite until 2026-09-06 — "deliberately *not* used… the wrong shape for a multi-minute
+ * transcode" — and the quota it named does not reach a transcode the way it reads:
+ *
+ *  - The quota belongs to the *JobScheduler* job, and `SystemJobInfoConverter:135` in
+ *    work-runtime 2.11.2 sets `JobInfo.setExpedited(true)` only when `!isRetry && !isDelayed`.
+ *    A retry is therefore scheduled exactly as every job is scheduled today.
+ *  - A job the system stops mid-run does not get its answer from [FailureOutcome].
+ *    `WorkerWrapper.interrupt` cancels the worker's coroutine with a `WorkerStoppedException`,
+ *    which its `launch` resolves as `ResetWorkerStatus` — the worker's own `Result` is discarded
+ *    and the work re-enqueued with backoff, whatever it returned. So a quota stop is a retry, and
+ *    the `CancellationException` arm in [doWork] is what deletes the partial on the way through.
+ *
+ * What it buys is narrower than "conversions start sooner", and the narrowness is the honest part:
+ * `GreedyScheduler` starts unconstrained, undelayed work in-process the moment it is enqueued and
+ * carries no `expedited` branch at all, so a conversion begun from the open app runs exactly when
+ * it ran before — the common case does not move. The flag is for the job that has to go *through*
+ * JobScheduler because no process is left to start it: one still enqueued when the app died.
+ * `SystemJobScheduler.schedule` re-converts the spec every time it schedules, so such a job is
+ * expedited on the way back in, and a retried one is not. `RUN_AS_NON_EXPEDITED_WORK_REQUEST`
+ * rather than `DROP_WORK_REQUEST`: an invisible quota is no reason to throw a user's conversion
+ * away, and `SystemJobScheduler:198` degrades it to an ordinary job instead.
  *
  * That durability is not free, and the queue surviving is not the same as the job surviving.
  * When WorkManager recovers a job after process death the app is by definition in the background,
@@ -60,7 +81,7 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
     override suspend fun doWork(): Result {
         val inputUri = inputData.getString(KEY_INPUT_URI)?.let(Uri::parse)
             ?: return Result.failure(workDataOf(KEY_ERROR to "No input file."))
-        val displayName = inputData.getString(KEY_DISPLAY_NAME) ?: "input"
+        val displayName = displayName()
         // Absent, not zero, when nobody could say -- see InputQuery. `getLong(key, 0L)` is what
         // made those two the same number, and `hasSpaceFor(0)` is only "is there 128 MB free".
         val declaredSize = inputData
@@ -100,7 +121,10 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
             // process death is. With it above the try that throw escaped doWork() entirely: no
             // retry, no error in the output Data, and no staged.delete(). MediaProbe.probe below
             // was outside for the same reason and had the same problem.
-            setForeground(foregroundInfo(displayName, percent = 0, indeterminate = true))
+            //
+            // Posted through getForegroundInfo() rather than built here a second time -- see that
+            // override for what the duplicate cost.
+            setForeground(getForegroundInfo())
 
             // Through the seam rather than MediaProbe directly. The seam already existed for the
             // ViewModel and the worker was the last caller bypassing it, which is why nothing on
@@ -339,8 +363,32 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
         return OutputSpec(container, video, audio)
     }
 
+    /**
+     * What this job's input is called, or [InputQuery.FALLBACK_DISPLAY_NAME] when nothing named it.
+     *
+     * One read rather than the two copies of `?: "input"` that [doWork] and [getForegroundInfo]
+     * each carried, and against `InputQuery`'s constant rather than a third literal of the same
+     * string: it is the same fallback the picker uses, and it reaches the save dialog as
+     * `input_converted.mp4`.
+     */
+    private fun displayName(): String = inputData.getString(KEY_DISPLAY_NAME) ?: InputQuery.FALLBACK_DISPLAY_NAME
+
+    /**
+     * The notification a starting conversion posts, and now the only definition of it.
+     *
+     * This is WorkManager's hook for expedited work, and **it will not be called on any device
+     * this app supports.** `WorkForeground.kt:38` in work-runtime 2.11.2 opens with
+     * `if (!spec.expedited || Build.VERSION.SDK_INT >= 31) return`, that function is the library's
+     * only caller of `getForegroundInfoAsync()`, and `minSdk` is 33. So #252's premise — that
+     * enqueueing expedited work would make these lines live — is false, and `setExpedited` alone
+     * would have left them exactly as cold as the first instrumented coverage read found them.
+     *
+     * What makes them live is [doWork] posting *this* instead of building its own copy. The two
+     * were identical — same title, `percent = 0`, `indeterminate = true` — so one was a duplicate
+     * that could drift, and the one nothing executed is the one that would have drifted silently.
+     */
     override suspend fun getForegroundInfo(): ForegroundInfo = foregroundInfo(
-        inputData.getString(KEY_DISPLAY_NAME) ?: "input",
+        displayName(),
         percent = 0,
         indeterminate = true,
     )
@@ -416,6 +464,12 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
             quality: QualityTier = QualityTier.FAST,
             enginePreference: EnginePreference = EnginePreference.AUTO,
         ) = OneTimeWorkRequestBuilder<ConversionWorker>()
+            // Expedited, so the jobs that do go through JobScheduler are treated as the
+            // user-initiated work they are -- see the class KDoc for what that is and is not worth.
+            // Safe to set here and only because of what this builder does not do: `build()` refuses
+            // an expedited request carrying an initial delay or any constraint but network and
+            // storage, and none of the three is set below.
+            .setExpedited(OutOfQuotaPolicy.RUN_AS_NON_EXPEDITED_WORK_REQUEST)
             .addTag(JobTags.displayName(displayName))
             // Neither the tag nor the Data entry is written for a size nobody knows. A `Data` has
             // no null, so the absence of the key *is* the unknown — and a tag reading

app/src/test/java/org/libremediaconverter/convert/LauncherWiringTest.kt

@@ -6,6 +6,7 @@ import android.net.Uri
 import androidx.activity.ComponentActivity
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.performClick
 import androidx.media3.common.util.UnstableApi
@@ -77,6 +78,28 @@ class LauncherWiringTest {
      * The transposition guard. A picked file has to reach `onInputPicked`, which is observable as
      * the screen arriving at `Ready` with the file card showing — `save()` from `Idle` returns at
      * its own guard and leaves nothing behind.
+     *
+     * ## Why this waits rather than asserting straight away (#220)
+     *
+     * `onInputPicked` does not reach `Ready` on the calling thread. It hops twice —
+     * `withContext(pickDispatcher) { InputQuery.describe(...) }` and then the probe — and
+     * `pickDispatcher` defaults to `Dispatchers.IO`, a real background thread that Compose's
+     * idling does not know about. `deliver` therefore returns with the state still `Idle` more
+     * often than not, and asserting immediately was a race the test usually won.
+     *
+     * It lost five times on CI in one day, on PRs whose diffs were instrumented tests and
+     * documentation, which is what #220 was filed for. `waitUntil` polls through
+     * `waitForIdle`, so it drains the main looper each time round and sees the recomposition that
+     * the IO hop eventually posts back.
+     *
+     * **Injecting the dispatcher would be better and is not available here.** `pickDispatcher` is
+     * a constructor parameter precisely so a test can pin it, but this test composes the real
+     * `ConverterScreen`, which resolves its own ViewModel through `viewModel()` — the seam exists
+     * one layer below the thing under test. Pinning it would mean not testing the launcher edge,
+     * which is the whole point of this class.
+     *
+     * The wait does not weaken the assertion: transposing the two callbacks leaves the screen in
+     * `Idle` forever, so it fails on the timeout with the same meaning it failed with before.
      */
     @Test
     fun `a picked document is loaded as input rather than saved to`() {
@@ -85,6 +108,11 @@ class LauncherWiringTest {
         composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).performClick()
         deliver(Uri.parse("content://test/holiday.mkv"))
 
+        composeRule.waitUntil(PICK_TIMEOUT_MS) {
+            composeRule.onAllNodesWithTag(TestTags.Converter.FILE_CARD_NAME)
+                .fetchSemanticsNodes()
+                .isNotEmpty()
+        }
         composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD_NAME).assertIsDisplayed()
     }
 
@@ -138,4 +166,13 @@ class LauncherWiringTest {
         )
         composeRule.waitForIdle()
     }
+
+    private companion object {
+        /**
+         * Long enough that a slow CI runner is not the reason this fails, short enough that a
+         * genuinely transposed callback does not stall the suite. The pick normally lands in
+         * single-digit milliseconds.
+         */
+        const val PICK_TIMEOUT_MS = 10_000L
+    }
 }

app/src/test/java/org/libremediaconverter/convert/Media3MuxersTest.kt

@@ -106,7 +106,10 @@ class Media3MuxersTest {
      * has changed its mind and somebody should say so on purpose.
      *
      * - Media3's MP4 muxer accepts Vorbis; [ContainerCapabilities] declines to offer it, because
-     *   Vorbis-in-MP4 is poorly supported by players.
+     *   Vorbis-in-MP4 is poorly supported by players. That refusal is about **this container**,
+     *   not about the codec: since #254 the app encodes Vorbis for Ogg, Matroska and WebM, and
+     *   the assertion below is what keeps MP4 out of that list on purpose rather than by
+     *   omission — it is `CARRIES_AUDIO[MP4]`, so widening the encodable set cannot reach it.
      * - The matrix offers MP3 and FLAC in MP4, which is legal and which FFmpeg writes happily, but
      *   Media3's MP4 muxer carries neither — so those jobs route to FFmpeg rather than failing.
      */

app/src/test/java/org/libremediaconverter/ffmpeg/FFmpegCommandBuilderTest.kt

@@ -166,6 +166,47 @@ class FFmpegCommandBuilderTest {
         assertPair(cmd(OutputFormat.OPUS), "-c:a", "libopus")
     }
 
+    /**
+     * The arm that named an encoder the shipped binary did not contain.
+     *
+     * This read `-c:a libvorbis` from the day the builder was written and had never been run: no
+     * preset produced [AudioCodec.VORBIS] and `ContainerCapabilities` refused it. It could not
+     * have worked either — `--enable-libvorbis` was in neither `bin/README.md`'s configure line
+     * nor `tools/ffmpeg/build-ffmpeg.sh`, and the string `libvorbis` was not in the shipped
+     * `libavcodec.so` while `libopus`, `libmp3lame`, `libx264` and five others were. #254 rebuilt
+     * the AAR with it.
+     *
+     * **What this test cannot do is tell you that.** `-c:a libvorbis` and `-c:a libvorbisss` are
+     * the same string to a JVM assertion, which is precisely how the defect survived four coverage
+     * waves and a review that asked whether every test asserted something. The positive claim —
+     * that this encoder exists in the binary and produces a Vorbis track — is proved by
+     * `FFmpegEngineTest.encodesOggVorbisThroughAnEncoderTheBundledBinaryActuallyHas` on a device,
+     * and by nothing else in this repo.
+     *
+     * The two negatives are the assertions that carry real weight here, because each pins a
+     * decision rather than a name. `-strict experimental` and `-ac 2` are what FFmpeg's in-tree
+     * `vorbis` encoder forces, and taking the in-tree encoder would silently upmix mono; the arm's
+     * KDoc has the measurements. `-f ogg` is asserted because encoder and muxer together are what
+     * make the file — an encoder without its muxer is how a Vorbis stream ends up in a container
+     * that will not open.
+     */
+    @Test
+    fun `ogg vorbis names libvorbis, with no experimental gate and no forced stereo`() {
+        val args = cmd(OutputFormat.OGG_VORBIS)
+
+        assertPair(args, "-c:a", "libvorbis")
+        assertPair(args, "-q:a", "5")
+        assertPair(args, "-f", "ogg")
+        assertFalse(
+            "libvorbis is not experimental; -strict belongs to FFmpeg's in-tree encoder: $args",
+            args.contains("-strict"),
+        )
+        assertFalse(
+            "libvorbis takes any channel count, so mono must not be upmixed: $args",
+            args.contains("-ac"),
+        )
+    }
+
     /**
      * The arm most conversions actually take, and the only one in `audioArgs` with no test.
      *
@@ -216,7 +257,13 @@ class FFmpegCommandBuilderTest {
 
     @Test
     fun `audio only formats never carry a video encoder`() {
-        listOf(OutputFormat.MP3, OutputFormat.FLAC, OutputFormat.WAV, OutputFormat.OPUS)
+        listOf(
+            OutputFormat.MP3,
+            OutputFormat.FLAC,
+            OutputFormat.WAV,
+            OutputFormat.OPUS,
+            OutputFormat.OGG_VORBIS,
+        )
             .forEach { format ->
                 val args = cmd(format)
                 assertFalse("$format should not set -c:v", args.contains("-c:v"))

app/src/test/java/org/libremediaconverter/ffmpeg/FFmpegConcatCommandTest.kt

@@ -56,6 +56,33 @@ class FFmpegConcatCommandTest {
         assertEquals("0", args[args.indexOf("-safe") + 1])
     }
 
+    /**
+     * The gate that `-safe 0` does not open, and the one every real join needs (#238).
+     *
+     * `-safe 0` permits absolute *paths*; the concat demuxer separately whitelists the *protocol*,
+     * defaulting to `file,crypto,data`. `JoinScreen` picks with `OpenMultipleDocuments`, so real
+     * inputs are `content://` and `ConcatEngine` writes `ffkitsaf:` paths into the list file — which
+     * the demuxer refused outright, failing every stream-copy join a user could actually start.
+     *
+     * The re-encode strategy has no equivalent assertion because it needs none: it passes each
+     * input with its own `-i` and never feeds the demuxer a list file. That asymmetry is exactly
+     * why the defect survived — joining mismatched clips over SAF worked.
+     */
+    @Test
+    fun `stream copy whitelists the protocol its list file entries actually use`() {
+        val args = FFmpegConcatCommand.build(
+            ConcatStrategy.STREAM_COPY,
+            inputs,
+            listFile,
+            output,
+            OutputFormat.MP4_H264,
+        )
+        val whitelist = args[args.indexOf("-protocol_whitelist") + 1].split(",")
+        assertTrue("ffmpeg-kit's SAF scheme must be permitted, got $whitelist", "ffkitsaf" in whitelist)
+        // The defaults have to survive too: the list file itself is opened over `file`.
+        assertTrue("the demuxer still reads the list file itself, got $whitelist", "file" in whitelist)
+    }
+
     @Test
     fun `re-encode passes every input separately and builds a filter graph`() {
         val args = FFmpegConcatCommand.build(

app/src/test/java/org/libremediaconverter/model/ContainerCapabilitiesTest.kt

@@ -19,6 +19,16 @@ import org.junit.Test
  */
 class ContainerCapabilitiesTest {
 
+    /**
+     * The codecs the matrix can actually be asked about.
+     *
+     * `COPY` and `NONE` are excluded because [ContainerCapabilities.accepts] refuses the first
+     * outright — `resolving COPY before asking the matrix is required` covers that — and answers
+     * the second `true` for every container without consulting any table.
+     */
+    private val realAudioCodecs = AudioCodec.entries - AudioCodec.COPY - AudioCodec.NONE
+    private val realVideoCodecs = VideoCodec.entries - VideoCodec.COPY - VideoCodec.NONE
+
     private val h264Source = InputProbe(
         videoCodec = "h264",
         audioCodec = "aac",
@@ -79,10 +89,50 @@ class ContainerCapabilitiesTest {
     }
 
     @Test
-    fun `Matroska carries Vorbis on copy but nothing here encodes it`() {
-        assertTrue(ContainerCapabilities.accepts(Container.MKV, AudioCodec.VORBIS, CodecMode.COPY))
+    fun `Matroska carries VP8 on copy but nothing here encodes it`() {
+        assertTrue(ContainerCapabilities.accepts(Container.MKV, VideoCodec.VP8, CodecMode.COPY))
         assertFalse(
-            ContainerCapabilities.accepts(Container.MKV, AudioCodec.VORBIS, CodecMode.ENCODE),
+            ContainerCapabilities.accepts(Container.MKV, VideoCodec.VP8, CodecMode.ENCODE),
+        )
+    }
+
+    /**
+     * Where the copy/encode gap actually is, asserted as a set rather than as examples.
+     *
+     * This used to have an audio twin — Matroska carries Vorbis, and nothing was thought to encode
+     * it. That was never true of the code: `FFmpegCommandBuilder` has emitted a Vorbis encoder
+     * since it was written, and only `ENCODABLE_AUDIO`'s omission made the arm unreachable (#254).
+     * With Vorbis in the set, **the audio gap is empty** and the mode axis earns its place on the
+     * video side alone.
+     *
+     * Two consequences worth having pinned rather than rediscovered:
+     *
+     *  - `validateAudio`'s "this app cannot encode X audio" arm now has no reachable input, which
+     *    is why no test drives it. It stays in production as the landing spot for the first ALAC
+     *    or AC-3 entry, and this test is what will fail the day one is carried without an encoder
+     *    — where before, an omission like Vorbis's could sit unnoticed for the life of the file.
+     *  - The video list is the real one, and asserting it as a set is what makes an accidental
+     *    addition visible: an encoder added for VP8 without a matching `ENCODABLE_VIDEO` entry
+     *    would leave this passing, but a *carried* codec quietly dropped from the encodable set
+     *    would not.
+     */
+    @Test
+    fun `the copy-only gap is video-only, and VP8 and AV1 are all of it`() {
+        fun <T> gap(codecs: List<T>, accepts: (Container, T, CodecMode) -> Boolean): Set<T> =
+            Container.entries.flatMap { container ->
+                codecs
+                    .filter { accepts(container, it, CodecMode.COPY) }
+                    .filterNot { accepts(container, it, CodecMode.ENCODE) }
+            }.toSet()
+
+        assertEquals(
+            "no container may carry an audio codec this app cannot also encode",
+            emptySet<AudioCodec>(),
+            gap(realAudioCodecs, ContainerCapabilities::accepts),
+        )
+        assertEquals(
+            setOf(VideoCodec.VP8, VideoCodec.AV1),
+            gap(realVideoCodecs, ContainerCapabilities::accepts),
         )
     }
 
@@ -405,21 +455,30 @@ class ContainerCapabilitiesTest {
         assertEverySuggestionValid(invalid, mp3Source)
     }
 
+    /**
+     * The spec that used to be this class's example of an unencodable audio codec, now valid.
+     *
+     * It asserted `"This app cannot encode Vorbis audio. It can still be copied from a Vorbis
+     * source."` for exactly this spec, and the message was wrong about the app: the encoder
+     * existed, unreachable (#254). Asserting the positive is what stops the omission coming back —
+     * a revert of `ENCODABLE_AUDIO` fails here rather than merely restoring an old refusal that
+     * reads plausible.
+     *
+     * The audio arm it used to cover no longer has a reachable input; `the copy-only gap is
+     * video-only` above is where that is now recorded, and `copying is offered as the fix when the
+     * codec is right but unencodable` still covers the live video half of the same rule.
+     */
     @Test
-    fun `an audio codec this app cannot encode is refused, and copying is offered instead`() {
-        // Matroska carries Vorbis; nothing here encodes it. The refusal has to say so *and* say
-        // what would work, which is the audio twin of `copying is offered as the fix when the codec
-        // is right but unencodable`.
+    fun `Vorbis into Matroska is a re-encode this app will do`() {
         val spec = OutputSpec(Container.MKV, VideoCodec.H264, AudioCodec.VORBIS)
 
-        val invalid = ContainerCapabilities.validate(spec, h264Source) as? Validation.Invalid
-            ?: throw AssertionError("encoding Vorbis must be refused")
-
-        assertEquals(
-            "This app cannot encode Vorbis audio. It can still be copied from a Vorbis source.",
-            invalid.message,
+        assertTrue(
+            "Vorbis is encodable, so this spec must validate: ${ContainerCapabilities.validate(spec, h264Source)}",
+            ContainerCapabilities.validate(spec, h264Source).isValid,
         )
-        assertEverySuggestionValid(invalid, h264Source)
+        // The plan has to reach the encoder, not merely be permitted: an AAC source into Matroska
+        // cannot be upgraded to a copy, so this is an Encode carrying the codec that was asked for.
+        assertEquals(AudioPlan.Encode(AudioCodec.VORBIS), CopyPlanner.plan(spec, h264Source).audio)
     }
 
     @Test

app/src/test/java/org/libremediaconverter/model/ConversionRouterTest.kt

@@ -330,6 +330,28 @@ class ConversionRouterTest {
         }
     }
 
+    /**
+     * Ogg Vorbis leaves the hardware path one rule earlier than its Ogg sibling, and the reason
+     * shown to the user is the difference.
+     *
+     * Two rules would each send it to FFmpeg — Media3 cannot encode Vorbis, and it cannot write
+     * Ogg at all — and the order decides which explanation appears. The audio-encoder check runs
+     * first deliberately: `NO_PLATFORM_ENCODER` ("Android has no encoder for this format") is true
+     * of Vorbis on every Android version and tells the user something about their choice, where
+     * `CONTAINER_UNSUPPORTED` would name an internal boundary they cannot act on. That ordering is
+     * documented in the router and this is what holds it — asserting only the engine would pass
+     * with the two rules swapped.
+     */
+    @Test
+    fun `ogg vorbis routes to ffmpeg because Android has no Vorbis encoder`() {
+        val d = route(OutputFormat.OGG_VORBIS)
+        assertEquals(Engine.FFMPEG, d.engine)
+        assertEquals(Reason.NO_PLATFORM_ENCODER, d.reason)
+        // The sibling in the same container stops at the container rule instead, because Media3
+        // *can* encode Opus. One container, two reasons, and only the codec differs.
+        assertEquals(Reason.CONTAINER_UNSUPPORTED, route(OutputFormat.OPUS).reason)
+    }
+
     /** M4A is the audio format that does stay on hardware, because its container is MP4. */
     @Test
     fun `m4a stays on hardware because MP4 is a container Media3 can write`() {

app/src/test/java/org/libremediaconverter/model/OutputFormatTest.kt

@@ -75,9 +75,14 @@ class OutputFormatTest {
     fun `every container names an extension, a mime type and an ffmpeg muxer`() {
         Container.entries.forEach { container ->
             listOf(true, false).forEach { hasVideo ->
-                val ext = container.extensionFor(hasVideo)
-                assertTrue("$container has no extension", ext.isNotBlank())
-                assertFalse("$container extension has a dot", ext.startsWith("."))
+                // Every audio codec, because the extension now varies by one — see the Ogg pair
+                // below. A container that answered blank for a codec it carries would be a
+                // filename with no extension at all.
+                AudioCodec.entries.forEach { audioCodec ->
+                    val ext = container.extensionFor(hasVideo, audioCodec)
+                    assertTrue("$container/$audioCodec has no extension", ext.isNotBlank())
+                    assertFalse("$container/$audioCodec extension has a dot", ext.startsWith("."))
+                }
                 assertTrue(
                     "$container has no mime type",
                     container.mimeTypeFor(hasVideo).contains('/'),
@@ -89,10 +94,34 @@ class OutputFormatTest {
 
     @Test
     fun `audio-only variants of a container get their own extension`() {
-        assertEquals("mp4", Container.MP4.extensionFor(hasVideo = true))
-        assertEquals("m4a", Container.MP4.extensionFor(hasVideo = false))
-        assertEquals("mkv", Container.MKV.extensionFor(hasVideo = true))
-        assertEquals("mka", Container.MKV.extensionFor(hasVideo = false))
+        assertEquals("mp4", Container.MP4.extensionFor(hasVideo = true, audioCodec = AudioCodec.AAC))
+        assertEquals("m4a", Container.MP4.extensionFor(hasVideo = false, audioCodec = AudioCodec.AAC))
+        assertEquals("mkv", Container.MKV.extensionFor(hasVideo = true, audioCodec = AudioCodec.AAC))
+        assertEquals("mka", Container.MKV.extensionFor(hasVideo = false, audioCodec = AudioCodec.AAC))
+    }
+
+    /**
+     * The second thing the extension depends on, and the reason [Container.extensionFor] takes a
+     * codec at all.
+     *
+     * One Ogg stream holds Vorbis or Opus, and the two are named differently: RFC 7845 §9 asks for
+     * `.opus` on an Ogg carrying Opus alone, while a Vorbis one is a plain `.ogg`. The container
+     * declared `opus` for every Ogg until [OutputFormat.OGG_VORBIS] existed, which would have
+     * shipped a Vorbis file called `.opus` — the same shape as the `FLAC` preset that once
+     * declared Matroska with a `.flac` extension, which is the regression guarded above.
+     *
+     * Both halves are asserted. Pinning only the Vorbis one would pass just as well if the
+     * override map were deleted and every Ogg went back to a single extension, which is the
+     * mutation that has to fail.
+     */
+    @Test
+    fun `Ogg names its file after the codec in it, not after the container`() {
+        assertEquals("opus", OutputFormat.OPUS.extension)
+        assertEquals("ogg", OutputFormat.OGG_VORBIS.extension)
+        // The MIME type does not split the same way: audio/ogg is correct for both, so the SAF
+        // create-document contract sees one type for the two formats.
+        assertEquals("audio/ogg", OutputFormat.OPUS.mimeType)
+        assertEquals("audio/ogg", OutputFormat.OGG_VORBIS.mimeType)
     }
 
     /** Regression guard: FLAC used to be declared as Matroska with a `.flac` extension. */

app/src/test/java/org/libremediaconverter/work/ExpeditedRequestTest.kt

@@ -0,0 +1,102 @@
+package org.libremediaconverter.work
+
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Constraints
+import androidx.work.OutOfQuotaPolicy
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * Both workers enqueue **expedited** work, and stay legal doing it.
+ *
+ * The two questions are separate and only one of them is about the flag.
+ *
+ *  - **Is it set.** `expedited` is `false` by default, so `assertTrue` here is what a deleted
+ *    `setExpedited(...)` reddens. That mutation was run.
+ *  - **Is it legal.** `WorkRequest.Builder.build()` refuses an expedited request that carries an
+ *    initial delay or any constraint but network and storage — `require(workSpec.initialDelay <= 0)
+ *    { "Expedited jobs cannot be delayed" }` in work-runtime 2.11.2. Neither `request` sets either
+ *    today, so both `build()` calls pass and the `IllegalArgumentException` is a *future* hazard
+ *    rather than a current one. The delay and constraints assertions below are what name it: add a
+ *    delay to either builder and this class fails on the throw, in the same second, instead of the
+ *    app failing to enqueue a conversion on a device.
+ *
+ * **The policy assertion bites less than it reads, and that is worth writing down rather than
+ * leaving to be rediscovered.** `WorkSpec.outOfQuotaPolicy` *defaults* to
+ * `RUN_AS_NON_EXPEDITED_WORK_REQUEST`, so it is already this value on a request that was never
+ * expedited at all — deleting `setExpedited` does not redden it. What it does pin is the one
+ * alternative: `DROP_WORK_REQUEST` throws a user's conversion away because an invisible quota ran
+ * out, and that mutation *is* red here.
+ *
+ * The delay is not hypothetical either. Three tests deliberately build a delayed request to hold a
+ * job in `ENQUEUED` — `NotificationCancelActionTest`, `ReattachOnLaunchTest` and
+ * `CancelReachesWorkManagerTest` — and every one of them builds its own
+ * `OneTimeWorkRequestBuilder` rather than adding a delay to what `request` returns. That is why
+ * making these expedited broke none of them; the one that starts from `request` takes only
+ * `base.workSpec.input` from it.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ExpeditedRequestTest {
+
+    @Test
+    fun `a conversion is enqueued as expedited work`() {
+        val spec = ConversionWorker.request(INPUT, DISPLAY_NAME, INPUT_BYTES).workSpec
+
+        assertTrue("a conversion the user asked for has to be expedited work", spec.expedited)
+        assertEquals(
+            "a quota nobody can see is no reason to drop a conversion",
+            OutOfQuotaPolicy.RUN_AS_NON_EXPEDITED_WORK_REQUEST,
+            spec.outOfQuotaPolicy,
+        )
+    }
+
+    @Test
+    fun `a join is enqueued as expedited work`() {
+        val spec = ConcatWorker.request(listOf(INPUT, SECOND_INPUT), TOTAL_BYTES).workSpec
+
+        assertTrue("a join the user asked for has to be expedited work", spec.expedited)
+        assertEquals(
+            "a quota nobody can see is no reason to drop a join",
+            OutOfQuotaPolicy.RUN_AS_NON_EXPEDITED_WORK_REQUEST,
+            spec.outOfQuotaPolicy,
+        )
+    }
+
+    /**
+     * The two properties that keep `build()` from throwing, asserted on both requests at once
+     * because the rule is WorkManager's rather than either worker's.
+     */
+    @Test
+    fun `neither expedited request carries what would make it illegal`() {
+        val requests = listOf(
+            ConversionWorker.request(INPUT, DISPLAY_NAME, INPUT_BYTES).workSpec,
+            ConcatWorker.request(listOf(INPUT, SECOND_INPUT), TOTAL_BYTES).workSpec,
+        )
+
+        requests.forEach { spec ->
+            assertEquals(
+                "expedited work cannot be delayed: ${spec.workerClassName}",
+                0L,
+                spec.initialDelay,
+            )
+            assertEquals(
+                "expedited work takes only network and storage constraints: ${spec.workerClassName}",
+                Constraints.NONE,
+                spec.constraints,
+            )
+        }
+    }
+
+    private companion object {
+        val INPUT: Uri = Uri.parse("file:///tmp/holiday.mp4")
+        val SECOND_INPUT: Uri = Uri.parse("file:///tmp/holiday2.mp4")
+        const val DISPLAY_NAME = "holiday.mp4"
+        const val INPUT_BYTES = 1_024L
+        const val TOTAL_BYTES = 2_048L
+    }
+}

app/src/test/java/org/libremediaconverter/work/ForegroundNotificationTest.kt

@@ -0,0 +1,203 @@
+package org.libremediaconverter.work
+
+import android.app.Application
+import android.app.Notification
+import android.net.Uri
+import androidx.media3.common.util.UnstableApi
+import androidx.work.Data
+import androidx.work.testing.TestListenableWorkerBuilder
+import androidx.work.workDataOf
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.libremediaconverter.convert.ConcatJoiner
+import org.libremediaconverter.convert.ConversionDependencies
+import org.libremediaconverter.convert.installTestWorkManager
+import org.libremediaconverter.ffmpeg.ConcatEngine
+import org.libremediaconverter.model.ConcatStrategy
+import org.libremediaconverter.model.DeviceCodecs
+import org.libremediaconverter.model.EnginePreference
+import org.libremediaconverter.model.InputProbe
+import org.libremediaconverter.model.OutputFormat
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import java.io.File
+import java.util.UUID
+
+/**
+ * The first thing either worker posts is what its own `getForegroundInfo()` builds.
+ *
+ * **Both overrides were dead code until 2026-09-06, and #252 is where that was found** — the first
+ * instrumented coverage read reported `ConversionWorker:342-346` and `ConcatWorker:132-136` among
+ * the 32 lines *neither* suite reaches. The ticket's premise was that enqueueing expedited work
+ * would make them live, since `getForegroundInfo()` is WorkManager's expedited-work hook.
+ *
+ * **That premise is false at this `minSdk`, which is the finding underneath the fix.**
+ * `WorkForeground.kt:38` in work-runtime 2.11.2 opens `workForeground` with
+ * `if (!spec.expedited || Build.VERSION.SDK_INT >= 31) return`, that function is the library's only
+ * caller of `getForegroundInfoAsync()`, and `minSdk` is 33. So `setExpedited` alone would have left
+ * both overrides exactly as cold as the read found them, and a test written to drive them through
+ * WorkManager would be testing a code path no device this app supports can take — E1's failure
+ * mode, where a test asserts and never reaches.
+ *
+ * What makes them live is a single-definition change instead. Each worker had **two** definitions
+ * of one notification: the override, and an identical `ForegroundInfo` built inline in `doWork`.
+ * `doWork` now posts the override's, so the copy nothing executed is gone and the one that remains
+ * runs on every job.
+ *
+ * These tests are what hold that wiring. Each asserts the notification's *contents* against
+ * constants rather than against `worker.getForegroundInfo()` — comparing the two would move
+ * together under every mutation and stay green — and the mutations that redden them are named on
+ * each test.
+ */
+@UnstableApi
+@RunWith(RobolectricTestRunner::class)
+class ForegroundNotificationTest {
+
+    private lateinit var app: Application
+    private lateinit var updater: RecordingForegroundUpdater
+
+    @Before
+    fun setUp() {
+        app = RuntimeEnvironment.getApplication()
+        updater = RecordingForegroundUpdater()
+        ConversionDependencies.publisher = { AlwaysRoomPublisher(app) }
+        ConversionDependencies.probe = { _, _ -> InputProbe() }
+        ConversionDependencies.deviceCodecs = { DeviceCodecs.PERMISSIVE }
+        ConversionDependencies.software = { WritingTranscoder }
+        ConversionDependencies.concat = { WritingJoiner }
+        // The notification carries a WorkManager cancel PendingIntent, so without this the worker
+        // fails building the notification rather than on anything these tests are about.
+        installTestWorkManager(app, Data.EMPTY)
+    }
+
+    @After
+    fun tearDown() {
+        ConversionDependencies.reset()
+    }
+
+    /**
+     * Mutation that must go red, and did: inside `ConversionWorker.getForegroundInfo`, replace
+     * `displayName()` with a literal, or `percent = 0` with anything else. Both are in the override's
+     * own body, so a red here is proof `doWork` executes it rather than a copy of it.
+     */
+    @Test
+    fun `a conversion's first foreground post is the one getForegroundInfo builds`() {
+        runBlocking { conversionWorker().doWork() }
+
+        val first = updater.infos.first()
+        val extras = first.notification.extras
+        assertEquals(
+            "the notification has to name the file the user picked",
+            DISPLAY_NAME,
+            extras.getString(Notification.EXTRA_TITLE),
+        )
+        assertEquals("a conversion starts at zero", 0, extras.getInt(Notification.EXTRA_PROGRESS))
+        assertTrue(
+            "nothing is known about the length of the job yet, so the bar is indeterminate",
+            extras.getBoolean(Notification.EXTRA_PROGRESS_INDETERMINATE),
+        )
+        assertEquals(
+            "the foreground service type is the regime's, not zero",
+            ConversionForegroundType.current(),
+            first.foregroundServiceType,
+        )
+    }
+
+    /**
+     * The count is the point.
+     *
+     * `getForegroundInfo` said `"Joining files"` and `doWork` said `"Joining N files"` — one
+     * notification with two texts, and the one nothing ran was free to drift. Now there is one,
+     * and it reads the input array itself so it can still answer before `doWork` has parsed
+     * anything.
+     *
+     * Mutation that must go red, and did: replace the array read in `ConcatWorker.getForegroundInfo`
+     * with a constant `0`, which yields `"Joining 0 files"`. Asserting merely that the title starts
+     * with "Joining" would survive that, which is why the whole string is pinned.
+     */
+    @Test
+    fun `a join's first foreground post counts the files it was given`() {
+        runBlocking { joinWorker().doWork() }
+
+        val first = updater.infos.first()
+        assertEquals(
+            "the notification has to say how many files are being joined",
+            ConcatWorker.joiningTitle(INPUTS.size),
+            first.notification.extras.getString(Notification.EXTRA_TITLE),
+        )
+        assertEquals(
+            "the foreground service type is the regime's, not zero",
+            ConversionForegroundType.current(),
+            first.foregroundServiceType,
+        )
+    }
+
+    /**
+     * And the title is really the file's name rather than any string at all.
+     *
+     * [ConcatWorker.joiningTitle] is asserted above through the constant the worker itself uses, so
+     * that assertion cannot catch the sentence being reworded — deliberately, since the wording is
+     * not what the test is about. This one can: two files, two names, one worker each.
+     */
+    @Test
+    fun `two conversions of differently named files post differently named notifications`() {
+        runBlocking { conversionWorker(displayName = OTHER_NAME).doWork() }
+
+        assertEquals(
+            OTHER_NAME,
+            updater.infos.first().notification.extras.getString(Notification.EXTRA_TITLE),
+        )
+    }
+
+    private fun conversionWorker(displayName: String = DISPLAY_NAME) = TestListenableWorkerBuilder<ConversionWorker>(
+        context = app,
+        inputData = workDataOf(
+            ConversionWorker.KEY_INPUT_URI to INPUT.toString(),
+            ConversionWorker.KEY_DISPLAY_NAME to displayName,
+            ConversionWorker.KEY_SIZE_BYTES to INPUT_BYTES,
+            // FORCE_SOFTWARE is the one preference that decides without consulting the input,
+            // and a file:// URI keeps the worker out of FFmpegKit's native SAF bridge.
+            ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
+        ),
+        runAttemptCount = 0,
+    ).setId(JOB_ID)
+        .setForegroundUpdater(updater)
+        .build()
+
+    private fun joinWorker() = TestListenableWorkerBuilder<ConcatWorker>(
+        context = app,
+        inputData = workDataOf(
+            ConcatWorker.KEY_INPUT_URIS to INPUTS.map(Uri::toString).toTypedArray(),
+            ConcatWorker.KEY_TOTAL_BYTES to TOTAL_BYTES,
+            ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name,
+        ),
+        runAttemptCount = 0,
+    ).setId(JOB_ID)
+        .setForegroundUpdater(updater)
+        .build()
+
+    private companion object {
+        val INPUT: Uri = Uri.parse("file:///tmp/holiday.mp4")
+        val INPUTS: List<Uri> = listOf(INPUT, Uri.parse("file:///tmp/holiday2.mp4"))
+        const val DISPLAY_NAME = "holiday.mp4"
+        const val OTHER_NAME = "birthday.mkv"
+        const val INPUT_BYTES = 1_024L
+        const val TOTAL_BYTES = 2_048L
+        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000252")
+    }
+}
+
+/** A joiner that writes an output and reports a strategy; nothing here is about the engine. */
+private object WritingJoiner : ConcatJoiner {
+    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): ConcatEngine.Result {
+        output.writeBytes(ByteArray(OUTPUT_BYTES))
+        return ConcatEngine.Result(ConcatStrategy.STREAM_COPY, output)
+    }
+
+    private const val OUTPUT_BYTES = 512
+}

app/src/test/java/org/libremediaconverter/work/ProgressNotificationTest.kt

@@ -3,16 +3,12 @@ package org.libremediaconverter.work
 import android.app.Application
 import android.app.Notification
 import android.app.NotificationManager
-import android.content.Context
 import android.net.Uri
 import androidx.media3.common.util.UnstableApi
 import androidx.work.Data
-import androidx.work.ForegroundInfo
 import androidx.work.WorkInfo
-import androidx.work.testing.TestForegroundUpdater
 import androidx.work.testing.TestListenableWorkerBuilder
 import androidx.work.workDataOf
-import com.google.common.util.concurrent.ListenableFuture
 import kotlinx.coroutines.runBlocking
 import org.junit.After
 import org.junit.Assert.assertEquals
@@ -224,26 +220,6 @@ class ProgressNotificationTest {
     }
 }
 
-/**
- * Records every [ForegroundInfo] the worker publishes, and otherwise behaves as the test default.
- *
- * Delegating to [TestForegroundUpdater] rather than hand-rolling a `ListenableFuture<Void>`: the
- * worker awaits what this returns, so a future that never completes would hang the initial
- * `setForeground` rather than test anything.
- */
-private class RecordingForegroundUpdater : TestForegroundUpdater() {
-    val infos = mutableListOf<ForegroundInfo>()
-
-    override fun setForegroundAsync(
-        context: Context,
-        id: UUID,
-        foregroundInfo: ForegroundInfo,
-    ): ListenableFuture<Void> {
-        infos += foregroundInfo
-        return super.setForegroundAsync(context, id, foregroundInfo)
-    }
-}
-
 /** An engine that reports whatever [report] wants reported, then writes an output. */
 private class ReportingTranscoder(private val report: ((Int) -> Unit) -> Unit) : SoftwareTranscoder {
     override suspend fun run(

app/src/test/java/org/libremediaconverter/work/WorkerStubs.kt

@@ -1,11 +1,14 @@
 package org.libremediaconverter.work
 
 import android.content.Context
+import androidx.work.ForegroundInfo
+import androidx.work.testing.TestForegroundUpdater
 import com.google.common.util.concurrent.ListenableFuture
 import org.libremediaconverter.convert.OutputPublisher
 import org.libremediaconverter.convert.SoftwareTranscoder
 import org.libremediaconverter.model.ConversionRequest
 import java.io.File
+import java.util.UUID
 import java.util.concurrent.ExecutionException
 import java.util.concurrent.Executor
 import java.util.concurrent.TimeUnit
@@ -94,3 +97,27 @@ internal class FailedFuture(private val failure: Throwable) : ListenableFuture<V
     override fun get(): Void = throw ExecutionException(failure)
     override fun get(timeout: Long, unit: TimeUnit): Void = throw ExecutionException(failure)
 }
+
+/**
+ * Records every [ForegroundInfo] the worker publishes, and otherwise behaves as the test default.
+ *
+ * Delegating to [TestForegroundUpdater] rather than hand-rolling a `ListenableFuture<Void>`: the
+ * worker awaits what this returns, so a future that never completes would hang the initial
+ * `setForeground` rather than test anything.
+ *
+ * Shared scaffolding since #252 moved it here out of `ProgressNotificationTest`, which asks what a
+ * *running* worker publishes; `ForegroundNotificationTest` asks what its *first* post is, and both
+ * questions need the same recorder. `infos.first()` is that first post in either.
+ */
+internal class RecordingForegroundUpdater : TestForegroundUpdater() {
+    val infos = mutableListOf<ForegroundInfo>()
+
+    override fun setForegroundAsync(
+        context: Context,
+        id: UUID,
+        foregroundInfo: ForegroundInfo,
+    ): ListenableFuture<Void> {
+        infos += foregroundInfo
+        return super.setForegroundAsync(context, id, foregroundInfo)
+    }
+}

bin/README.md

@@ -22,19 +22,33 @@ It also removes roughly forty minutes from every cold CI run.
 | API level | 33, matching the app's minSdk |
 | ABIs | arm64-v8a, x86_64 |
 | Shared libraries | 20 (10 per ABI) |
-| SHA-256 | `ae188c9aec3c89a1c87a169589253c85438d57cfdcc3ce8b40fb3e87de368ff2` |
+| SHA-256 | `c8f4491d2c626566cbf18d5035513c1a5d8049e6696531342ea030c5427df507` |
+| Rebuilt | 2026-09-06, to add libvorbis (#254). Previous archive: `ae188c9a…`, same tag and FFmpeg version, one library fewer |
 
 Configure line, read back out of the shipped `libavutil.so`:
 
 ```
---enable-asm --enable-cross-compile --enable-gpl --enable-iconv 
---enable-inline-asm --enable-jni --enable-libass --enable-libdav1d 
---enable-libfontconfig --enable-libfreetype --enable-libfribidi 
---enable-libharfbuzz --enable-libjxl --enable-libmp3lame --enable-libopus 
---enable-libsvtav1 --enable-libvpx --enable-libx264 --enable-libx265 
---enable-lto --enable-mediacodec --enable-neon --enable-optimizations 
---enable-pic --enable-pthreads --enable-shared --enable-small 
---enable-swscale --enable-v4l2-m2m --enable-version3 --enable-zlib 
+--enable-asm --enable-cross-compile --enable-gpl --enable-iconv
+--enable-inline-asm --enable-jni --enable-libass --enable-libdav1d
+--enable-libfontconfig --enable-libfreetype --enable-libfribidi
+--enable-libharfbuzz --enable-libjxl --enable-libmp3lame --enable-libopus
+--enable-libsvtav1 --enable-libvorbis --enable-libvpx --enable-libx264
+--enable-libx265 --enable-lto --enable-mediacodec --enable-neon
+--enable-optimizations --enable-pic --enable-pthreads --enable-shared
+--enable-small --enable-swscale --enable-v4l2-m2m --enable-version3
+--enable-zlib
+```
+
+`--enable-libvorbis` is the one that arrived late, in #254, and the two ways to get it wrong are
+worth having written down. ffmpeg-kit's `--enable-*` names are its own — `--enable-lame` for
+libmp3lame, `--enable-opus` for libopus — so `--enable-vorbis` is the plausible guess and it is not
+the flag; `get_library_name()` in the upstream `scripts/function.sh` calls library 9 `libvorbis`.
+And an unrecognised `--enable-*` is **ignored silently**, so a build that dropped it looks exactly
+like one that worked. What tells them apart is the binary:
+
+```sh
+unzip -p bin/ffmpeg-kit-next-8.1.1.aar 'jni/x86_64/libavcodec.so' > /tmp/libavcodec.so
+strings /tmp/libavcodec.so | grep -x libvorbis     # and the same for arm64-v8a
 ```
 
 Every `.so` reports `LOAD align 0x4000`, so the archive satisfies the 16 KB page-size

docs/api-37-emulator-crash.md

@@ -315,25 +315,90 @@ clean zero. Its own post-disable check on the run recorded below printed
 
 So what is reliably achieved is a **rate collapse** — from roughly one abort every fourteen
 seconds to one every forty-five — which a 47-second Gradle run survives and a five-minute one
-might not. The 180-second zero above is one measurement on a device that had been up for twelve
-minutes and had already cycled its framework several times. The harness prints the quiet-check
-delta on every run precisely so this is visible rather than assumed.
+might not.
 
-One ordering detail cost a whole run and is now encoded in `disable_region_sampling`: by the time
-`sys.boot_completed` flips, SystemUI has **already registered**, and `pm disable-user` does not
-retract an existing registration — it only stops the package being started again. Disabling it
-and proceeding straight to the tests fails exactly as before. The harness therefore does
-`stop; start` afterwards, so the framework that comes back never starts SystemUI at all.
+**And that restart has never happened — which is how the disable turned out not to work either.**
+Corrected 2026-09-05; this replaces the two paragraphs above rather than qualifying them.
+
+`adb shell stop` and `start` are root-only, adbd is not root on a booted emulator, and all three
+copies of this logic called them without `adb root`. On CI both printed `Must be root`, between
+lines that read as if the restart had happened; `run-e2e.sh` sent them to `/dev/null`, so its
+`Must be root` was never even visible. Neither number in those logs was an observation either —
+the `pidof` loop breaks when the process is gone and otherwise falls out at its last iteration,
+and the old code printed the iteration count either way, so `system_server down after ~40 s` is
+what a stop that did nothing looks like.
+
+Adding `adb root` made the restart real, and **that is what proved the disable ineffective**.
+`api37-debug` run 34010167885, `disable_system_ui=true`:
+
+```
+--- disable round 1 ---
+  pm attempt 1: Package com.android.systemui new state: disabled-user
+  restarting the framework
+  adbd is running as root
+  system_server down after 2 s
+  services back after 10 s
+  NOT DISABLED after the restart -- the package state did not survive
+```
+
+Three rounds of that, then `final state: SystemUI STILL ENABLED`, and the leg reported
+`expected: 0, received: 0` — `Starting 0 tests`, the exact failure this function exists to
+prevent.
+
+Bisected locally on `android-37.0`, which explains the lost state and nothing else:
+
+| arm | sequence | disabled after the restart? |
+|---|---|---|
+| A | `pm disable-user`, then `stop` at once | **no** |
+| B | `pm disable-user`, wait 15 s, then `stop` | **yes** |
+
+That is PackageManager's delayed write of package restrictions: the stop kills `system_server`
+before the settings are flushed, and arm A is what CI did. **Arm B does not help either**, which
+is the measurement that matters. With the package verified `disabled-user` before *and* after a
+further clean restart:
+
+```
+  package still disabled? YES
+  processes:
+   9275  00:17 system_server
+   9695  00:14 com.android.systemui     <- started 3 s after system_server
+```
+
+CI's own logcat says the same without any restart at all. In the gating leg of run 34006456986,
+`pm disable-user` is accepted at 02:28:37.9 and the package really is in `pm list packages -d` at
+02:29:33 — and SystemUI is started at 02:28:39.5 and again at 02:28:52.3, the second of which
+(pid 4275) is alive for the whole instrumentation run.
+
+**So `pm disable-user --user 0 com.android.systemui` does not stop SystemUI starting on this
+image**, with or without a framework restart, on CI or locally. The premise this section was
+built on — "the framework that comes back never starts SystemUI at all" — is false.
+
+Two things follow, pointing in opposite directions.
+
+- **The restart is removed rather than repaired**, in all three copies. It cost a leg every test
+  it had and there is nothing for it to buy. What is kept is the 45-second window with zero new
+  aborts, which was always the part doing the work: in that same run the boot aborts land at
+  02:28:18 and 02:28:43, and the wait is what puts instrumentation at 02:32:42 — after them
+  rather than inside one. The `pm disable-user` call is kept too, for a narrower reason than it
+  was written for: every green leg and every number quoted about this row was measured with it
+  applied, and changing the configuration while fixing a flake is not a trade worth making.
+- **The rate collapse recorded above is not evidence of what it says.** Both arms of that
+  comparison had SystemUI running. What it measured is a device twelve minutes into its uptime
+  against one that had just booted — a real difference, and a different claim. The quiet gate is
+  still worth having on exactly that reading.
 
 ### The two deviations, stated plainly
 
 1. **The renderer is ANGLE, not the host GPU.** Shared with nothing else in the matrix — API
    33–36 run `-gpu host` locally, and CI runs `swiftshader_indirect`.
-2. **SystemUI is disabled.** The API 37 leg does not run the same device configuration as any
-   other leg or as the Pixel. It was defensible here because nothing in this suite touched
-   system UI — Media3, FFmpeg and WorkManager tests — and because the alternative is no local
-   API 37 coverage at all. **Anything that ever does depend on system UI must not trust this
-   leg.** Something now does; see the section below.
+2. **SystemUI is asked to be disabled, and runs anyway.** This was written as the deviation that
+   mattered — "anything that ever does depend on system UI must not trust this leg" — and the
+   measurements above say the deviation does not exist: the package is marked `disabled-user` and
+   `com.android.systemui` is up for the whole leg regardless. **The correction is good news
+   rather than bad.** This row is *more* comparable to API 33–36 and to the Pixel than it has
+   been claiming, not less, and the test that depends on system UI (see the section below) was
+   never running in the exotic configuration this bullet describes. What `pm disable-user` leaves
+   behind is a package-manager flag nothing acts on.
 
 ### Something does depend on system UI now, and half of it is excluded
 
@@ -341,12 +406,13 @@ Added 2026-08-24, and the first entry on this page that is not a codec.
 
 `SafPickerRoundTripTest` drives the real system file picker and rotates the display. Both reach
 the gralloc mapper — DocumentsUI is another app's windows, and a rotation rebuilds every surface
-on screen — and **disabling SystemUI does not help**, because it removes the *idle* trigger
-(RegionSamplingThread's nav-bar luma sampling) and not this one.
+on screen — and **disabling SystemUI does not help**. Two reasons now, and only the first was
+known when this was written: it removes the *idle* trigger (RegionSamplingThread's nav-bar luma
+sampling) and not this one, and — see the section above — it does not remove SystemUI either.
 
-Measured one method per fresh emulator, `android-37.0`, `swangle_indirect`, SystemUI disabled and
-verified quiet — separately, because inferring the second from the first is the mistake this
-page's opening correction is about:
+Measured one method per fresh emulator, `android-37.0`, `swangle_indirect`, with the disable
+applied and verified quiet — separately, because inferring the second from the first is the
+mistake this page's opening correction is about:
 
 | test | result on android-37.0 | `hasReadColorBufferDma` aborts in the window |
 |---|---|---|
@@ -357,6 +423,111 @@ So a rotation, which rebuilds every surface at once, is what the mapper does not
 starting DocumentsUI is not. Only the rotation test carries `@FailsOnEmulatorApi37`; the picker
 test runs on the gating leg like anything else.
 
+#### That last sentence was wrong for twelve days, and the aborts in the table said so
+
+**Corrected 2026-09-05.** Read the second row again: the picker test passes *and takes four
+`hasReadColorBufferDma` aborts with it*. This section counted them, put them in the table, and then
+drew the conclusion from the pass/fail column alone. The right question is not "does the test
+pass" but "does the image survive it", and the answer had been printed in the right-hand column
+from the day it was written.
+
+Four gating API 37 runs read logcat-first — 34006456986, 34001744574, 34001377499, and the **green**
+34002313300 — say it without ambiguity. Each carries exactly two aborts before the suite starts
+(both `surfaceflinger`, during boot and the SystemUI disable) and then exactly **one** during it:
+
+| run | picker test window | the run's only in-suite abort | leg |
+|---|---|---|---|
+| 34006456986 | 02:33:04.2 → 02:34:46.9, **failed** | 02:34:46.845 | red, `failed: 1` |
+| 34001744574 | 00:55:41.4 → 00:57:23.9, **failed** | 00:57:23.794 | red, `failed: 1` |
+| 34001377499 | 00:35:53.3 → 00:36:00.6, passed | 00:35:59.662 | red, `failed: 0` |
+| 34002313300 | 00:58:12.7 → 00:58:19.8, passed | 00:58:19.218 | green |
+
+Every one is `system_server`, thread `TaskSnapshotPer`, and every one lands inside that test's
+window. Nothing else in the gating set reached the mapper at all. So the picker test is
+**deterministic** in what it does to the image and a coin flip in what the leg reports: 34001377499
+passed it and lost the leg from teardown with no failing test to name, and 34002313300 passed it
+0.6 s after the abort and went green.
+
+That is #108, which had been filed against this behaviour in August and left open because the
+trigger was unknown. The trigger is this test. It now carries `@FailsOnEmulatorApi37` too, and the
+marker's KDoc had to widen from "does not pass on this image" to "cannot be run on this image" to
+say so honestly.
+
+The stack, for the record, is a different caller from either of the two above:
+
+```
+Cmdline: system_server        name: TaskSnapshotPer
+Abort message: 'Assertion failed: !rcEnc->featureInfo()->hasReadColorBufferDma'
+
+  #04  mapper.ranchu.so   GoldfishMapper::readFromHost(cb_handle_t const&) const+543
+  #06  libui.so           android::Gralloc5Mapper::lock(...)+63
+  #10  libandroid_runtime.so  android::lockImageFromBuffer(...)+374
+  #15  framework.jar      android.media.ImageReader$SurfaceImage.getPlanes+50
+  #17  services.jar       com.android.server.wm.TaskSnapshotConvertUtil.copyToSwBitmapDirect+56
+  #28  services.jar       com.android.server.wm.SnapshotPersistQueue$StoreWriteQueueItem.writeBuffer+66
+  #32  services.jar       com.android.server.wm.SnapshotPersistQueue$1.run+186
+```
+
+WindowManager writing a task snapshot to disk, which needs the buffer as a software bitmap, which
+is the non-DMA readback path. `PickActivity` is started **into the app's own task** (`Task #11
+A=10234:org.libremediaconverter` in the logcat), so the snapshot being persisted is that task's,
+and the churn at the end of the pick is what schedules it.
+
+#### There is no shell knob for task snapshots, and that was checked rather than assumed
+
+#108 asks whether `TaskSnapshotPersister` is suppressible the way the region-sampling listener was.
+Probed on a local `android-37.0 google_apis x86_64` AVD, 2026-09-05:
+
+```
+getprop | grep -i snapshot                          # nothing but apexd-snapshotde
+settings list global | grep -iE 'snapshot|recents'  # empty
+device_config list window_manager | grep -i snapshot # empty
+cmd window help                                     # no snapshot or screenshot command
+dumpsys window | grep -i snapshot                   # mSnapshotEnabled=true, for Task and Activity
+```
+
+`mSnapshotEnabled` is real state and there is nothing that sets it from outside. The only
+`device_config` hits anywhere in the tree are aconfig flags — e.g.
+`windowing_frontend/com.android.window.flags.respect_requested_task_snapshot_resolution` — which
+tune the snapshot rather than disable it. So the marker is the available answer, not the lazy one.
+
+#### When the picker test does fail, the abort is the coda and not the cause
+
+Worth separating, because the failure message points the wrong way. In both runs where the test
+itself went red, it had been broken for 98 seconds before the abort landed. The discriminator is
+one line, present in both reds and absent from the green:
+
+```
+I/InputDispatcher: No new touched window at (539.0, 525.0) in display 0
+```
+
+(539, 525) is the centre of the fixture's root row — the same coordinates the green run clicks.
+The touch reaches no window and is discarded; `UiObject2.click()` cannot see that and returns
+normally. DocumentsUI then logs nothing at all, where the green run logs `DocumentStack` and
+`Creating new directory loader` 40 ms after its click. The walk waits out its timeout twice for a
+fixture it never navigated to, and by the time the back presses start, WindowManager is still
+saying `no window has focus but ...PickActivity may eventually add a window when it finishes
+starting up` — for another 63 s. All four presses are dropped, DocumentsUI ANRs on
+`Input dispatching timed out`, and only *then* does the abort fire and make the failure message
+read `no windows at all`.
+
+`SafPickerRoundTripTest.forceStopThePicker` is the answer to that half: `am force-stop` goes around
+input entirely, so the picker's process can be removed from a task no key press can reach and
+`pickTheFixture`'s whole-picker retry — which exists for exactly this — becomes reachable again.
+That is a fix to the test on every level, not to API 37.
+
+**It was made to bite before it was believed.** On a local API 36 emulator, with the walk cut short
+so the picker is left open and in front and with `device.pressBack()` removed, so that nothing but
+the force-stop can close it:
+
+| | result |
+|---|---|
+| with `forceStopThePicker()` | **passes** — `ActivityManager: Force stopping com.google.android.documentsui ... from pid 5334`, `Killing 5269:com.google.android.documentsui (adj 0)`, a second `PickActivity` opens, the retry completes the pick |
+| with the one call removed | **fails** — `the system picker would not close: after 4 back presses ... com.google.android.documentsui is in front`, which is the API 37 failure verbatim |
+
+The unmutated class passes on that emulator either way, which is the point of running the mutation
+at all: the recovery path is unreachable on a healthy device, so a green suite says nothing about it.
+
 #### The correction that produced that table
 
 **The first version of this section said both tests failed, and put the marker on the class.** The

docs/ci-failure-modes.md

@@ -0,0 +1,207 @@
+# When a gating E2E leg goes red and the diff cannot explain it
+
+**Status:** a census of every gating E2E leg-attempt in the repo's history, classified by mode,
+with a disposition for each. **1489 gating leg-attempts, 129 failures, 8.7%** — 2026-08-20 to
+2026-09-07. This is the standing answer to "my docs-only PR turned an emulator leg red, what is
+it?", and it is what #102 asked for before being closed as an umbrella.
+**Last verified:** 2026-09-07, against `main` at `ef9d35e`. Mode 6's fix is in #272 and is the only
+thing here not yet on `main`.
+
+This document is about **the emulator failing underneath the suite**. It is not a defect record
+(`docs/defect-audit.md`), not a coverage read (`docs/coverage-read-findings.md`), and not a
+test-suite read (`docs/e2e-read-findings.md`). Nothing here is a bug in the app.
+
+## Read this first: three counting rules, each learned by getting it wrong
+
+**Count per leg-attempt, never per run.** Measured here rather than asserted: the 129 failing
+leg-attempts sit in **83 distinct runs, and 45 of those 83 ended green** once someone re-ran them.
+So a census that counts failed *runs* finds 38 events where there were 129 — it does not
+under-report evenly, it deletes exactly the failures somebody already decided were noise, which are
+the ones this document is about. Every number here is per leg-attempt, with `cancelled` legs
+excluded: those are `concurrency: cancel-in-progress` cancellations rather than runs, and there are
+135 of them.
+
+**Every mode has its own denominator, and it is not 1489.** Derive it from where and when the
+*test* ran, not from the leg count, and two things move it. The API 37 row filters out every test
+carrying `@FailsOnEmulatorApi37` with `notAnnotation` — **all four of `SafPickerRoundTripTest` and
+three of `Media3EngineTest`, seven today** — which is every mode in the table below except 3 and 5.
+And **that set has grown across this window**: the picker test and the two saves only joined it on
+2026-09-06, which is why `SafPickerRoundTripTest` has 25 API 37 failures on record — 14 of them
+since 2026-08-27 — that could not happen now. The saves did
+not exist at all before 2026-09-06T15:12. A rate quoted over "all gating leg-attempts" is wrong for
+every one of them, and is how "8% of legs" gets said about a thing that happens on one row.
+
+**Anchor the mode to the test name beside the `FAILED` marker, then to the message under it.**
+The name alone is not enough: `transcodesH264ToH265AndReportsProgress` has failed for three
+different reasons, one of which was the whole suite going down around it.
+
+## The modes
+
+| # | mode | signature | where | disposition |
+|---|---|---|---|---|
+| 1 | SAF picker will not close | `the system picker would not close: after 4 back presses ...` | 37 only, since #96 | **#108** — collateral of the gralloc abort |
+| 1b | picker never showed, from the rotation test | `never showed BySelector [PKG=...], in 3 separate pickers` | 33, 34 — 3 times | #268/#269; no gating attempt on `main` since |
+| 2 | wedge | gradle never returns; leg killed at `WEDGE_TIMEOUT`; `wedged: yes` in the shape row | 33/34 only | **#122**, addressed by #219 — see below |
+| 3 | emulator never came up | `adb ... failed with exit code 224`, before any test | 37 only, 3 times | infra, before the suite; nothing to attribute |
+| 4 | Media3 export watchdog | `ExportException: Muxer error` / `no output sample written in the last 25000 milliseconds` | 34, 36 | **environmental, measured** — see below |
+| 5 | `system_server` gone mid-suite | `Can't find service: package`, `am get-current-user` fails, `INSTRUMENTATION_ABORTED` | 37 only | **#108** — `hasReadColorBufferDma` |
+| 6 | app Activity destroyed under the SAF save tests | `NullPointerException: Cannot run onActivity since Activity has been destroyed already` | 35, once | **fixed** — see below |
+
+**#96 held, and mode 1 is worth stating as a number rather than a memory.**
+`pickingAFileThroughTheSystemPickerFillsInTheFileCard` — the test #93 and #96 were about — has
+failed **zero times on API 33-36 in the 881 gating leg-attempts since #96 merged**. Every remaining
+failure of that class on those four rows is a *different* test: three of the rotation test (1b) and
+seven of the two save tests (mode 6). The picker mode is an API 37 mode now.
+
+Background noise that is **not** a mode on its own: `Failed to find ColorBuffer: N` and `bad color
+buffer handle N` never name anything in this app and appear on green legs. Measured over 12 green
+gating legs sampled from 2026-09-02 onwards, all reporting `failed: 0`: `bad color buffer handle`
+in **6** of them, `Failed to find ColorBuffer` in **2**. Neither is evidence of anything on its own.
+
+## Mode 4 — the Media3 export watchdog is the emulator's codec HAL segfaulting
+
+**This is the mode #102 was filed for, and it is not starvation.** The per-test logcat in
+`e2e-report-api34` of run `34000816016` attempt 1, 62 ms after the test starts:
+
+```
+00:20:39.814 D MediaCodec: MediaCodec::reclaim(...) c2.goldfish.h264.decoder
+00:20:39.822 F DEBUG : Cmdline: /vendor/bin/hw/android.hardware.media.c2@1.0-service-goldfish
+00:20:39.822 F DEBUG : signal 0 (SIGSEGV), code 1 (SEGV_MAPERR)
+00:20:39.822 F DEBUG : Cause: null pointer dereference
+  #00 C2Block2D::handle() const+4                          libcodec2_vndk.so
+  #01 getClientUsage(std::shared_ptr<C2BlockPool> const&)  libcodec2_goldfish_common.so
+  #02 android::C2GoldfishAvcDec::process(...)              libcodec2_goldfish_avcdec.so
+00:20:39.839 E CCodec  : Codec2 component "c2.goldfish.h264.decoder" died.
+00:20:39.846 E MediaCodec: Codec reported err 0xffffffe0/DEAD_OBJECT
+```
+
+The decoder HAL process dies and respawns. Media3 is left with a dead codec, writes no output
+sample, and its own 25-second export watchdog aborts the export — which is the `Muxer error` the
+job log shows. **The crashing code is `/vendor/lib64/*` inside the system image**, so this is
+environmental in the same sense `@FailsOnEmulatorApi37` is, and now with the same kind of evidence.
+
+**Six for six.** Every leg-attempt that has failed this way carries the crash in the same job's
+`--- native crashes (tail 60) ---` dump. **Grep `c2@1.0-service-goldfish` and not the friendlier
+line**: `Codec2 component "c2.goldfish.h264.decoder" died` is a `CCodec` message in the main
+buffer and is in **none** of the six job logs, because that dump is `adb logcat -d -b crash` and
+what reaches it is the tombstone, whose `Cmdline:` names the HAL. The six are
+`32855014836` a1 (36), `32857067112` a1 (34),
+`32919928048` a1 (36), `33261618358` a1 (34), `33588264439` a1 (36), `34000816016` a1 (34).
+**Six in 1210 API 33-36 leg-attempts — 0.5%**, split 3 on API 34 and 3 on API 36, none on 33 or 35.
+
+**It is the same weakness the API 37 marker names.** `FailsOnEmulatorApi37`'s stated reason is that
+Media3 transcodes "fail inside the emulator's own `c2.goldfish.h264.decoder`". That is this HAL.
+One weakness, deterministic on the android-37 images and 0.5% below them.
+
+**What is not settled:** *why* it dereferences null. `MediaCodec::reclaim` is logged 8 ms earlier,
+and a reclaim is the resource manager taking a codec instance away — so "a reclaim races
+`C2GoldfishAvcDec::process` and the block pool goes out under it" is the obvious hypothesis and is
+**untested**. Recorded as a hypothesis, not as a cause.
+
+**Two failures of that test are excluded and it matters that they are.** `32545625459` a1 (API 37)
+had 37 tests fail together with the gralloc assertion present — that is mode 5, and this test was
+collateral. `32669190757` a1 (API 35) predates #111's shape report and carries a bare `FAILED`
+marker with no message at all; it is **unclassifiable, and is not classified**.
+
+## Mode 6 — the back press that finished `MainActivity`
+
+Traced on the API 35 gating leg of run `34161043035` **attempt 1**, whose head is #269's own
+commit:
+
+```
+20:59:35.689  UiObject2: Clicking on (927, 2274)   <- iteration 2's dismissal, on button1
+20:59:36.033  MainActivity RESUMED                 <- the picker is gone, by the test's own hand
+20:59:36.350  VRI[PickActivity]: visibilityChanged ... newVisibility=false
+20:59:37.068  UiDevice: Pressing back button.      <- iteration 2 presses anyway
+20:59:41.094  UiDevice: Retrieving node ... [RES='android:id/aerr_wait']
+20:59:41.169  Input channel 'Application Not Responding: ...nexuslauncher' was disposed
+20:59:41.713  UiDevice: Pressing back button.      <- iteration 3
+20:59:41.754  TopTaskTracker: onTaskMovedToFront: ... NexusLauncherActivity
+20:59:42.278  MainActivity DESTROYED
+```
+
+`dismissThePicker` guarded its back presses on `Activity.hasWindowFocus`. A system app-error dialog
+is a fullscreen `system_server` window, so **it makes that false too** — the guard could not tell
+"the picker is still up" from "a dialog is on top of an app that is already in front".
+
+**And the first two lines are the part to read carefully, because the obvious reading is wrong.**
+The picker did not close on its own: `dismissASystemErrorDialog` closed it on iteration 2, by
+falling through to `android:id/button1` and clicking DocumentsUI's own positive button (#271). From
+`20:59:36.033` there was nothing to back out of — and the loop pressed back on iteration 2 anyway,
+then dismissed the launcher's ANR dialog on iteration 3 and pressed again on the reading taken
+before doing so. That press finished `MainActivity`. **So this mode and #271 are one incident**, and
+the fix stops it at iteration 2, where the re-read now returns.
+
+Fixed by re-reading the focus after a dialog is actually dismissed, and only then —
+`SafPickerRoundTripTest.dismissThePicker` carries the trace. That **removes** a press sent on a
+stale reading rather than retrying one, and a picker genuinely in front still fails there.
+
+**It cannot be demonstrated by re-running.** The launcher ANR is ambient and not reproducible on
+demand, so a green sweep is not evidence for this fix; the trace is.
+
+### The other six failures of those save tests are four different things
+
+Filed as one mode, they are not one: seven occurrences, **five distinct messages** counting the
+destroy above. Three of the six below are on heads that predate their own follow-up fix, and one is
+on a head that **contains** the fix meant for it. This is the worked example for "split by message
+before diagnosing". **The two rows still open are #270**; the `button1` finding below is **#271**.
+
+| run / attempt | head | message | what it is |
+|---|---|---|---|
+| `34041593697` a1 (35) | `fa10d94` — the commit that **added** the test | `No compose hierarchies found`, thrown directly | pre-`b23ff0f` |
+| `34056545386` a1 (35) | `cbbaf74` | `ComposeTimeoutException ... after 120000 ms` | the `CONVERSION_TIMEOUT_MS` case `19e3539` fixed. **Not a system-service failure at all** — API 35's software encode measured 134.8 s against a 120 s bound |
+| `34057706195` a1 (34) | `19e3539` | `No compose hierarchies found` ×2 | **contains `b23ff0f`**, so that fix did not close this shape. Open |
+| `34067653670` a1 (35), `34146936252` a1 (35) | `d45abe7`, `73482520` | `waited 300000ms for a node tagged action.saveFile`, **no** composition error | `awaitNode` appends the composition error only when `fetchSemanticsNodes` threw, so the composition was readable throughout. `34067653670`'s per-test logcat has `MainActivity` `RESUMED` for the whole 300 s and **no conversion running at all**. Open |
+| `34146936252` a2 (35) | `73482520` | `waited 300000ms ...; last composition error: No compose hierarchies` | app `PAUSED` and never resumed; the back press at `17:38:32.479` follows `Waiting 5000ms for ... permissioncontroller`, the permission-dialog helper #269 replaced with `pm grant` |
+
+### And the dismissal can click a dialog that is not a system dialog (#271)
+
+In the same trace, at `20:59:35.689`, `aerr_wait` and `aerr_close` both missed and
+`android:id/button1` — the framework's generic `AlertDialog` positive button, present on every
+`AlertDialog` on the device — was found and clicked. `MainActivity` came back 339 ms later and
+`PickActivity`'s window went away with it, so what was clicked was a button inside **DocumentsUI's
+own create-document flow**. It did no harm on that run. Filed rather than fixed here, because
+narrowing the selector is a decision about what `dismissASystemErrorDialog` may reach.
+
+## Mode 2 — the wedge, and why this says "consistent with" rather than "fixed"
+
+Nine occurrences, **all on API 33/34**, 9 in 497 leg-attempts before 2026-09-06T02:00Z — **1.8%**
+— and **0 in the 106 since**. The last one, `34001741668` (2026-09-06T00:36), is
+`thePickedInputSurvivesARealRotation` again, and `git merge-base --is-ancestor 32ab54d <head>` says
+that head **does not contain** #219's fix, so no wedge has ever been recorded against the fix.
+
+At the prior rate, P(0 in 106) ≈ 0.15. **That is suggestive and it is not evidence.** Re-count
+before writing "fixed" here.
+
+Its diagnostics say the framework is fine, which is what separates it from every other mode in this
+document: `e2e-wedge-api34` of `34001741668` has `started:` the rotation test with no `finished:`,
+and `input`, `window`, `activity` and `media.player` all `found`.
+
+## Reading the evidence, when the leg is already gone
+
+Four things that are not obvious and each cost a wrong answer:
+
+- **A re-run destroys the log.** `gh run view --job <id> --log` resolves by *run* and serves the
+  latest attempt, so after a re-run to green it hands back a green log for a red attempt. Use
+  `gh api --allow-escape-sequences /repos/{owner}/{repo}/actions/jobs/{job_id}/logs`, with the job
+  id from `/actions/runs/{run}/attempts/{n}/jobs`. Without `--allow-escape-sequences`, `gh` writes
+  nothing and exits 0.
+- **A re-run does *not* destroy the artifacts, but the convenient command hides them.**
+  `/actions/runs/{run}/artifacts` returns every attempt's upload under the same name with different
+  ids and `created_at`; `gh run download` takes the newest, which after a re-run-to-green is the
+  green one. Match `created_at` to the attempt's window and fetch
+  `/actions/artifacts/{id}/zip`.
+- **The per-test logcat is the evidence, not the job log.** `e2e-report-apiNN` carries
+  `outputs/androidTest-results/connected/debug/<device>/logcat-<class>-<method>.txt` — one file per
+  test, scoped to that test's window — plus the JUnit XML with the untruncated stack. The job log
+  truncates a stack to its first frame, which is why the `ActivityScenario` frames in mode 6 are
+  invisible there.
+- **Grep the fault, not the thread.** #102 once split one bug into two by grepping
+  `TaskSnapshotPer` — a thread name from a ticket title — instead of `hasReadColorBufferDma`, the
+  assertion. The assertion is the invariant; the thread is only which caller tripped it.
+
+## What this does not cover
+
+The advisory `E2E API 37 Media3 hardware transcode (advisory)` job is **red on every PR by design**
+and is not a signal. `docs/api-37-emulator-crash.md` has API 37's own story;
+`.github/scripts/e2e-report-shape.sh` explains the shape table every leg prints.

docs/coverage-read-findings.md

@@ -1,9 +1,11 @@
 # Coverage-read findings
 
-**Status:** ten findings, none fixed, none urgent. F1-F4 came from the 2026-08-26 read; F5 was added
-on 2026-08-27 while decomposing #132; **F6-F10 were added on 2026-09-02 from the wave-4 read**. Every
-entry here is a *code* observation — something a test would document rather than repair. The test
-gaps found in the same reads are tickets, not entries here; see [Not covered here](#not-covered-here).
+**Status:** ten findings; **F1 is closed — by #254 on 2026-09-06, which found it was a defect rather
+than the dead arm it was filed as** — and the other nine stand, none urgent. F1-F4 came from the
+2026-08-26 read; F5 was added on 2026-08-27 while decomposing #132; **F6-F10 were added on
+2026-09-02 from the wave-4 read**. Every entry here is a *code* observation — something a test
+would document rather than repair. The test gaps found in the same reads are tickets, not entries
+here; see [Not covered here](#not-covered-here).
 **Scope:** what a JaCoCo read turned up that writing a test would not fix. This is a survey, not a
 work order. Acting on any entry is a separate decision and would be its own commit.
 **Last verified:** `main` at `54ca2dd`, 2026-09-02. Coverage measured that day with
@@ -40,7 +42,9 @@ Same vocabulary as `defect-audit.md`, deliberately, so the two read alike:
 - **No action** — recorded because it looks like a finding and is not.
 
 Nothing below was observed on a device, and nothing below needs to be: every entry is a claim about
-what the code says, checkable by reading it.
+what the code says, checkable by reading it. **F1's resolution is the exception, and it had to be**:
+what that entry turned on — whether the encoder it named exists in the shipped binary — is not
+readable from the source at all.
 
 ---
 
@@ -110,6 +114,56 @@ files agree and to say so in one place.
 2. Correct the `ContainerCapabilities.kt:84` comment, which is false as written, and give the
    `FFmpegCommandBuilder` arm the treatment `Media3Engine.kt:221-233` already models.
 
+### Resolved 2026-09-06 (#254) — and the arm was not merely unreached, it was unrunnable
+
+Vorbis is now in `ENCODABLE_AUDIO`, `OutputFormat.OGG_VORBIS` is a one-tap preset beside `OPUS`,
+and `FFmpegEngineTest.encodesOggVorbisThroughAnEncoderTheBundledBinaryActuallyHas` asserts the
+produced track's MIME and its channel count. The false comment is gone.
+
+**The finding this entry did not have is that `-c:a libvorbis` could never have worked.** Three
+independent sources agree and none of them is the coverage report:
+
+| source | says |
+|---|---|
+| `bin/README.md`'s configure line, read back out of the shipped `libavutil.so` | `--enable-libopus`, `--enable-libmp3lame`, `--enable-libvpx`, `--enable-libx264/5`, `--enable-libdav1d`, `--enable-libsvtav1`, `--enable-libjxl` — **no `--enable-libvorbis`** |
+| `tools/ffmpeg/build-ffmpeg.sh` | neither `COMMON_LIBS` nor `EXTRA_LIBS` names it |
+| `strings` on `jni/x86_64/libavcodec.so` | the `lib*` encoder names present are `libdav1d libjxl libmp3lame libopus libsvtav1 libvpx libx264 libx265`. `libvorbis` is absent; `libavcodec/vorbisenc.c` is present |
+
+So the first user to pick Ogg Vorbis would have got `Unknown encoder 'libvorbis'`. The arm was
+*wrong*, not just dead — and **nothing short of building the command and running it could have
+found that**, which is why the e2e half of this ticket is the load-bearing half. It is #238's shape
+again: two covered facts (a builder arm, a configure line) that no test put together.
+
+**The AAR was rebuilt rather than the arm rewritten, and the measurements are why.** A first pass
+at this ticket implemented Vorbis on FFmpeg's in-tree `vorbisenc.c`, which the binary already had.
+It works, and it is not good enough to sit in a picker beside MP3, FLAC and Opus:
+
+| | `libvorbis` | in-tree `vorbis` |
+|---|---|---|
+| experimental gate | none | **needs `-strict experimental`** |
+| channels | mono, stereo, surround | **stereo only** |
+| `-q:a 0..10`, one 3 s clip | 10931 -> 64166 bytes | 7549 -> 14645 bytes |
+
+`AV_CODEC_CAP_EXPERIMENTAL` is upstream FFmpeg saying *do not ship this by accident*. The
+stereo limit forces `-ac 2`, so a mono source is silently upmixed — and **this repo's own fixture,
+`sample_h264.mp4`, is mono**, so the compromise was not hypothetical. And a quality knob spanning
+2x its floor against libvorbis's 6x has nowhere to go: libvorbis at `-q:a 5` writes 16429 bytes of
+that clip, more than the in-tree encoder produces at q10.
+
+So #254 added `--enable-libvorbis` to `tools/ffmpeg/build-ffmpeg.sh` and rebuilt: a new ~35 MB blob
+in git history permanently, a new configure line and SHA-256 in `bin/README.md`. What that bought
+is the arm as originally written — `-c:a libvorbis -q:a 5`, no experimental gate, no forced
+channel count — and mono that stays mono, which the e2e test asserts alongside the track MIME.
+
+Two things about the flag are worth keeping, because both are ways to get this wrong quietly.
+ffmpeg-kit's `--enable-*` names come from its own `get_library_name()` and are not FFmpeg's — it is
+`--enable-lame` for libmp3lame and `--enable-opus` for libopus — so `--enable-vorbis` is the
+plausible guess and it is **wrong**; id 9 is literally `libvorbis`, so `--enable-libvorbis` is
+right, and it pulls libogg in with it. And ffmpeg-kit does **not** error on an unrecognised
+`--enable-*`, so a rebuild that quietly omitted the library looks exactly like one that worked.
+`strings jni/*/libavcodec.so | grep -x libvorbis` and the e2e test are the only two things that
+tell those apart.
+
 ---
 
 ## F2 — `ConversionRequest.hardwareEncodeAvailable` is written, read by nothing, and its KDoc describes behaviour that was removed
@@ -403,6 +457,27 @@ They are still correct to keep: `ForegroundInfo` is required by the `CoroutineWo
 named — a `getForegroundInfo` that starts branching — plus one more: the day anything calls
 `setExpedited`.
 
+**Updated 2026-09-06 (#252, and the sentence above is half wrong).** "WorkManager calls
+`getForegroundInfoAsync()` only for expedited work" is true and *not sufficient*, and the missing
+half is what made the reopening trigger wrong. `WorkForeground.kt:38` in work-runtime 2.11.2 opens
+the library's only caller with
+
+```kotlin
+if (!spec.expedited || Build.VERSION.SDK_INT >= 31) return
+```
+
+and `minSdk` is 33. So calling `setExpedited` reopens nothing: on **every** device this app
+supports, WorkManager does not consult `getForegroundInfo()` whether the work is expedited or not.
+#252 was filed on the trigger as this entry stated it, and its acceptance criterion — "a request
+now carries `setExpedited` and the existing worker tests drive them" — cannot be met that way.
+
+What made the lines live instead was that each worker held **two** definitions of one notification:
+the override, and an identical `ForegroundInfo` built inline in `doWork`. `doWork` now posts the
+override's, so the duplicate is gone and what remains runs on every job. The general lesson is the
+one E1 states from the other side: *check that the mechanism you are relying on actually fires on
+the machine that runs it* — here the mechanism was a library early-return two source lines long,
+and four waves of reading had taken the API summary's word for it.
+
 ---
 
 ## F10 — Three arms that are reachable, uncovered, and cannot be made to bite
@@ -444,7 +519,7 @@ the cheaper order.
 
 | ID | Finding | Severity | Evidence | Action |
 |---|---|---|---|---|
-| F1 | `FFmpegCommandBuilder` emits a Vorbis encoder `ContainerCapabilities` says does not exist | low | confirmed by inspection; unreachability traced through four call sites | **decide**: feature or dead arm — the comment is false either way |
+| F1 | `FFmpegCommandBuilder` emits a Vorbis encoder `ContainerCapabilities` says does not exist | low → **the severity was wrong** | confirmed by inspection; unreachability traced through four call sites | **closed #254 as a feature** — and the encoder it named is not in the shipped binary, so the arm could never have run |
 | F2 | `hardwareEncodeAvailable` written, never read; KDoc describes removed behaviour | low | confirmed by inspection; `FFmpegCommandBuilderTest:132` corroborates | **decide**: delete or mark vestigial |
 | F3 | `ConversionRequest.videoCodec` / `.audioCodec` have no callers | low | confirmed by inspection | delete, or keep for symmetry — **not** a test gap |
 | F4 | Two private guards reachable only by direct call | n/a | confirmed by inspection | **no action** — named exemption, per #88 |
@@ -452,7 +527,7 @@ the cheaper order.
 | F6 | Four more unreachable arms; `ConversionRouter:214-217`'s KDoc is false | low | confirmed by inspection; each traced to its upstream guard | **no action**, except the one-line KDoc fix |
 | F7 | `probeWithExtractor`'s catch is unreachable, as `probeForConcat`'s is | n/a | measured across four URI shapes (recorded in `CLAUDE.md`) | **no action** — device-only, now written down for both sites |
 | F8 | Three more dead members and six unused defaults | low | confirmed by inspection; grep per member | delete or keep knowingly — **not** a test gap |
-| F9 | Both `getForegroundInfo` overrides are dead: expedited work is never used | n/a | confirmed by inspection; `grep setExpedited` returns nothing | **no action** — sharpens #88's close |
+| F9 | Both `getForegroundInfo` overrides are dead: expedited work is never used | n/a | confirmed by inspection; `grep setExpedited` returns nothing | **closed 2026-09-06 by #252** — and its stated reopening trigger was wrong; see the update on the entry |
 | F10 | Three reachable arms where no mutation bites | n/a | confirmed by inspection; each mutation traced to its masking guard | **no action** — recorded to stop the next read re-picking them |
 
 Order, if these are acted on: **F1 and F5 first, separately.** They are the two with a possible

docs/e2e-read-findings.md

@@ -1,6 +1,6 @@
 # E2E-read findings
 
-**Status:** six findings, none fixed, none urgent — **plus one confirmed vacuous test, which is a
+**Status:** seven findings; E4 fixed, E7 extended and its ticket closed, the rest standing — **plus one confirmed vacuous test, which is a
 ticket rather than an entry here** (see [Not covered here](#not-covered-here)). `E1`–`E6` came from
 the 2026-09-05 read of the instrumented suite. Every entry here is a *test-suite* observation —
 something a new test would not fix, because the test already exists and the problem is what it
@@ -242,6 +242,70 @@ visible skip or a red test, and that decision is the ticket's.
 
 ---
 
+## E7 — a real `DocumentsProvider` cannot be reached without the picker, so there is no cheap SAF test
+
+**Severity: n/a · Confirmed by measurement · this is a platform rule, not a gap**
+
+Added 2026-09-06, from doing #225 and #226 rather than from reading.
+
+`OutputPublisher.publish`'s destination side is asserted only against Robolectric fakes —
+`FakeSafProvider`, registered with `asDocumentsProvider = true`, which is the flag that *makes*
+`DocumentsContract.isDocumentUri` answer true. #226 split that into a cheap headless half (drive a
+real `DocumentsProvider` directly) and an expensive picker-driven half.
+
+**The cheap half does not exist.** Three approaches, all measured on an API 34 emulator:
+
+| approach | result |
+|---|---|
+| a second `DOCUMENTS_PROVIDER` declared **without** `MANAGE_DOCUMENTS` | refused at install: `SecurityException: Provider must be protected by MANAGE_DOCUMENTS` |
+| create the document as the **test APK**, which owns the provider | denied — instrumentation runs *in the target app's process*, so it carries the app's uid whatever `Context` is asked |
+| `uiAutomation.adoptShellPermissionIdentity(MANAGE_DOCUMENTS)` | denied identically |
+
+The denial names the only way in:
+
+> `Permission Denial: opening provider …FixtureDocumentsProvider from
+> ProcessRecord{… org.libremediaconverter/u0a192} requires that you obtain access using
+> ACTION_OPEN_DOCUMENT or related APIs`
+
+And the intent filter is not optional: without it `isDocumentUri` returns false, which is exactly
+the branch guarding `deletePartialOutput` — so a provider without the filter tests nothing the
+ticket is about.
+
+**So any test of `publish` against a real `DocumentsProvider` must drive DocumentsUI**, and pays
+#190's flake tax. The work is one item at that cost, not two, and #226 was updated to say so.
+
+**Updated 2026-09-06, doing it: there is a second constraint underneath, and it has the same
+cause.** The obvious way to avoid driving the app was a host Activity in `androidTest` owning its
+own `CreateDocument` launcher. It cannot be started at all:
+
+```
+java.lang.RuntimeException: Intent in process org.libremediaconverter resolved to different
+  process org.libremediaconverter.test
+    at android.app.Instrumentation.startActivitySync
+```
+
+Instrumentation runs in the target app's process, so a component declared in the instrumentation
+APK is in the wrong one — the same fact that sinks approach 2 above, arriving from the other side.
+**The app's own Save button is the only launcher available to drive**, which is also the more
+faithful thing to drive. `SafPickerRoundTripTest.aSaveWritesToTheDocumentTheSystemPickerCreated` is
+what came of it.
+
+**And the premise turned out to be true**, which is the answer #226 was filed for: on API 34,
+stock DocumentsUI hands back a document URI reporting a size of exactly zero. `deletePartialOutput`
+can fire, and D4's fix is live rather than inert. A "no defect found" — and not one that could have
+been reached by reading.
+
+### What this does *not* block, which is the useful half
+
+`FFmpegKitConfig.getSafParameterForRead` — the bridge on every real conversion and join — needs no
+documents provider. It opens a descriptor through the resolver, so **any readable `content://` URI
+exercises it**, and an ordinary `ContentProvider` may be exported without a permission. That is what
+`FixtureContentProvider` is, and it made #225 headless.
+
+**That distinction was worth the trouble**: the first test ever to hand the join path a real
+`content://` input found #238, a defect that broke joining for every user who picks matched files.
+The expensive gate protects the *destination* side; the *input* side never needed it.
+
 ## Summary
 
 | ID | Finding | Severity | Evidence | Action |
@@ -249,11 +313,12 @@ visible skip or a red test, and that decision is the ticket's.
 | E1 | `RemuxTest`'s KDoc claims engine assertions three of its tests correctly omit | low | confirmed by inspection; traced through `MEDIA3_CONTAINERS` | **one line of KDoc** — the tests are right |
 | E2 | Three of the 60 instrumented tests assert nothing; two never run | n/a | confirmed by inspection; `docs/local-emulator.md:305` | **no action** — deliberate; but 60 ≠ 60 |
 | E3 | `…AndReportsProgress` does not assert progress fired | low | confirmed by inspection; reason inline | **no action** — the name overstates, the KDoc corrects it |
-| E4 | The API 37 marker's KDoc says "two"; three tests carry it | low | confirmed by inspection; baseline const says 3 | **fix the sentence** |
+| E4 | The API 37 marker's KDoc says "two"; three tests carry it | low | confirmed by inspection; baseline const says 3 | **fixed** in #243 — it names the constant now |
 | E5 | `coverage-read-findings.md` F7's "uncovered" half is stale | low | confirmed by inspection; `RemuxTest.kt:111` drives it | **amend F7** — "device-only" stands, "uncovered" does not |
 | E6 | The device-capability assertion asks the class under test what to expect | low | confirmed by inspection; no third oracle exists on a device | **no action** — read with **#223** |
+| E7 | A real `DocumentsProvider` is unreachable without the picker, so #226 has no cheap half | n/a | measured three ways on API 34; each denial names `ACTION_OPEN_DOCUMENT` | **no action** — it re-scoped #226 |
 
-**Five of the six are prose, not code**, and that is the shape of this read. The instrumented suite
+**Six of the seven are prose, not code**, and that is the shape of this read. The instrumented suite
 is in good condition: 57 of its 60 tests bite, the fixtures are committed with their generation
 recipes, and the one class that asserts nothing says so in its first line. What this read found is
 that **the suite's self-description has drifted from the suite** in five small places and one large
@@ -312,16 +377,244 @@ decision, not a detail — see **E6** for why no third option exists — and **#
 
 | # | Gap |
 |---|---|
-| **#223** | `HardwareFallbackTest` never attempts the hardware path on any emulator leg |
-| **#224** | Cancelling a *running* native session, in any of the three engines |
-| **#225** | No `content://` input has reached a *successful* conversion — the ffkitsaf bridge |
-| **#226** | `OutputPublisher.publish` against a real `DocumentsProvider`, and the SAF premise it rests on |
-| **#227** | The notification's Cancel action has never been fired |
-| **#228** | `encodesFlacLosslessAudio` and `encodesOpus` pass on any non-empty file |
-| **#229** | FFmpeg's progress percentage is computed everywhere and asserted nowhere |
-| **#230** | *(spike)* whether a running conversion's process can be killed under instrumentation |
+| # | Gap | Outcome |
+|---|---|---|
+| **#223** | `HardwareFallbackTest` never attempts the hardware path on any emulator leg | closed — it skips instead of passing vacuously |
+| **#224** | Cancelling a *running* native session, in any of the three engines | closed — all three engines |
+| **#225** | No `content://` input has reached a *successful* conversion — the ffkitsaf bridge | closed, and it found **#238** |
+| **#226** | `OutputPublisher.publish` against a real `DocumentsProvider` | closed — the *premise* holds; see E7. The delete **arm** is still unrun: **#250** |
+| **#227** | The notification's Cancel action has never been fired | closed |
+| **#228** | `encodesFlacLosslessAudio` and `encodesOpus` pass on any non-empty file | closed |
+| **#229** | FFmpeg's progress percentage is computed everywhere and asserted nowhere | closed |
+| **#230** | *(spike)* whether a running conversion's process can be killed | closed — it cannot; the runner shares the app's process |
+
+**The read's own result, once the tickets were worked: one production defect.** #238 — joining files
+picked through the system picker failed outright on the stream-copy path, because the concat demuxer
+whitelists protocols separately from `-safe 0` and `ffkitsaf` was not on the list. Only `STREAM_COPY`
+feeds the demuxer a list file, and every existing join test passed `Uri.fromFile`, so the one broken
+combination was the only one a user could reach.
+
+That is the argument for this kind of read in one line: the gap was not a missed line or an
+unasserted value, it was **a combination of two covered things that no test put together**.
 
 **Nothing here was filed as a coverage delta.** Each names the mutation that has to go red, which is
 the acceptance criterion wave 4 established and which caught two vacuous tests in that wave before
 they shipped. #223 is the one that shows why the criterion matters: it has two passing assertions and
 still tests nothing.
+
+## The 2026-09-06 re-check
+
+Run after the last ticket landed, to ask whether the suite's self-description had drifted again. It
+had, and **every drifted line came from #226 — the last PR of this read's own wave.**
+
+The suite is 70 tests in 14 classes, 6 carrying `@FailsOnEmulatorApi37`, gating leg 64; the
+committed baseline says 6 and the advisory job agrees (`baseline: matches`). Every gating leg is
+green on `main`.
+
+- **The counts had gone stale in four places** — `CLAUDE.md` (three sites),
+  `FailsOnEmulatorApi37.kt`'s KDoc, and two comments in `status_check.yml` — all still saying five
+  carriers of 69. **The gating figure is what hid it**: 69 − 5 and 70 − 6 are both 64, so the one
+  number a reader would check against a run had not moved. CLAUDE.md's own instruction to derive
+  these rather than remember them is what caught it.
+- **Two KDoc claims in `SafPickerRoundTripTest` described a draft rather than the code.** The save
+  test says MP3 was chosen so the setup could not depend on device codecs; the code converts at the
+  default `MP4_H265` / `FAST`, which routes by `canEncode(H265)`. The *negation* of the stated
+  reason was true. This is **E1 and E3's failure mode landing in a test written by the read that
+  found it** — a passing test with a wrong explanation.
+- **Neither picker test has ever reported on the advisory leg.** The marker's KDoc said the picker
+  test *fails* there behind the rotation test; with six carriers the rotation test truncates the run
+  first, and all four advisory runs at this baseline (`34041156680`, `34041593697`,
+  `34042397320`, `34043502322`) report `expected: 6, received: 4, failed: 4` — the three Media3
+  tests plus the rotation. The save test is therefore
+  marked by **inheritance, not measurement**, which is now what both KDocs say.
+- **One substantive gap, filed as #250.** `FixtureDocumentsProvider.deletedDocumentIds()` has no
+  callers. #226 proved D4's *premise* — SAF hands back a document of exactly zero bytes — but drove
+  only the success path, so `deletePartialOutput` against a real `DocumentsProvider` is still
+  asserted nowhere. `openDestination` is `protected open` precisely to force the failure, so the
+  test is cheap; it costs another marked picker test and a baseline of 7.
+
+**The reusable part is the second bullet.** A read that fixes documentation drift can introduce it in
+the same wave, and the tests it writes are no more self-describing than the ones it audited. The
+check that found it is the one this document already recommends: **read the KDoc against the code,
+not against the ticket.**
+
+## E8 — the instrumented suite's coverage, measured for the first time
+
+**Severity: n/a · Measured 2026-09-06 on API 34 · the number had never existed**
+
+Four coverage waves were steered by a figure that cannot see `app/src/androidTest`. Nothing had
+ever produced the other half, because `enableAndroidTestCoverage` was unset, so a connected run
+emitted no `.ec` at all and `jacocoTestReport`'s execution data names only `testDebugUnitTest`.
+
+Measured by setting that flag temporarily, running `run-e2e.sh 34` (70/70, 0 failed, 3m21s — the
+instrumentation destabilised nothing), and reporting the resulting `.ec` against the **same** class
+directories and exclusions the committed task uses:
+
+| suite | line | branch |
+|---|---|---|
+| JVM `testDebugUnitTest` | 2236/2374 — **94.2%** | 1171/1338 — **87.5%** |
+| Instrumented, 70 tests | 1711/2374 — **72.1%** | 669/1354 — **49.4%** |
+| **Union** | 2342/2374 — **98.7%** | 1212/1354 — **89.5%** |
+
+The JVM row reproduced the committed figure exactly, which is the control: both exec sets match the
+current class files, so the union is trustworthy.
+
+**Two caveats before anyone quotes these.** Branch denominators differ by 16 — 1338 against 1354 —
+entirely inside `MediaProbe`, an artefact of offline versus on-the-fly instrumentation; line
+denominators are identical at 2374, so only the line figures compare exactly. And **72.1% is not a
+grade for the instrumented suite.** Seventy end-to-end tests reach code broadly and choose arms
+rarely; a branch figure of 49.4% is what that shape looks like. This whole document exists because
+the gaps that mattered — #223's vacuous assertions, #238's two covered things nobody combined —
+are invisible to any percentage.
+
+### What the device suite is for, in numbers
+
+It closes **106 lines** the JVM suite misses, and they are precisely the ones wave 4 wrote off:
+
+| file | JVM missed | union missed |
+|---|---|---|
+| `FFmpegEngine.kt` | 32 | **0** |
+| `Media3Engine.kt` | 24 | **0** |
+| `ConcatEngine.kt` | 15 | **0** |
+| `MediaProbe.kt` | 13 | **3** |
+| `MainActivity.kt` | 10 | **1** |
+| `AndroidDeviceCodecs.kt` | 8 | **0** |
+| `Transcoders.kt` | 10 | 3 |
+
+CLAUDE.md's wave-4 read called 81 lines "native or device edges" — `FFmpegEngine` 33,
+`Media3Engine` 24, `ConcatEngine` 14, `MainActivity.onCreate` 10. The first four rows above total
+**81**, and the union leaves **1**. That **confirms** the read's own hypothesis rather than
+overturning it: it always said those zeroes were "the `testDebugUnitTest`-only measurement
+boundary". Nobody had measured past the boundary. `AndroidDeviceCodecs` is the pointed one — #194
+was filed to cut a seam because `probe()` could not be reached, and on a device it is fully covered.
+
+### The 32 lines neither suite reaches, classified
+
+Every one was read. **None of them is an e2e test gap**, which is the result:
+
+| lines | where | classification |
+|---|---|---|
+| 9 | `Transcoders` ×3, `ConversionViewModel`, `ConverterScreen`, `JoinViewModel`, `JoinScreen`, `MainActivity`, `Reattachment` | **compiler-generated** — default-arg `$default` bridges, coroutine completion, the synthetic `NoWhenBranchMatchedException` arm of a `when` over `Destination` |
+| 10 | `ConversionWorker:342-346`, `ConcatWorker:132-136` | `getForegroundInfo()` — WorkManager's **expedited-work** hook, and nothing here enqueues expedited work. The live path is `setForeground(foregroundInfo(...))`, which is covered. **#252 — closed 2026-09-06, and not the way this row expects.** Expedited work is now enqueued, but that is *not* what covers these lines: `WorkForeground.kt:38` returns before the hook whenever `SDK_INT >= 31`, and `minSdk` is 33. What covers them is `doWork` posting the override instead of a second copy of the same notification. See `coverage-read-findings.md` F9's update |
+| 3 | `ConversionNotifications:60-62` | **F5** — `areEnabled()` has no callers. Already on record |
+| 3 | `CopyPlanner:28`, `OutputFormat:222-223` | public members with no callers. **#253**, with F5 |
+| 3 | `MediaProbe:210-212` | `probeWithFFprobe`'s `catch` — **F7's sibling, and now measured**. See below |
+| 2 | `FFmpegCommandBuilder:167-168` | `COPY`/`NONE -> error(...)` — F4-shaped, deliberately exempt |
+| 1 | `FFmpegCommandBuilder:188` | the `VORBIS` encode arm. No `OutputFormat` produced it, but `ContainerCapabilities` listed it for WEBM and OGG. **#254 — closed, and it was the row that turned out to be a defect**: the arm named `libvorbis`, which was not compiled into the shipped AAR at all, so it could never have run. Closing it meant rebuilding the AAR with `--enable-libvorbis`, not editing the arm. See F1 in `coverage-read-findings.md` |
+| 1 | `ConversionWorker:231` | `?: error("Could not open the input file.")`. `UnopenableUriTest` fails the job *downstream* of it, so the elvis is unprovoked — F4-shaped, same as the two above |
+
+**`MediaProbe:210-212` is the one that gained a measurement.** F7 ruled `probeWithExtractor`'s catch
+unreachable because Robolectric's `MediaExtractor` never throws. That reasoning does not transfer:
+`probeWithFFprobe` calls `readMediaInformation` in native ffmpeg-kit, which the JVM never loads.
+But `MediaProbe.probe` calls **both** probes on one line, and
+`RemuxTest.probeDistinguishesAudioFromImagesFromRubbish` drives it on a device with 4096 bytes of
+garbage — so the ffprobe path *has* been given malformed input on real hardware and **did not
+throw**. Same conclusion as F7, reached by a different mechanism, and now on record rather than
+assumed.
+
+**The reusable part**: a union report is what separates "no test calls this" from "only a device
+calls it", and neither report alone can. Six of the eight rows above were indistinguishable from
+real gaps in the JVM-only number.
+
+---
+
+## E9 — the branch tier of the same union, classified
+
+**Severity: n/a · Measured 2026-09-07 at `c2cc9e2` · the half E8 stopped short of**
+
+E8 classified the 32 lines neither suite executes and stopped there. It never asked the other
+question a union can answer: which *arms* does neither suite take, on lines both suites run? That
+tier had never been read, and it is where what is left actually lives.
+
+**Line numbers below are as of `c2cc9e2`**, and #261 rewrites four of these files. Every row names
+the expression beside the number for that reason — E8's own refs shifted under #252 within a day.
+
+### How this was measured, and why it is not E8's report
+
+E8's union was built once and kept as an artifact; no Gradle task produces one, because a connected
+run only emits an `.ec` with `enableAndroidTestCoverage` set by hand. This read rebuilt it: a fresh
+`:app:jacocoTestReport` merged with **E8's own API 34 `.ec`**, against one set of current class
+files, through a scratchpad init script. Union: **99.0% line (2352/2375), 90.1% branch
+(1206/1338)**; JVM alone 94.6% / 87.6%.
+
+Controls, because a silently-rejected `.ec` looks exactly like a well-covered codebase: the device
+half contributes 32 lines in `FFmpegEngine`, 24 in `Media3Engine`, 15 in `ConcatEngine` and 9 in
+`MainActivity` that the JVM suite never reaches. It applied.
+
+**Two classes are the exception, and the bound matters more than the exception.** #252 changed
+`ConversionWorker` and `ConcatWorker`, so JaCoCo rejected E8's `.ec` for exactly those two — a class
+is matched by a hash of its bytecode. E8's measurement says the device contributed **1** unique line
+in `ConversionWorker` and **0** in `ConcatWorker`, so the blind spot is one line wide. It is
+`ConversionWorker:252`, `getSafParameterForRead` — old line 228, and the one device-only line in
+that file. It shows as never-executed here and **is not a gap**; #252's own commit message records
+an instrumented API 34 pass on the new bytecode.
+
+### The filter, named once
+
+**`mi == 0 && mb > 0`** — a *fully* executed line carrying an arm nothing takes.
+
+`CLAUDE.md` describes its second filter as `ci > 0 && mb > 0` at method level and reports **18**
+lines from wave 4. That figure reproduces exactly under `mi == 0` (19 branches on 18 lines) and not
+under `ci > 0`, which admits partially-executed signature lines and gives 139. The two are different
+metrics, not a stale number and a correction — worth stating because the difference looks like drift
+and is not.
+
+### The artefact E8 flagged is retired
+
+E8 warned that the union's branch denominator ran 16 ahead of the JVM's, "entirely inside
+`MediaProbe`", and told readers not to quote a MediaProbe branch figure raw. Rebuilt, both
+denominators are **1338**, and `MediaProbe:321` (`matroskaOrWebm`) reads `mb=0 cb=4` — fully
+covered, against `mb=11` of 20 before.
+
+**Stated as measured, because this entry is about a number that was quoted past its evidence.** That
+one line accounts for a 16-branch difference, and the two denominators now agree. The remaining
+lines were *not* enumerated in both reports, so read that as consistent with the whole gap sitting
+at `:321` rather than as proof that nothing moved elsewhere. Either way the difference is an
+artefact of how the report was constructed and not a property of the code, so E8's caveat is
+withdrawn rather than carried forward: `matroskaOrWebm` is not, and never was, a gap.
+
+### The result: 23 arms on 22 lines, and 12 of the 22 are decided here
+
+Tier 1 is now **22** lines, down from 32: #252 closed the ten `getForegroundInfo` lines and added no
+new one. Tier 2 did not move.
+
+**Decided — no ticket.** Recorded here rather than as new F-entries, following E8's precedent and
+because `coverage-read-findings.md` is being rewritten by #261. **A JVM-only read that flags any of
+these should look here before re-filing them.**
+
+| site | expression | why it is decided |
+|---|---|---|
+| `FFmpegCommandBuilder:113` | `when (codec)` in `encodeVideo` | the missed arm is the `COPY`/`NONE` pair whose body at `:167-168` is already Tier 1 and F4-exempt. One arm counted in two tiers |
+| `FFmpegCommandBuilder:183` | `when (audio.codec)` | the `VORBIS` arm — **in flight**, see below |
+| `ContainerCapabilities:277` | `?.let(::add)` | F6-shaped. `a?.let{b}?.let(::add)` reaches this branch only when the *lambda* returned null — `firstContainerHolding` finding no carrier. `VIDEO_ALIASES` targets are exactly H264, H265, VP8, VP9, AV1, and MKV carries all five, so it never does. A null at `:275` jumps past this line entirely |
+| `ConversionViewModel:405` | `!is Idle \|\| activeWorkId != null` | F10-shaped, and the line's own comment says so: `ScreenOwnership`'s token is what holds the line. Delete the second half and the suite stays green, correctly |
+| `ConverterScreen:362`, `JoinScreen:245` | `is Failed -> {` | the last arm of its `when` over a sealed state, so the missed branch is the synthetic `NoWhenBranchMatchedException` — compiler-generated |
+| `ConverterScreen:91` | `) { viewModel.convert() }` | the `rememberLauncherForActivityResult` callback; Compose codegen, the shape `CLAUDE.md` already names at `JoinScreen:222` |
+| `AndroidDeviceCodecs:52` | `cached ?: synchronized(this) { cached ?: … }` | double-checked locking's **inner** re-check. Reaching it needs two threads racing the same first call; a seam does not create one |
+| `ConversionWorker:319` | `e is CancellationException \|\| isStopped` | the `isStopped` half — WorkManager stopping a worker mid-run. Device-only |
+| `Media3Engine:83`, `:153`, `:157` | `if (cont.isActive)` ×3 | cancellation racing completion inside the Transformer listener. Device-only and inherently racy; a test that pinned it would be pinning a scheduler |
+
+**Filed — 10 sites, 5 tickets.** Each names the mutation that must go red, or says the read *is* the
+ticket where it cannot yet:
+
+| ticket | sites | what |
+|---|---|---|
+| **#262** | `MediaProbe:303, :305, :306, :309` | `containerFrom`'s alias arms. `names` is `getFormat().split(',')` and ffprobe reports a demuxer *group* (`"mov,mp4,m4a,3gp,3g2,mj2"`), so the second half of each `\|\|` may be dead by construction. Per-site read. Carries `:312` (`aac`/`adts`) as the one that looks like a real fixture gap: the only AAC fixture is `sample_aac.m4a`, which matches `:305` and never reaches it |
+| **#263** | `MediaProbe:386` | the `audio != null` arm — no fixture has two audio tracks, so the guard that makes "first track wins" true is unasserted. E1's shape |
+| **#264** | `ConcatStrategy:57`, `ContainerCapabilities:122`, `OutputFormat:103` | three pure `model`-layer decision arms a test can call directly: the dimension check's height half, an image spec carrying a codec, and `isPureRemux`'s all-`NONE` case |
+| **#265** | `FFmpegEngine:67` | `if (durationMs > 0)`'s false arm. `MediaProbe` returns `0` when it cannot read a duration, so this is a real input, not a second line of defence |
+| **#266** | `FFmpegConcatCommand:95` | the non-MP4 concat output. Reachability depends on what the join UI offers — read that first; F4-shaped if it offers only MP4 |
+
+### One row is being closed while this was written
+
+`FFmpegCommandBuilder:183`'s missed arm is `VORBIS`, which is #254 — open as **#261**, which rebuilds
+the AAR with `--enable-libvorbis` and makes the arm reachable. **The set is 21 arms on 21 lines the
+day that merges**, and both tiers want re-deriving then rather than editing this sentence.
+
+### The reusable part
+
+E8's lesson was that a union separates "no test calls this" from "only a device calls it". This
+tier's is narrower and less comfortable: **once the never-executed lines are gone, what is left is
+mostly not a test gap at all** — 12 of 22 sites are compiler codegen, a documented exemption, or a
+race, and they are indistinguishable from real gaps in any report. The five tickets are what
+survived reading all 22, and three of them are reads rather than tests.

docs/local-emulator.md

@@ -312,6 +312,18 @@ on sample media that is deliberately not committed. Its third test,
 `reportDeviceEncoderCapabilities`, has no such guard and runs. A level reporting 0 skipped
 would mean someone had staged sample files, not that something improved.
 
+**Since #223 there is a third, and it is the interesting one.**
+`HardwareFallbackTest.aFileMedia3CannotDecodeStillConvertsViaFfmpeg` is `assumeTrue`-guarded on
+`AndroidDeviceCodecs.get().canEncode(H265)`, which is false on every emulator image — so it now
+skips here and runs only on the Pixel. It used to *pass* on emulators without ever attempting the
+hardware path, which is worse. **Expect `skipped="3"` locally**, and note the guard is a property
+of the machine rather than of staged files: a level reporting 2 would mean an emulator image had
+gained a hardware HEVC encoder, which is worth knowing.
+
+That test's KDoc carries the measurement, including the part that decides it: forcing the route to
+Media3 anyway does *not* produce a fallback, because the goldfish decoder decodes the High 4:4:4
+fixture despite declaring `NoSupport` for its profile.
+
 ### What the sweep adds, and what it does not
 
 **The renderer rule held four more times.** No boot log contains the string

tools/ffmpeg/README.md

@@ -60,11 +60,22 @@ Only `arm64-v8a` and `x86_64` are built, matching the app's `abiFilters`. Droppi
 
 ## Library selection
 
-Flag names come from `get_library_name()` in the upstream `scripts/function.sh`. Two
+Flag names come from `get_library_name()` in the upstream `scripts/function.sh`. Three
 that are easy to get wrong:
 
 - It is **`--enable-lame`**, not `--enable-libmp3lame`.
 - It is **`--enable-libsvtav1`** for SVT-AV1.
+- It *is* **`--enable-libvorbis`** — the rule above makes `--enable-vorbis` the natural
+  guess and it is wrong. Read the function rather than extrapolating from the first two;
+  library 9 is named `libvorbis` there. Enabling it also enables libogg, which ffmpeg-kit
+  pulls in as its dependency without being asked.
+
+**An unrecognised `--enable-*` is ignored silently.** ffmpeg-kit does not error on one, so a
+build that quietly dropped a library looks exactly like one that worked, and forty minutes
+later there is an AAR that is wrong in a way nothing in the log says. #254 is where that
+was learned, from the other end: the builder carried `-c:a libvorbis` for months against a
+binary with no libvorbis in it — unreachable, so no user ever hit it, and no build log ever
+mentioned it. Check the artifact, not the log — `strings jni/*/libavcodec.so | grep -x <name>`.
 
 MP3 deserves a note: **Android has no MP3 encoder at any API level**. That is a platform
 gap, not a Media3 limitation, so `--enable-lame` is the only way the app can output MP3.
@@ -100,11 +111,15 @@ and `x86_64`. Confirmed against the artifact rather than assumed:
   `--enable-gpl --enable-version3 --enable-libx264 --enable-libx265 --enable-libsvtav1
   --enable-libvpx --enable-libmp3lame --enable-libopus --enable-libdav1d --enable-libass
   --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libharfbuzz
-  --enable-mediacodec --enable-jni --enable-shared --enable-small --enable-lto`
+  --enable-mediacodec --enable-jni --enable-shared --enable-small --enable-lto`.
+  **Since 2026-09-06 it also carries `--enable-libvorbis`** (#254), which is the only
+  difference between that build and the one in `bin/` today — same tag, same FFmpeg
+  version, same 10 shared libraries per ABI, all still `LOAD align 0x4000`.
 - Present and verified: `libx264` (with an x264 core banner, so genuinely linked),
   `libx265`, `libsvtav1`, `libmp3lame`, `h264_mediacodec`, `hevc_mediacodec`, `libopus`,
-  `libdav1d`, the GIF encoder and muxer, libass internals (`ass_shaper_new`), and the
-  `subtitles`, `scale`, `palettegen`, `paletteuse` and `concat` filters.
+  `libdav1d`, `libvorbis` (from 2026-09-06), the GIF encoder and muxer, libass internals
+  (`ass_shaper_new`), and the `subtitles`, `scale`, `palettegen`, `paletteuse` and
+  `concat` filters.
 
 Note `--enable-version3`: combined with `--enable-gpl` this makes the binary **GPL-3.0**,
 which is what `LICENSES/README.md` states.

tools/ffmpeg/build-ffmpeg.sh

@@ -28,7 +28,10 @@ OUT=/work/out
 # Library selection
 # ---------------------------------------------------------------------------
 # Flag names come from get_library_name() in scripts/function.sh — note it is
-# --enable-lame, NOT --enable-libmp3lame.
+# --enable-lame, NOT --enable-libmp3lame. Read that function before adding one: the
+# names are ffmpeg-kit's, not FFmpeg's, and they agree only sometimes. libvorbis is
+# one that does agree (id 9 is literally "libvorbis"), so --enable-libvorbis is right
+# and the --enable-vorbis this rule would predict is not.
 #
 # android-media-codec gives FFmpeg the h264_mediacodec / hevc_mediacodec wrappers.
 # Those are the fallback-within-the-fallback: hardware encode from the FFmpeg side
@@ -41,6 +44,11 @@ COMMON_LIBS=(
   --enable-lame          # MP3 encode. Android has NO MP3 encoder at any API level,
                          # so this is the only way the app can output MP3 at all.
   --enable-opus
+  --enable-libvorbis     # Ogg Vorbis encode. Android has no Vorbis ENCODER at any API
+                         # level either, and FFmpeg's own in-tree vorbis encoder is
+                         # experimental, stereo-only and barely responds to -q:a, so
+                         # this is the only usable route. Pulls libogg in as its
+                         # dependency (ffmpeg-kit sets LIBRARY_LIBOGG with it).
   --enable-dav1d         # fast AV1 decode
 )
 

tools/git-hooks/local-gate.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+#
+# The local gate: what has to be green before a commit is made or a branch is pushed.
+#
+# THE RULE THIS ENFORCES (2026-09-06). Source changes must have the unit tests AND the
+# instrumented tests passing at every supported API level before they are committed or
+# pushed; test changes must have the whole suite passing at every API level. CI is not the
+# place to find out. Four legs of this repo's history were spent discovering on CI what a
+# local sweep would have said in twenty minutes -- and worse, the failing leg MOVED between
+# runs (API 35 red then green, API 34 green then red), which is exactly the signal that gets
+# misread as "someone else's flake" when it is read one leg at a time.
+#
+# WHY BOTH HOOKS RUN THE SAME GATE. A pre-commit-only gate is bypassed by amending; a
+# pre-push-only gate lets a broken commit exist locally and get rebased into something else.
+# Running both is not redundant in practice because of the cache below.
+#
+# THE CACHE IS KEYED ON CONTENT, NOT ON TIME, AND ON THE RIGHT CONTENT. The sweep is recorded
+# under the hash of the `app/src` SUBTREE it verified, not the whole repo tree. Keying it on the
+# whole tree was the first cut and it was wrong in a way that would have trained people to hate
+# this hook: editing a comment in CLAUDE.md, or in this script, invalidated a sweep of identical
+# application code and re-ran forty minutes of emulators to prove nothing. What the sweep is
+# evidence about is `app/src`; that is what it is filed under. Any change to a single byte under
+# `app/src` still invalidates it. The JVM gate is cheap and runs unconditionally.
+#
+# WHAT COUNTS AS "EVERY SUPPORTED API LEVEL", AND WHY 37 IS NOT AN EMULATOR HERE. 33, 34, 35
+# and 36 run the whole suite on emulators. **API 37 cannot be run on an emulator on this host at
+# all** -- not "is red", cannot run: measured 2026-09-06, the image logs
+# `3 new surfaceflinger aborts in 45 s (want 0)` and then the APK install itself fails with
+# `Can't find service: package`, because the framework is already gone before Gradle gets to
+# install anything. `Starting 0 tests`. That is the same gralloc abort docs/api-37-emulator-crash.md
+# measures, hit earlier in the sequence than the suite.
+#
+# So API 37 is covered here by the physical Pixel 10 Pro XL when it is attached, and by CI's
+# gating leg otherwise. The hook says loudly which of the two happened rather than quietly
+# claiming five levels when it ran four.
+#
+# THERE IS DELIBERATELY NO SKIP VARIABLE. An `LMC_SKIP_E2E=1` would be `--no-verify` wearing
+# a different hat, and `--no-verify` needs the repo owner's say-so each time. If this gate is
+# wrong, fix the gate.
+set -uo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT" || exit 1
+
+MODE="$(basename "$0")"
+ZERO="0000000000000000000000000000000000000000"
+# `git rev-parse --git-common-dir`, not a literal ".git" (#258). In a linked worktree `.git` is a
+# FILE containing `gitdir: ...`, so `mkdir -p .git/lmc-verify` fails with "Not a directory" -- and
+# because the write is the last thing this script does, it failed while the gate still printed
+# green and exited 0. Every push from a worktree then re-swept 33-36 for nothing, silently, which
+# is the worst shape a cache can fail in: invisible and expensive.
+#
+# --git-common-dir rather than --git-dir so the cache is SHARED across worktrees. The key is the
+# app/src tree hash, and identical content is identical content whichever worktree produced it.
+CACHE_DIR="$(git rev-parse --git-common-dir)/lmc-verify"
+GRADLE_GATE=(:app:assembleDebug :app:testDebugUnitTest :app:compileDebugAndroidTestKotlin
+  :app:ktlintCheck :app:detekt :app:lintDebug)
+
+# Says so when it cannot record, rather than leaving a cache that silently never fills (#258).
+record_sweep() {
+  [ -n "$tree" ] || return 0
+  if mkdir -p "$CACHE_DIR" 2>/dev/null && : > "$CACHE_DIR/$tree" 2>/dev/null; then
+    return 0
+  fi
+  printf '\n\033[1m[local-gate]\033[0m could not record the sweep under %s -- it will re-run next
+  time. Not fatal, but it means every commit and push pays for it again.\n' "$CACHE_DIR"
+}
+
+say() { printf '\n\033[1m[local-gate]\033[0m %s\n' "$*"; }
+die() {
+  printf '\n\033[1;31m[local-gate] BLOCKED\033[0m %s\n' "$*"
+  printf '  The rule: source work needs unit + e2e green at every API level before commit/push;\n'
+  printf '  test work needs the whole suite green at every level. Fix it, or ask before using\n'
+  printf '  --no-verify -- that flag is not yours to reach for unprompted.\n\n'
+  exit 1
+}
+
+# --- what changed, and what tree is being verified ---------------------------------------
+
+changed_files=""
+tree=""
+case "$MODE" in
+  pre-commit)
+    changed_files="$(git diff --cached --name-only --diff-filter=ACMR)"
+    tree="$(git rev-parse "$(git write-tree):app/src" 2>/dev/null || echo "")"
+    ;;
+  pre-push)
+    # stdin is `<local ref> <local sha> <remote ref> <remote sha>`, one line per ref pushed.
+    while read -r _ local_sha _ remote_sha; do
+      [ "$local_sha" = "$ZERO" ] && continue          # branch deletion carries no content
+      base="$remote_sha"
+      if [ "$remote_sha" = "$ZERO" ]; then
+        # A new branch: compare against main rather than against every commit ever made.
+        base="$(git merge-base origin/main "$local_sha" 2>/dev/null || echo "")"
+      fi
+      if [ -n "$base" ]; then
+        changed_files="$changed_files$(git diff --name-only --diff-filter=ACMR "$base" "$local_sha")"$'\n'
+      else
+        changed_files="$changed_files$(git show --pretty=format: --name-only "$local_sha")"$'\n'
+      fi
+      tree="$(git rev-parse "$local_sha:app/src" 2>/dev/null || echo "")"
+    done
+    ;;
+  *)
+    say "unknown hook name '$MODE'; nothing to do"
+    exit 0
+    ;;
+esac
+
+if [ -z "${changed_files//[[:space:]]/}" ]; then
+  say "no added/modified files; nothing to verify"
+  exit 0
+fi
+
+touches_source=0
+touches_tests=0
+while IFS= read -r f; do
+  case "$f" in
+    app/src/main/*) touches_source=1 ;;
+    app/src/test/*|app/src/androidTest/*) touches_tests=1 ;;
+  esac
+done <<< "$changed_files"
+
+# --- the cheap gate always runs -----------------------------------------------------------
+
+# --- shellcheck, at CI's exact pin ---------------------------------------------------------
+# WHY THIS IS HERE. The gate ran ktlint, detekt and Android lint but not shellcheck, so a new or
+# edited `.sh` file was precisely the case where this hook passed and CI's Static analysis leg
+# still went red. That is not hypothetical: this script is itself a new `.sh` file, and the first
+# thing it could not check was itself. It was caught by hand twice before it was caught here.
+#
+# THE DIGEST IS READ OUT OF status_check.yml, NOT COPIED INTO THIS FILE. shellcheck 0.9.0 and
+# 0.11.0 disagree about how to report a trap handler -- SC2317 on seven body lines versus SC2329
+# once on the declaration, same script, same directive, one red and one green. That disagreement
+# is why CI pins by digest, and a second copy of the digest here would drift from it silently.
+# When it drifts, the symptom is this gate passing and CI failing: the exact thing this section
+# exists to prevent. So there is one digest in the repo and this reads it.
+#
+# ALL TRACKED FILES, not just changed ones, because that is what CI does -- `git ls-files '*.sh'`.
+# The point is to predict that leg, not to audit the diff.
+shellcheck_pin="$(grep -oE 'koalaman/shellcheck@sha256:[0-9a-f]{64}' \
+  .github/workflows/status_check.yml | head -1)"
+# :z is podman's SELinux relabel and is what this host needs; docker on CI does without it.
+runtime=""
+mount=":z"
+for candidate in podman docker; do
+  if command -v "$candidate" >/dev/null 2>&1; then
+    runtime="$candidate"
+    [ "$candidate" = "docker" ] && mount=""
+    break
+  fi
+done
+
+if [ -z "$shellcheck_pin" ]; then
+  say "NOT COVERED: shellcheck. Could not read the pinned digest out of
+  .github/workflows/status_check.yml -- if that pin moved or was reformatted, fix this grep
+  rather than leaving the check silently absent."
+elif [ -z "$runtime" ]; then
+  say "NOT COVERED: shellcheck. Neither podman nor docker is on PATH, and there is no shellcheck
+  system package on this host. CI's Static analysis leg is what answers for .sh files then."
+else
+  say "shellcheck ($runtime, $shellcheck_pin)"
+  if ! git ls-files -z '*.sh' |
+    xargs -0 -r "$runtime" run --rm -v "$PWD:/mnt$mount" "docker.io/$shellcheck_pin"; then
+    die "shellcheck failed. CI runs the same digest over the same files, so this is a red
+  Static analysis leg waiting to happen."
+  fi
+fi
+
+# --- actionlint, the half shellcheck cannot see ---------------------------------------------
+# A good deal of this repo's bash lives in workflow `run:` blocks, which `git ls-files '*.sh'`
+# does not match at all -- so without this a workflow edit is the same hole the section above
+# just closed: green here, red on Static analysis. Pinned by digest for the reason in that
+# section, and for actionlint's own: its documented install is `curl | bash` off a moving branch,
+# which does not belong in a repo that pins every action by SHA.
+actionlint_pin="$(grep -oE 'rhysd/actionlint@sha256:[0-9a-f]{64}' \
+  .github/workflows/status_check.yml | head -1)"
+
+if [ -z "$actionlint_pin" ]; then
+  say "NOT COVERED: actionlint. Could not read the pinned digest out of
+  .github/workflows/status_check.yml -- fix this grep rather than leaving the check absent."
+elif [ -z "$runtime" ]; then
+  say "NOT COVERED: actionlint. Neither podman nor docker is on PATH; CI's Static analysis leg
+  is what answers for the workflows then."
+else
+  say "actionlint ($runtime, $actionlint_pin)"
+  if ! "$runtime" run --rm -v "$PWD:/repo$mount" -w /repo "docker.io/$actionlint_pin" -color; then
+    die "actionlint failed. CI runs the same digest over the same workflows."
+  fi
+fi
+
+say "$MODE: running the JVM gate"
+if ! ./gradlew "${GRADLE_GATE[@]}" --continue; then
+  die "the JVM gate failed (assemble, unit tests, androidTest compile, ktlint, detekt, lint)."
+fi
+
+# --- the sweep, when code is involved ------------------------------------------------------
+
+if [ "$touches_source" -eq 0 ] && [ "$touches_tests" -eq 0 ]; then
+  say "no app/src changes; the instrumented sweep is not required for this one"
+  record_sweep
+  exit 0
+fi
+
+if [ -n "$tree" ] && [ -f "$CACHE_DIR/$tree" ]; then
+  say "app/src ($tree) already swept and green; nothing under app/src has changed since"
+  exit 0
+fi
+
+say "app/src changed -- sweeping API 33, 34, 35, 36 (this takes tens of minutes, by design)"
+if ! tools/local-emulator/run-e2e.sh 33 34 35 36; then
+  die "the instrumented suite is not green on 33-36."
+fi
+
+# API 37: the physical device if it is here, and an honest statement if it is not. run-e2e.sh is
+# emulator-only (and overwrites E2E_EXTRA_GRADLE_ARGS with --rerun, so extra args cannot be passed
+# through it), so this drives Gradle directly with the serial pinned -- the phone must never be
+# picked up by accident, which is the hazard run-e2e.sh's header calls out.
+export ANDROID_HOME="${ANDROID_HOME:-$HOME/Android/Sdk}"
+export PATH="$ANDROID_HOME/platform-tools:$PATH"
+
+device=""
+while read -r serial state; do
+  [ "$state" = "device" ] || continue
+  case "$serial" in emulator-*) continue ;; esac
+  [ "$(adb -s "$serial" shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r')" = "37" ] || continue
+  device="$serial"
+  break
+done < <(adb devices 2>/dev/null | tail -n +2)
+
+levels="33, 34, 35, 36"
+if [ -n "$device" ]; then
+  say "API 37 on the attached device $device"
+  if ! ANDROID_SERIAL="$device" ./gradlew :app:connectedDebugAndroidTest -PabiFilters=arm64-v8a; then
+    die "the instrumented suite is not green on API 37 (device $device)."
+  fi
+  levels="$levels, 37"
+else
+  say "NOT COVERED LOCALLY: API 37. No API 37 device is attached, and the API 37 emulator cannot
+  install the APK on this host (see this script's header). CI's gating leg is what answers for it;
+  attach the Pixel 10 Pro XL to have this hook cover it too."
+fi
+
+record_sweep
+# Name the levels rather than claiming "every supported level". The first cut said the latter on
+# both paths, including the one that had just printed NOT COVERED two lines above -- a false claim
+# printed by the tool whose whole job is to stop false claims reaching CI.
+say "green on API $levels; $MODE allowed"
+exit 0

tools/git-hooks/pre-commit

@@ -0,0 +1 @@
+local-gate.sh

tools/git-hooks/pre-push

@@ -0,0 +1 @@
+local-gate.sh

tools/local-emulator/run-e2e.sh

@@ -355,12 +355,10 @@ boot_emulator() {
 # may be in one of its restarts and `pm` is simply not published yet. The first attempt at this
 # failed exactly that way, with `cmd: Can't find service: package`.
 #
-# The framework restart at the end is not optional, and finding that out cost a run. By the
-# time `sys.boot_completed` flips, SystemUI has already registered its region-sampling listener,
-# and `pm disable-user` does not retract a registration that already happened -- it only stops
-# the package being started again. So the first attempt disabled SystemUI, reported success, and
-# then died exactly as before with `Starting 0 tests` and four more aborts. `stop; start` cycles
-# zygote deliberately, and the framework that comes back up does not start SystemUI at all.
+# This used to end with a framework restart, described here as "not optional". It was neither
+# optional nor happening -- see the block inside the function. What the first attempt's
+# `Starting 0 tests` and four more aborts actually showed is that a `pm disable-user` on its own
+# buys nothing, which is still true; what was wrong is the conclusion that a restart would.
 disable_region_sampling() {
   local api="$1" out i before after ready
   case "$api" in 37 | 37.*) ;; *) return 0 ;; esac
@@ -383,14 +381,18 @@ disable_region_sampling() {
     return 0
   fi
 
-  echo "  restarting the framework so the region-sampling listener goes with it"
-  emu_adb shell stop > /dev/null 2>&1
-  emu_adb shell start > /dev/null 2>&1
-  # There is no property worth waiting on here, and an earlier version of this only looked
-  # like it was waiting on one: `stop` does not clear sys.boot_completed, so it still reads
-  # `1` throughout the restart and any loop over it returns at once. The loop below is the
-  # wait -- and it polls the better thing anyway, since `Can't find service: package` is the
-  # failure it exists to prevent.
+  # NO FRAMEWORK RESTART, and the two lines that used to be here are why this comment is long.
+  # They were `emu_adb shell stop` and `emu_adb shell start`, both redirected to /dev/null, and
+  # both root-only -- so what they printed there was `Must be root` and what they did was nothing,
+  # here and in the two CI copies alike. Making them real (2026-09-05) is what established that
+  # the disable never worked in the first place: with the package verified `disabled-user` before
+  # AND after a clean restart on android-37.0, `com.android.systemui` comes up 3 s after
+  # `system_server` regardless, and the same is visible in CI's own logcat. The restart also loses
+  # the package state to PackageManager's delayed write if it lands too soon after the `pm` call,
+  # which cost api37-debug run 34010167885 every test in the leg.
+  #
+  # So the useful part of this function is the quiet window below, not the disable. See
+  # .github/scripts/e2e-run.sh's header, and docs/api-37-emulator-crash.md.
   ready=0
   for i in $(seq 1 30); do
     if emu_adb shell service check package 2> /dev/null | grep -q ': found' \