Merge pull request #146 from JMR-dev/test/container-capabilities-audio

C2: test the audio half of validate, and the one video refusal missing

CLAUDE.md

@@ -130,9 +130,8 @@ install for code that can never run — and on API 37 the full APK does not fit
 - The `model` package is excluded from `ReturnCount` and `CyclomaticComplexMethod` only. It is the
   decision layer, where one branch is one documented user-visible outcome and the metric counts
   answers rather than complexity. Every other rule still applies there.
-- **Coverage is reported, not gated** — **92.8% of lines (2183/2352), 81.3% of branches
-  (1091/1342)**, measured 2026-09-02 with `./gradlew :app:jacocoTestReport`, against 584 JVM tests
-  in 87 classes.
+- **Coverage is reported, not gated** — **84.9% of lines (1971/2321), 63.8% of branches**,
+  measured 2026-08-26 with `./gradlew :app:jacocoTestReport`, against 454 JVM tests in 67 classes.
 
   **Every figure this file carried before 2026-08-24 was an artifact, roughly half the real one.**
   Robolectric loads classes through its own sandbox classloader with no source location, JaCoCo
@@ -148,141 +147,12 @@ install for code that can never run — and on API 37 the full APK does not fit
   disproportionately Robolectric, so each one added denominator and no numerator — the measurement
   was punishing exactly the tests that were hardest to write.
 
-  Two things still hold. A floor needs a baseline that has settled, and this one has not. It moved
-  39 points in a single build change on 2026-08-24; then another 16 as the #52 test push and the
+  Two things still hold. A floor needs a baseline that has settled, and this one has not: it moved
+  39 points in a single build change on 2026-08-24, then another 16 as the #52 test push and the
   fixes it turned up landed — 69.2% -> 84.9% line, 53.2% -> 63.8% branch — while the denominator
-  grew 2194 -> 2321, because that work added production code of its own; then again on 2026-08-27
-  as #132 and #133's ten children landed — 84.9% -> 87.1% line, 63.8% -> **69.1%** branch, 454 ->
-  502 tests. **Branch moved four times as far as line that last time**, and that is the shape to
-  expect from this kind of work rather than a surprise: those children targeted decision code —
-  enum fallbacks, refusal arms, cursor shapes, a `when` over container rules — where one test
-  chooses a branch the suite had never taken. Line coverage barely notices; branch coverage is the
-  whole point.
-
-  Then #153's five children on 2026-08-29 — 87.1% -> 88.9% line, 69.1% -> **75.4%** branch, 502 ->
-  546 tests.
-
-  **That last branch figure moved for two reasons, and only one of them is new tests.** The
-  numerator rose 974 -> 1011; the denominator *fell* 1410 -> 1340. Both are the seam work. Pulling
-  a `when` out of a lambda inside a `collect` deletes the coroutine state machine's synthesized
-  branches around it, and what is left is a plain function whose branches a test can choose:
-  `ConversionViewModel$observe$1$1` went from carrying the whole mapping to 6 branches, while the
-  extracted `ConversionViewModelKt` covers 41 of 42 and `JoinViewModelKt` 38 of 39. So a seam is
-  worth more than the tests it enables — it also stops the measurement counting scaffolding.
-
-  Be careful quoting a branch move on its own for that reason. A percentage that rises because the
-  denominator shrank is not the same claim as one that rises because more branches are tested, and
-  this entry has a history of explaining its own numbers wrongly.
-
-  Then wave 3 (#167-#178) on 2026-09-02 — 88.9% -> 92.8% line, 75.4% -> **81.3%** branch, 546 ->
-  584 tests, in ten PRs from #179 to #188.
-
-  **Its shape is different from the two before it, and the difference is the thing to carry
-  forward.** Waves 1 and 2 were finding uncovered code. By wave 3 there was not much of that left,
-  so the gaps were sorted into two kinds before any test was written:
-
-  - **coverage gaps** — the line never executes. Filtered to sites where JaCoCo reports `mi > 0`, a
-    concrete instruction no test runs, which is what separates a real gap from a partial branch on
-    a compound condition. That filter cut the candidate list roughly in half and was right to.
-    **Wave 4 found it wrong in both directions, though — use the two filters below instead.**
-  - **assertion gaps** — JaCoCo is green and nothing checks the answer. `MainActivity`'s rail and
-    bottom bar were both *executed* by `AppRootRestorationTest` and **transposing them passed the
-    entire suite**; so did swapping the two progress-notification strings, and swapping `Content`'s
-    two destinations. No coverage number would ever have found any of the three.
-
-  **Wave 4 (2026-09-02) corrected that first filter, and the correction is the reusable part.**
-  `mi > 0` fails in both directions. It *over-reports* on Compose: `JoinScreen.kt:222` reads
-  `mi=10` and also `ci=38`, and `JoinStateAffordancesTest` already clicks that Save button and
-  asserts `save:joined.mp4` — the missed instructions are the synthesized `$changed`/`$dirty`
-  recomposition-skip path, the same codegen this file already warns about for *branch* counts,
-  showing up in the instruction count too. And it *under-reports* on warm methods with cold arms:
-  `ConversionViewModel.cancel()` misses no line, yet `activeWorkId?.let(...)` had only ever been
-  entered on the null side in 584 tests. Use two filters together instead:
-
-  - **`ci == 0`** — the line never executed. This is JaCoCo's own missed-line definition, so it
-    totals exactly the reported missed-line count and needs no judgement.
-  - **`ci > 0 && mb > 0` at method level** — a covered method with an arm nothing takes. This is
-    the only one that finds the `cancel()` shape.
-
-  Of wave 4's 251 missed branches, just **18** sat on lines that do execute, so the branch gap and
-  the line gap are largely the same gap; the second filter is about which of them are reachable.
-
-  So **every ticket named the mutation that had to go red, and that was its acceptance criterion
-  rather than a coverage delta**. It caught **two vacuous tests written in the same session**,
-  before either shipped:
-
-  - a `firstContainerHolding` test asserting a refusal still offered *something*. True, and
-    useless: the source container is a candidate in its own right, so the list stays non-empty
-    whatever the fallback does. What it actually buys is the codec the user asked for.
-  - a staged-delete test scanning for a `"join-"` prefix `StagingNames.forJob` does not produce —
-    it names files `<jobId>.<ext>`, so the assertion was true of everything.
-
-  It also corrected a *third* test that was not vacuous: `probeForConcat`'s KDoc claimed to drive
-  the `catch` arm, and rethrowing from that catch left it green. That is how the arm turned out to
-  be unreachable — see the next paragraph. A passing test with a wrong explanation is its own
-  failure mode.
-
-  **A green mutation is only evidence when the mutation is a real change**, which is the mirror
-  trap: one `classify` mutation stayed green because reordering two arms was semantically
-  equivalent for every reachable input. A bad mutation and a weak test look identical in the output.
-
-  Three things came back **not as the ticket described them**, which is a result rather than a
-  shortfall:
-
-  - `ContainerCapabilities:282`'s `exclude` filter **cannot drop anything**. `repair` always
-    changes a codec on the shared container — a codec it left alone is one `validate` would not
-    have refused — and the one non-default `exclude` carries `COPY` while every candidate carries
-    `NONE`. F4-shaped.
-  - `probeForConcat`'s catch arm is **unreachable on this runtime**. Robolectric's `MediaExtractor`
-    never throws from `setDataSource`, measured across an unregistered `content://` authority, a
-    missing `file://`, a file of garbage bytes and an `http://` URL — all four returned with
-    `trackCount = 0`. It stays device-only.
-  - `JobSnapshots:31`'s missed arm was **not** the `!isFile` one the ticket named — that is already
-    covered by the `reclaimed` fixture. It was `path == null`: a job carrying no output path at
-    all. Read the report, not the ticket, when the two disagree.
-
-  One item was **included against** the F4 rule rather than exempted by it, and the distinction is
-  worth having written down since both live in the same function: `ContainerCapabilities:94`
-  (`accepts(container, VideoCodec.NONE, mode)`) is dead in production today — every caller guards
-  `NONE` first — and was tested anyway, because its audio twin at `:101` has had a test since #136
-  and the asymmetry was the argument. The `COPY -> error(...)` arms beside it stay exempt, because
-  a second line of defence that can be provoked is not one.
-
-  Denominators moved here too, in both directions and for two different reasons: 1340 -> 1342
-  branches from `MediaProbe.merge`, 2348 -> 2352 lines from the `ConcatJoiner` interface. Neither
-  is new untested code.
-
-  And **re-measure before quoting**: this entry was once written quoting 81.4%, measured four hours
-  earlier, and was already three points stale by the time it was ready to merge.
-
-  **Wave 4's read (2026-09-02) moved no number at all, and that is its result.** It was a triage
-  rather than a test push: twelve tickets (**#192-#203**), four deferred candidates (**#204**), and
-  five findings (**F6-F10** in `docs/coverage-read-findings.md`). What it establishes is the shape
-  of what is left, which is different again from wave 3's:
-
-  - Of 169 never-executed lines, **81 are native or device edges and stay that way** —
-    `FFmpegEngine` 33, `Media3Engine` 24, `ConcatEngine` 14, `MainActivity.onCreate` 10 — their
-    zeroes being the `testDebugUnitTest`-only measurement boundary that #84, #85, #86 and #88 each
-    recorded before. A further **34 are device-bound only until a seam moves them**:
-    `AndroidDeviceCodecs` 20 (#194) and the 14 of `MediaProbe`'s 26 that are `readMediaInformation`
-    (#195). Do not read that second group as exempt — the two tickets exist because it is not.
-  - Most of the rest is **already closed with a reason on record**, or compiler-generated: default-arg
-    bridges, DI factory lambdas, synthetic `NoWhenBranchMatchedException` arms, coroutine completion.
-  - Six of the ten findings in that document are now "no action" or "not a test gap". By this point
-    the report's remaining red is mostly arms nothing can reach, members nothing calls, and arms a
-    test *can* reach but cannot pin — and a coverage number tells none of them apart.
-
-  **The biggest single gap it found was not a missed line.** `ConversionViewModel.cancel()` and
-  `JoinViewModel.cancel()` report every line covered; only the null arm of
-  `activeWorkId?.let(workManager::cancelWorkById)` had ever been entered, so nothing in 584 tests
-  connected the Cancel button to WorkManager (#192). That is what the second filter above is for.
-
-  It also re-opened a mechanism, not a close: #86 and #133 ruled `AndroidDeviceCodecs.probe()` out
-  **through `ShadowMediaCodecList`**, on the grounds that the builder cannot set `isAlias` or
-  `canonicalName`. A pure seam does not have that constraint, and #133 did not evaluate one. Read
-  #194 before re-arguing either way — and note the reason it is worth cutting is not coverage but
-  that the `runCatching` fallback logs "assuming permissive" while returning empty sets, which makes
-  `canEncode` and `canDecode` answer *no* for everything.
+  grew 2194 -> 2321, because that work added production code of its own. And **re-measure before
+  quoting**: this entry was written quoting 81.4%, measured four hours earlier, and was already
+  three points stale by the time it was ready to merge.
 - **Testable code is not done until it is tested.** If a piece is unit testable, it gets unit
   tests before it counts as done. If it is e2e testable, it gets e2e tests. Both clauses apply —
   a change that is both needs both.
@@ -304,32 +174,6 @@ install for code that can never run — and on API 37 the full APK does not fit
 
 - `kotlin.code.style=official`. Gradle stays Kotlin DSL.
 
-- **A stacked PR does not merge with `gh pr merge`, and `MERGED` is not proof it reached `main`.**
-  Two separate traps, both measured on 2026-08-27 while landing #144-#151.
-
-  `gh pr merge` uses the GraphQL mutation, which refuses a stacked PR outright: *"This pull request
-  is part of a stack and must be merged using the asynchronous merge REST API."* So does
-  `PUT .../pulls/{n}/merge`. The one that works is
-  `gh api -X PUT repos/OWNER/REPO/pulls/N/merge-async -f merge_method=merge`, which returns a uuid
-  to poll at `.../merge-async/{uuid}` until `status` is `merged` or `failed`.
-
-  **The second trap is worse, because nothing looks wrong.** GitHub retargets a stacked PR's base
-  to `main` when the PR below it merges, but *asynchronously*. Merge a stack faster than that
-  settles — five PRs about thirty seconds apart, in the case that found this — and each one merges
-  into its own base branch, which has itself already been merged and left behind. Every call
-  returns `status: merged` and every one is true. `gh pr list --state open` comes back empty, every
-  PR shows `MERGED`, and **none of the content is on `main`**.
-
-  What caught it was a coverage re-measure reading two points lower than the same tree had measured
-  an hour earlier; a fresh `git pull` changed nothing, which is what turned it into a question.
-  `git merge-base --is-ancestor <merge-sha> origin/main` answers it in one line. Do that after
-  merging a stack, or merge one at a time and re-read `baseRefName` between. #160 is what the
-  recovery cost.
-
-  The auto-retarget belongs to the stacking feature specifically. A PR opened with a plain
-  `gh pr create --base some-branch` does **not** retarget when that branch merges — it is left
-  pointing at a dead base and has to be moved by hand.
-
 - **File one-off issues with `tools/github/file-issue.sh`, not `gh issue create`.** `gh issue
   create` does not touch the project board, so the issue exists, carries its labels, and is
   invisible in the Kanban — indistinguishable from never having been filed. Measured 2026-08-24:
@@ -411,24 +255,3 @@ Because versions float, a build can change without a commit. `./gradlew :app:dep
   `app/build.gradle.kts`, neither of which moves a thread. `HangBoundTest` guards both numbers,
   and **a timed-out run writes no XML for the class that hung** — the dump is its only
   attribution, so do not delete the watchdog as stray config.
-- **The JVM suite does not run `LibreMediaConverterApp`.** `app/src/test/resources/robolectric.properties`
-  names `TestLibreMediaConverterApp` for every test, and it differs from the real class in exactly
-  one thing: `sweepScope` is `Dispatchers.Unconfined`, so the startup staging sweep finishes before
-  `onCreate()` returns instead of running on `Dispatchers.IO`.
-
-  **That line is load-bearing — do not delete it as stray config.** Robolectric builds an
-  `Application` per test class that asks for one, and each `onCreate` launched a sweep over the
-  shared `<cacheDir>/conversions/` that nothing joined. So a test asserting about a staged file was
-  racing every sweep the classes before it had left in flight (#159). It was CI-only until wave 4
-  added ten Robolectric classes, at which point `OutputPublisherStagingTest` failed on roughly one
-  local run in six. Per-test opt-in was measured and rejected: **27 of the 58 Robolectric classes
-  touch that directory**. The `SupervisorJob` is kept in the test scope so a throwing sweep is
-  swallowed there exactly as in production — the dispatcher is the only intended difference.
-
-  **It cost one assertion, knowingly.** `AppStartSweepTest` used to open by asserting that the
-  manifest's `android:name` is what Robolectric instantiated, so the sweep is code that actually
-  runs. An `application=` override *replaces* the manifest rather than being checked against it, and
-  `applicationInfo.className` reports the override too — measured — so that claim is not merely
-  unasserted on the JVM now, it is unobservable, and a rewritten version would assert the override
-  against itself. **The manifest link is device-only.** What remains is the `as LibreMediaConverterApp`
-  cast in that class's `setUp`, which catches only the test app ceasing to extend the real one.

app/src/main/java/org/libremediaconverter/LibreMediaConverterApp.kt

@@ -3,7 +3,6 @@ package org.libremediaconverter
 import android.app.Application
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.launch
 import org.libremediaconverter.convert.OutputPublisher
@@ -18,36 +17,14 @@ import org.libremediaconverter.convert.OutputPublisher
  * ever becomes a `Converted` state, or a `reset()`'s delete is cancelled along with the
  * Activity. Process start is the one moment those leftovers are reliably observable.
  */
-open class LibreMediaConverterApp : Application() {
+class LibreMediaConverterApp : Application() {
 
     /**
      * Deliberately process-lifetime and never cancelled: the work it carries is a single
      * short task that should outlive nothing in particular and be interrupted by nothing.
      * A `SupervisorJob` so a failure here could never take a sibling down with it.
-     *
-     * **`protected open` for #159.** Robolectric builds an `Application` for every test that asks
-     * for one, so on the JVM this is not one background sweep but one *per test* — all of them on
-     * `Dispatchers.IO`, all touching the same `cacheDir`, none of them joined by anything. That is
-     * a race against any test asserting about a file under `conversions/`, and it grew with the
-     * suite: wave 4 added ten Robolectric classes and took it from CI-only to roughly one local run
-     * in six. The JVM suite substitutes a scope that runs the sweep inline — see
-     * `app/src/test/resources/robolectric.properties` and `TestLibreMediaConverterApp`.
-     *
-     * A constructor parameter would be the ordinary way to inject this and is not available: the
-     * framework builds this class, so the seam has to be a member.
      */
-    protected open val sweepScope: CoroutineScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-
-    /**
-     * The sweep [onCreate] last started, so a caller that needs it finished can wait for it.
-     *
-     * Nothing in production reads this — process start does not wait for its own housekeeping. It
-     * exists because the alternative for a test is a timed poll, and a poll cannot tell "the sweep
-     * has not run yet" from "the sweep ran and did nothing".
-     */
-    @Volatile
-    var startupSweep: Job? = null
-        private set
+    private val appScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
     override fun onCreate() {
         super.onCreate()
@@ -76,6 +53,6 @@ open class LibreMediaConverterApp : Application() {
         //
         // sweepStaging() also re-reads each timestamp immediately before deleting, which
         // closes the window between listing the directory and acting on the listing.
-        startupSweep = sweepScope.launch { OutputPublisher(this@LibreMediaConverterApp).sweepStaging() }
+        appScope.launch { OutputPublisher(this@LibreMediaConverterApp).sweepStaging() }
     }
 }

app/src/main/java/org/libremediaconverter/MainActivity.kt

@@ -24,11 +24,9 @@ import androidx.compose.runtime.saveable.Saver
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.testTag
 import androidx.media3.common.util.UnstableApi
 import org.libremediaconverter.convert.ConverterScreen
 import org.libremediaconverter.join.JoinScreen
-import org.libremediaconverter.ui.TestTags
 import org.libremediaconverter.ui.theme.LibreMediaConverterTheme
 
 /**
@@ -116,7 +114,7 @@ internal fun AppRoot(
 
     if (useRail) {
         Row(modifier = Modifier.fillMaxSize()) {
-            NavigationRail(modifier = Modifier.testTag(TestTags.Shell.NAVIGATION_RAIL)) {
+            NavigationRail {
                 Destination.entries.forEach { item ->
                     NavigationRailItem(
                         selected = destination == item,
@@ -134,7 +132,7 @@ internal fun AppRoot(
         Scaffold(
             modifier = Modifier.fillMaxSize(),
             bottomBar = {
-                NavigationBar(modifier = Modifier.testTag(TestTags.Shell.NAVIGATION_BAR)) {
+                NavigationBar {
                     Destination.entries.forEach { item ->
                         NavigationBarItem(
                             selected = destination == item,

app/src/main/java/org/libremediaconverter/codec/AndroidDeviceCodecs.kt

@@ -21,11 +21,6 @@ import org.libremediaconverter.model.VideoCodec
  *   words, "cannot be tested for correctness". It is a hint, not a guarantee, which is
  *   why the router treats a failed hardware export as a signal to fall back rather
  *   than trusting this up front.
- * - **An enumeration that fails answers no to everything**, which sends every job to
- *   FFmpeg. Empty sets are not a permissive default: `canEncode` looks a MIME type up in
- *   [hardwareEncodeMimes] and finds nothing there. That is the intended answer — FFmpeg
- *   can do whatever Media3 can, only slower — but it is the opposite of what this class
- *   said until #194, so it is written down rather than left to be re-derived.
  */
 class AndroidDeviceCodecs private constructor(
     private val hardwareEncodeMimes: Set<String>,
@@ -51,62 +46,22 @@ class AndroidDeviceCodecs private constructor(
 
         fun get(): AndroidDeviceCodecs = cached ?: synchronized(this) { cached ?: probe().also { cached = it } }
 
-        /**
-         * One entry of the platform's codec list, reduced to what the rules below read.
-         *
-         * The five booleans and the type list are the whole of what [capabilitiesFrom] needs, and
-         * none of them can be set on a `MediaCodecInfo` from a test: Robolectric ships
-         * `MediaCodecInfoBuilder`, but it has no `setIsAlias` and no `setCanonicalName`, which is
-         * exactly the objection #133 raised against reaching this code through
-         * `ShadowMediaCodecList`. That objection is about the shadow. It does not apply to a
-         * function that takes its own entry type, which is why this exists.
-         */
-        internal data class CodecEntry(
-            val canonicalName: String,
-            val isAlias: Boolean,
-            val isEncoder: Boolean,
-            val isHardwareAccelerated: Boolean,
-            val isSoftwareOnly: Boolean,
-            val supportedTypes: List<String>,
-        )
-
-        /**
-         * The enumeration rules, over entries a caller chooses.
-         *
-         * [probe] is the only production caller and supplies the real codec list; a test supplies
-         * its own, which is the point — the two rules this class's KDoc calls out as easy to get
-         * wrong, the alias skip and the canonical-name dedup, are unreachable any other way.
-         *
-         * **`enumerate` returns a `Sequence`, deliberately.** The `runCatching` has to wrap the
-         * *iteration* rather than a list built before it, because a `MediaCodecInfo` whose
-         * properties throw does so partway through — and when that happens the codecs already read
-         * are kept. Taking a `List` here would move that throw outside the loop and silently turn a
-         * partial answer into an empty one. That behaviour predates this seam; a `List` parameter
-         * would have changed it as a side effect of a refactor.
-         *
-         * **An enumeration that fails answers restrictively, and that is deliberate.** The sets
-         * come back empty, and `"video/avc" in emptySet()` is `false`, so [canEncode] and
-         * [canDecode] both answer no and every job routes to FFmpeg. FFmpeg can do everything
-         * Media3 can, only slower, so refusing the hardware path is the safe reading of "we could
-         * not find out what this device supports". This used to log "assuming permissive", which
-         * described the opposite of what the code does.
-         */
-        internal fun capabilitiesFrom(enumerate: () -> Sequence<CodecEntry>): AndroidDeviceCodecs {
+        private fun probe(): AndroidDeviceCodecs {
             val encoders = mutableSetOf<String>()
             val decoders = mutableSetOf<String>()
             val seen = mutableSetOf<String>()
 
             runCatching {
-                enumerate().forEach { entry ->
+                MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.forEach { info ->
                     // Aliases point at the same underlying codec; counting both would
                     // double-count capabilities.
-                    if (entry.isAlias) return@forEach
-                    if (!seen.add(entry.canonicalName)) return@forEach
+                    if (info.isAlias) return@forEach
+                    if (!seen.add(info.canonicalName)) return@forEach
 
-                    entry.supportedTypes.forEach { mime ->
+                    info.supportedTypes.forEach { mime ->
                         if (!mime.startsWith("video/")) return@forEach
-                        if (entry.isEncoder) {
-                            if (entry.isHardwareAccelerated && !entry.isSoftwareOnly) {
+                        if (info.isEncoder) {
+                            if (info.isHardwareAccelerated && !info.isSoftwareOnly) {
                                 encoders += mime
                             }
                         } else {
@@ -114,32 +69,12 @@ class AndroidDeviceCodecs private constructor(
                         }
                     }
                 }
-            }.onFailure { Log.w(TAG, "Codec enumeration failed; routing everything to FFmpeg.", it) }
+            }.onFailure { Log.w(TAG, "Codec enumeration failed; assuming permissive.", it) }
 
             Log.i(TAG, "Hardware video encoders: $encoders")
             return AndroidDeviceCodecs(encoders, decoders)
         }
 
-        /**
-         * The thin edge: the real codec list, mapped onto [CodecEntry] one at a time.
-         *
-         * Lazily, so a property that throws does it inside [capabilitiesFrom]'s `runCatching` and
-         * on the entry that caused it — see that function's note on why the parameter is a
-         * `Sequence`.
-         */
-        private fun probe(): AndroidDeviceCodecs = capabilitiesFrom {
-            MediaCodecList(MediaCodecList.REGULAR_CODECS).codecInfos.asSequence().map { info ->
-                CodecEntry(
-                    canonicalName = info.canonicalName,
-                    isAlias = info.isAlias,
-                    isEncoder = info.isEncoder,
-                    isHardwareAccelerated = info.isHardwareAccelerated,
-                    isSoftwareOnly = info.isSoftwareOnly,
-                    supportedTypes = info.supportedTypes.toList(),
-                )
-            }
-        }
-
         /**
          * `internal` rather than `private` so the cross-check test can ask what a [VideoCodec]
          * means here and compare it with what [NAME_TO_MIME] says the same codec's names mean.

app/src/main/java/org/libremediaconverter/convert/ConversionViewModel.kt

@@ -6,7 +6,6 @@ import android.util.Log
 import androidx.lifecycle.AndroidViewModel
 import androidx.lifecycle.viewModelScope
 import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
 import androidx.work.WorkInfo
 import androidx.work.WorkManager
 import kotlinx.coroutines.CoroutineDispatcher
@@ -72,119 +71,6 @@ data class InputFile(
     val probe: InputProbe? = null,
 )
 
-/**
- * One update about a running conversion, as WorkManager last reported it.
- *
- * Only the fields [conversionStateFrom] reads — the same shape, and for the same reason, as
- * `JobSnapshot` beside `Reattachment.choose`: the rule stays testable on the JVM because nothing
- * in it needs a `WorkInfo`, which a test cannot readily build.
- *
- * [outputData] stays a `Data` rather than being unpacked into five nullable strings. It is what a
- * test already builds with `workDataOf` everywhere in this suite, so unpacking would move the same
- * reads without making anything easier to drive.
- */
-internal data class ConversionUpdate(
-    val state: WorkInfo.State,
-    val progressPercent: Int,
-    val runAttemptCount: Int,
-    val outputData: Data,
-)
-
-/**
- * What the screen should show, given what WorkManager last said about the job.
- *
- * ## Why this is a function rather than the body of a `collect`
- *
- * It was the body of one. `workManager` is built in the constructor from `WorkManager.getInstance`,
- * `observe` is private, and nothing could hand either a chosen `WorkInfo` — so every arm below ran
- * only when a real worker happened to produce it. A real worker produces a terminal state with
- * well-formed output, which meant six of these arms had never been chosen by any test: the progress
- * read, both sides of the retry check, a success with no file, a failure with nothing to say, and
- * the two that map to a state the user cannot otherwise reach.
- *
- * That is the argument #141 made for `MediaProbe`'s track walk, against `WorkManager` instead of a
- * media fixture, and it takes the same answer: the branch matrix is a pure function, and what is
- * left needing the framework — the flow, the null check, the ownership check — is the thin edge.
- *
- * ## What is deliberately *not* in here
- *
- * The ownership check stays at the call site. Its comment is explicit that it guards the file
- * ownership the `SUCCEEDED` arm takes, not merely the assignment, so moving it inside would change
- * what it protects. And this function takes no responsibility for the staged file: it returns the
- * state, and the caller reads the file off it. A pure function that deletes files is not a seam.
- *
- * @param cancelled where a cancellation lands, which differs for a reattached job — see [observe].
- * @param fallbackSpec the current settings, read only when finished work predates the worker
- *   reporting its own name and MIME type.
- */
-@UnstableApi
-internal fun conversionStateFrom(
-    update: ConversionUpdate,
-    input: InputFile,
-    cancelled: ConversionState,
-    fallbackSpec: OutputSpec,
-): ConversionState = when (update.state) {
-    WorkInfo.State.RUNNING -> ConversionState.Converting(input, update.progressPercent)
-
-    // ENQUEUED after a run means a retry is pending. Either the six-hour foreground budget ran out
-    // mid-job, or the system refused to let the job start again while the app was in the background
-    // — the second being the likelier of the two, since it needs only a process restart. Nothing
-    // here can tell them apart, and nothing needs to: the answer is the same.
-    WorkInfo.State.ENQUEUED ->
-        if (update.runAttemptCount > 0) {
-            ConversionState.Waiting(input)
-        } else {
-            ConversionState.Converting(input, 0)
-        }
-
-    WorkInfo.State.SUCCEEDED -> convertedFrom(update.outputData, input, fallbackSpec)
-
-    // A worker that dies before it can report anything leaves no output data at all — a
-    // foreground-service start refused after a process restart is one way — and an exception's
-    // message can be an empty string. Both would read as a failure with nothing said, so blank
-    // falls back like missing does.
-    WorkInfo.State.FAILED -> ConversionState.Failed(
-        update.outputData.getString(ConversionWorker.KEY_ERROR)
-            ?.takeIf { it.isNotBlank() }
-            ?: ConversionWorker.GENERIC_FAILURE_MESSAGE,
-    )
-
-    WorkInfo.State.CANCELLED -> cancelled
-    WorkInfo.State.BLOCKED -> ConversionState.Converting(input, 0)
-}
-
-/**
- * The `SUCCEEDED` arm, which is the only one that reads more than one field.
- *
- * Split out so [conversionStateFrom] stays a table of one line per state. A success with no output
- * path is a failure: the job said it finished and named nothing, and there is no file to offer.
- */
-@UnstableApi
-private fun convertedFrom(outputData: Data, input: InputFile, fallbackSpec: OutputSpec): ConversionState {
-    val path = outputData.getString(ConversionWorker.KEY_OUTPUT_PATH)
-        ?: return ConversionState.Failed(SUCCEEDED_WITHOUT_A_FILE_MESSAGE)
-    return ConversionState.Converted(
-        input = input,
-        staged = File(path),
-        engineUsed = outputData.getString(ConversionWorker.KEY_ENGINE_USED).orEmpty(),
-        routeReason = outputData.getString(ConversionWorker.KEY_ROUTE_REASON).orEmpty(),
-        // Work enqueued before the worker reported this carries nothing, and WorkManager keeps
-        // finished work for about a week -- so this branch is ordinary for a few days rather than a
-        // corner. It is the old derivation, kept because it is the same guess the app already made
-        // and there is genuinely nothing better available for such a job. New work never reaches it.
-        suggestedName = outputData.getString(ConversionWorker.KEY_SUGGESTED_NAME)
-            ?.takeIf { it.isNotBlank() }
-            ?: ConversionWorker.outputNameFor(input.displayName, fallbackSpec),
-        mimeType = outputData.getString(ConversionWorker.KEY_MIME_TYPE)
-            ?.takeIf { it.isNotBlank() }
-            ?: fallbackSpec.mimeType,
-    )
-}
-
-/** A job that reported success and named no file. There is nothing to offer the user to save. */
-internal const val SUCCEEDED_WITHOUT_A_FILE_MESSAGE: String =
-    "Conversion reported success but produced no file."
-
 sealed interface ConversionState {
     data object Idle : ConversionState
     data class Ready(val input: InputFile) : ConversionState
@@ -556,24 +442,75 @@ class ConversionViewModel @JvmOverloads constructor(
                 // that either. The state and `pendingStaged` are meant to refer to the same file
                 // or to no file, and this is where that stays true.
                 if (!ownership.stillHeldBy(token)) return@collect
-                val next = conversionStateFrom(
-                    ConversionUpdate(
-                        state = info.state,
-                        progressPercent = info.progress.getInt(ConversionWorker.KEY_PROGRESS, 0),
-                        runAttemptCount = info.runAttemptCount,
-                        outputData = info.outputData,
-                    ),
-                    input = input,
-                    cancelled = cancelled,
-                    fallbackSpec = _settings.value.spec,
-                )
-                // Take responsibility for the file at the same moment the state starts referring
-                // to it, so the two cannot disagree. Read off the result rather than assigned
-                // inside the mapping: `Converted` is the only state that carries a staged file, so
-                // "the state and `pendingStaged` refer to the same file or to no file" is now the
-                // shape of the code rather than a rule two branches have to keep.
-                if (next is ConversionState.Converted) pendingStaged = next.staged
-                _state.value = next
+                _state.value = when (info.state) {
+                    WorkInfo.State.RUNNING -> ConversionState.Converting(
+                        input,
+                        info.progress.getInt(ConversionWorker.KEY_PROGRESS, 0),
+                    )
+
+                    // ENQUEUED after a run means a retry is pending. Either the six-hour
+                    // foreground budget ran out mid-job, or the system refused to let the job
+                    // start again while the app was in the background — the second being the
+                    // likelier of the two, since it needs only a process restart. Nothing here
+                    // can tell them apart, and nothing needs to: the answer is the same.
+                    WorkInfo.State.ENQUEUED ->
+                        if (info.runAttemptCount > 0) {
+                            ConversionState.Waiting(input)
+                        } else {
+                            ConversionState.Converting(input, 0)
+                        }
+
+                    WorkInfo.State.SUCCEEDED -> {
+                        val path = info.outputData.getString(ConversionWorker.KEY_OUTPUT_PATH)
+                        if (path == null) {
+                            ConversionState.Failed("Conversion reported success but produced no file.")
+                        } else {
+                            val staged = File(path)
+                            // Take responsibility for the file at the same moment the state
+                            // starts referring to it, so the two cannot disagree.
+                            pendingStaged = staged
+                            ConversionState.Converted(
+                                input = input,
+                                staged = staged,
+                                engineUsed = info.outputData
+                                    .getString(ConversionWorker.KEY_ENGINE_USED).orEmpty(),
+                                routeReason = info.outputData
+                                    .getString(ConversionWorker.KEY_ROUTE_REASON).orEmpty(),
+                                suggestedName = info.outputData
+                                    .getString(ConversionWorker.KEY_SUGGESTED_NAME)
+                                    ?.takeIf { it.isNotBlank() }
+                                    // Work enqueued before the worker reported this carries
+                                    // nothing, and WorkManager keeps finished work for about a
+                                    // week -- so this branch is ordinary for a few days rather
+                                    // than a corner. It is the old derivation, kept because it is
+                                    // the same guess the app already made and there is genuinely
+                                    // nothing better available for such a job. New work never
+                                    // reaches it.
+                                    ?: ConversionWorker.outputNameFor(
+                                        input.displayName,
+                                        _settings.value.spec,
+                                    ),
+                                mimeType = info.outputData
+                                    .getString(ConversionWorker.KEY_MIME_TYPE)
+                                    ?.takeIf { it.isNotBlank() }
+                                    ?: _settings.value.spec.mimeType,
+                            )
+                        }
+                    }
+
+                    // A worker that dies before it can report anything leaves no output data at
+                    // all — a foreground-service start refused after a process restart is one
+                    // way — and an exception's message can be an empty string. Both would read
+                    // as a failure with nothing said, so blank falls back like missing does.
+                    WorkInfo.State.FAILED -> ConversionState.Failed(
+                        info.outputData.getString(ConversionWorker.KEY_ERROR)
+                            ?.takeIf { it.isNotBlank() }
+                            ?: "Conversion failed.",
+                    )
+
+                    WorkInfo.State.CANCELLED -> cancelled
+                    WorkInfo.State.BLOCKED -> ConversionState.Converting(input, 0)
+                }
             }
         }
     }
@@ -628,7 +565,7 @@ class ConversionViewModel @JvmOverloads constructor(
                 // than a fresh handle for the second failure's sake: a retry that fails again
                 // lands back here still carrying the file, not on a bare Failed that would take
                 // the offer away.
-                _state.value = ConversionState.Failed(e.message ?: SAVE_FAILED_MESSAGE, pending)
+                _state.value = ConversionState.Failed(e.message ?: "Could not save the file.", pending)
             }
         }
     }
@@ -673,23 +610,13 @@ class ConversionViewModel @JvmOverloads constructor(
         else -> null
     }
 
-    /**
-     * The input `convert()` may act on, which is only ever the one on a `Ready` screen.
-     *
-     * This used to answer for `Converting`, `Waiting` and `Converted` as well. Those arms were not
-     * reachable by tapping Convert -- the button renders only in the `Ready` branch -- but they
-     * were reachable through the POST_NOTIFICATIONS **result**, which `ConverterScreen.kt:91` wires
-     * to `convert()` rather than to the button. Reaching one of them enqueued a *second* job over a
-     * live one: `activeWorkId` was overwritten, and the first job kept running with its foreground
-     * notification orphaned and nothing left holding its id to cancel it.
-     *
-     * Narrowed under #202 rather than tested as it stood, because a test written against the old
-     * shape would have frozen the double-enqueue as intended behaviour -- the F1/F5 failure mode.
-     *
-     * `JoinViewModel.join()` has been `(_state.value as? JoinState.Ready)?.inputs ?: return` all
-     * along. The two screens are the same shape and only one of them was over-general.
-     */
-    private fun currentInput(): InputFile? = (_state.value as? ConversionState.Ready)?.input
+    private fun currentInput(): InputFile? = when (val s = _state.value) {
+        is ConversionState.Ready -> s.input
+        is ConversionState.Converting -> s.input
+        is ConversionState.Waiting -> s.input
+        is ConversionState.Converted -> s.input
+        else -> null
+    }
 
     private companion object {
         /**

app/src/main/java/org/libremediaconverter/convert/ConverterScreen.kt

@@ -94,61 +94,24 @@ fun ConverterScreen(modifier: Modifier = Modifier, viewModel: ConversionViewMode
         state = state,
         settings = settings,
         validation = validation,
-        actions = converterActions(
-            viewModel = viewModel,
+        actions = ConverterActions(
             onPickInput = { pickInput.launch(arrayOf("*/*")) },
+            onPreset = viewModel::setPreset,
+            onContainer = viewModel::setContainer,
+            onVideoCodec = viewModel::setVideoCodec,
+            onAudioCodec = viewModel::setAudioCodec,
+            onSuggestion = viewModel::applySuggestion,
+            onQuality = viewModel::setQuality,
+            onEnginePreference = viewModel::setEnginePreference,
             onConvert = { requestNotifications.launch(Manifest.permission.POST_NOTIFICATIONS) },
+            onCancel = viewModel::cancel,
             onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
+            onReset = viewModel::reset,
         ),
         modifier = modifier,
     )
 }
 
-/**
- * Which of the ViewModel's methods each affordance on the screen calls.
- *
- * ## Why this is a function rather than an argument list
- *
- * It was an argument list, inside [ConverterScreen], which no test reached: `ConverterScreenContent`
- * builds its own [ConverterActions], so every test in the suite drove the stateless inner and none
- * of them ever saw the wiring.
- *
- * Most of the list is safe without a test, and saying so is more useful than pretending otherwise:
- * `onContainer`, `onVideoCodec`, `onAudioCodec`, `onPreset`, `onSuggestion`, `onQuality` and
- * `onEnginePreference` each take a distinct type, so binding one to another's setter does not
- * compile. Verified rather than assumed — swapping `onVideoCodec` and `onAudioCodec` fails with
- * *"Inapplicable candidate(s): fun setAudioCodec(codec: AudioCodec)"*.
- *
- * **[ConverterActions.onCancel] and [ConverterActions.onReset] are the exception.** Both are
- * `() -> Unit`, so swapping them compiles silently — also verified — and ships a Cancel button that
- * throws the conversion away and a Start-over button that leaves it on screen. That pair is what
- * `ConverterWiringTest` exists for.
- *
- * The three launcher-backed actions stay parameters: they need an `ActivityResultLauncher`, which
- * is the part that genuinely needs the composition, and keeping them out means the rest can be
- * checked without one.
- */
-@UnstableApi
-internal fun converterActions(
-    viewModel: ConversionViewModel,
-    onPickInput: () -> Unit,
-    onConvert: () -> Unit,
-    onSave: (suggestedName: String) -> Unit,
-): ConverterActions = ConverterActions(
-    onPickInput = onPickInput,
-    onPreset = viewModel::setPreset,
-    onContainer = viewModel::setContainer,
-    onVideoCodec = viewModel::setVideoCodec,
-    onAudioCodec = viewModel::setAudioCodec,
-    onSuggestion = viewModel::applySuggestion,
-    onQuality = viewModel::setQuality,
-    onEnginePreference = viewModel::setEnginePreference,
-    onConvert = onConvert,
-    onCancel = viewModel::cancel,
-    onSave = onSave,
-    onReset = viewModel::reset,
-)
-
 /**
  * Everything [ConverterScreenContent] can ask for, in one value.
  *

app/src/main/java/org/libremediaconverter/convert/MediaProbe.kt

@@ -50,42 +50,19 @@ object MediaProbe {
     )
 
     fun probe(context: Context, uri: Uri): InputProbe {
-        val merged = merge(probeWithExtractor(context, uri), probeWithFFprobe(context, uri))
-        if (merged.kind == InputKind.UNPARSEABLE) {
-            // Not a failure: an unparseable input is a strong signal that this job belongs on
-            // FFmpeg. Reporting an unknown codec makes the router say so.
-            Log.i(TAG, "Neither MediaExtractor nor FFprobe could read $uri; routing to FFmpeg.")
-        }
-        return merged
-    }
+        val extracted = probeWithExtractor(context, uri)
+        val info = probeWithFFprobe(context, uri)
 
-    /**
-     * What the two probes together say about one input.
-     *
-     * A pure function, and `internal` for the same reason [extractedFrom] is: the precedence rules
-     * below are the answer to "which probe wins", and until this was pulled out of [probe] the only
-     * way to ask was to have a real `MediaExtractor` and a real FFprobe **disagree**, which nothing
-     * on any source set can arrange. `RemuxTest` drives this on a device against committed
-     * fixtures, but only ever with one probe answering and the other agreeing or also failing --
-     * so every elvis here was taken in one direction and never the other.
-     *
-     * The rules, each of which is a decision rather than an accident:
-     *
-     * - **The extractor wins on codecs.** It is the platform's own view of what it can decode,
-     *   which is the thing the router is about to ask about. FFprobe's name for the same track can
-     *   differ, and the copy planner keys off these strings.
-     * - **FFprobe alone reports the container.** `MediaExtractor` cannot, which is why [InputProbe]
-     *   carries a nullable one and `CopyPlanner` treats null as "container unknown".
-     * - **Duration is the larger of the two**, not the first non-zero. Either probe can report zero
-     *   for a file the other times correctly, and a zero duration makes the FFmpeg progress
-     *   percentage undefined.
-     */
-    internal fun merge(extracted: Extracted?, info: FFprobeInfo?): InputProbe {
         val videoCodec = extracted?.videoCodec ?: info?.videoCodec
         val audioCodec = extracted?.audioCodec ?: info?.audioCodec
         val kind = classify(extracted, info)
 
-        if (kind == InputKind.UNPARSEABLE) return UNREADABLE
+        if (kind == InputKind.UNPARSEABLE) {
+            // Not a failure: an unparseable input is a strong signal that this job belongs on
+            // FFmpeg. Reporting an unknown codec makes the router say so.
+            Log.i(TAG, "Neither MediaExtractor nor FFprobe could read $uri; routing to FFmpeg.")
+            return UNREADABLE
+        }
 
         return InputProbe(
             videoCodec = videoCodec,
@@ -106,7 +83,7 @@ object MediaProbe {
      * audio file and a corrupt file indistinguishable. The source-info card cannot describe either
      * honestly until they are separate, and neither can the copy planner.
      */
-    internal fun classify(extracted: Extracted?, info: FFprobeInfo?): InputKind = when {
+    private fun classify(extracted: Extracted?, info: FFprobeInfo?): InputKind = when {
         info?.isImage == true -> InputKind.IMAGE
         extracted == null && info == null -> InputKind.UNPARSEABLE
         (extracted?.videoCodec ?: info?.videoCodec) != null -> InputKind.VIDEO
@@ -115,12 +92,7 @@ object MediaProbe {
         else -> InputKind.UNPARSEABLE
     }
 
-    /**
-     * `internal` rather than `private` so [extractedFrom] can be named from a test. The JVM test
-     * source set is a friend of `main`, so this stays invisible outside the module — the precedent
-     * is `MainActivity`'s `Destination`, and [containerFrom] beside it.
-     */
-    internal class Extracted(
+    private class Extracted(
         val videoCodec: String?,
         val audioCodec: String?,
         val durationMs: Long,
@@ -128,55 +100,33 @@ object MediaProbe {
         val height: Int,
     )
 
-    /**
-     * What a set of track formats says about a file.
-     *
-     * Split out of [probeWithExtractor] so the rules below can be tested against tracks a test
-     * *chooses*, rather than against whatever the committed fixtures happen to contain. The device
-     * tests exercise this through real files; none of them can construct a two-video-track input,
-     * a track that omits its duration, or an audio-before-video ordering on purpose.
-     *
-     * Three rules live here, and each is a decision rather than plumbing:
-     *
-     * - **First track of a type wins.** `video == null` is the whole guard. A file with two video
-     *   tracks must report the first, because that is the one an engine will transcode.
-     * - **Duration is the maximum across tracks**, not the first one found or the last. A file
-     *   whose audio outlasts its video is ordinary, and reporting the video's length would cut the
-     *   progress bar short.
-     * - **A track that omits `KEY_DURATION` contributes nothing** rather than zero. `MediaExtractor`
-     *   omits it for plenty of real tracks — see `MediaProbeTrackFieldsTest` — and `maxOf` against a
-     *   fabricated 0 would still be correct here, but reading a key that is absent is not.
-     */
-    internal fun extractedFrom(formats: List<MediaFormat>): Extracted {
-        var video: String? = null
-        var audio: String? = null
-        var durationUs = 0L
-        var width = 0
-        var height = 0
-
-        for (format in formats) {
-            val mime = format.getString(MediaFormat.KEY_MIME).orEmpty()
-            if (format.containsKey(MediaFormat.KEY_DURATION)) {
-                durationUs = maxOf(durationUs, format.getLong(MediaFormat.KEY_DURATION))
-            }
-            when {
-                mime.startsWith("video/") && video == null -> {
-                    video = shortName(mime)
-                    width = format.intOr(MediaFormat.KEY_WIDTH)
-                    height = format.intOr(MediaFormat.KEY_HEIGHT)
-                }
-
-                mime.startsWith("audio/") && audio == null -> audio = shortName(mime)
-            }
-        }
-        return Extracted(video, audio, durationUs / US_PER_MS, width, height)
-    }
-
     private fun probeWithExtractor(context: Context, uri: Uri): Extracted? {
         val extractor = MediaExtractor()
         return try {
             extractor.setDataSource(context, uri, null)
-            extractedFrom(extractor.trackFormats())
+            var video: String? = null
+            var audio: String? = null
+            var durationUs = 0L
+            var width = 0
+            var height = 0
+
+            for (i in 0 until extractor.trackCount) {
+                val format = extractor.getTrackFormat(i)
+                val mime = format.getString(MediaFormat.KEY_MIME).orEmpty()
+                if (format.containsKey(MediaFormat.KEY_DURATION)) {
+                    durationUs = maxOf(durationUs, format.getLong(MediaFormat.KEY_DURATION))
+                }
+                when {
+                    mime.startsWith("video/") && video == null -> {
+                        video = shortName(mime)
+                        width = format.intOr(MediaFormat.KEY_WIDTH)
+                        height = format.intOr(MediaFormat.KEY_HEIGHT)
+                    }
+
+                    mime.startsWith("audio/") && audio == null -> audio = shortName(mime)
+                }
+            }
+            Extracted(video, audio, durationUs / US_PER_MS, width, height)
         } catch (e: Exception) {
             Log.i(TAG, "Platform extractor could not read $uri.", e)
             null
@@ -185,11 +135,7 @@ object MediaProbe {
         }
     }
 
-    /**
-     * `internal` rather than `private` for the same reason [Extracted] is, and it should have been
-     * from the start: [merge] cannot be named from a test while half its signature is private.
-     */
-    internal class FFprobeInfo(
+    private class FFprobeInfo(
         val container: Container?,
         val videoCodec: String?,
         val audioCodec: String?,
@@ -221,39 +167,12 @@ object MediaProbe {
         null
     }
 
-    /**
-     * The thin edge: spawn FFprobe, hand what it said to [ffprobeInfoFrom].
-     *
-     * Everything device-bound is on this line and the null check under it. What FFprobe *said* is a
-     * `MediaInformation`, which is an ordinary object over a `JSONObject` — so the reading of it is
-     * a decision a test can choose the inputs for, and it lives below rather than here.
-     */
-    private fun readMediaInformation(path: String): FFprobeInfo? =
-        FFprobeKit.getMediaInformation(path).getMediaInformation()?.let(::ffprobeInfoFrom)
+    private fun readMediaInformation(path: String): FFprobeInfo? {
+        // ffmpeg-kit-next is compiled from Kotlin with private backing fields, so these have to go
+        // through the Java getters rather than property syntax.
+        val info: MediaInformation = FFprobeKit.getMediaInformation(path).getMediaInformation()
+            ?: return null
 
-    /**
-     * What FFprobe's answer means, as a function of the answer alone.
-     *
-     * `internal` for the same reason [Extracted] and [FFprobeInfo] are: a test cannot name it
-     * otherwise, and the JVM test source set is a friend of `main`.
-     *
-     * **JVM-safe, verified rather than assumed.** `javap` over the committed AAR's runtime jar:
-     * `MediaInformation(JSONObject, List<StreamInformation>, List<Chapter>)` and
-     * `StreamInformation(JSONObject)` are plain public constructors, and neither class's `<clinit>`
-     * touches the native library — so a test builds its own without `libffmpegkit` being present.
-     * That is the whole reason this split is worth making: `readMediaInformation` was 114 missed
-     * instructions and 24 missed branches, of which exactly one line needed a device.
-     *
-     * The subtle part is the **second argument to [containerFrom]**. `matroska,webm` is reported
-     * for both MKV and WebM — they share a demuxer — so the video codec is the only thing that
-     * separates them, and dropping it silently turns every VP9 WebM into an MKV. `containerFrom`
-     * has thirty-three covered branches of its own and none of them can notice that, because the
-     * mistake is at the call rather than in the callee.
-     *
-     * ffmpeg-kit-next is compiled from Kotlin with private backing fields, so these go through the
-     * Java getters rather than property syntax.
-     */
-    internal fun ffprobeInfoFrom(info: MediaInformation): FFprobeInfo {
         val streams = info.getStreams().orEmpty()
         val video = streams.firstOrNull { it.getType() == "video" }
         val audio = streams.firstOrNull { it.getType() == "audio" }
@@ -350,7 +269,25 @@ object MediaProbe {
         val extractor = MediaExtractor()
         return try {
             extractor.setDataSource(context, uri, null)
-            concatInputFrom(extractor.trackFormats())
+            var video: String? = null
+            var audio: String? = null
+            var width = 0
+            var height = 0
+            var fps = 0
+
+            for (i in 0 until extractor.trackCount) {
+                val format = extractor.getTrackFormat(i)
+                val mime = format.getString(MediaFormat.KEY_MIME).orEmpty()
+                if (mime.startsWith("video/") && video == null) {
+                    video = shortName(mime)
+                    width = format.intOr(MediaFormat.KEY_WIDTH)
+                    height = format.intOr(MediaFormat.KEY_HEIGHT)
+                    fps = format.intOr(MediaFormat.KEY_FRAME_RATE)
+                } else if (mime.startsWith("audio/") && audio == null) {
+                    audio = shortName(mime)
+                }
+            }
+            ConcatInput(video, audio, width, height, fps)
         } catch (e: Exception) {
             Log.i(TAG, "Could not probe $uri for concat; will re-encode.", e)
             ConcatInput(null, null, 0, 0, 0)
@@ -359,45 +296,6 @@ object MediaProbe {
         }
     }
 
-    /**
-     * The join flow's read of the same track formats. See [extractedFrom] for why this is separate
-     * from the extractor.
-     *
-     * Deliberately **not** folded into [extractedFrom] despite the overlap. This one reads frame
-     * rate and does not read duration; that one reads duration and does not read frame rate. A
-     * merged version would have to compute both for every caller, and `ConcatPlanner` treats an
-     * unknown frame rate as "cannot prove a match" — so a field this flow does not need must not
-     * start arriving as a number.
-     */
-    internal fun concatInputFrom(formats: List<MediaFormat>): ConcatInput {
-        var video: String? = null
-        var audio: String? = null
-        var width = 0
-        var height = 0
-        var fps = 0
-
-        for (format in formats) {
-            val mime = format.getString(MediaFormat.KEY_MIME).orEmpty()
-            if (mime.startsWith("video/") && video == null) {
-                video = shortName(mime)
-                width = format.intOr(MediaFormat.KEY_WIDTH)
-                height = format.intOr(MediaFormat.KEY_HEIGHT)
-                fps = format.intOr(MediaFormat.KEY_FRAME_RATE)
-            } else if (mime.startsWith("audio/") && audio == null) {
-                audio = shortName(mime)
-            }
-        }
-        return ConcatInput(video, audio, width, height, fps)
-    }
-
-    /**
-     * Every track format this extractor holds, read once.
-     *
-     * The thin edge the two pure functions above leave behind: a `trackCount` and a
-     * `getTrackFormat` per index, which is the whole of what needs a real `MediaExtractor`.
-     */
-    private fun MediaExtractor.trackFormats(): List<MediaFormat> = (0 until trackCount).map(::getTrackFormat)
-
     /**
      * One track property as an Int, or [fallback] when the format has no Int to give.
      *

app/src/main/java/org/libremediaconverter/convert/OutputPublisher.kt

@@ -24,20 +24,6 @@ const val STAGED_FILE_GONE_MESSAGE: String =
     "The finished file is no longer in the cache, so there is nothing left to save. " +
         "Start over to make it again."
 
-/**
- * What to tell the user when the copy into their chosen destination did not finish.
- *
- * A fallback, not the usual message: `publish` throws with a real reason most of the time — the
- * volume filled, the provider revoked the grant — and that reason is better than this. This is for
- * the exception that arrives with nothing to say, which would otherwise reach the screen as an
- * empty failure.
- *
- * Kept next to [STAGED_FILE_GONE_MESSAGE] for exactly the reason that one names: **both ViewModels
- * need it**, and saving is what it is about. It was written out twice before — `ConversionViewModel`
- * and `JoinViewModel` each carried their own copy of the literal, agreeing by coincidence.
- */
-const val SAVE_FAILED_MESSAGE: String = "Could not save the file."
-
 /**
  * A staged file that is still there to be saved, and everything the save dialog needs to offer it.
  *

app/src/main/java/org/libremediaconverter/convert/Transcoders.kt

@@ -4,7 +4,6 @@ import android.content.Context
 import android.net.Uri
 import androidx.media3.common.util.UnstableApi
 import org.libremediaconverter.codec.AndroidDeviceCodecs
-import org.libremediaconverter.ffmpeg.ConcatEngine
 import org.libremediaconverter.ffmpeg.FFmpegEngine
 import org.libremediaconverter.model.ConversionRequest
 import org.libremediaconverter.model.DeviceCodecs
@@ -41,27 +40,6 @@ interface SoftwareTranscoder {
     )
 }
 
-/**
- * The join path. Implemented by [org.libremediaconverter.ffmpeg.ConcatEngine].
- *
- * Added last of the three, and the gap it closes was measured rather than guessed:
- * `PerJobStagingTest`'s KDoc records that reverting `ConcatWorker` to a constant staging name left
- * all 257 tests green, because nothing in the JVM suite can get past a `ConcatEngine` constructed
- * in place. Everything after that line -- the failure mapping, the message fallback, the staged
- * delete -- was untested on every source set.
- *
- * The result type stays nested in the implementation rather than being lifted here. Moving it would
- * touch every call site to buy nothing: what a test needs is the ability to *not* run FFmpeg, and
- * that is the method, not the type.
- */
-interface ConcatJoiner {
-    suspend fun join(
-        inputs: List<Uri>,
-        output: File,
-        format: OutputFormat = OutputFormat.MP4_H264,
-    ): ConcatEngine.Result
-}
-
 /**
  * The seam that lets tests force failure paths.
  *
@@ -91,9 +69,6 @@ object ConversionDependencies {
     @Volatile
     var software: () -> SoftwareTranscoder = { FFmpegEngine() }
 
-    @Volatile
-    var concat: (Context) -> ConcatJoiner = { ConcatEngine(it) }
-
     @Volatile
     var publisher: (Context) -> OutputPublisher = { OutputPublisher(it) }
 
@@ -128,7 +103,6 @@ object ConversionDependencies {
     fun reset() {
         hardware = { Media3Engine(it) }
         software = { FFmpegEngine() }
-        concat = { ConcatEngine(it) }
         publisher = { OutputPublisher(it) }
         deviceCodecs = { AndroidDeviceCodecs.get() }
         probe = { context, uri -> MediaProbe.probe(context, uri) }

app/src/main/java/org/libremediaconverter/ffmpeg/ConcatEngine.kt

@@ -5,8 +5,8 @@ import android.net.Uri
 import android.util.Log
 import com.arthenica.ffmpegkit.FFmpegKit
 import com.arthenica.ffmpegkit.FFmpegKitConfig
+import com.arthenica.ffmpegkit.ReturnCode
 import kotlinx.coroutines.suspendCancellableCoroutine
-import org.libremediaconverter.convert.ConcatJoiner
 import org.libremediaconverter.convert.MediaProbe
 import org.libremediaconverter.convert.StagingNames
 import org.libremediaconverter.model.ConcatPlanner
@@ -24,11 +24,11 @@ import kotlin.coroutines.resumeWithException
  * reliably fail when they differ — it can emit a file whose later segments are
  * garbled. See [ConcatPlanner].
  */
-class ConcatEngine(private val context: Context) : ConcatJoiner {
+class ConcatEngine(private val context: Context) {
 
     data class Result(val strategy: ConcatStrategy, val output: File)
 
-    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): Result {
+    suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat = OutputFormat.MP4_H264): Result {
         require(inputs.size >= 2) { "Joining needs at least two files." }
 
         val paths = inputs.map { uri ->
@@ -65,16 +65,16 @@ class ConcatEngine(private val context: Context) : ConcatJoiner {
     private suspend fun execute(args: List<String>) = suspendCancellableCoroutine { cont ->
         Log.i(TAG, "ffmpeg ${args.joinToString(" ")}")
         val session = FFmpegKit.executeWithArgumentsAsync(args.toTypedArray()) { completed ->
-            val outcome = sessionOutcome(
-                rc = completed.getReturnCode(),
-                prefix = "Joining",
-                failStackTrace = { completed.getFailStackTrace() },
-                logTail = { completed.getAllLogsAsString(LOG_TAIL_LIMIT) },
-            )
-            when (outcome) {
-                SessionOutcome.Success -> cont.resume(Unit)
-                SessionOutcome.Cancelled -> cont.cancel()
-                is SessionOutcome.Failed -> cont.resumeWithException(FFmpegEngine.FFmpegException(outcome.message))
+            val rc = completed.getReturnCode()
+            when {
+                ReturnCode.isSuccess(rc) -> cont.resume(Unit)
+                ReturnCode.isCancel(rc) -> cont.cancel()
+                else -> cont.resumeWithException(
+                    FFmpegEngine.FFmpegException(
+                        "Joining failed (${rc?.value}): " +
+                            completed.getAllLogsAsString(LOG_TAIL_LIMIT).orEmpty(),
+                    ),
+                )
             }
         }
         cont.invokeOnCancellation { FFmpegKit.cancel(session.getSessionId()) }

app/src/main/java/org/libremediaconverter/ffmpeg/FFmpegEngine.kt

@@ -4,6 +4,7 @@ import android.util.Log
 import com.arthenica.ffmpegkit.FFmpegKit
 import com.arthenica.ffmpegkit.FFmpegKitConfig
 import com.arthenica.ffmpegkit.Level
+import com.arthenica.ffmpegkit.ReturnCode
 import kotlinx.coroutines.suspendCancellableCoroutine
 import org.libremediaconverter.convert.SoftwareTranscoder
 import org.libremediaconverter.model.ConversionRequest
@@ -50,16 +51,19 @@ class FFmpegEngine : SoftwareTranscoder {
         val session = FFmpegKit.executeWithArgumentsAsync(
             args.toTypedArray(),
             { completed ->
-                val outcome = sessionOutcome(
-                    rc = completed.getReturnCode(),
-                    prefix = "FFmpeg",
-                    failStackTrace = { completed.getFailStackTrace() },
-                    logTail = { completed.getAllLogsAsString(LOG_TAIL_LIMIT) },
-                )
-                when (outcome) {
-                    SessionOutcome.Success -> cont.resume(Unit)
-                    SessionOutcome.Cancelled -> cont.cancel()
-                    is SessionOutcome.Failed -> cont.resumeWithException(FFmpegException(outcome.message))
+                val rc = completed.getReturnCode()
+                when {
+                    ReturnCode.isSuccess(rc) -> cont.resume(Unit)
+                    ReturnCode.isCancel(rc) ->
+                        cont.cancel()
+                    else -> cont.resumeWithException(
+                        FFmpegException(
+                            "FFmpeg failed (${rc?.value}): " +
+                                completed.getFailStackTrace().orEmpty().ifBlank {
+                                    completed.getAllLogsAsString(LOG_TAIL_LIMIT).orEmpty()
+                                },
+                        ),
+                    )
                 }
             },
             { log -> Log.d(TAG, log.message.trimEnd()) },

app/src/main/java/org/libremediaconverter/ffmpeg/SessionOutcome.kt

@@ -1,54 +0,0 @@
-package org.libremediaconverter.ffmpeg
-
-import com.arthenica.ffmpegkit.ReturnCode
-
-/**
- * What a finished FFmpegKit session means, as a function of its return code.
- *
- * Both engines had their own copy of this `when`, twelve lines apart in two files, and the copies
- * had drifted: [FFmpegEngine] preferred the fail stack trace and fell back to the log tail, while
- * [ConcatEngine] only ever read the log tail. Neither was tested — both live inside a callback
- * handed to `FFmpegKit`, which does not run on the JVM — so the divergence was invisible.
- *
- * #203 decided to unify on the stack trace, so a join failure now carries the diagnostics a
- * conversion failure always did. The *prefix* stays per-engine: unifying the strategy must not
- * unify the sentence, since "FFmpeg failed" and "Joining failed" describe different jobs.
- */
-internal sealed interface SessionOutcome {
-
-    /** rc 0. The suspension resumes normally. */
-    data object Success : SessionOutcome
-
-    /** rc 255. The suspension is cancelled rather than failed — the user asked for this. */
-    data object Cancelled : SessionOutcome
-
-    /** Anything else, with the sentence the user is shown. */
-    data class Failed(val message: String) : SessionOutcome
-}
-
-/**
- * Maps a return code onto the outcome, and builds the failure sentence when there is one.
- *
- * **The two message parts arrive as lambdas, deliberately.** `getAllLogsAsString` and
- * `getFailStackTrace` are calls onto a native session, and only the failure arm needs either. Taking
- * them by value would put both on the happy path of every successful conversion, which is a cost the
- * shape this replaced did not have — the old code read them inside the `else` branch. That is the
- * same reason [org.libremediaconverter.codec.AndroidDeviceCodecs.capabilitiesFrom] takes a
- * `Sequence`: a seam should not change what runs when.
- *
- * A null [rc] is a real input rather than a defensive one — `getReturnCode()` is nullable, and a
- * session killed before it reported anything has none. It is neither success nor cancellation, so
- * it fails, and the sentence says `null` where the number would be.
- */
-internal fun sessionOutcome(
-    rc: ReturnCode?,
-    prefix: String,
-    failStackTrace: () -> String?,
-    logTail: () -> String?,
-): SessionOutcome = when {
-    ReturnCode.isSuccess(rc) -> SessionOutcome.Success
-    ReturnCode.isCancel(rc) -> SessionOutcome.Cancelled
-    else -> SessionOutcome.Failed(
-        "$prefix failed (${rc?.value}): " + failStackTrace().orEmpty().ifBlank { logTail().orEmpty() },
-    )
-}

app/src/main/java/org/libremediaconverter/join/JoinScreen.kt

@@ -56,38 +56,17 @@ fun JoinScreen(modifier: Modifier = Modifier, viewModel: JoinViewModel = viewMod
 
     JoinScreenContent(
         state = state,
-        actions = joinActions(
-            viewModel = viewModel,
+        actions = JoinActions(
             onPickInputs = { pickInputs.launch(arrayOf("video/*")) },
+            onJoin = viewModel::join,
+            onCancel = viewModel::cancel,
             onSave = { suggestedName -> chooseDestination.launch(suggestedName) },
+            onReset = viewModel::reset,
         ),
         modifier = modifier,
     )
 }
 
-/**
- * Which of the ViewModel's methods each affordance on the join screen calls.
- *
- * The join-side twin of `converterActions`, and the transposition risk here is worse: **three**
- * `() -> Unit` bindings rather than two. `onJoin`, `onCancel` and `onReset` are mutually
- * interchangeable as far as the compiler is concerned, so a Join button that cancels, or a Cancel
- * button that starts the job, is a swap nothing but a test would catch.
- *
- * See `converterActions` for why the launcher-backed actions stay parameters.
- */
-@UnstableApi
-internal fun joinActions(
-    viewModel: JoinViewModel,
-    onPickInputs: () -> Unit,
-    onSave: (suggestedName: String) -> Unit,
-): JoinActions = JoinActions(
-    onPickInputs = onPickInputs,
-    onJoin = viewModel::join,
-    onCancel = viewModel::cancel,
-    onSave = onSave,
-    onReset = viewModel::reset,
-)
-
 /**
  * Everything [JoinScreenContent] can ask for, in one value.
  *

app/src/main/java/org/libremediaconverter/join/JoinViewModel.kt

@@ -5,7 +5,6 @@ import android.net.Uri
 import androidx.lifecycle.AndroidViewModel
 import androidx.lifecycle.viewModelScope
 import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
 import androidx.work.WorkInfo
 import androidx.work.WorkManager
 import kotlinx.coroutines.CoroutineDispatcher
@@ -20,7 +19,6 @@ import org.libremediaconverter.convert.ConversionDependencies
 import org.libremediaconverter.convert.InputFile
 import org.libremediaconverter.convert.InputQuery
 import org.libremediaconverter.convert.PendingSave
-import org.libremediaconverter.convert.SAVE_FAILED_MESSAGE
 import org.libremediaconverter.convert.STAGED_FILE_GONE_MESSAGE
 import org.libremediaconverter.convert.ScreenOwnership
 import org.libremediaconverter.model.ConcatStrategy
@@ -31,108 +29,6 @@ import org.libremediaconverter.work.jobSnapshots
 import java.io.File
 import java.util.UUID
 
-/**
- * One update about a running join, as WorkManager last reported it.
- *
- * The join-side twin of `ConversionUpdate`, and deliberately the same shape: this pair of seams is
- * one refactor done twice, and letting them diverge would make the two flows harder to compare than
- * the duplication costs. There is no `progressPercent` here because `ConcatWorker` publishes none —
- * a join is indeterminate.
- */
-internal data class JoinUpdate(val state: WorkInfo.State, val runAttemptCount: Int, val outputData: Data)
-
-/**
- * What the join screen should show, given what WorkManager last said about the job.
- *
- * The join-side twin of `conversionStateFrom`, extracted for the same reason and with the same two
- * exclusions: the ownership check stays at the call site, and this takes no responsibility for the
- * staged file. See that function's KDoc for the argument in full.
- *
- * Five arms had never been chosen by any test before this was cut out, because a real `ConcatWorker`
- * only ever produces a terminal state with well-formed output.
- *
- * @param cancelled where a cancellation lands, which differs for a reattached job — see [observe].
- */
-@UnstableApi
-internal fun joinStateFrom(update: JoinUpdate, inputs: List<InputFile>, cancelled: JoinState): JoinState =
-    when (update.state) {
-        // BLOCKED is a job waiting on a prerequisite, which the user has nothing to do about and
-        // nothing useful to be told about. It reads as "starting", like a fresh ENQUEUED.
-        WorkInfo.State.RUNNING, WorkInfo.State.BLOCKED -> JoinState.Joining(inputs)
-
-        // ENQUEUED after a run means a retry is pending -- the same rule, and the same reasoning, as
-        // the convert side. See `conversionStateFrom`.
-        WorkInfo.State.ENQUEUED ->
-            if (update.runAttemptCount > 0) {
-                JoinState.Waiting(inputs)
-            } else {
-                JoinState.Joining(inputs)
-            }
-
-        WorkInfo.State.SUCCEEDED -> joinedFrom(update.outputData)
-
-        // A worker that dies before it can report anything leaves no output data at all, and an
-        // exception's message can be an empty string. Both would read as a failure with nothing said,
-        // so blank falls back like missing does.
-        WorkInfo.State.FAILED -> JoinState.Failed(
-            update.outputData.getString(ConcatWorker.KEY_ERROR)
-                ?.takeIf { it.isNotBlank() }
-                ?: ConcatWorker.GENERIC_FAILURE_MESSAGE,
-        )
-
-        WorkInfo.State.CANCELLED -> cancelled
-    }
-
-/**
- * The `SUCCEEDED` arm. A join that reported success and named no file has nothing to offer.
- */
-@UnstableApi
-private fun joinedFrom(outputData: Data): JoinState {
-    val path = outputData.getString(ConcatWorker.KEY_OUTPUT_PATH)
-        ?: return JoinState.Failed(JOINED_WITHOUT_A_FILE_MESSAGE)
-    return JoinState.Joined(
-        staged = File(path),
-        strategy = strategyFrom(outputData.getString(ConcatWorker.KEY_STRATEGY)),
-        // A join enqueued before the worker reported these carries neither, and the fallback is
-        // the format such a job really used -- ConcatWorker.request has always defaulted to it,
-        // and the join screen has never offered a choice.
-        suggestedName = outputData.getString(ConcatWorker.KEY_SUGGESTED_NAME)
-            ?.takeIf { it.isNotBlank() }
-            ?: ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT),
-        mimeType = outputData.getString(ConcatWorker.KEY_MIME_TYPE)
-            ?.takeIf { it.isNotBlank() }
-            ?: ConcatWorker.DEFAULT_FORMAT.mimeType,
-    )
-}
-
-/**
- * The strategy a finished join reported, or [ConcatStrategy.REENCODE] when it named none.
- *
- * **Looked up rather than `valueOf`, and that is a fix rather than a style choice.** `valueOf`
- * throws `IllegalArgumentException` on a name this build does not define, and this runs inside a
- * `viewModelScope` collect with no handler -- so the throw does not become a `Failed` state, it
- * takes the process down.
- *
- * Reachable for the reason `WorkerEnumFallbackTest` and `JobTags` are both written on: WorkManager
- * keeps finished work for about a week, so a downgrade or a rollback hands this build a job
- * enqueued by another one. `ConcatWorker` writes `result.strategy.name` into the output `Data`, so
- * a build that added a third strategy would leave this one crashing on its own completed joins.
- *
- * `ConcatWorker.kt` already made exactly this change for `KEY_FORMAT`, and says why in as many
- * words: *"Looked up rather than `valueOf` … a format name this build does not define used to throw
- * past the catch."* The same read on this side had not been changed with it.
- *
- * REENCODE is the safe default rather than an arbitrary one: it is the answer for inputs that do
- * not match, so a job whose strategy cannot be read is described as the more conservative of the
- * two rather than being claimed as a lossless stream copy.
- */
-private fun strategyFrom(name: String?): ConcatStrategy =
-    ConcatStrategy.entries.firstOrNull { it.name == name } ?: ConcatStrategy.REENCODE
-
-/** A join that reported success and named no file. There is nothing to offer the user to save. */
-internal const val JOINED_WITHOUT_A_FILE_MESSAGE: String =
-    "Joining reported success but produced no file."
-
 sealed interface JoinState {
     data object Idle : JoinState
     data class Ready(val inputs: List<InputFile>) : JoinState
@@ -298,7 +194,7 @@ class JoinViewModel @JvmOverloads constructor(
     fun onInputsPicked(uris: List<Uri>) {
         val token = ownership.claim()
         if (uris.size < 2) {
-            _state.value = JoinState.Failed(ConcatWorker.TOO_FEW_INPUTS_MESSAGE)
+            _state.value = JoinState.Failed("Pick at least two files to join.")
             return
         }
         viewModelScope.launch {
@@ -354,19 +250,56 @@ class JoinViewModel @JvmOverloads constructor(
                 // takes ownership of the staged file, and a superseded observation must not do
                 // that either.
                 if (!ownership.stillHeldBy(token)) return@collect
-                val next = joinStateFrom(
-                    JoinUpdate(
-                        state = info.state,
-                        runAttemptCount = info.runAttemptCount,
-                        outputData = info.outputData,
-                    ),
-                    inputs = inputs,
-                    cancelled = cancelled,
-                )
-                // Read off the result rather than assigned inside the mapping -- see the same
-                // three lines in ConversionViewModel for why that is the better half of the swap.
-                if (next is JoinState.Joined) pendingStaged = next.staged
-                _state.value = next
+                _state.value = when (info.state) {
+                    WorkInfo.State.RUNNING, WorkInfo.State.BLOCKED -> JoinState.Joining(inputs)
+                    WorkInfo.State.ENQUEUED ->
+                        if (info.runAttemptCount > 0) {
+                            JoinState.Waiting(inputs)
+                        } else {
+                            JoinState.Joining(inputs)
+                        }
+
+                    WorkInfo.State.SUCCEEDED -> {
+                        val path = info.outputData.getString(ConcatWorker.KEY_OUTPUT_PATH)
+                        val strategy = info.outputData.getString(ConcatWorker.KEY_STRATEGY)
+                            ?.let(ConcatStrategy::valueOf) ?: ConcatStrategy.REENCODE
+                        if (path == null) {
+                            JoinState.Failed("Joining reported success but produced no file.")
+                        } else {
+                            val staged = File(path)
+                            // Take responsibility for the file at the same moment the state
+                            // starts referring to it, so the two cannot disagree.
+                            pendingStaged = staged
+                            JoinState.Joined(
+                                staged = staged,
+                                strategy = strategy,
+                                // A join enqueued before the worker reported these carries
+                                // neither, and the fallback is the format such a job really
+                                // used -- ConcatWorker.request has always defaulted to it, and
+                                // the join screen has never offered a choice.
+                                suggestedName = info.outputData
+                                    .getString(ConcatWorker.KEY_SUGGESTED_NAME)
+                                    ?.takeIf { it.isNotBlank() }
+                                    ?: ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT),
+                                mimeType = info.outputData
+                                    .getString(ConcatWorker.KEY_MIME_TYPE)
+                                    ?.takeIf { it.isNotBlank() }
+                                    ?: ConcatWorker.DEFAULT_FORMAT.mimeType,
+                            )
+                        }
+                    }
+
+                    // A worker that dies before it can report anything leaves no output data at
+                    // all, and an exception's message can be an empty string. Both would read as
+                    // a failure with nothing said, so blank falls back like missing does.
+                    WorkInfo.State.FAILED -> JoinState.Failed(
+                        info.outputData.getString(ConcatWorker.KEY_ERROR)
+                            ?.takeIf { it.isNotBlank() }
+                            ?: "Joining failed.",
+                    )
+
+                    WorkInfo.State.CANCELLED -> cancelled
+                }
             }
         }
     }
@@ -413,7 +346,7 @@ class JoinViewModel @JvmOverloads constructor(
                 // than leaving "Start over" -- which deletes it -- as the only thing on offer.
                 // Passing `pending` rather than rebuilding it is what keeps a retry that fails
                 // again on a carrying Failed instead of a bare one.
-                _state.value = JoinState.Failed(e.message ?: SAVE_FAILED_MESSAGE, pending)
+                _state.value = JoinState.Failed(e.message ?: "Could not save the file.", pending)
             }
         }
     }

app/src/main/java/org/libremediaconverter/ui/TestTags.kt

@@ -56,20 +56,6 @@ object TestTags {
      */
     const val RETRY_SAVE: String = "action.retrySave"
 
-    /**
-     * The adaptive shell around both screens -- `AppRoot`'s two layouts.
-     *
-     * Named because there is no other way to tell them apart from a test. Both render the same two
-     * destinations with the same labels and the same selection state, so every assertion that could
-     * be written without these tags is satisfied by either layout, and transposing the two bodies
-     * passed the whole suite. Exactly one of the two exists at a time, which is what makes
-     * `assertExists` / `assertDoesNotExist` on this pair a statement about the width class.
-     */
-    object Shell {
-        const val NAVIGATION_RAIL: String = "shell.navigationRail"
-        const val NAVIGATION_BAR: String = "shell.navigationBar"
-    }
-
     /** `ConverterScreen`. */
     object Converter {
         const val CHOOSE_FILE: String = "converter.chooseFile"

app/src/main/java/org/libremediaconverter/work/ConcatWorker.kt

@@ -15,6 +15,7 @@ import kotlinx.coroutines.CancellationException
 import org.libremediaconverter.convert.ConversionDependencies
 import org.libremediaconverter.convert.InputQuery
 import org.libremediaconverter.convert.StagingNames
+import org.libremediaconverter.ffmpeg.ConcatEngine
 import org.libremediaconverter.model.OutputFormat
 
 /**
@@ -36,9 +37,9 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
 
     override suspend fun doWork(): Result {
         val uris = inputData.getStringArray(KEY_INPUT_URIS)?.map(Uri::parse)
-            ?: return Result.failure(workDataOf(KEY_ERROR to NO_INPUTS_MESSAGE))
+            ?: return Result.failure(workDataOf(KEY_ERROR to "No input files."))
         if (uris.size < 2) {
-            return Result.failure(workDataOf(KEY_ERROR to TOO_FEW_INPUTS_MESSAGE))
+            return Result.failure(workDataOf(KEY_ERROR to "Pick at least two files to join."))
         }
         // Absent, not zero, when the picker could not size every input -- see the same read in
         // ConversionWorker and InputQuery for why the two are no longer one number.
@@ -76,7 +77,7 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
                 ),
             )
 
-            val result = ConversionDependencies.concat(applicationContext).join(uris, staged, format)
+            val result = ConcatEngine(applicationContext).join(uris, staged, format)
             Result.success(
                 workDataOf(
                     KEY_OUTPUT_PATH to staged.absolutePath,
@@ -106,7 +107,7 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
                 }
                 FailureOutcome.FAIL -> {
                     Log.e(TAG, "Joining failed.", e)
-                    Result.failure(workDataOf(KEY_ERROR to (e.message ?: GENERIC_FAILURE_MESSAGE)))
+                    Result.failure(workDataOf(KEY_ERROR to (e.message ?: "Joining failed.")))
                 }
             }
         }
@@ -136,44 +137,6 @@ class ConcatWorker(context: Context, params: WorkerParameters) : CoroutineWorker
     )
 
     companion object {
-        /**
-         * What the user is told when a join arrives with fewer than two inputs.
-         *
-         * Shared with `JoinViewModel`, which refuses the same condition one layer up so the picker
-         * can answer without enqueueing anything. Two copies of this sentence existed before, and
-         * only the one here was pinned by a test (#139) — so the wording could drift on the screen
-         * without a single test noticing, for one message the user sees from one condition.
-         *
-         * Here rather than in the ViewModel because the rule is the worker's: `request(...)` takes
-         * a `List<Uri>` and checks nothing about its length, so this is the guard that always runs.
-         */
-        /**
-         * A job carrying no input array at all -- a downgrade, or a queue entry from a build that
-         * spelled the key differently.
-         *
-         * A constant rather than the literal it was, for the convention #158 established: a message
-         * the user can see is named once, so a test asserts the same string the worker writes
-         * rather than a copy of it that can drift.
-         */
-        const val NO_INPUTS_MESSAGE: String = "No input files."
-
-        const val TOO_FEW_INPUTS_MESSAGE: String = "Pick at least two files to join."
-
-        /**
-         * The last resort when a join fails and the exception says nothing.
-         *
-         * Shared with `JoinViewModel`, whose `FAILED` arm falls back to the same sentence when the
-         * output `Data` carries no error at all — a worker killed before it could write one. The two
-         * are a chain rather than a coincidence: this is what the worker puts *in* `KEY_ERROR`, and
-         * that is what the ViewModel says when `KEY_ERROR` never arrived. The user cannot tell the
-         * two apart and should not have to, so they are one sentence.
-         *
-         * The `Log.e` above deliberately keeps its own literal. A log line has a different audience
-         * and carries the exception with it; coupling it to the user-facing wording would mean
-         * rewording the screen to change a log.
-         */
-        const val GENERIC_FAILURE_MESSAGE: String = "Joining failed."
-
         const val KEY_INPUT_URIS = "input_uris"
         const val KEY_TOTAL_BYTES = "total_bytes"
         const val KEY_FORMAT = "format"

app/src/main/java/org/libremediaconverter/work/ConversionWorker.kt

@@ -313,7 +313,7 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
             }
             FailureOutcome.FAIL -> {
                 Log.e(TAG, "Conversion failed.", cause)
-                Result.failure(workDataOf(KEY_ERROR to (cause.message ?: GENERIC_FAILURE_MESSAGE)))
+                Result.failure(workDataOf(KEY_ERROR to (cause.message ?: "Conversion failed.")))
             }
         }
 
@@ -352,20 +352,6 @@ class ConversionWorker(context: Context, params: WorkerParameters) : CoroutineWo
     )
 
     companion object {
-        /**
-         * The last resort when a conversion fails and the exception says nothing.
-         *
-         * Shared with `ConversionViewModel`, whose `FAILED` arm falls back to the same sentence when
-         * the output `Data` carries no error — a worker killed before it could write one, which a
-         * refused foreground start after a process restart produces. The two are a chain rather than
-         * a coincidence: this is what goes *into* `KEY_ERROR`, and that is what is said when
-         * `KEY_ERROR` never arrived. The user cannot tell those apart and should not have to.
-         *
-         * See [ConcatWorker.GENERIC_FAILURE_MESSAGE] for the join-side twin, and the note there
-         * about why the neighbouring `Log.e` keeps its own literal.
-         */
-        const val GENERIC_FAILURE_MESSAGE: String = "Conversion failed."
-
         const val KEY_INPUT_URI = "input_uri"
         const val KEY_DISPLAY_NAME = "display_name"
         const val KEY_SIZE_BYTES = "size_bytes"

app/src/test/java/org/libremediaconverter/AdaptiveShellTest.kt

@@ -1,129 +0,0 @@
-package org.libremediaconverter
-
-import androidx.activity.ComponentActivity
-import androidx.compose.material3.windowsizeclass.WindowWidthSizeClass
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performClick
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import org.junit.After
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.ui.TestTags
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * Which navigation affordance the shell actually renders, and which screen it actually shows.
- *
- * Assertion gaps rather than coverage gaps, both of them, and that is why they lasted.
- * `AppRootRestorationTest` already drives `AppRoot` at `Compact` and `Expanded`, so JaCoCo is green
- * on `useRail` -- but it asserts only that the *selected tab* survives recreation, through a stub
- * `content` composable. Nothing anywhere queried for a rail or a bar, and nothing rendered the real
- * screens. Two consequences, both measured before this file existed:
- *
- * - **Transposing the `NavigationRail` and `NavigationBar` bodies passed the entire suite.**
- * - **Transposing `Content`'s two arms passed it too** -- a tablet showing the phone chrome, or the
- *   Convert tab opening the Join screen, and 546 tests with nothing to say about either.
- *
- * `AppRoot`'s own KDoc is why this matters more than it looks: from targetSdk 37 the app is resized
- * and rotated whether or not it is ready, so the width class is not a preference, it is whatever
- * the system hands over.
- *
- * ## Two things this needed that the rest of the suite does not
- *
- * **`createAndroidComposeRule`, not `createComposeRule`.** Rendering `AppRoot` with its *default*
- * content reaches `ConverterScreen`'s `viewModel = viewModel()`, which needs a
- * `ViewModelStoreOwner`; the plain rule supplies none. It works because both ViewModels are
- * `@JvmOverloads constructor(app: Application, …)`, so `AndroidViewModelFactory` can build them,
- * and because `app/build.gradle.kts` already puts `ui-test-manifest`'s `ComponentActivity` in the
- * merged manifest the unit tests build against -- which that file says in terms.
- *
- * **Tags on the two bars.** They are in `TestTags`, applied inside `main`, for the reason that
- * file's KDoc gives: a tag the test hands down proves only that the test set it.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class AdaptiveShellTest {
-
-    @get:Rule
-    val composeRule = createAndroidComposeRule<ComponentActivity>()
-
-    @Before
-    fun setUp() {
-        val app = RuntimeEnvironment.getApplication()
-        installTestWorkManager(app, Data.EMPTY)
-        // The real screens are composed here, so their ViewModels are real too. Neither test is
-        // about probing or publishing; left alone they would reach the FFprobe loader and this
-        // machine's codec list, and decide things no assertion mentions.
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `a phone gets the bottom bar and a tablet gets the rail`() {
-        setShell(WindowWidthSizeClass.Compact)
-
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertExists()
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertDoesNotExist()
-    }
-
-    @Test
-    fun `an expanded window gets the rail`() {
-        setShell(WindowWidthSizeClass.Expanded)
-
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertExists()
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertDoesNotExist()
-    }
-
-    /**
-     * The width class no test had ever passed.
-     *
-     * `useRail` is `!= Compact`, so Medium takes the rail with Expanded. Narrowing it to
-     * `== Expanded` is a one-character change that breaks every tablet and unfolded foldable and
-     * nothing else -- and until this test, nothing in either source set used `Medium` at all.
-     */
-    @Test
-    fun `a medium window is a rail window, not a phone`() {
-        setShell(WindowWidthSizeClass.Medium)
-
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_RAIL).assertExists()
-        composeRule.onNodeWithTag(TestTags.Shell.NAVIGATION_BAR).assertDoesNotExist()
-    }
-
-    /**
-     * The mapping every other test stubs out: which screen each destination actually opens.
-     *
-     * Matched on each screen's own "choose a file" affordance rather than on a title, because those
-     * tags are applied by the screens themselves -- so this fails if the destinations are
-     * transposed, and it fails for the right reason.
-     */
-    @Test
-    fun `Convert opens the converter and Join opens the join screen`() {
-        setShell(WindowWidthSizeClass.Compact)
-
-        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).assertExists()
-        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).assertDoesNotExist()
-
-        composeRule.onNodeWithText(Destination.JOIN.label).performClick()
-
-        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).assertExists()
-        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).assertDoesNotExist()
-    }
-
-    /** [AppRoot] with its real content, which is the half nothing else composes. */
-    private fun setShell(width: WindowWidthSizeClass) {
-        composeRule.setContent { AppRoot(width) }
-    }
-}

app/src/test/java/org/libremediaconverter/AppStartSweepTest.kt

@@ -1,8 +1,8 @@
 package org.libremediaconverter
 
-import kotlinx.coroutines.runBlocking
-import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -10,6 +10,7 @@ import org.libremediaconverter.convert.StagingSweep
 import org.robolectric.RobolectricTestRunner
 import org.robolectric.RuntimeEnvironment
 import java.io.File
+import java.util.concurrent.TimeUnit
 
 /**
  * That process start actually sweeps.
@@ -22,19 +23,8 @@ import java.io.File
  * output ever became a `Converted` state, a `reset()` whose delete was cancelled with the Activity.
  *
  * `onCreate()` is called again rather than a second Application being built: it is what the
- * framework calls at process start, and the scope it launches on is already there.
- *
- * **What this class stopped covering in #159, deliberately.** It used to open by asserting that
- * `RuntimeEnvironment.getApplication()` is a [LibreMediaConverterApp] — that the manifest's
- * `android:name` points here, so the sweep is code that actually runs. That assertion cannot exist
- * on the JVM any more: `robolectric.properties` now names [TestLibreMediaConverterApp] for the
- * whole suite, and an `application=` override replaces the manifest rather than being checked
- * against it — `applicationInfo.className` reports the override too, measured. So the manifest is
- * not merely unasserted here, it is unobservable from this source set, and a rewritten version of
- * that test would have asserted the override against itself. **The manifest link is a device-only
- * guarantee now**, and it was traded knowingly for the race that override fixes. The cast in
- * [setUp] still fails if [TestLibreMediaConverterApp] stops extending the real class, which is a
- * smaller claim than the one withdrawn.
+ * framework calls at process start, the scope it launches on is already there, and the first test
+ * below is what pins that the framework calls it on *this* class.
  */
 @RunWith(RobolectricTestRunner::class)
 class AppStartSweepTest {
@@ -44,35 +34,17 @@ class AppStartSweepTest {
 
     @Before
     fun setUp() {
+        // The cast is an assertion in itself: Robolectric builds the Application named in the
+        // merged manifest, so this fails if `android:name` ever stops pointing here -- in which
+        // case the sweep below would be perfectly correct code that never runs.
         app = RuntimeEnvironment.getApplication() as LibreMediaConverterApp
         stagingDir = File(app.cacheDir, "conversions").apply { mkdirs() }
         stagingDir.listFiles()?.forEach { it.delete() }
     }
 
-    /**
-     * The property the whole substitution exists for, asserted directly rather than waited on.
-     *
-     * #159 is not "the sweep is slow", it is "the sweep is still running while some later test
-     * reads the directory". [TestLibreMediaConverterApp] answers that by finishing the sweep before
-     * `onCreate()` returns, and this is the only place that claim is checked -- every other test in
-     * the suite benefits from it silently and would go back to racing without saying why.
-     *
-     * Deterministic in the direction that matters: `Dispatchers.Unconfined` runs a `launch` whose
-     * body never suspends to completion inline, so this cannot flake green-to-red. Putting the test
-     * app back on `Dispatchers.IO` makes it a race that the assertion loses essentially every time,
-     * which is what a six-run suite comparison could not show -- at the rate #159 was observed at,
-     * a clean six-run arm is a coin flip.
-     */
     @Test
-    fun `the sweep is finished before onCreate returns`() {
-        app.onCreate()
-
-        val sweep = app.startupSweep
-        assertNotNull("onCreate() started no sweep", sweep)
-        assertTrue(
-            "the JVM suite's sweep outlived onCreate(), so it is in flight during test bodies again",
-            sweep?.isCompleted == true,
-        )
+    fun `the application the manifest starts is the one that sweeps`() {
+        assertEquals(LibreMediaConverterApp::class.java, RuntimeEnvironment.getApplication().javaClass)
     }
 
     @Test
@@ -92,23 +64,35 @@ class AppStartSweepTest {
 
         app.onCreate()
 
-        // Joined rather than polled. `onCreate` publishes the sweep it started, so this waits for
-        // that exact sweep -- where a timed poll could not tell "swept" from "not started yet", and
-        // answered the second case by failing after ten seconds.
-        val sweep = app.startupSweep
-        assertNotNull("onCreate() started no sweep to wait for", sweep)
-        runBlocking { sweep?.join() }
-
-        assertTrue("process start left ${abandoned.name} in staging; nothing swept it", !abandoned.exists())
+        awaitGone(abandoned)
         // The other half, and the one that says the sweep is a sweep rather than a
         // `clearStaging()`: the directory is shared by the convert tab, the join tab and
         // ConcatEngine's list file, so deleting everything could take a file from a running job.
         assertTrue("a file written moments ago belongs to a live job", live.exists())
     }
 
+    /**
+     * Waits for [file] to be deleted.
+     *
+     * The sweep runs on `Dispatchers.IO`, deliberately: it lists a directory and stats every entry
+     * on the path that decides how long the launcher icon stays unresponsive. So there is nothing
+     * to join, and the wait is a bounded poll — long enough for a directory listing, short enough
+     * that a sweep which never happens fails rather than hangs.
+     */
+    private fun awaitGone(file: File) {
+        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(AWAIT_TIMEOUT_SECONDS)
+        while (System.nanoTime() < deadline) {
+            if (!file.exists()) return
+            Thread.sleep(POLL_INTERVAL_MS)
+        }
+        fail("process start left ${file.name} in staging; nothing swept it")
+    }
+
     private fun stagedFile(name: String): File = File(stagingDir, name).apply { writeBytes(ByteArray(4096)) }
 
     private companion object {
         const val ONE_MINUTE_MS = 60L * 1000
+        const val AWAIT_TIMEOUT_SECONDS = 10L
+        const val POLL_INTERVAL_MS = 5L
     }
 }

app/src/test/java/org/libremediaconverter/TestLibreMediaConverterApp.kt

@@ -1,28 +0,0 @@
-package org.libremediaconverter
-
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-
-/**
- * The [LibreMediaConverterApp] the JVM suite runs, differing from it in exactly one thing: the
- * startup sweep runs inline on the thread that builds the Application instead of on
- * `Dispatchers.Unconfined`.
- *
- * **This is #159.** Robolectric builds an `Application` per test class that asks for one, and each
- * one launches a sweep over the shared `<cacheDir>/conversions/`. Nothing joins them, so a test
- * asserting about a staged file is racing however many sweeps the classes before it left in
- * flight — `OutputPublisherStagingTest` being the one that lost, at roughly one local run in six
- * once wave 4 added ten more Robolectric classes. Making the sweep finish before `onCreate()`
- * returns removes the race for every test at once rather than asking each to opt in; 27 of the
- * suite's 58 Robolectric classes touch that directory, so opting in was not a real option.
- *
- * `Dispatchers.Unconfined` is what makes it inline: `sweepStaging()` is a plain function, so an
- * `Unconfined` `launch` runs it to completion before returning. The `SupervisorJob` is kept so this
- * differs from production in the dispatcher alone — a sweep that throws is logged and swallowed
- * here exactly as it is there, rather than taking Application construction down with it and failing
- * every test in the class for an unrelated reason.
- */
-class TestLibreMediaConverterApp : LibreMediaConverterApp() {
-    override val sweepScope: CoroutineScope = CoroutineScope(SupervisorJob() + Dispatchers.Unconfined)
-}

app/src/test/java/org/libremediaconverter/codec/CodecEnumerationTest.kt

@@ -1,201 +0,0 @@
-package org.libremediaconverter.codec
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.VideoCodec
-import org.robolectric.RobolectricTestRunner
-
-/**
- * The rules `AndroidDeviceCodecs.probe()` applies to the platform's codec list.
- *
- * ## Why this is not a third run of the #86/#133 spike
- *
- * #86 closed `probe()` as device-bound. #133 re-opened the question with
- * `ShadowMediaCodecList` in hand and closed it again, for a reason that was right about what it
- * was answering: `MediaCodecInfoBuilder` "has no `setIsAlias` and no `setCanonicalName`, so the
- * alias skip and the canonical-name dedup — the two things the class's KDoc calls out as easy to
- * get wrong — are not reachable through it."
- *
- * **That objection is about the shadow.** It does not apply to a function that takes its own entry
- * type, which is what `capabilitiesFrom` now does. The half #133 named as unreachable is the half
- * this file spends most of its cases on.
- *
- * ## What made the seam worth cutting, which is not coverage
- *
- * The `runCatching` fallback logged *"assuming permissive"* and returned empty sets — and empty
- * sets are **restrictive**: `"video/avc" in emptySet()` is `false`, so `canEncode` and `canDecode`
- * both answer no and every job routes to FFmpeg. The code was right and the message described the
- * opposite of it. That is pinned below, so whichever reading a future change takes, it has to say
- * so out loud.
- *
- * Robolectric only because `capabilitiesFrom` logs what it found; the rules themselves are pure.
- */
-@RunWith(RobolectricTestRunner::class)
-class CodecEnumerationTest {
-
-    /**
-     * The alias skip, in the one arrangement where it is observable — and finding that arrangement
-     * is the whole of this test.
-     *
-     * A first attempt listed the alias *after* the codec it aliases and passed with the skip
-     * deleted, because `canonicalName` is shared and the dedup below catches the second entry
-     * either way. The two rules overlap, so a fixture that does not separate them tests neither.
-     *
-     * What separates them is **order**. `MediaCodecInfo.getCanonicalName()` on an alias returns the
-     * underlying codec's name, so an alias arriving first claims that name in `seen` and has its
-     * own `supportedTypes` credited — and then the real codec is dropped by the dedup. Without the
-     * alias skip the device is described by whichever entry the platform happened to list first.
-     *
-     * That also says what the rule is worth. With a `Set` accumulator, an alias declaring the same
-     * types as its codec changes nothing whichever order they arrive in; the skip earns its place
-     * only when the two disagree, which is exactly when believing the wrong one matters.
-     */
-    @Test
-    fun `an alias listed before the codec it aliases does not describe the device`() {
-        val codecs = capabilities(
-            entry("c2.qti.avc.encoder", encoder = true, types = listOf(HEVC), alias = true),
-            entry("c2.qti.avc.encoder", encoder = true, types = listOf(AVC)),
-        )
-
-        assertTrue("the real codec's types are the device's", codecs.canEncode(VideoCodec.H264))
-        assertFalse(
-            "an alias must not be credited with types the codec it aliases never claimed",
-            codecs.canEncode(VideoCodec.H265),
-        )
-    }
-
-    @Test
-    fun `two entries sharing a canonical name are read once`() {
-        val codecs = capabilities(
-            entry("c2.qti.avc.encoder", encoder = true, types = listOf(AVC)),
-            entry("c2.qti.avc.encoder", encoder = true, types = listOf(HEVC)),
-        )
-
-        assertEquals(setOf(AVC), codecs.hardwareEncoders())
-    }
-
-    /**
-     * Both halves of the hardware predicate, one arm at a time.
-     *
-     * A vendor may declare a codec hardware-accelerated *and* software-only; the class KDoc is
-     * explicit that the first flag "cannot be tested for correctness", so the second is what stops
-     * a mislabelled software encoder being treated as the fast path.
-     */
-    @Test
-    fun `an encoder counts as hardware only when it is accelerated and not software-only`() {
-        assertEquals(
-            setOf(AVC),
-            capabilities(entry("hw", encoder = true, accelerated = true, types = listOf(AVC))).hardwareEncoders(),
-        )
-        assertEquals(
-            emptySet<String>(),
-            capabilities(entry("sw", encoder = true, accelerated = false, types = listOf(AVC))).hardwareEncoders(),
-        )
-        assertEquals(
-            "a codec claiming both must not be trusted as hardware",
-            emptySet<String>(),
-            capabilities(
-                entry("both", encoder = true, accelerated = true, softwareOnly = true, types = listOf(AVC)),
-            ).hardwareEncoders(),
-        )
-    }
-
-    /**
-     * Decoders are collected regardless of the hardware flags, and that asymmetry is the design.
-     *
-     * `canDecode` asks whether the platform can read the input at all — a software decoder answers
-     * that as well as a hardware one. `canEncode` asks whether the *fast path* exists, which is a
-     * different question and why only encoders are filtered.
-     */
-    @Test
-    fun `a software decoder still counts as something the platform can read`() {
-        val codecs = capabilities(
-            entry(
-                "c2.android.avc.decoder",
-                encoder = false,
-                accelerated = false,
-                softwareOnly = true,
-                types = listOf(AVC),
-            ),
-        )
-
-        assertTrue(codecs.canDecode("h264"))
-    }
-
-    @Test
-    fun `audio types are ignored on both sides`() {
-        val codecs = capabilities(
-            entry("aac.encoder", encoder = true, accelerated = true, types = listOf("audio/mp4a-latm")),
-            entry("aac.decoder", encoder = false, types = listOf("audio/mp4a-latm")),
-        )
-
-        assertEquals(emptySet<String>(), codecs.hardwareEncoders())
-        // Not "the platform cannot decode AAC" -- `canDecode` is asked about *video* codec names,
-        // and an unknown name is answered permissively. The point is that nothing audio reached
-        // either set.
-        assertTrue("an unknown name stays permissive", codecs.canDecode("something-nobody-named"))
-    }
-
-    /**
-     * The failure fallback, pinned as the restrictive answer it actually is.
-     *
-     * #194 decided this rather than assuming it: the code stays, the message changes. If a later
-     * change wants the permissive reading its old log line described, this test is what makes that
-     * a decision instead of a drift.
-     */
-    @Test
-    fun `an enumeration that fails sends every job to FFmpeg`() {
-        val codecs = AndroidDeviceCodecs.capabilitiesFrom { error("MediaCodecList exploded") }
-
-        assertFalse("a failed enumeration must not claim a hardware encoder", codecs.canEncode(VideoCodec.H264))
-        assertFalse(codecs.canDecode("h264"))
-        assertEquals(emptySet<String>(), codecs.hardwareEncoders())
-    }
-
-    /**
-     * A list that throws partway keeps what it already read.
-     *
-     * This predates the seam — `runCatching` has always wrapped the iteration rather than a list
-     * built before it — and it is asserted here because the seam is where it could quietly have
-     * been lost. Taking a `List` instead of a `Sequence` would move the throw outside the loop and
-     * turn this partial answer into an empty one, with no test to notice.
-     */
-    @Test
-    fun `codecs read before a failing entry are kept`() {
-        val codecs = AndroidDeviceCodecs.capabilitiesFrom {
-            sequence {
-                yield(entry("good", encoder = true, accelerated = true, types = listOf(AVC)))
-                error("the sixth codec's properties threw")
-            }
-        }
-
-        assertEquals(setOf(AVC), codecs.hardwareEncoders())
-    }
-
-    private fun capabilities(vararg entries: AndroidDeviceCodecs.Companion.CodecEntry) =
-        AndroidDeviceCodecs.capabilitiesFrom { entries.asSequence() }
-
-    private fun entry(
-        canonicalName: String,
-        encoder: Boolean,
-        accelerated: Boolean = true,
-        softwareOnly: Boolean = false,
-        alias: Boolean = false,
-        types: List<String>,
-    ) = AndroidDeviceCodecs.Companion.CodecEntry(
-        canonicalName = canonicalName,
-        isAlias = alias,
-        isEncoder = encoder,
-        isHardwareAccelerated = accelerated,
-        isSoftwareOnly = softwareOnly,
-        supportedTypes = types,
-    )
-
-    private companion object {
-        const val AVC = "video/avc"
-        const val HEVC = "video/hevc"
-    }
-}

app/src/test/java/org/libremediaconverter/codec/CodecVocabularyTest.kt

@@ -7,7 +7,6 @@ import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import org.libremediaconverter.model.CodecNames
-import org.libremediaconverter.model.InputProbe
 import org.libremediaconverter.model.VideoCodec
 
 /**
@@ -134,38 +133,6 @@ class CodecVocabularyTest {
      * landed, a device with no HEVC decoder answered true for `x265` and Media3 was handed a job it
      * could not do; now the router sends it to FFmpeg without spending the attempt.
      */
-    /**
-     * The sentinel is not just another unknown name, and the difference is the whole guard.
-     *
-     * `canDecode` ends `?: true` -- a name neither table knows keeps the permissive answer, because
-     * the app would rather try than refuse a file it might handle. `InputProbe.UNPARSEABLE` has to
-     * be the exception: the platform has *already* failed to parse the input, so there is nothing
-     * for a decoder to be permissive about, and waving it through spends a Media3 attempt on a job
-     * that cannot start.
-     *
-     * The `cinepak` line is what makes the sentinel line mean something. Without it, deleting the
-     * early return leaves this test green -- both names would fall through to the same `?: true`.
-     * The pair is the assertion.
-     *
-     * `DeviceCodecs.PERMISSIVE` carries the same rule and `ConversionRouterTest` pins its routing
-     * consequence. This is the implementation that runs on a device.
-     */
-    @Test
-    fun `the unparseable sentinel is refused even where an unknown name is waved through`() {
-        val everything = AndroidDeviceCodecs.forTesting(
-            encoders = emptySet(),
-            decoders = setOf("video/avc", "video/hevc"),
-        )
-        assertFalse(
-            "the platform could not parse this input, so there is nothing to decode with",
-            everything.canDecode(InputProbe.UNPARSEABLE),
-        )
-        assertTrue(
-            "a merely unknown name still keeps the permissive answer",
-            everything.canDecode("cinepak"),
-        )
-    }
-
     @Test
     fun `a device without the decoder now says so for the aliases it used to wave through`() {
         val hevcOnly = AndroidDeviceCodecs.forTesting(encoders = emptySet(), decoders = setOf("video/hevc"))

app/src/test/java/org/libremediaconverter/convert/CancelReachesWorkManagerTest.kt

@@ -1,180 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import androidx.media3.common.util.UnstableApi
-import androidx.work.OneTimeWorkRequestBuilder
-import androidx.work.WorkInfo
-import androidx.work.WorkManager
-import androidx.work.workDataOf
-import kotlinx.coroutines.Dispatchers
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.join.JoinState
-import org.libremediaconverter.join.JoinViewModel
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.work.ConcatWorker
-import org.libremediaconverter.work.ConversionWorker
-import org.libremediaconverter.work.JobTags
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.util.UUID
-import java.util.concurrent.TimeUnit
-
-/**
- * That `cancel()` cancels the job, on both screens.
- *
- * ## Why this was missing, which is the interesting part
- *
- * Both `cancel()` methods are one line — `activeWorkId?.let(workManager::cancelWorkById)` — and
- * **JaCoCo reports every line of both as covered**. `SettingsEditsTest`'s
- * `cancelling with no active job does nothing rather than throwing` runs the method, and its own
- * comment names which half it drives: "`activeWorkId?.let(...)` -- the null side". The other side
- * had never been entered, and `JoinViewModel.cancel()` had no test at all.
- *
- * So no line-level coverage filter could see this. What surfaces it is a method-level read —
- * `mi=11, ci=7, mb=1, cb=1` on both — a covered method with an arm nothing takes. That is the
- * second of the two filters #194 records, and this is the gap that argued for it.
- *
- * The affordance tests are not this. `ConverterStateAffordancesTest` and `JoinStateAffordancesTest`
- * click `TestTags.CANCEL` and assert the *action* fires into a stub; `ScreenWiringTest` asserts the
- * action calls `viewModel.cancel()`. Both halves were pinned and the join between them was not, so
- * nothing in 584 tests connected the button to WorkManager.
- *
- * ## Why the job is enqueued with a delay
- *
- * The test WorkManager runs on a `SynchronousExecutor`, so an ordinary request finishes inline —
- * which is exactly why only the null half was ever covered: by the time a test could call
- * `cancel()`, `convert()`'s job was already terminal. `setInitialDelay` is what `TestScheduler`
- * honours, so the job sits in `ENQUEUED` until the test lets it go, and it never does.
- *
- * **Production never sets a delay**, so the request is built here rather than through
- * `ConversionWorker.request`. The *state* is not synthetic: `ENQUEUED` at `runAttemptCount == 0` is
- * what every job passes through before the scheduler picks it up, `Reattachment.choose` ranks it
- * `QUEUED`, and `conversionStateFrom` maps it to `Converting(input, 0)`. The delay changes how long
- * the job stays in a real state, not which state it is in.
- *
- * ## What is asserted, and in which order
- *
- * WorkManager's own record first, then the screen. The screen alone would be a weaker claim than it
- * looks: `CANCELLED` maps to `Idle` for a reattached job, and `Idle` is also where a ViewModel that
- * did nothing at all would sit.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class CancelReachesWorkManagerTest {
-
-    private lateinit var app: Application
-    private lateinit var workManager: WorkManager
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        ConversionDependencies.publisher = { RecordingPublisher(app) }
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-        installTestWorkManager(app, workDataOf())
-        workManager = WorkManager.getInstance(app)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `cancelling a queued conversion cancels that job`() {
-        val id = enqueueQueuedConversion()
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        awaitState(viewModel.state, "Converting") { it is ConversionState.Converting }
-
-        viewModel.cancel()
-
-        assertEquals(
-            "Cancel must reach WorkManager, not just the screen",
-            WorkInfo.State.CANCELLED,
-            stateOf(id),
-        )
-        awaitState(viewModel.state, "Idle") { it is ConversionState.Idle }
-    }
-
-    @Test
-    fun `cancelling a queued join cancels that job`() {
-        val id = enqueueQueuedJoin()
-        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
-        awaitState(viewModel.state, "Joining") { it is JoinState.Joining }
-
-        viewModel.cancel()
-
-        assertEquals(
-            "Cancel must reach WorkManager, not just the screen",
-            WorkInfo.State.CANCELLED,
-            stateOf(id),
-        )
-        awaitState(viewModel.state, "Idle") { it is JoinState.Idle }
-    }
-
-    /**
-     * The negative that bounds both: cancelling must cancel the job the screen is showing, and only
-     * that one.
-     *
-     * Without this, `cancel()` could cancel everything in the queue — `cancelAllWork()` in place of
-     * `cancelWorkById(activeWorkId)` — and both tests above would still pass.
-     */
-    @Test
-    fun `cancelling one conversion leaves another queued job alone`() {
-        val bystander = enqueueQueuedConversion(displayName = "beach.mp4")
-        val id = enqueueQueuedConversion(displayName = "holiday.mp4")
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        val converting = awaitState(viewModel.state, "Converting") { it is ConversionState.Converting }
-        val onScreen = (converting as ConversionState.Converting).input.displayName
-
-        viewModel.cancel()
-
-        // Which of the two the ViewModel reattached to is the query's business, not this test's --
-        // the comparator leaves queued jobs tied deliberately, per Reattachment's ordering notes.
-        // So assert the shape rather than the identity: exactly one is cancelled, and the other is
-        // untouched.
-        val cancelled = listOf(id, bystander).filter { stateOf(it) == WorkInfo.State.CANCELLED }
-        assertEquals(
-            "exactly one job may be cancelled, with $onScreen on screen",
-            1,
-            cancelled.size,
-        )
-    }
-
-    private fun stateOf(id: UUID): WorkInfo.State =
-        requireNotNull(workManager.getWorkInfoById(id).get()) { "no WorkInfo for $id" }.state
-
-    /**
-     * A conversion sitting in the queue, which is where every job starts.
-     *
-     * Built by hand rather than through `ConversionWorker.request` for the reason in the class
-     * KDoc; the display-name tag is included because `reattach()` reads it for the file card, and a
-     * job without one would exercise the `UNKNOWN_INPUT_NAME` fallback instead of this test's
-     * subject.
-     */
-    private fun enqueueQueuedConversion(displayName: String = "holiday.mp4"): UUID {
-        val request = OneTimeWorkRequestBuilder<ConversionWorker>()
-            .addTag(JobTags.displayName(displayName))
-            .setInitialDelay(QUEUE_HOLD_HOURS, TimeUnit.HOURS)
-            .build()
-        workManager.enqueue(request).result.get()
-        return request.id
-    }
-
-    private fun enqueueQueuedJoin(inputCount: Int = 2): UUID {
-        val request = OneTimeWorkRequestBuilder<ConcatWorker>()
-            .addTag(JobTags.inputCount(inputCount))
-            .setInitialDelay(QUEUE_HOLD_HOURS, TimeUnit.HOURS)
-            .build()
-        workManager.enqueue(request).result.get()
-        return request.id
-    }
-
-    private companion object {
-        /** Long enough that `TestScheduler` never releases the job during a test run. */
-        const val QUEUE_HOLD_HOURS = 1L
-    }
-}

app/src/test/java/org/libremediaconverter/convert/ConversionStateMappingTest.kt

@@ -1,238 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.WorkInfo
-import androidx.work.workDataOf
-import org.junit.Assert.assertEquals
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.work.ConversionWorker
-import org.robolectric.RobolectricTestRunner
-
-/**
- * Every answer [conversionStateFrom] can give, chosen rather than stumbled into.
- *
- * ## What this revises
- *
- * The mapping is not cold code and never was: `ConversionViewModel$observe$1$1` reported 28 covered
- * lines before this file existed, because every test that drives a real worker runs it. What no
- * test did was **choose which arm it took**. A real worker reaches a terminal state with
- * well-formed output, so `SUCCEEDED`-with-a-path and `FAILED`-with-a-message were the only arms any
- * test had ever produced — the other six ran never.
- *
- * A `grep` for `WorkInfo.State.` across the JVM suite makes that look untrue: all six constants are
- * there. They are in `ReattachmentTest`, driven into **`Reattachment.choose`** — a different
- * function that encodes the same enqueued-means-retry rule. So that rule had a test in one of its
- * two homes, and the copy the user's screen reads had none.
- *
- * ## Why the seam, and why these assertions
- *
- * `WorkManager.getInstance` is called in the ViewModel's constructor and `observe` is private, so
- * nothing could hand this a chosen `WorkInfo`. Cutting the `when` out as a pure function over
- * [ConversionUpdate] is the answer #141 took for `MediaProbe`, and `JobSnapshot` beside
- * `Reattachment.choose` is the same shape again.
- *
- * The assertions are on the whole state, not on its type. `Converting(input, 40)` and
- * `Converting(input, 0)` are both `Converting`, and a mapping that dropped the progress read would
- * pass any test that only asked which class came back.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class ConversionStateMappingTest {
-
-    // --- running ------------------------------------------------------------
-
-    @Test
-    fun `a running job reports the progress it published`() {
-        // The percent is read from `progress`, not from `outputData`, and not from the settings.
-        // A mapping that returned Converting(input, 0) for every RUNNING would leave the bar
-        // pinned at zero for the whole conversion.
-        val state = map(WorkInfo.State.RUNNING, progress = 40)
-
-        assertEquals(ConversionState.Converting(INPUT, 40), state)
-    }
-
-    @Test
-    fun `a running job with no published progress reports zero rather than failing`() {
-        // getInt's default. A worker that has started but not yet called setProgress is ordinary,
-        // and must not read as an error.
-        val state = map(WorkInfo.State.RUNNING, progress = null)
-
-        assertEquals(ConversionState.Converting(INPUT, 0), state)
-    }
-
-    // --- enqueued: the rule that had a test only in its other home ----------
-
-    @Test
-    fun `an enqueued job that has already run is waiting to retry`() {
-        val state = map(WorkInfo.State.ENQUEUED, runAttemptCount = 1)
-
-        assertEquals(
-            "an ENQUEUED after a run is a pending retry, which the user is told about",
-            ConversionState.Waiting(INPUT),
-            state,
-        )
-    }
-
-    @Test
-    fun `an enqueued job that has never run is simply starting`() {
-        // The other side, and the reason the test above is not enough on its own: a mapping that
-        // ignored runAttemptCount and always answered Waiting would pass that one and fail this.
-        val state = map(WorkInfo.State.ENQUEUED, runAttemptCount = 0)
-
-        assertEquals(ConversionState.Converting(INPUT, 0), state)
-    }
-
-    // --- succeeded ----------------------------------------------------------
-
-    @Test
-    fun `a success that named no file is a failure, not an empty success`() {
-        // The job said it finished and named nothing. There is no file to offer, so `Converted`
-        // would put a Save button over a path that does not exist.
-        val state = map(WorkInfo.State.SUCCEEDED, data = Data.EMPTY)
-
-        assertEquals(ConversionState.Failed(SUCCEEDED_WITHOUT_A_FILE_MESSAGE), state)
-    }
-
-    @Test
-    fun `a success carries the worker's own name and type, not the current settings`() {
-        val state = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(
-                ConversionWorker.KEY_OUTPUT_PATH to "/cache/conversions/out.mkv",
-                ConversionWorker.KEY_SUGGESTED_NAME to "holiday.mkv",
-                ConversionWorker.KEY_MIME_TYPE to "video/x-matroska",
-                ConversionWorker.KEY_ENGINE_USED to "FFMPEG",
-                ConversionWorker.KEY_ROUTE_REASON to "container needs FFmpeg",
-            ),
-        )
-
-        val converted = state as ConversionState.Converted
-        assertEquals("holiday.mkv", converted.suggestedName)
-        assertEquals("video/x-matroska", converted.mimeType)
-        assertEquals("FFMPEG", converted.engineUsed)
-        assertEquals("container needs FFmpeg", converted.routeReason)
-    }
-
-    @Test
-    fun `a success from older work falls back to the current settings for name and type`() {
-        // WorkManager keeps finished work about a week, so a job enqueued before the worker
-        // reported these is ordinary for a few days rather than a corner case.
-        val state = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(ConversionWorker.KEY_OUTPUT_PATH to "/cache/conversions/out.mp4"),
-        )
-
-        val converted = state as ConversionState.Converted
-        assertEquals(FALLBACK_SPEC.mimeType, converted.mimeType)
-        assertEquals(
-            ConversionWorker.outputNameFor(INPUT.displayName, FALLBACK_SPEC),
-            converted.suggestedName,
-        )
-    }
-
-    @Test
-    fun `a blank name or type falls back the same way a missing one does`() {
-        // A blank string is not an answer. Without takeIf, the save dialog opens named "" and
-        // registered for a MIME type of "", which no provider will accept.
-        val state = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(
-                ConversionWorker.KEY_OUTPUT_PATH to "/cache/conversions/out.mp4",
-                ConversionWorker.KEY_SUGGESTED_NAME to "",
-                ConversionWorker.KEY_MIME_TYPE to "   ",
-            ),
-        )
-
-        val converted = state as ConversionState.Converted
-        assertEquals(FALLBACK_SPEC.mimeType, converted.mimeType)
-        assertEquals(
-            ConversionWorker.outputNameFor(INPUT.displayName, FALLBACK_SPEC),
-            converted.suggestedName,
-        )
-    }
-
-    // --- failed -------------------------------------------------------------
-
-    @Test
-    fun `a failure carries the reason the worker gave`() {
-        val state = map(
-            WorkInfo.State.FAILED,
-            data = workDataOf(ConversionWorker.KEY_ERROR to "Not enough free space to convert."),
-        )
-
-        assertEquals(ConversionState.Failed("Not enough free space to convert."), state)
-    }
-
-    @Test
-    fun `a failure with nothing said still says something`() {
-        // A worker killed before it could write output data leaves none at all -- a refused
-        // foreground start after a process restart is one way. Failed("") would render as a blank
-        // error card.
-        val state = map(WorkInfo.State.FAILED, data = Data.EMPTY)
-
-        assertEquals(ConversionState.Failed(ConversionWorker.GENERIC_FAILURE_MESSAGE), state)
-    }
-
-    @Test
-    fun `a failure whose message is blank falls back like a missing one`() {
-        val state = map(
-            WorkInfo.State.FAILED,
-            data = workDataOf(ConversionWorker.KEY_ERROR to "   "),
-        )
-
-        assertEquals(ConversionState.Failed(ConversionWorker.GENERIC_FAILURE_MESSAGE), state)
-    }
-
-    // --- cancelled and blocked ---------------------------------------------
-
-    @Test
-    fun `a cancellation lands wherever the caller said it should`() {
-        // Not a fixed state: a conversion started here goes back to Ready with the picked file,
-        // while one picked up by reattach goes to Idle, because the URI that job holds belongs to
-        // a process that no longer exists. `observe`'s KDoc is where that distinction is set.
-        val toReady = map(WorkInfo.State.CANCELLED, cancelled = ConversionState.Ready(INPUT))
-        val toIdle = map(WorkInfo.State.CANCELLED, cancelled = ConversionState.Idle)
-
-        assertEquals(ConversionState.Ready(INPUT), toReady)
-        assertEquals(ConversionState.Idle, toIdle)
-    }
-
-    @Test
-    fun `a blocked job looks like one that is starting`() {
-        // BLOCKED is a job waiting on a prerequisite. There is nothing useful to say about it that
-        // differs from "starting", and inventing a state for it would put a word on screen the
-        // user cannot act on.
-        val state = map(WorkInfo.State.BLOCKED)
-
-        assertEquals(ConversionState.Converting(INPUT, 0), state)
-    }
-
-    private fun map(
-        state: WorkInfo.State,
-        progress: Int? = null,
-        runAttemptCount: Int = 0,
-        data: Data = Data.EMPTY,
-        cancelled: ConversionState = ConversionState.Ready(INPUT),
-    ): ConversionState = conversionStateFrom(
-        ConversionUpdate(
-            state = state,
-            // Modelled on the call site, which reads `getInt(KEY_PROGRESS, 0)` -- so "no progress
-            // published" is the default reaching the mapping, not a null it has to handle.
-            progressPercent = progress ?: 0,
-            runAttemptCount = runAttemptCount,
-            outputData = data,
-        ),
-        input = INPUT,
-        cancelled = cancelled,
-        fallbackSpec = FALLBACK_SPEC,
-    )
-
-    private companion object {
-        val INPUT = InputFile(Uri.parse("content://test/holiday.mov"), "holiday.mov", 4096L)
-        val FALLBACK_SPEC = OutputFormat.MP4_H265.spec
-    }
-}

app/src/test/java/org/libremediaconverter/convert/FFprobeMappingTest.kt

@@ -1,192 +0,0 @@
-package org.libremediaconverter.convert
-
-import com.arthenica.ffmpegkit.MediaInformation
-import com.arthenica.ffmpegkit.StreamInformation
-import org.json.JSONObject
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.Container
-import org.robolectric.RobolectricTestRunner
-
-/**
- * What FFprobe's answer means, read as a function of the answer alone.
- *
- * `readMediaInformation` was 114 missed instructions and 24 missed branches — the second-biggest
- * block on the wave-4 report — of which **exactly one line needed a device**:
- *
- * ```kotlin
- * FFprobeKit.getMediaInformation(path).getMediaInformation()
- * ```
- *
- * Everything after it reads an ordinary object. `javap` over the committed AAR's runtime jar:
- * `MediaInformation(JSONObject, List<StreamInformation>, List<Chapter>)` and
- * `StreamInformation(JSONObject)` are plain public constructors, and neither class's `<clinit>`
- * loads the native library — so the fixtures below are built without `libffmpegkit` present.
- *
- * ## The one that matters
- *
- * `containerFrom(formatName, video?.getCodec())`. FFprobe reports `matroska,webm` for **both** MKV
- * and WebM, because they share a demuxer, so the video codec is the only thing separating them.
- * `containerFrom` has thirty-three covered branches of its own and not one of them can notice the
- * argument being dropped — the mistake would be at the call, not in the callee, and every existing
- * `containerFrom` test would stay green while every VP9 WebM quietly became an MKV.
- *
- * Robolectric only for `org.json`, which is a stub in a plain JVM test.
- */
-@RunWith(RobolectricTestRunner::class)
-class FFprobeMappingTest {
-
-    @Test
-    fun `the video codec decides between matroska and webm`() {
-        assertEquals(
-            Container.WEBM,
-            MediaProbe.ffprobeInfoFrom(info("matroska,webm", stream("video", "vp9"))).container,
-        )
-        assertEquals(
-            Container.MKV,
-            MediaProbe.ffprobeInfoFrom(info("matroska,webm", stream("video", "h264"))).container,
-        )
-    }
-
-    /**
-     * The same format name with no video stream at all, which is what makes the case above about
-     * the *argument* rather than about the format string.
-     */
-    @Test
-    fun `a matroska container with no video track cannot be told from webm and is not guessed`() {
-        val read = MediaProbe.ffprobeInfoFrom(info("matroska,webm", stream("audio", "opus")))
-
-        assertEquals(Container.MKV, read.container)
-        assertNull(read.videoCodec)
-    }
-
-    @Test
-    fun `the first stream of each type wins`() {
-        val read = MediaProbe.ffprobeInfoFrom(
-            info(
-                "mov,mp4,m4a,3gp,3g2,mj2",
-                stream("video", "h264", width = 1920, height = 1080),
-                stream("video", "hevc", width = 640, height = 480),
-                stream("audio", "aac"),
-                stream("audio", "mp3"),
-            ),
-        )
-
-        assertEquals("h264", read.videoCodec)
-        assertEquals("aac", read.audioCodec)
-        assertEquals(1920, read.width)
-        assertEquals(1080, read.height)
-    }
-
-    /**
-     * Dimensions come from the stream the codec came from, not from whichever stream has some.
-     *
-     * The fixture is deliberately awkward: the chosen video stream carries **no** dimensions and a
-     * later one does. That is a real shape — FFprobe omits `width`/`height` for a stream it could
-     * not measure — and it is the only arrangement that separates the two readings.
-     *
-     * A first version of this file asserted the dimensions inside the case above, where the chosen
-     * stream was also the first one carrying any. Replacing `video?.getWidth()` with
-     * `streams.firstNotNullOfOrNull { it.getWidth() }` gave the same answer there and **the
-     * mutation survived**. It reddens here.
-     */
-    @Test
-    fun `a video stream with no dimensions reports none rather than borrowing another stream's`() {
-        val read = MediaProbe.ffprobeInfoFrom(
-            info(
-                "mov,mp4,m4a,3gp,3g2,mj2",
-                stream("video", "h264"),
-                stream("video", "hevc", width = 640, height = 480),
-            ),
-        )
-
-        assertEquals("h264", read.videoCodec)
-        assertEquals(0, read.width)
-        assertEquals(0, read.height)
-    }
-
-    /**
-     * Stream order is the file's, not a promise. An audio-first container must read the same as a
-     * video-first one.
-     */
-    @Test
-    fun `an audio track listed first does not become the video track`() {
-        val read = MediaProbe.ffprobeInfoFrom(
-            info("mov,mp4,m4a,3gp,3g2,mj2", stream("audio", "aac"), stream("video", "h264")),
-        )
-
-        assertEquals("h264", read.videoCodec)
-        assertEquals("aac", read.audioCodec)
-    }
-
-    @Test
-    fun `a duration in seconds becomes milliseconds`() {
-        assertEquals(12_345L, MediaProbe.ffprobeInfoFrom(info("mp4", duration = "12.345")).durationMs)
-    }
-
-    /**
-     * Both ways a duration can be absent, and neither may throw.
-     *
-     * FFprobe reports `"N/A"` for a stream it could not measure, and omits the key entirely for
-     * some containers. `toDoubleOrNull` is what keeps the second from being an exception on the
-     * file-pick path, where there is no user-visible failure to report it as.
-     */
-    @Test
-    fun `a duration that is not a number is no duration rather than a crash`() {
-        assertEquals(0L, MediaProbe.ffprobeInfoFrom(info("mp4", duration = "N/A")).durationMs)
-        assertEquals(0L, MediaProbe.ffprobeInfoFrom(info("mp4", duration = null)).durationMs)
-    }
-
-    @Test
-    fun `a file with no streams reports nothing rather than defaults that look measured`() {
-        val read = MediaProbe.ffprobeInfoFrom(info("mp4"))
-
-        assertNull(read.videoCodec)
-        assertNull(read.audioCodec)
-        assertEquals(0, read.width)
-        assertEquals(0, read.height)
-    }
-
-    @Test
-    fun `an image format is reported as one`() {
-        assertTrue(MediaProbe.ffprobeInfoFrom(info("png_pipe", stream("video", "png"))).isImage)
-        assertFalse(MediaProbe.ffprobeInfoFrom(info("mp4", stream("video", "h264"))).isImage)
-    }
-
-    private fun stream(type: String, codec: String, width: Int? = null, height: Int? = null) = StreamInformation(
-        JSONObject().apply {
-            put(StreamInformation.KEY_TYPE, type)
-            put(StreamInformation.KEY_CODEC, codec)
-            width?.let { put(StreamInformation.KEY_WIDTH, it) }
-            height?.let { put(StreamInformation.KEY_HEIGHT, it) }
-        },
-    )
-
-    /**
-     * The format properties are **nested** under `"format"`, which is how FFprobe reports them and
-     * what `MediaInformation` reads: `getFormat()` resolves through `getStringFormatProperty`, not
-     * off the top-level object. A first version of this helper put the keys at the top level and
-     * every format-dependent case failed with a null container, which is worth recording here so
-     * the next fixture does not have to rediscover it.
-     *
-     * Streams are the other half and are *not* nested — they come from the constructor argument.
-     */
-    private fun info(formatName: String, vararg streams: StreamInformation, duration: String? = "1.0") =
-        MediaInformation(
-            JSONObject().apply {
-                put(
-                    MediaInformation.KEY_FORMAT_PROPERTIES,
-                    JSONObject().apply {
-                        put(MediaInformation.KEY_FORMAT, formatName)
-                        duration?.let { put(MediaInformation.KEY_DURATION, it) }
-                    },
-                )
-            },
-            streams.toList(),
-            emptyList(),
-        )
-}

app/src/test/java/org/libremediaconverter/convert/FailedSaveRetryTest.kt

@@ -51,13 +51,10 @@ import java.io.File
  *   here needs. `OutputPublisherPublishTest` owns what a real publish writes.
  * - **The screen's two buttons.** `ConverterStateAffordancesTest` and `JoinStateAffordancesTest`
  *   own what each state renders; this file owns what each state carries.
- * - ~~**`ConverterScreen`'s `destinationMime` line itself.**~~ **Withdrawn 2026-09-02 (#201).** The
- *   exemption read: "it lives in the entry point, above the `ScreenContent` seam, and reaching it
- *   needs a real ViewModel inside a composition". That was true when written and is no longer:
- *   `AdaptiveShellTest` (#173) established composing the real screens with real ViewModels, and
- *   #200 added the `ShadowActivity` mechanics for reading what a launcher launched. `RetrySaveMimeTest`
- *   now asserts the line directly. What this file still owns is the half below the seam -- what each
- *   state *carries* -- which is why `pendingSave()?.mimeType` is also asserted here.
+ * - **`ConverterScreen`'s `destinationMime` line itself.** It lives in the entry point, above the
+ *   `ScreenContent` seam, and reaching it needs a real ViewModel inside a composition. What it
+ *   reads -- `pendingSave()?.mimeType` -- is asserted directly instead, which is why that
+ *   derivation was moved out of the entry point in the first place.
  * - **Picking a new input while a `Failed` carries a file.** `onInputPicked` overwrites the state
  *   without discarding, from `Converted` exactly as much as from a carrying `Failed`, and neither
  *   branch renders a picker. It is a pre-existing path this change neither opens nor widens: the

app/src/test/java/org/libremediaconverter/convert/FileCardTest.kt

@@ -205,34 +205,6 @@ class FileCardTest {
         assertNoRow("Length")
     }
 
-    /**
-     * A video the app knows a great deal about and cannot name the container of.
-     *
-     * Not an edge case. `InputProbe.container`'s own KDoc says `MediaExtractor` cannot report a
-     * container at all -- it comes from FFprobe -- so any run where FFprobe did not answer produces
-     * exactly this: real codec, real dimensions, real duration, `container = null`.
-     *
-     * **The twin was already tested and this one was not**, which is the argument for adding it.
-     * `FileCard` renders `probe.container?.label ?: "Unknown"` twice, once in the `AUDIO_ONLY`
-     * branch (`ConverterScreen.kt:660`) and once in the `VIDEO` branch (`:668`), and
-     * `an audio-only file nothing else could describe degrades one row at a time` drives only the
-     * first. Same expression, same fallback, one kind covered. That asymmetry is the same one
-     * `CLAUDE.md` records for including `ContainerCapabilities:94`.
-     *
-     * The other rows are asserted alongside so this is not a copy of the audio-only case: there,
-     * everything is unknown at once; here, one field is missing from a probe that is otherwise
-     * complete, and the rest must be unaffected by it.
-     */
-    @Test
-    fun `a video file whose container nothing identified says so and keeps its other rows`() {
-        setFileCard(input(probe = VIDEO_PROBE.copy(container = null)))
-
-        assertRow("Container", "Unknown")
-        assertRow("Video", "${VideoCodec.H264.label} · 1920×1080")
-        assertRow("Audio", AudioCodec.AAC.label)
-        assertRow("Length", "1:30")
-    }
-
     /**
      * The row is one node, not a label node beside a value node. A test matching on `"Container"`
      * alone would pass against either shape.

app/src/test/java/org/libremediaconverter/convert/LauncherWiringTest.kt

@@ -1,141 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Activity
-import android.content.Intent
-import android.net.Uri
-import androidx.activity.ComponentActivity
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.performClick
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.join.JoinScreen
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.ui.TestTags
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import org.robolectric.Shadows.shadowOf
-import org.robolectric.shadows.ShadowActivity
-
-/**
- * The launcher layer above the `ScreenContent` seam — registered, and until now never resulted.
- *
- * ## The hazard this exists for
- *
- * `ConversionViewModel.onInputPicked(uri: Uri)` and `.save(destination: Uri)` are **both
- * `(Uri) -> Unit`**, so swapping the two launcher callbacks at `ConverterScreen.kt:70` and `:83`
- * compiles, renders, and passes the entire suite. Picking a file would attempt a save to it, and
- * choosing a destination would load it as input.
- *
- * That is precisely the defect class `ScreenWiringTest` exists for, on the one pair it declines to
- * cover: it drives `converterActions` directly and says the launcher-backed actions stay
- * parameters. Correct for the `actions` seam, and it leaves the edge above that seam unpinned.
- *
- * Join's equivalents (`JoinScreen.kt:45`, `:55`) are `List<Uri>` and `Uri`, so they are **not**
- * transposable and need no such test. The picker filter is a different matter and is covered below
- * for both screens.
- *
- * ## The two mechanics, verified before the assertions were written
- *
- * Neither is used anywhere else in the suite, so both were spiked first:
- *
- * - **Reading what was launched** — `shadowOf(activity).nextStartedActivityForResult`, which returns
- *   the `Intent` with its `EXTRA_MIME_TYPES` intact.
- * - **Delivering a result** — `shadowOf(activity).receiveResult(...)`, which reaches
- *   `ComponentActivity`'s `ActivityResultRegistry` and fires the `rememberLauncherForActivityResult`
- *   callback.
- *
- * `createAndroidComposeRule`, as `AdaptiveShellTest` uses and for the reason it gives: the screens
- * compose real ViewModels through `viewModel()`, and the plain rule supplies no `ViewModelStoreOwner`.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class LauncherWiringTest {
-
-    @get:Rule
-    val composeRule = createAndroidComposeRule<ComponentActivity>()
-
-    @Before
-    fun setUp() {
-        val app = RuntimeEnvironment.getApplication()
-        installTestWorkManager(app, Data.EMPTY)
-        // The real screen composes a real ViewModel; neither test here is about probing.
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-    }
-
-    @After
-    fun tearDown() = ConversionDependencies.reset()
-
-    /**
-     * The transposition guard. A picked file has to reach `onInputPicked`, which is observable as
-     * the screen arriving at `Ready` with the file card showing — `save()` from `Idle` returns at
-     * its own guard and leaves nothing behind.
-     */
-    @Test
-    fun `a picked document is loaded as input rather than saved to`() {
-        composeRule.setContent { ConverterScreen() }
-
-        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).performClick()
-        deliver(Uri.parse("content://test/holiday.mkv"))
-
-        composeRule.onNodeWithTag(TestTags.Converter.FILE_CARD_NAME).assertIsDisplayed()
-    }
-
-    /**
-     * `ConverterScreen.kt:65-67` records why the all-types wildcard is load-bearing rather than lazy:
-     *
-     * > the picker is images and video only, offers no audio at all, and will not reliably surface
-     * > .mkv/.flac/.webm
-     *
-     * Narrowing it would make every audio conversion unreachable from the file picker, and nothing
-     * would have gone red. (The literal is spelled only in the assertion below: a KDoc cannot
-     * contain it, because the wildcard's second half closes the comment.)
-     */
-    @Test
-    fun `the converter picker asks for every type, not just the ones a photo picker offers`() {
-        composeRule.setContent { ConverterScreen() }
-
-        composeRule.onNodeWithTag(TestTags.Converter.CHOOSE_FILE).performClick()
-
-        val intent = launched().intent
-        assertEquals(Intent.ACTION_OPEN_DOCUMENT, intent.action)
-        assertEquals(listOf("*/*"), intent.getStringArrayExtra(Intent.EXTRA_MIME_TYPES)?.toList())
-    }
-
-    @Test
-    fun `the join picker asks for video and accepts more than one file`() {
-        composeRule.setContent { JoinScreen() }
-
-        composeRule.onNodeWithTag(TestTags.Join.CHOOSE_FILES).performClick()
-
-        val intent = launched().intent
-        assertEquals(Intent.ACTION_OPEN_DOCUMENT, intent.action)
-        assertEquals(listOf("video/*"), intent.getStringArrayExtra(Intent.EXTRA_MIME_TYPES)?.toList())
-        // A join of one file is not a join; the contract is what asks for several.
-        assertEquals(true, intent.getBooleanExtra(Intent.EXTRA_ALLOW_MULTIPLE, false))
-    }
-
-    private fun launched(): ShadowActivity.IntentForResult {
-        composeRule.waitForIdle()
-        return requireNotNull(shadowOf(composeRule.activity).nextStartedActivityForResult) {
-            "nothing was launched for a result"
-        }
-    }
-
-    private fun deliver(uri: Uri) {
-        val started = launched()
-        shadowOf(composeRule.activity).receiveResult(
-            started.intent,
-            Activity.RESULT_OK,
-            Intent().setData(uri),
-        )
-        composeRule.waitForIdle()
-    }
-}

app/src/test/java/org/libremediaconverter/convert/Media3MuxerGuardTest.kt

@@ -1,99 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import kotlinx.coroutines.runBlocking
-import kotlinx.coroutines.withTimeout
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.AudioCodec
-import org.libremediaconverter.model.AudioPlan
-import org.libremediaconverter.model.Container
-import org.libremediaconverter.model.ConversionRequest
-import org.libremediaconverter.model.CopyPlanner
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.model.OutputSpec
-import org.libremediaconverter.model.VideoCodec
-import org.libremediaconverter.model.VideoPlan
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.io.File
-import java.util.concurrent.CancellationException
-
-/**
- * A job that reached Media3 with a container Media3 cannot mux.
- *
- * [Media3Muxers]' own KDoc names the defect this guards: *"the router claimed five containers while
- * the engine silently wrote MP4 for all of them."* `factoryFor` answers null for fourteen of the
- * app's containers, and `buildTransformer` turns that null into a failed job rather than letting
- * `Transformer` fall back to its default muxer.
- *
- * The guard had never fired. `Media3Engine$buildTransformer$3` -- the `requireNotNull` message
- * lambda -- was four lines and four branches at 0%, which is to say the entire repair for a defect
- * the codebase went to the trouble of writing down was untested. Weakening it would restore that
- * bug silently, because the wrong output is a *playable file with the wrong container*, not a crash.
- *
- * Same harness and same two disciplines as [Media3EngineEmptyCompositionTest]: assert the plan
- * really is the one the test needs before driving the engine, and rule out
- * `CancellationException` so an unresumed continuation cannot read as a pass.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class Media3MuxerGuardTest {
-
-    @Test
-    fun `a container Media3 cannot mux fails the job rather than silently writing MP4`() {
-        val context = RuntimeEnvironment.getApplication()
-        val engine = Media3Engine(context)
-        val request = ConversionRequest(
-            spec = OutputSpec(Container.WEBM, VideoCodec.VP9, AudioCodec.OPUS),
-            probe = InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.MP4),
-        )
-
-        // The premise, asserted rather than assumed -- three separate ways this test could pass
-        // over a path it never entered.
-        val plan = CopyPlanner.plan(request.spec, request.probe)
-        assertEquals("the plan has to still be WebM by the time the engine sees it", Container.WEBM, plan.container)
-        assertNull("...and Media3 really has no muxer for it", Media3Muxers.factoryFor(plan.container))
-        // Not the empty-composition refusal, which fires earlier and is a different test's subject.
-        assertNotEquals(VideoPlan.Drop, plan.video)
-        assertNotEquals(AudioPlan.Drop, plan.audio)
-
-        val failure = try {
-            runCatching {
-                runBlocking {
-                    withTimeout(TIMEOUT_MS) {
-                        engine.transcode(Uri.parse("file:///dev/null"), File(context.cacheDir, "guard.webm"), request) {
-                        }
-                    }
-                }
-            }.exceptionOrNull()
-        } finally {
-            engine.close()
-        }
-
-        assertFalse(
-            "the continuation was never resumed -- the refusal escaped instead of failing the job: $failure",
-            failure is CancellationException,
-        )
-        // Type *and* message, and the message half is the load-bearing one. Replacing the
-        // requireNotNull with a fallback factory does not make the export succeed here: it lets it
-        // run on and fail some other way, which a bare type assertion would happily accept.
-        assertTrue("expected the muxer guard to refuse the job, got $failure", failure is IllegalArgumentException)
-        assertTrue(
-            "the refusal has to name the container it could not mux, got: ${failure?.message}",
-            failure?.message.orEmpty().contains("cannot mux") &&
-                failure?.message.orEmpty().contains(Container.WEBM.name),
-        )
-    }
-
-    private companion object {
-        /** Nothing is decoded or muxed on this path -- the guard refuses before any of that. */
-        const val TIMEOUT_MS = 10_000L
-    }
-}

app/src/test/java/org/libremediaconverter/convert/MediaProbeMergeTest.kt

@@ -1,166 +0,0 @@
-package org.libremediaconverter.convert
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-import org.libremediaconverter.model.Container
-import org.libremediaconverter.model.InputKind
-import org.libremediaconverter.model.InputProbe
-
-/**
- * Which of the two probes wins, when they disagree.
- *
- * [MediaProbe.probe] runs `MediaExtractor` and FFprobe independently and then merges the two, and
- * every rule in that merge is a decision. None of them had a test, for a reason that is structural
- * rather than an oversight: `RemuxTest` drives the whole thing on a device against committed
- * fixtures, but only ever with **one probe answering and the other agreeing or also failing**.
- * Nothing on any source set can arrange for a real extractor and a real FFprobe to disagree, so
- * every elvis in the merge was taken in one direction and never the other.
- *
- * Cutting `merge` out of `probe` is what makes the question askable. Both halves of its signature
- * had to become `internal` for that -- `Extracted` already was, with a KDoc giving this exact
- * reason; `FFprobeInfo` simply never got the same treatment.
- */
-class MediaProbeMergeTest {
-
-    /**
-     * The rule with the loudest failure mode, and `isImageFormat`'s own KDoc names it: a false
-     * positive here "makes the source-info card describe a video as an image". So the image verdict
-     * has to beat a real video codec from the extractor, and the ordering that makes it do so is
-     * the first arm of `classify` rather than anything a reader would infer from the fields.
-     */
-    @Test
-    fun `an image verdict from FFprobe beats a video codec from the extractor`() {
-        val merged = MediaProbe.merge(
-            extracted = extracted(video = "h264"),
-            info = info(video = "mjpeg", isImage = true),
-        )
-
-        assertEquals(InputKind.IMAGE, merged.kind)
-    }
-
-    @Test
-    fun `the extractor wins on codecs, because it is the view the router will act on`() {
-        val merged = MediaProbe.merge(
-            extracted = extracted(video = "h264", audio = "aac"),
-            info = info(video = "hevc", audio = "mp3"),
-        )
-
-        assertEquals("h264", merged.videoCodec)
-        assertEquals("aac", merged.audioCodec)
-    }
-
-    @Test
-    fun `FFprobe answers for a file the extractor could not open`() {
-        val merged = MediaProbe.merge(extracted = null, info = info(video = "vp9", audio = "opus"))
-
-        assertEquals("vp9", merged.videoCodec)
-        assertEquals("opus", merged.audioCodec)
-        assertEquals(InputKind.VIDEO, merged.kind)
-    }
-
-    @Test
-    fun `the extractor answers for a file FFprobe could not read`() {
-        val merged = MediaProbe.merge(extracted = extracted(video = "h264", audio = "aac"), info = null)
-
-        assertEquals("h264", merged.videoCodec)
-        assertEquals("aac", merged.audioCodec)
-        assertNull("only FFprobe can name the container, so it stays unknown here", merged.container)
-    }
-
-    /**
-     * The larger of the two, not the first non-zero.
-     *
-     * Either probe can report zero for a file the other times correctly, and a zero duration makes
-     * the FFmpeg progress percentage undefined -- `FFmpegEngine` divides by it. Both orderings are
-     * asserted because "take the extractor's" and "take the larger" agree in one direction and not
-     * the other, and only one of them is the rule.
-     */
-    @Test
-    fun `duration is the longer of the two readings, whichever probe supplied it`() {
-        assertEquals(
-            5_000L,
-            MediaProbe.merge(extracted(duration = 0L), info(duration = 5_000L)).durationMs,
-        )
-        assertEquals(
-            5_000L,
-            MediaProbe.merge(extracted(duration = 5_000L), info(duration = 0L)).durationMs,
-        )
-    }
-
-    @Test
-    fun `dimensions come from the extractor, and from FFprobe only when it has none`() {
-        assertEquals(1920, MediaProbe.merge(extracted(width = 1920), info(width = 640)).width)
-        assertEquals(640, MediaProbe.merge(extracted = null, info = info(width = 640)).width)
-        assertEquals(0, MediaProbe.merge(extracted(width = 0), info(width = 0)).width)
-    }
-
-    @Test
-    fun `the container comes from FFprobe, which is the only probe that can name one`() {
-        val merged = MediaProbe.merge(extracted(video = "h264"), info(container = Container.MKV))
-
-        assertEquals(Container.MKV, merged.container)
-    }
-
-    @Test
-    fun `a file with audio and no video is audio-only, not unparseable`() {
-        val merged = MediaProbe.merge(extracted(video = null, audio = "mp3"), info = null)
-
-        assertEquals(InputKind.AUDIO_ONLY, merged.kind)
-        assertFalse(merged.hasVideo)
-    }
-
-    @Test
-    fun `a file neither probe could open is the one unreadable answer`() {
-        val merged = MediaProbe.merge(extracted = null, info = null)
-
-        assertEquals(MediaProbe.UNREADABLE, merged)
-        assertEquals(InputProbe.UNPARSEABLE, merged.videoCodec)
-    }
-
-    /**
-     * The arm the ticket was filed for: parsed, and carrying no stream either probe recognised.
-     *
-     * Distinct from "neither probe could open it" -- here the extractor opened the file happily and
-     * found nothing convertible, which is what a container holding only subtitles looks like. It
-     * has to reach the same [MediaProbe.UNREADABLE] answer, because the router keys off that and
-     * there is nothing here for Media3 to do either way.
-     *
-     * Its input was already being built elsewhere in the suite -- `MediaProbeTrackWalkTest` calls
-     * `extractedFrom(emptyList())` and gets exactly this -- and had simply never been handed to the
-     * merge.
-     */
-    @Test
-    fun `a file that parsed but carries no recognised stream is unreadable too`() {
-        val merged = MediaProbe.merge(extracted = MediaProbe.extractedFrom(emptyList()), info = null)
-
-        assertEquals(InputKind.UNPARSEABLE, merged.kind)
-        assertEquals(MediaProbe.UNREADABLE, merged)
-    }
-
-    @Test
-    fun `hasVideo follows the codec that survived the merge, not either probe alone`() {
-        assertTrue(MediaProbe.merge(extracted(video = null), info(video = "vp9")).hasVideo)
-        assertFalse(MediaProbe.merge(extracted(video = null, audio = "aac"), info(video = null)).hasVideo)
-    }
-
-    private fun extracted(
-        video: String? = "h264",
-        audio: String? = "aac",
-        duration: Long = 1_000L,
-        width: Int = 1280,
-        height: Int = 720,
-    ) = MediaProbe.Extracted(video, audio, duration, width, height)
-
-    private fun info(
-        container: Container? = null,
-        video: String? = "h264",
-        audio: String? = "aac",
-        duration: Long = 1_000L,
-        width: Int = 1280,
-        height: Int = 720,
-        isImage: Boolean = false,
-    ) = MediaProbe.FFprobeInfo(container, video, audio, duration, width, height, isImage)
-}

app/src/test/java/org/libremediaconverter/convert/MediaProbeTrackWalkTest.kt

@@ -1,221 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.media.MediaFormat
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-
-/**
- * The rules `MediaProbe` applies to a set of track formats.
- *
- * ## Why this exists, and what it revises
- *
- * Issue #84 classified `probeWithExtractor` and `probeForConcat` as device-bound and explicitly not
- * a gap:
- *
- * > These are exercised by `RemuxTest`, `ConcatEngineTest` and `RealMediaBenchmark` in
- * > `androidTest` … **Do not read their 0% as untested.**
- *
- * That was right about the measurement boundary and right about FFprobe. It was not right that
- * these are only orchestration. The track walk is a **branch matrix**, and `androidTest` reaches it
- * only through whatever the committed fixtures happen to contain — so none of the rules below is
- * *chosen* by any test there. A fixture with two video tracks, a track that omits its duration, or
- * an audio-before-video ordering is not something a device test would produce on purpose.
- *
- * The seam is the answer #133 preferred over driving `ShadowMediaExtractor`: the walk is a pure
- * function over `List<MediaFormat>`, and what is left needing a device — `setDataSource`,
- * `getTrackFormat`, `release` — is the thin edge `androidTest` should be covering. This is the
- * `work/FailureOutcome.kt` pattern `CLAUDE.md` names.
- *
- * `MediaFormat` is a real one throughout, not a stub. `MediaProbeTrackFieldsTest` records why that
- * matters: it is a heterogeneous map whose getters throw rather than coerce, and a hand-rolled
- * double would not reproduce that.
- */
-@RunWith(RobolectricTestRunner::class)
-class MediaProbeTrackWalkTest {
-
-    // --- extractedFrom: the conversion flow's read ---------------------------
-
-    @Test
-    fun `the first video track wins when a file carries two`() {
-        // `video == null` is the entire guard. A file with two video tracks must report the first,
-        // because that is the one an engine will transcode -- and the width and height must come
-        // from the same track, not be mixed across them.
-        val extracted = MediaProbe.extractedFrom(
-            listOf(
-                video(MediaFormat.MIMETYPE_VIDEO_AVC, width = 1920, height = 1080),
-                video(MediaFormat.MIMETYPE_VIDEO_HEVC, width = 640, height = 480),
-            ),
-        )
-
-        assertEquals("h264", extracted.videoCodec)
-        assertEquals(1920, extracted.width)
-        assertEquals(1080, extracted.height)
-    }
-
-    @Test
-    fun `the first audio track wins when a file carries two`() {
-        val extracted = MediaProbe.extractedFrom(
-            listOf(
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC),
-                audio(MediaFormat.MIMETYPE_AUDIO_OPUS),
-            ),
-        )
-
-        assertEquals("aac", extracted.audioCodec)
-    }
-
-    @Test
-    fun `duration is the longest track, not the first or the last`() {
-        // A file whose audio outlasts its video is ordinary. Taking the video's length would cut
-        // the progress bar short; taking the last track's would be right only by accident of order.
-        val extracted = MediaProbe.extractedFrom(
-            listOf(
-                video(MediaFormat.MIMETYPE_VIDEO_AVC, durationUs = 10_000_000),
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC, durationUs = 12_500_000),
-                audio(MediaFormat.MIMETYPE_AUDIO_OPUS, durationUs = 1_000_000),
-            ),
-        )
-
-        assertEquals(12_500L, extracted.durationMs)
-    }
-
-    @Test
-    fun `a track that does not declare its duration contributes nothing to it`() {
-        // MediaExtractor omits KEY_DURATION for plenty of real tracks -- MediaProbeTrackFieldsTest
-        // records the same for KEY_FRAME_RATE. Reading a key that is absent is what containsKey
-        // stands between us and.
-        val extracted = MediaProbe.extractedFrom(
-            listOf(
-                video(MediaFormat.MIMETYPE_VIDEO_AVC),
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC, durationUs = 7_000_000),
-            ),
-        )
-
-        assertEquals(7_000L, extracted.durationMs)
-    }
-
-    @Test
-    fun `declaring audio before video changes nothing`() {
-        // Track order is a property of the container, not of the content. Both orderings have to
-        // reach the same answer or the same file remuxed twice would probe differently.
-        val videoFirst = MediaProbe.extractedFrom(
-            listOf(
-                video(MediaFormat.MIMETYPE_VIDEO_AVC, width = 1280, height = 720),
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC),
-            ),
-        )
-        val audioFirst = MediaProbe.extractedFrom(
-            listOf(
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC),
-                video(MediaFormat.MIMETYPE_VIDEO_AVC, width = 1280, height = 720),
-            ),
-        )
-
-        assertEquals(videoFirst.videoCodec, audioFirst.videoCodec)
-        assertEquals(videoFirst.audioCodec, audioFirst.audioCodec)
-        assertEquals(videoFirst.width, audioFirst.width)
-        assertEquals(videoFirst.height, audioFirst.height)
-    }
-
-    @Test
-    fun `a track that is neither audio nor video is ignored`() {
-        // Subtitle and timed-metadata tracks are common in MKV and MP4. Neither prefix matches, so
-        // neither slot is filled -- and, importantly, a subtitle track must not be mistaken for the
-        // absence of an audio track by some later `else`.
-        val extracted = MediaProbe.extractedFrom(
-            listOf(
-                MediaFormat().apply { setString(MediaFormat.KEY_MIME, "text/vtt") },
-                video(MediaFormat.MIMETYPE_VIDEO_AVC),
-            ),
-        )
-
-        assertEquals("h264", extracted.videoCodec)
-        assertNull(extracted.audioCodec)
-    }
-
-    @Test
-    fun `a file with no tracks reports nothing rather than zero-width video`() {
-        val extracted = MediaProbe.extractedFrom(emptyList())
-
-        assertNull(extracted.videoCodec)
-        assertNull(extracted.audioCodec)
-        assertEquals(0L, extracted.durationMs)
-        assertEquals(0, extracted.width)
-        assertEquals(0, extracted.height)
-    }
-
-    @Test
-    fun `an audio-only file reports no video codec at all`() {
-        // The distinction MediaProbe.classify turns into InputKind.AUDIO_ONLY, and the reason
-        // `hasVideo` exists: an audio file and a corrupt file must not look alike.
-        val extracted = MediaProbe.extractedFrom(listOf(audio(MediaFormat.MIMETYPE_AUDIO_AAC)))
-
-        assertNull(extracted.videoCodec)
-        assertEquals("aac", extracted.audioCodec)
-        assertEquals(0, extracted.width)
-    }
-
-    // --- concatInputFrom: the join flow's read -------------------------------
-
-    @Test
-    fun `the join read takes frame rate from the first video track`() {
-        val input = MediaProbe.concatInputFrom(
-            listOf(
-                video(MediaFormat.MIMETYPE_VIDEO_AVC, width = 1920, height = 1080, frameRate = 30),
-                video(MediaFormat.MIMETYPE_VIDEO_HEVC, width = 640, height = 480, frameRate = 60),
-                audio(MediaFormat.MIMETYPE_AUDIO_AAC),
-            ),
-        )
-
-        assertEquals("h264", input.videoCodec)
-        assertEquals("aac", input.audioCodec)
-        assertEquals(1920, input.width)
-        assertEquals(1080, input.height)
-        assertEquals(30, input.frameRate)
-    }
-
-    @Test
-    fun `a video track with no declared frame rate reports zero rather than guessing`() {
-        // ConcatPlanner treats 0 as "cannot prove a match" and re-encodes. A guessed 30 would read
-        // as agreement and produce a stream copy of clips that do not actually match -- the failure
-        // its KDoc says the whole flow is arranged to avoid.
-        val input = MediaProbe.concatInputFrom(listOf(video(MediaFormat.MIMETYPE_VIDEO_AVC)))
-
-        assertEquals(0, input.frameRate)
-    }
-
-    @Test
-    fun `a file with no tracks joins as entirely unknown`() {
-        val input = MediaProbe.concatInputFrom(emptyList())
-
-        assertNull(input.videoCodec)
-        assertNull(input.audioCodec)
-        assertEquals(0, input.width)
-        assertEquals(0, input.height)
-        assertEquals(0, input.frameRate)
-    }
-
-    private fun video(
-        mime: String,
-        width: Int = 1920,
-        height: Int = 1080,
-        durationUs: Long? = null,
-        frameRate: Int? = null,
-    ): MediaFormat = MediaFormat.createVideoFormat(mime, width, height).apply {
-        durationUs?.let { setLong(MediaFormat.KEY_DURATION, it) }
-        frameRate?.let { setInteger(MediaFormat.KEY_FRAME_RATE, it) }
-    }
-
-    private fun audio(mime: String, durationUs: Long? = null): MediaFormat =
-        MediaFormat.createAudioFormat(mime, SAMPLE_RATE, CHANNELS).apply {
-            durationUs?.let { setLong(MediaFormat.KEY_DURATION, it) }
-        }
-
-    private companion object {
-        const val SAMPLE_RATE = 48_000
-        const val CHANNELS = 2
-    }
-}

app/src/test/java/org/libremediaconverter/convert/MessagelessFailureTest.kt

@@ -1,213 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.ListenableWorker
-import androidx.work.testing.TestListenableWorkerBuilder
-import androidx.work.workDataOf
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotNull
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.join.JoinState
-import org.libremediaconverter.join.JoinViewModel
-import org.libremediaconverter.model.ConversionRequest
-import org.libremediaconverter.model.EnginePreference
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.work.ConcatWorker
-import org.libremediaconverter.work.ConversionWorker
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.io.File
-import java.util.UUID
-
-/**
- * A failure that says nothing still has to say something.
- *
- * Three sites, all `ci == 0` before this file, and all the same rule:
- *
- * ```
- * work/ConversionWorker.kt:316     cause.message ?: GENERIC_FAILURE_MESSAGE
- * convert/ConversionViewModel.kt:631   e.message ?: SAVE_FAILED_MESSAGE
- * join/JoinViewModel.kt:416           e.message ?: SAVE_FAILED_MESSAGE
- * ```
- *
- * Every existing test throws *with* a message, so the right-hand side had never been evaluated
- * anywhere in the suite. A `Throwable` carrying none is not exotic — `RuntimeException()`,
- * `IOException()` and most platform exceptions raised without an argument all have a null message.
- *
- * ## Held in one class, against the ticket's suggestion
- *
- * #193 proposed putting each case beside the behaviour it neighbours. They are together instead,
- * because they are one rule at three layers and because the trap below has to be explained once
- * rather than three times. `FailedSaveRetryTest` sets the precedent for both ViewModels in one
- * file; this extends it by one worker.
- *
- * ## The trap, which is why the worker case asserts what it does
- *
- * `ConversionStateMappingTest`'s *"a failure with nothing said still says something"* looks like it
- * already covers the worker site. It does not: it drives the **read** side, `map(FAILED, Data.EMPTY)`,
- * and that side has a fallback of its own (`ConversionViewModel.kt:147-149`):
- *
- * ```kotlin
- * update.outputData.getString(ConversionWorker.KEY_ERROR)
- *     ?.takeIf { it.isNotBlank() }
- *     ?: ConversionWorker.GENERIC_FAILURE_MESSAGE
- * ```
- *
- * So mutating the worker's fallback to `.orEmpty()` writes `KEY_ERROR to ""`, and the ViewModel
- * turns that straight back into the same constant. **A test asserting on the resulting `Failed`
- * state stays green under the mutation**, which is most likely why the write-side fallback survived
- * three waves of test work. The worker case therefore reads `KEY_ERROR` off the worker's own
- * `Result`, before anything downstream can repair it.
- *
- * The two save cases have no such second line: both write `_state.value` directly, so the state is
- * the right thing to assert there.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class MessagelessFailureTest {
-
-    private lateinit var app: Application
-    private lateinit var publisher: RecordingPublisher
-    private lateinit var staged: File
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        publisher = RecordingPublisher(app)
-        ConversionDependencies.publisher = { publisher }
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-        staged = publisher.createStagingFile("holiday.mp4").apply { writeBytes(ByteArray(4096)) }
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    /**
-     * The engine gives up without saying why, which is what a native crash looks like from here.
-     *
-     * Asserted on the worker's own output `Data` rather than on a screen — see the class KDoc.
-     */
-    @Test
-    fun `a conversion that fails without a message still reports one`() {
-        installTestWorkManager(app, Data.EMPTY)
-        ConversionDependencies.software = { MessagelessTranscoder }
-
-        val result = runBlocking { failingWorker().doWork() }
-
-        assertTrue("the job must fail rather than retry, got $result", result is ListenableWorker.Result.Failure)
-        assertEquals(
-            "a failure with no message must still put something on screen",
-            ConversionWorker.GENERIC_FAILURE_MESSAGE,
-            (result as ListenableWorker.Result.Failure).outputData.getString(ConversionWorker.KEY_ERROR),
-        )
-    }
-
-    @Test
-    fun `a save that fails without a message still reports one`() {
-        installTestWorkManager(app, conversionOutput())
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        viewModel.onInputPicked(Uri.parse("content://test/holiday.mkv"))
-        awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
-        viewModel.convert()
-        awaitState(viewModel.state, "Converted") { it is ConversionState.Converted }
-
-        publisher.publishFailure = RuntimeException()
-        viewModel.save(DESTINATION)
-
-        val failed = awaitState(viewModel.state, "Failed") { it is ConversionState.Failed } as ConversionState.Failed
-        assertEquals(SAVE_FAILED_MESSAGE, failed.message)
-        // The handle travels even on the wordless path. Without this, a fallback that also dropped
-        // `pending` would pass -- and the file would be unreachable from the screen that just said
-        // the save failed.
-        assertNotNull("a wordless failure must still offer the file again", failed.retry)
-    }
-
-    @Test
-    fun `a join save that fails without a message still reports one`() {
-        installTestWorkManager(app, joinOutput())
-        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
-        viewModel.onInputsPicked(listOf(Uri.parse("content://test/a.mp4"), Uri.parse("content://test/b.mp4")))
-        awaitState(viewModel.state, "Ready") { it is JoinState.Ready }
-        viewModel.join()
-        awaitState(viewModel.state, "Joined") { it is JoinState.Joined }
-
-        publisher.publishFailure = RuntimeException()
-        viewModel.save(DESTINATION)
-
-        val failed = awaitState(viewModel.state, "Failed") { it is JoinState.Failed } as JoinState.Failed
-        assertEquals(SAVE_FAILED_MESSAGE, failed.message)
-        assertNotNull("a wordless failure must still offer the file again", failed.retry)
-    }
-
-    /**
-     * `FORCE_SOFTWARE` so the failure comes straight out of `runFFmpeg`.
-     *
-     * `AUTO` would enter `runMedia3OrFallBack`, whose catch runs the job a second time in software
-     * — the same exception would arrive, but through a path this test is not about and which
-     * `HardwareFallbackTest` already owns.
-     */
-    private fun failingWorker(): ConversionWorker {
-        val spec = OutputFormat.MP4_H265.spec
-        return TestListenableWorkerBuilder<ConversionWorker>(
-            context = app,
-            inputData = workDataOf(
-                ConversionWorker.KEY_INPUT_URI to "file:///tmp/holiday.mp4",
-                ConversionWorker.KEY_DISPLAY_NAME to "holiday.mp4",
-                ConversionWorker.KEY_CONTAINER to spec.container.name,
-                ConversionWorker.KEY_VIDEO_CODEC to spec.videoCodec.name,
-                ConversionWorker.KEY_AUDIO_CODEC to spec.audioCodec.name,
-                ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
-            ),
-            runAttemptCount = 0,
-        ).setId(JOB_ID).build()
-    }
-
-    private fun conversionOutput() = workDataOf(
-        ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath,
-        ConversionWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
-        ConversionWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
-    )
-
-    private fun joinOutput() = workDataOf(
-        ConcatWorker.KEY_OUTPUT_PATH to staged.absolutePath,
-        ConcatWorker.KEY_SUGGESTED_NAME to SUGGESTED_NAME,
-        ConcatWorker.KEY_MIME_TYPE to JOB_MIME_TYPE,
-    )
-
-    private companion object {
-        val DESTINATION: Uri = Uri.parse("content://test/destination.mp4")
-        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000019a")
-        const val SUGGESTED_NAME = "holiday.mp4"
-        const val JOB_MIME_TYPE = "video/mp4"
-    }
-}
-
-/**
- * An engine that gives up without saying why.
- *
- * `RuntimeException()` rather than a subclass with a blank message: `Throwable.message` is *null*
- * here, which is the case the elvis exists for. A blank-but-present message takes the left-hand
- * side and is a different path — `ConversionStateMappingTest` covers that one, on the read side.
- */
-@UnstableApi
-private object MessagelessTranscoder : SoftwareTranscoder {
-    override suspend fun run(
-        request: ConversionRequest,
-        inputPath: String,
-        output: File,
-        durationMs: Long,
-        onProgress: (Int) -> Unit,
-    ): Unit = throw RuntimeException()
-}

app/src/test/java/org/libremediaconverter/convert/OutputPublisherPublishTest.kt

@@ -232,12 +232,6 @@ class OutputPublisherPublishTest {
             RowShape.NO_SIZE_COLUMN to "a cursor with no SIZE column",
             RowShape.NULL_SIZE to "a cursor whose SIZE cell is null",
             RowShape.NO_ROWS to "a cursor holding no rows",
-            // The third case the KDoc names -- "a resolver call that throws" -- and the one the
-            // list was missing. It reaches `?: false` through `runCatching` rather than through a
-            // cursor answer, so it is the only one of the four that proves the catch is load
-            // bearing: a provider that revokes its grant between the picker and the write must not
-            // have its document deleted on the way out.
-            RowShape.QUERY_THROWS to "a provider that throws out of query",
         ).forEach { (shape, description) ->
             FakeSafProvider.deleteRequests.clear()
             FakeSafProvider.backingFile(documentUri).writeBytes(ByteArray(0))

app/src/test/java/org/libremediaconverter/convert/OutputPublisherStagingTest.kt

@@ -122,25 +122,24 @@ class OutputPublisherStagingTest {
 
     /**
      * Makes `cacheDir/conversions` a regular file, which is the whole precondition of the test
-     * above -- and does it in a loop, because a single delete-then-write once lost a race that CI
-     * caught and this machine did not reproduce.
+     * above -- and does it in a loop, because a single delete-then-write loses a race that CI
+     * caught and this machine does not reproduce.
      *
-     * **That race is closed at the source as of #159, and the loop is kept anyway.**
-     * `LibreMediaConverterApp.onCreate` launched its staging sweep on `Dispatchers.IO`, and
-     * `sweepStaging` reads `stagingDir`, whose getter calls `mkdirs()`. Robolectric builds an
-     * application for every test class that asks for one, so that background `mkdirs()` was in
-     * flight across the whole suite, on a thread the paused main looper does not control. Between
-     * deleting this path and writing it there is a window where the path does not exist and that
-     * `mkdirs()` could win -- `FileNotFoundException: ... (Is a directory)` out of `writeBytes`,
-     * run 33069641674 on #149, once, against 468 tests that passed here. The JVM suite now runs
-     * `TestLibreMediaConverterApp`, whose sweep finishes before `onCreate()` returns, so nothing is
-     * sweeping while a test body runs.
+     * `LibreMediaConverterApp.onCreate` ends with
+     * `appScope.launch { OutputPublisher(...).sweepStaging() }` on `Dispatchers.IO`, and
+     * `sweepStaging` reads `stagingDir`, whose getter calls `mkdirs()`. Robolectric instantiates
+     * the application for every test that asks for one, so that background `mkdirs()` is in flight
+     * across the whole suite, on a thread the paused main looper does not control. Between deleting
+     * this path and writing it there is a window where the path does not exist and that `mkdirs()`
+     * can win, which is `FileNotFoundException: ... (Is a directory)` out of `writeBytes` -- run
+     * 33069641674 on #149, once, against 468 tests that pass here.
      *
-     * The loop stays because it is what would catch that substitution being undone. Without it the
-     * regression returns as this one class failing rarely on CI -- the exact shape that took #159
-     * from a single run on #149 to a wave-4 flake before anyone chased it. Retrying closes the
-     * window rather than narrowing it, because the race is not symmetric: `mkdirs()` fails on an
-     * existing regular file, so the invariant only has to survive being *established*.
+     * Retrying closes it rather than narrowing it, because the race is not symmetric: `mkdirs()`
+     * fails on an existing regular file, so the invariant only has to survive being *established*.
+     * Once a write lands, nothing in the suite can turn this back into a directory.
+     *
+     * The wider problem -- application-scope IO work racing every Robolectric test that shares
+     * `cacheDir` -- is #159, and is deliberately not fixed here.
      */
     private fun stagingPathAsRegularFile(): File {
         val stagingPath = File(cacheDir, "conversions")

app/src/test/java/org/libremediaconverter/convert/RetrySaveMimeTest.kt

@@ -1,136 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import android.content.Intent
-import android.net.Uri
-import androidx.activity.ComponentActivity
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.performClick
-import androidx.compose.ui.test.performScrollTo
-import androidx.media3.common.util.UnstableApi
-import androidx.work.WorkManager
-import androidx.work.workDataOf
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.ui.TestTags
-import org.libremediaconverter.work.ConversionWorker
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import org.robolectric.Shadows.shadowOf
-import java.io.File
-
-/**
- * The save dialog opens with the type the *job* produced, not the type the picker is showing now.
- *
- * `ConverterScreen.kt:80` — `state.pendingSave()?.mimeType ?: settings.spec.mimeType` — had never
- * taken its left-hand side. Its comment records what the line is for:
- *
- * > a retry offered after a failed save opens the dialog with the type its first attempt used —
- * > the cast answered null for a `Failed`, and the fallback below is the current picker, which a
- * > reattached job never set.
- *
- * So the untested half is the fix, and the tested half is the fallback it was added to stop being
- * used.
- *
- * ## This revises a named exemption, deliberately
- *
- * `FailedSaveRetryTest`'s KDoc lists this line under "Not asserted here, so each is a decision
- * rather than an omission":
- *
- * > It lives in the entry point, above the `ScreenContent` seam, and reaching it needs a real
- * > ViewModel inside a composition.
- *
- * That was true when written. `AdaptiveShellTest` (#173) then established exactly that capability,
- * and #200 added the two `ShadowActivity` mechanics that let a test read what a launcher launched.
- * The reason the exemption gave no longer holds, so the exemption is withdrawn rather than left to
- * be taken at face value — the same shape as #141 revising #84's boundary. That KDoc is corrected
- * in this change.
- *
- * ## Why the job is reattached rather than run
- *
- * The screen composes its own ViewModel through `viewModel()`, so nothing can be injected into it.
- * A job finished before the composition is the one route to a `Converted` state carrying output
- * `Data` this test chose — and it is also the case the line exists for, since a reattached job's
- * spec "was never in these settings at all".
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class RetrySaveMimeTest {
-
-    @get:Rule
-    val composeRule = createAndroidComposeRule<ComponentActivity>()
-
-    private lateinit var app: Application
-    private lateinit var staged: File
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-        staged = OutputPublisher(app).createStagingFile("holiday.mkv").apply { writeBytes(ByteArray(4096)) }
-    }
-
-    @After
-    fun tearDown() = ConversionDependencies.reset()
-
-    @Test
-    fun `the save dialog offers the type the job produced, not the one the picker is showing`() {
-        finishAJobProducing(JOB_MIME_TYPE)
-        composeRule.setContent { ConverterScreen() }
-        composeRule.waitForIdle()
-
-        composeRule.onNodeWithTag(TestTags.SAVE_FILE).performScrollTo().performClick()
-        composeRule.waitForIdle()
-
-        val intent = requireNotNull(shadowOf(composeRule.activity).nextStartedActivityForResult) {
-            "the save dialog was never launched"
-        }.intent
-        assertEquals(Intent.ACTION_CREATE_DOCUMENT, intent.action)
-        assertEquals(JOB_MIME_TYPE, intent.type)
-        // The fixture is only meaningful while the two differ; without this the assertion above
-        // would pass just as well against the fallback.
-        assertNotEquals(
-            "the picker's own type must differ, or this test proves nothing",
-            JOB_MIME_TYPE,
-            OutputFormat.MP4_H265.spec.mimeType,
-        )
-    }
-
-    /**
-     * A conversion that finished while nothing was watching, which is what `reattach()` picks up.
-     *
-     * `SucceedingWorkerFactory` reports this output `Data` for whatever is enqueued, so the job
-     * lands `SUCCEEDED` carrying a staged path that exists — the two things `Reattachment.choose`
-     * requires of a finished job.
-     */
-    private fun finishAJobProducing(mimeType: String) {
-        installTestWorkManager(
-            app,
-            workDataOf(
-                ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath,
-                ConversionWorker.KEY_SUGGESTED_NAME to "holiday.mkv",
-                ConversionWorker.KEY_MIME_TYPE to mimeType,
-            ),
-        )
-        WorkManager.getInstance(app).enqueue(
-            ConversionWorker.request(
-                inputUri = Uri.parse("content://test/holiday.mkv"),
-                displayName = "holiday.mkv",
-                sizeBytes = 4_096L,
-            ),
-        ).result.get()
-    }
-
-    private companion object {
-        /** Matroska, against the MP4 the picker defaults to. */
-        const val JOB_MIME_TYPE = "video/x-matroska"
-    }
-}

app/src/test/java/org/libremediaconverter/convert/ScreenWiringTest.kt

@@ -1,241 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.workDataOf
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.join.JoinState
-import org.libremediaconverter.join.JoinViewModel
-import org.libremediaconverter.join.joinActions
-import org.libremediaconverter.model.AudioCodec
-import org.libremediaconverter.model.Container
-import org.libremediaconverter.model.EnginePreference
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.model.QualityTier
-import org.libremediaconverter.model.VideoCodec
-import org.libremediaconverter.work.ConcatWorker
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * That each affordance is wired to the ViewModel method it is named after.
- *
- * ## What this covers that no other test can
- *
- * `ConverterScreenContentTest`, `ConverterStateAffordancesTest` and `JoinScreenContentTest` all
- * drive the **stateless** content composables, which build their own `ConverterActions`. So the
- * wiring — the list of `viewModel::` references the stateful outer hands down — was seen by nothing
- * in the suite.
- *
- * ## The hazard is narrower than "seventeen bindings", and this says so
- *
- * #156 was filed claiming a transposition of any two bindings would survive the suite. That is not
- * true, and it was worth checking rather than testing on the assumption:
- *
- * | swap | result |
- * |---|---|
- * | `onVideoCodec` ↔ `onAudioCodec` | **rejected by the compiler** |
- * | `onCancel` ↔ `onReset` | **compiles** |
- *
- * Every typed binding — container, both codecs, preset, suggestion, quality, engine preference —
- * takes a distinct parameter type, so the compiler is already the test. Writing assertions for
- * those would be theatre.
- *
- * **The `() -> Unit` bindings are the real gap**, because they are interchangeable to the compiler:
- * two on the converter screen (`onCancel`, `onReset`) and three on the join screen (`onJoin`,
- * `onCancel`, `onReset`). A Cancel that discards the finished file, or a Join that cancels, is a
- * one-character mistake that ships.
- *
- * ## How they are told apart
- *
- * By effect, not by a recording double. `reset()` sets the state to `Idle`; `cancel()` with no
- * active job leaves it alone (`ConversionViewModel.cancel` is `activeWorkId?.let(...)`, and
- * `SettingsEditsTest` pins that). Driving each from a non-`Idle` state is therefore enough to say
- * which one ran.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class ScreenWiringTest {
-
-    private lateinit var app: Application
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        ConversionDependencies.publisher = { RecordingPublisher(app) }
-        ConversionDependencies.probe = { _, _ -> org.libremediaconverter.model.InputProbe() }
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    // --- the converter screen ----------------------------------------------
-
-    @Test
-    fun `Start over resets, and Cancel does not`() {
-        // The transposition that compiles. If onReset were bound to cancel, this stays on Ready.
-        installTestWorkManager(app, Data.EMPTY)
-        val pick = ParkedPickDispatcher()
-        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
-        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
-        viewModel.onInputPicked(INPUT_URI)
-        pick.runAll()
-        assertNotEquals(
-            "the fixture needs a non-Idle state or neither action is observable",
-            ConversionState.Idle,
-            viewModel.state.value,
-        )
-
-        actions.onReset()
-
-        assertEquals(ConversionState.Idle, viewModel.state.value)
-    }
-
-    @Test
-    fun `Cancel leaves the picked file on screen`() {
-        // The other half. Without it, a wiring with BOTH actions bound to reset passes the test
-        // above -- and that is exactly what a copy-paste of the wrong line produces.
-        installTestWorkManager(app, Data.EMPTY)
-        val pick = ParkedPickDispatcher()
-        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
-        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
-        viewModel.onInputPicked(INPUT_URI)
-        pick.runAll()
-        val before = viewModel.state.value
-
-        actions.onCancel()
-
-        assertEquals(
-            "Cancel must not throw away the pick the way Start over does",
-            before,
-            viewModel.state.value,
-        )
-    }
-
-    @Test
-    fun `each settings affordance reaches the setting it is named after`() {
-        // The typed bindings. The compiler already rejects a transposition among these, so this is
-        // not that assertion -- it is the cheaper one that each is bound to *something*, and that a
-        // binding dropped to `{}` during an edit would be caught.
-        installTestWorkManager(app, Data.EMPTY)
-        val pick = ParkedPickDispatcher()
-        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
-        val actions = converterActions(viewModel, onPickInput = {}, onConvert = {}, onSave = {})
-
-        actions.onPreset(OutputFormat.WEBM_VP9)
-        assertEquals(OutputFormat.WEBM_VP9.spec, viewModel.settings.value.spec)
-
-        actions.onContainer(Container.MKV)
-        assertEquals(Container.MKV, viewModel.settings.value.spec.container)
-
-        actions.onVideoCodec(VideoCodec.H264)
-        assertEquals(VideoCodec.H264, viewModel.settings.value.spec.videoCodec)
-
-        actions.onAudioCodec(AudioCodec.FLAC)
-        assertEquals(AudioCodec.FLAC, viewModel.settings.value.spec.audioCodec)
-
-        actions.onQuality(QualityTier.BEST)
-        assertEquals(QualityTier.BEST, viewModel.settings.value.quality)
-
-        actions.onEnginePreference(EnginePreference.FORCE_SOFTWARE)
-        assertEquals(EnginePreference.FORCE_SOFTWARE, viewModel.settings.value.enginePreference)
-
-        actions.onSuggestion(OutputFormat.MP4_H264.spec)
-        assertEquals(OutputFormat.MP4_H264.spec, viewModel.settings.value.spec)
-    }
-
-    @Test
-    fun `the launcher-backed actions are the ones the screen supplies`() {
-        // Not wired to the ViewModel at all, deliberately -- they need an ActivityResultLauncher.
-        // Asserted so that a later edit routing one of them at the ViewModel is noticed.
-        installTestWorkManager(app, Data.EMPTY)
-        val pick = ParkedPickDispatcher()
-        val viewModel = ConversionViewModel(app, pickDispatcher = pick)
-        val called = mutableListOf<String>()
-        val actions = converterActions(
-            viewModel,
-            onPickInput = { called += "pick" },
-            onConvert = { called += "convert" },
-            onSave = { called += "save:$it" },
-        )
-
-        actions.onPickInput()
-        actions.onConvert()
-        actions.onSave("holiday.mp4")
-
-        assertEquals(listOf("pick", "convert", "save:holiday.mp4"), called)
-    }
-
-    // --- the join screen, where three are interchangeable -------------------
-
-    @Test
-    fun `Start over resets the join, and Cancel does not`() {
-        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
-        val pick = ParkedPickDispatcher()
-        val viewModel = JoinViewModel(app, pickDispatcher = pick)
-        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
-        viewModel.onInputsPicked(TWO_INPUTS)
-        pick.runAll()
-        assertTrue(
-            "the fixture needs a non-Idle state: ${viewModel.state.value}",
-            viewModel.state.value !is JoinState.Idle,
-        )
-
-        actions.onReset()
-
-        assertEquals(JoinState.Idle, viewModel.state.value)
-    }
-
-    @Test
-    fun `Cancel leaves the picked files on screen`() {
-        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
-        val pick = ParkedPickDispatcher()
-        val viewModel = JoinViewModel(app, pickDispatcher = pick)
-        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
-        viewModel.onInputsPicked(TWO_INPUTS)
-        pick.runAll()
-        val before = viewModel.state.value
-
-        actions.onCancel()
-
-        assertEquals(before, viewModel.state.value)
-    }
-
-    @Test
-    fun `Join starts the job rather than cancelling or resetting it`() {
-        // The third of the join screen's interchangeable trio, and the one whose transposition is
-        // worst: a Join button bound to cancel does nothing at all, which reads as a dead button.
-        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
-        val pick = ParkedPickDispatcher()
-        val viewModel = JoinViewModel(app, pickDispatcher = pick)
-        val actions = joinActions(viewModel, onPickInputs = {}, onSave = {})
-        viewModel.onInputsPicked(TWO_INPUTS)
-        pick.runAll()
-
-        actions.onJoin()
-
-        assertTrue(
-            "Join must leave Ready for a running state, not sit still and not go Idle: " +
-                "${viewModel.state.value}",
-            viewModel.state.value is JoinState.Joining || viewModel.state.value is JoinState.Joined,
-        )
-    }
-
-    private companion object {
-        val INPUT_URI: Uri = Uri.parse("content://test/holiday.mov")
-        val TWO_INPUTS = listOf(
-            Uri.parse("content://test/a.mp4"),
-            Uri.parse("content://test/b.mp4"),
-        )
-    }
-}

app/src/test/java/org/libremediaconverter/convert/SettingsEditsTest.kt

@@ -1,197 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertNull
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.AudioCodec
-import org.libremediaconverter.model.Container
-import org.libremediaconverter.model.EnginePreference
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.model.QualityTier
-import org.libremediaconverter.model.VideoCodec
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * The seven one-line edits the settings sheet makes, and what each one leaves alone.
- *
- * ## Why these needed a file of their own
- *
- * `setPreset` was covered. The six beside it — `setContainer`, `setVideoCodec`, `setAudioCodec`,
- * `applySuggestion`, `setQuality`, `setEnginePreference` — and `cancel()` had **no coverage at
- * all**, which is the tell: they are reachable from the JVM suite by exactly the route `setPreset`
- * already takes, and nothing had asked.
- *
- * ## What is actually being asserted
- *
- * Not "the setter sets something". Each of these copies into a nested `OutputSpec`, so the failure
- * worth catching is **a setter that writes the right value into the wrong field, or that rebuilds
- * the spec and silently discards the other two**. So every test here asserts the field it changed
- * *and* that the rest of the spec survived — a `setContainer` implemented as
- * `it.copy(spec = OutputFormat.MP4_H265.spec.copy(container = container))` would pass a test that
- * only checked the container.
- *
- * `ConverterScreenContentTest` cannot cover this: it builds `ConverterActions` itself and never
- * touches the ViewModel. That the *screen* calls these is #156's, and neither implies the other.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class SettingsEditsTest {
-
-    private lateinit var app: Application
-    private lateinit var viewModel: ConversionViewModel
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        installTestWorkManager(app, Data.EMPTY)
-        viewModel = ConversionViewModel(app)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `choosing a preset replaces the whole spec`() {
-        viewModel.setPreset(OutputFormat.WEBM_VP9)
-
-        assertEquals(OutputFormat.WEBM_VP9.spec, viewModel.settings.value.spec)
-    }
-
-    @Test
-    fun `changing the container leaves both codecs alone`() {
-        // Moved off the default spec first, and that is load-bearing rather than tidiness. The
-        // default IS `OutputFormat.MP4_H265.spec`, so a `setContainer` that rebuilt the spec from
-        // that preset instead of from the current one produced an identical answer and the
-        // mutation went green. Editing the codecs away from the default first is what makes
-        // "the other two survived" an assertion rather than a coincidence.
-        viewModel.setPreset(OutputFormat.WEBM_VP9)
-        val before = viewModel.settings.value.spec
-
-        viewModel.setContainer(Container.MKV)
-
-        val after = viewModel.settings.value.spec
-        assertEquals(Container.MKV, after.container)
-        assertEquals("the video codec is not the container's to change", before.videoCodec, after.videoCodec)
-        assertEquals("the audio codec is not the container's to change", before.audioCodec, after.audioCodec)
-    }
-
-    @Test
-    fun `changing the video codec leaves the container and the audio codec alone`() {
-        // The transposition this guards against is real: setVideoCodec and setAudioCodec take
-        // different enum types, but a copy(...) naming the wrong field compiles wherever the types
-        // happen to line up, and the picker would silently set the other one.
-        val before = viewModel.settings.value.spec
-
-        viewModel.setVideoCodec(VideoCodec.VP9)
-
-        val after = viewModel.settings.value.spec
-        assertEquals(VideoCodec.VP9, after.videoCodec)
-        assertEquals(before.container, after.container)
-        assertEquals(before.audioCodec, after.audioCodec)
-    }
-
-    @Test
-    fun `changing the audio codec leaves the container and the video codec alone`() {
-        val before = viewModel.settings.value.spec
-
-        viewModel.setAudioCodec(AudioCodec.OPUS)
-
-        val after = viewModel.settings.value.spec
-        assertEquals(AudioCodec.OPUS, after.audioCodec)
-        assertEquals(before.container, after.container)
-        assertEquals(before.videoCodec, after.videoCodec)
-    }
-
-    @Test
-    fun `applying a suggestion replaces the spec without disturbing quality or engine`() {
-        // A suggestion comes from ContainerCapabilities when the current spec is invalid, so it is
-        // a whole spec by construction. What it must not do is reset the two settings beside it.
-        viewModel.setQuality(QualityTier.BEST)
-        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
-
-        viewModel.applySuggestion(OutputFormat.MKV_H264.spec)
-
-        val settings = viewModel.settings.value
-        assertEquals(OutputFormat.MKV_H264.spec, settings.spec)
-        assertEquals(QualityTier.BEST, settings.quality)
-        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
-    }
-
-    @Test
-    fun `changing the quality leaves the spec and the engine preference alone`() {
-        // Both neighbours are moved off their defaults first. Asserting against AUTO -- which is
-        // what `ConversionSettings` starts with -- let a `setQuality` that also reset the engine
-        // preference to AUTO pass, because the reset and the survival looked identical.
-        viewModel.setPreset(OutputFormat.WEBM_VP9)
-        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
-        val before = viewModel.settings.value.spec
-
-        viewModel.setQuality(QualityTier.BEST)
-
-        val settings = viewModel.settings.value
-        assertEquals(QualityTier.BEST, settings.quality)
-        assertEquals(before, settings.spec)
-        assertEquals(
-            "quality is not the engine preference's to change",
-            EnginePreference.FORCE_SOFTWARE,
-            settings.enginePreference,
-        )
-    }
-
-    @Test
-    fun `changing the engine preference leaves the spec and the quality alone`() {
-        // Off the defaults for the same reason as the test above: QualityTier.FAST is the starting
-        // value, so asserting it here would have been satisfied by a reset as readily as by a
-        // survival.
-        viewModel.setPreset(OutputFormat.WEBM_VP9)
-        viewModel.setQuality(QualityTier.BEST)
-        val before = viewModel.settings.value.spec
-
-        viewModel.setEnginePreference(EnginePreference.FORCE_SOFTWARE)
-
-        val settings = viewModel.settings.value
-        assertEquals(EnginePreference.FORCE_SOFTWARE, settings.enginePreference)
-        assertEquals(before, settings.spec)
-        assertEquals(
-            "the engine preference is not the quality's to change",
-            QualityTier.BEST,
-            settings.quality,
-        )
-    }
-
-    @Test
-    fun `editing past every preset leaves no matching preset`() {
-        // `matchingPreset` is what the settings sheet reads to decide whether to show a preset as
-        // selected or to say "Custom". Editing one field of a preset must drop it out of the list
-        // rather than leaving the old one highlighted.
-        viewModel.setPreset(OutputFormat.MP4_H265)
-        assertEquals(OutputFormat.MP4_H265, viewModel.settings.value.matchingPreset)
-
-        viewModel.setAudioCodec(AudioCodec.FLAC)
-
-        assertNull(
-            "an edited spec is no longer any preset, and the sheet says Custom",
-            viewModel.settings.value.matchingPreset,
-        )
-        assertNotEquals(OutputFormat.MP4_H265.spec, viewModel.settings.value.spec)
-    }
-
-    @Test
-    fun `cancelling with no active job does nothing rather than throwing`() {
-        // `activeWorkId?.let(...)` -- the null side. A user can reach Cancel through a state that
-        // has already finished, and taking the app down for it would be worse than doing nothing.
-        viewModel.cancel()
-
-        assertEquals(ConversionState.Idle, viewModel.state.value)
-    }
-}

app/src/test/java/org/libremediaconverter/convert/StaleLauncherResultTest.kt

@@ -1,147 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.WorkManager
-import androidx.work.workDataOf
-import kotlinx.coroutines.Dispatchers
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.join.JoinState
-import org.libremediaconverter.join.JoinViewModel
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.work.ConcatWorker
-import org.libremediaconverter.work.ConversionWorker
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * An answer that arrives after the screen has moved on does nothing.
- *
- * Four refusal arms, cold before this file:
- *
- * ```
- * convert/ConversionViewModel.kt:513   currentInput() ?: return
- * convert/ConversionViewModel.kt:600   pendingSave() ?: return
- * join/JoinViewModel.kt:316            (as? Ready)?.inputs ?: return
- * join/JoinViewModel.kt:390            pendingSave() ?: return
- * ```
- *
- * They are not merely defensive. `ConverterScreen.kt:91` wires `convert()` to the
- * **POST_NOTIFICATIONS result**, and `:83` wires `save()` to the CreateDocument result — so both
- * are entered by a system callback rather than by a tap, and a result redelivered after process
- * death arrives at a brand-new ViewModel sitting on `Idle`.
- *
- * ## The production change that came with this
- *
- * `currentInput()` used to answer for `Converting`, `Waiting` and `Converted` as well as `Ready`.
- * Those arms were unreachable by tapping Convert but reachable through that permission callback,
- * and reaching one enqueued a **second** job over a live one — `activeWorkId` overwritten, the
- * first job still running with an orphaned notification and nothing holding its id.
- *
- * #202 decided to narrow rather than to test it as it stood, because a test written against the old
- * shape would have frozen the double-enqueue as intended behaviour. `JoinViewModel.join()` has been
- * `(_state.value as? JoinState.Ready)?.inputs ?: return` all along; the two screens are the same
- * shape and only one was over-general.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class StaleLauncherResultTest {
-
-    private lateinit var app: Application
-    private lateinit var workManager: WorkManager
-    private lateinit var staged: java.io.File
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        val publisher = RecordingPublisher(app)
-        ConversionDependencies.publisher = { publisher }
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-        // A real staged file, because a SUCCEEDED job with no output path maps to Failed rather
-        // than Converted -- and Converted is the state this file's second case has to reach.
-        staged = publisher.createStagingFile("holiday.mp4").apply { writeBytes(ByteArray(4096)) }
-        installTestWorkManager(
-            app,
-            workDataOf(
-                ConversionWorker.KEY_OUTPUT_PATH to staged.absolutePath,
-                ConversionWorker.KEY_SUGGESTED_NAME to "holiday.mp4",
-                ConversionWorker.KEY_MIME_TYPE to "video/mp4",
-            ),
-        )
-        workManager = WorkManager.getInstance(app)
-    }
-
-    @After
-    fun tearDown() = ConversionDependencies.reset()
-
-    @Test
-    fun `a permission answer arriving on an empty screen enqueues nothing`() {
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        awaitState(viewModel.state, "Idle") { it is ConversionState.Idle }
-
-        viewModel.convert()
-
-        assertEquals(ConversionState.Idle, viewModel.state.value)
-        assertEquals("nothing may be enqueued for a file that is not there", 0, conversionJobs())
-    }
-
-    /**
-     * The narrowing itself: a permission answer that arrives while a conversion is already running
-     * must not start a second one.
-     *
-     * Reached by converting once — the synchronous test WorkManager finishes it inline, so the
-     * screen is `Converted`, which is one of the three arms `currentInput()` used to answer for.
-     * Calling `convert()` again from there is precisely what the permission callback can do.
-     */
-    @Test
-    fun `a permission answer arriving after the job finished does not start a second one`() {
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        viewModel.onInputPicked(Uri.parse("content://test/holiday.mkv"))
-        awaitState(viewModel.state, "Ready") { it is ConversionState.Ready }
-        viewModel.convert()
-        val converted = awaitState(viewModel.state, "Converted") { it is ConversionState.Converted }
-        assertEquals("the fixture needs exactly one job to start with", 1, conversionJobs())
-
-        viewModel.convert()
-
-        assertEquals("a second job must not be enqueued over the first", 1, conversionJobs())
-        assertEquals("and the screen must not move", converted, viewModel.state.value)
-    }
-
-    @Test
-    fun `a save answer arriving on an empty screen does nothing`() {
-        val viewModel = ConversionViewModel(app, Dispatchers.Unconfined)
-        awaitState(viewModel.state, "Idle") { it is ConversionState.Idle }
-
-        viewModel.save(DESTINATION)
-
-        assertEquals(ConversionState.Idle, viewModel.state.value)
-    }
-
-    @Test
-    fun `a join answer arriving on an empty screen enqueues nothing`() {
-        val viewModel = JoinViewModel(app, Dispatchers.Unconfined)
-        awaitState(viewModel.state, "Idle") { it is JoinState.Idle }
-
-        viewModel.join()
-        viewModel.save(DESTINATION)
-
-        assertEquals(JoinState.Idle, viewModel.state.value)
-        assertEquals(0, joinJobs())
-    }
-
-    private fun conversionJobs() = jobsTagged(ConversionWorker::class.java.name)
-
-    private fun joinJobs() = jobsTagged(ConcatWorker::class.java.name)
-
-    private fun jobsTagged(tag: String) = workManager.getWorkInfosByTag(tag).get().size
-
-    private companion object {
-        val DESTINATION: Uri = Uri.parse("content://test/destination.mp4")
-    }
-}

app/src/test/java/org/libremediaconverter/convert/UnreadableJoinInputTest.kt

@@ -1,70 +0,0 @@
-package org.libremediaconverter.convert
-
-import android.net.Uri
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.model.ConcatPlanner
-import org.libremediaconverter.model.ConcatStrategy
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * A clip in a join that nothing could read, from the probe all the way to the strategy.
- *
- * Both halves of this are covered already, and separately: `MediaProbeTrackWalkTest` pins what
- * `concatInputFrom` makes of a track list, and `ConcatPlannerTest`'s
- * `an unknown codec is not treated as a match` pins what the planner does with a hand-built
- * `ConcatInput(video = null)`. **Nothing spanned the two**, and the span is the load-bearing part:
- * the planner's safety rests on the probe really producing that shape, and the hand-built fixture
- * would go on passing if it stopped.
- *
- * Measured rather than asserted: mutating `concatInputFrom`'s initial `video` to a non-null
- * placeholder leaves `ConcatPlannerTest` green and turns this red.
- *
- * ## The asymmetry this protects
- *
- * `ConcatPlanner` guards its video check against a null codec (`ConcatStrategy.kt:51`) and its
- * audio check not at all (`:54`). **That is correct, not an oversight.** `MediaProbe.shortName`
- * returns a non-null `String`, so in `concatInputFrom` a null `audioCodec` means the track is
- * *absent* — and two clips with no audio genuinely do match. A null `videoCodec` carries both
- * meanings, absent or unreadable, which is why only that one is guarded.
- *
- * So the audio check is safe *because* the video guard fires first on a clip nothing could read.
- * Nothing wrote that coupling down and nothing held it.
- *
- * ## What this deliberately does not cover
- *
- * `probeForConcat`'s `catch` arm (`MediaProbe.kt:300-302`). It is **not reachable on the JVM**:
- * Robolectric's `MediaExtractor` never throws from `setDataSource`, measured across an
- * unregistered `content://` authority, a missing `file://`, a file of garbage bytes and an `http://`
- * URL — all four returned normally with `trackCount = 0`. So the failure arrives here as an empty
- * track list rather than as an exception, which reaches the same `ConcatInput(null, null, 0, 0, 0)`
- * by the other road. The catch stays device-only, and this file does not pretend otherwise.
- */
-@RunWith(RobolectricTestRunner::class)
-class UnreadableJoinInputTest {
-
-    @Test
-    fun `a clip nothing could read probes as unknown, and an unknown clip is re-encoded`() {
-        val unreadable = MediaProbe.probeForConcat(RuntimeEnvironment.getApplication(), UNREADABLE)
-
-        assertNull("an unreadable clip proves nothing about its video codec", unreadable.videoCodec)
-        assertNull("nor about its audio codec", unreadable.audioCodec)
-        assertEquals("nor about its dimensions", 0, unreadable.width)
-        assertEquals(0, unreadable.height)
-        assertEquals(0, unreadable.frameRate)
-
-        assertEquals(
-            "a clip nothing could read is not evidence of a match with anything",
-            ConcatStrategy.REENCODE,
-            ConcatPlanner.plan(listOf(unreadable, unreadable)),
-        )
-    }
-
-    private companion object {
-        /** `content://` so the probe takes the SAF branch a real pick takes. Nothing answers it. */
-        val UNREADABLE: Uri = Uri.parse("content://test/vanished.mp4")
-    }
-}

app/src/test/java/org/libremediaconverter/ffmpeg/FFmpegCommandBuilderTest.kt

@@ -166,54 +166,6 @@ class FFmpegCommandBuilderTest {
         assertPair(cmd(OutputFormat.OPUS), "-c:a", "libopus")
     }
 
-    /**
-     * The arm most conversions actually take, and the only one in `audioArgs` with no test.
-     *
-     * `flac wav and opus select the right encoders` above covers the three named arms; MP3 has its
-     * own. AAC arrives through the `else`, so nothing named it and nothing pinned either half of
-     * what it emits -- neither `aac` nor `192k` appeared anywhere in this file. Both are shipped
-     * defaults: MP4 and M4A are the formats the picker offers first, so this is the audio
-     * every ordinary conversion gets.
-     *
-     * The bitrate is asserted as well as the encoder because it is the half a refactor is likelier
-     * to lose. An `-b:a` that quietly changed would not fail anything, would not look wrong in a
-     * command line, and would show up only as files that sound different from the ones the app
-     * produced last month.
-     */
-    @Test
-    fun `aac is the default encoder, at the bitrate the app ships`() {
-        assertPair(cmd(OutputFormat.MP4_H264), "-c:a", "aac")
-        assertPair(cmd(OutputFormat.MP4_H264), "-b:a", "192k")
-        // Through the `else` rather than through a named arm, so an AAC branch added above it later
-        // has to keep answering the same way.
-        assertPair(cmd(OutputFormat.M4A_AAC), "-c:a", "aac")
-        assertPair(cmd(OutputFormat.M4A_AAC), "-b:a", "192k")
-    }
-
-    /**
-     * Turning audio off, which the Advanced picker offers and nothing had ever built a command for.
-     *
-     * `audioArgs`' `Drop` arm was `ci == 0`. The suite's only `-an` assertion is in
-     * `gif generates a palette to avoid banding and drops audio`, and that one comes from the image
-     * path (`FFmpegCommandBuilder.kt:79`/`:90`), which emits `-an` directly and never reaches
-     * `audioArgs`. Two sites, one string, one tested.
-     *
-     * It is a live path rather than defensive code: `AdvancedPicker` renders all of
-     * `AudioCodec.entries` including `NONE`, `ContainerCapabilities.validate` permits audio-off
-     * whenever the input has video, and MKV routes the job to FFmpeg.
-     *
-     * Both halves are asserted. `-an` alone would still pass if the arm fell through to the `else`
-     * and emitted an AAC encoder beside it -- a file that is silent because the flag won, carrying
-     * an encoder nobody asked for.
-     */
-    @Test
-    fun `turning audio off drops the track instead of encoding one`() {
-        val args = cmd(OutputSpec(Container.MKV, VideoCodec.H264, AudioCodec.NONE))
-
-        assertTrue("audio turned off must emit -an, got $args", args.contains("-an"))
-        assertFalse("a dropped track must not also carry an encoder, got $args", args.contains("-c:a"))
-    }
-
     @Test
     fun `audio only formats never carry a video encoder`() {
         listOf(OutputFormat.MP3, OutputFormat.FLAC, OutputFormat.WAV, OutputFormat.OPUS)

app/src/test/java/org/libremediaconverter/ffmpeg/SessionOutcomeTest.kt

@@ -1,127 +0,0 @@
-package org.libremediaconverter.ffmpeg
-
-import com.arthenica.ffmpegkit.ReturnCode
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * What a finished FFmpegKit session means, for both engines at once.
- *
- * `FFmpegEngine` and `ConcatEngine` each carried their own copy of this `when`, and the copies had
- * drifted: one preferred the fail stack trace and fell back to the log tail, the other only ever
- * read the log tail. Neither was tested, because both live inside a callback handed to `FFmpegKit`,
- * which does not run on the JVM — so nothing could see that the two disagreed.
- *
- * **JVM-safe, verified rather than assumed.** `javap` over the committed AAR's runtime jar shows
- * `ReturnCode(int)` as a plain public constructor with `SUCCESS`/`CANCEL` int constants and pure
- * static `isSuccess`/`isCancel`; its `<clinit>` is constant initialisation and loads no native
- * library.
- *
- * The unification is #203's decision, so the tests pin it as one: a join failure now carries the
- * stack trace a conversion failure always did, while the two prefixes stay distinct.
- */
-class SessionOutcomeTest {
-
-    @Test
-    fun `a return code of zero is success`() {
-        assertEquals(SessionOutcome.Success, outcome(ReturnCode(ReturnCode.SUCCESS)))
-    }
-
-    /**
-     * Cancellation is a separate outcome from failure, and the distinction is the point: the engines
-     * resume the continuation *cancelled* rather than exceptionally, so a user who pressed Cancel
-     * does not get an error card.
-     */
-    @Test
-    fun `a return code of 255 is a cancellation, not a failure`() {
-        assertEquals(SessionOutcome.Cancelled, outcome(ReturnCode(ReturnCode.CANCEL)))
-    }
-
-    @Test
-    fun `any other return code fails, and the sentence carries the number`() {
-        val failed = outcome(ReturnCode(1), stackTrace = "boom") as SessionOutcome.Failed
-
-        assertTrue("the code belongs in the message, got: ${failed.message}", failed.message.contains("(1)"))
-    }
-
-    /**
-     * The half that was different between the two engines before #203, now the same in both.
-     */
-    @Test
-    fun `the stack trace is preferred over the log tail`() {
-        val failed = outcome(ReturnCode(1), stackTrace = "the real cause", logTail = "…noise…")
-            as SessionOutcome.Failed
-
-        assertTrue(failed.message.contains("the real cause"))
-        assertTrue("the log tail must not be appended as well", !failed.message.contains("noise"))
-    }
-
-    @Test
-    fun `a blank stack trace falls back to the log tail`() {
-        val blank = outcome(ReturnCode(1), stackTrace = "   ", logTail = "the last few lines") as SessionOutcome.Failed
-        val absent = outcome(ReturnCode(1), stackTrace = null, logTail = "the last few lines") as SessionOutcome.Failed
-
-        assertTrue(blank.message.contains("the last few lines"))
-        assertTrue("a null stack trace is a blank one", absent.message.contains("the last few lines"))
-    }
-
-    /**
-     * Both sources empty still has to produce a sentence. A message ending in a dangling colon is
-     * thin, but it is what the user gets when FFmpeg said nothing at all, and it must not be an
-     * exception on the way to the screen.
-     */
-    @Test
-    fun `a failure with nothing to say still names the code`() {
-        val failed = outcome(ReturnCode(1), stackTrace = null, logTail = null) as SessionOutcome.Failed
-
-        assertEquals("FFmpeg failed (1): ", failed.message)
-    }
-
-    /**
-     * `getReturnCode()` is nullable and a session killed before it reported anything has none.
-     * Neither success nor cancellation, so it fails — and the sentence says so rather than throwing.
-     */
-    @Test
-    fun `a session with no return code at all fails`() {
-        val failed = outcome(null, logTail = "whatever was logged") as SessionOutcome.Failed
-
-        assertTrue("got: ${failed.message}", failed.message.startsWith("FFmpeg failed (null): "))
-    }
-
-    /**
-     * Unifying the *strategy* must not unify the *sentence*: the two engines describe different
-     * jobs, and a join that reports "FFmpeg failed" is a worse message than the one it replaced.
-     */
-    @Test
-    fun `each engine keeps its own prefix`() {
-        val join = sessionOutcome(ReturnCode(1), "Joining", { "cause" }, { null }) as SessionOutcome.Failed
-
-        assertTrue(join.message.startsWith("Joining failed (1): "))
-    }
-
-    /**
-     * Neither message source is read unless the outcome is a failure.
-     *
-     * They are calls onto a native session, and reading them on the happy path is work every
-     * successful conversion would do for nothing — which the shape this replaced did not, since it
-     * read them inside the `else` branch. That is why the parameters are lambdas, and this is what
-     * would notice if they stopped being.
-     */
-    @Test
-    fun `a session that succeeded reads neither the stack trace nor the log`() {
-        var reads = 0
-        fun counted(): String? {
-            reads++
-            return null
-        }
-
-        sessionOutcome(ReturnCode(ReturnCode.SUCCESS), "FFmpeg", ::counted, ::counted)
-        sessionOutcome(ReturnCode(ReturnCode.CANCEL), "FFmpeg", ::counted, ::counted)
-
-        assertEquals("neither source may be touched unless the session failed", 0, reads)
-    }
-
-    private fun outcome(rc: ReturnCode?, stackTrace: String? = null, logTail: String? = null) =
-        sessionOutcome(rc, "FFmpeg", { stackTrace }, { logTail })
-}

app/src/test/java/org/libremediaconverter/join/JoinStateMappingTest.kt

@@ -1,200 +0,0 @@
-package org.libremediaconverter.join
-
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.WorkInfo
-import androidx.work.workDataOf
-import org.junit.Assert.assertEquals
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.InputFile
-import org.libremediaconverter.model.ConcatStrategy
-import org.libremediaconverter.work.ConcatWorker
-import org.robolectric.RobolectricTestRunner
-
-/**
- * Every answer [joinStateFrom] can give, chosen rather than stumbled into.
- *
- * The join-side twin of `ConversionStateMappingTest`, and the argument is the same one: the mapping
- * ran on every test that drove a real `ConcatWorker`, but a real worker only ever reaches a terminal
- * state with well-formed output, so five arms had never been *chosen* by anything.
- *
- * ## The one that is not just coverage
- *
- * `an unknown strategy name is read as a re-encode rather than thrown` covers a real defect this
- * seam exposed. The line it replaces was:
- *
- * ```kotlin
- * .getString(ConcatWorker.KEY_STRATEGY)?.let(ConcatStrategy::valueOf) ?: ConcatStrategy.REENCODE
- * ```
- *
- * `valueOf` throws on a name this build does not define, and this runs inside a `viewModelScope`
- * collect with no handler — so it does not become a `Failed` state, it takes the process down.
- * `ConcatWorker.kt` had already made this exact change for `KEY_FORMAT` and written down why; the
- * matching read on this side had not been changed with it.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class JoinStateMappingTest {
-
-    @Test
-    fun `a running join is joining`() {
-        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.RUNNING))
-    }
-
-    @Test
-    fun `a blocked join looks like one that is starting`() {
-        // Folded into the RUNNING arm deliberately: a job waiting on a prerequisite is nothing the
-        // user can act on, and a separate word for it would be noise.
-        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.BLOCKED))
-    }
-
-    @Test
-    fun `an enqueued join that has already run is waiting to retry`() {
-        assertEquals(JoinState.Waiting(INPUTS), map(WorkInfo.State.ENQUEUED, runAttemptCount = 1))
-    }
-
-    @Test
-    fun `an enqueued join that has never run is simply starting`() {
-        // The other side. Without it, a mapping that ignored runAttemptCount passes the test above.
-        assertEquals(JoinState.Joining(INPUTS), map(WorkInfo.State.ENQUEUED, runAttemptCount = 0))
-    }
-
-    @Test
-    fun `a success that named no file is a failure, not an empty success`() {
-        assertEquals(
-            JoinState.Failed(JOINED_WITHOUT_A_FILE_MESSAGE),
-            map(WorkInfo.State.SUCCEEDED, data = Data.EMPTY),
-        )
-    }
-
-    @Test
-    fun `a success carries the strategy the worker actually used`() {
-        // Not cosmetic: the join screen tells the user whether their files were stream-copied or
-        // re-encoded, which is the difference between lossless and lossy.
-        val joined = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(
-                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
-                ConcatWorker.KEY_STRATEGY to ConcatStrategy.STREAM_COPY.name,
-            ),
-        ) as JoinState.Joined
-
-        assertEquals(ConcatStrategy.STREAM_COPY, joined.strategy)
-    }
-
-    @Test
-    fun `an unknown strategy name is read as a re-encode rather than thrown`() {
-        // The defect. A build that added a third strategy leaves finished joins in the queue naming
-        // it, and WorkManager keeps those about a week -- the premise WorkerEnumFallbackTest and
-        // JobTags are both written on. With `valueOf` this throws IllegalArgumentException inside a
-        // viewModelScope collect that has no handler, so it is not a Failed state, it is a crash.
-        //
-        // REENCODE rather than STREAM_COPY because it is the conservative answer: describing an
-        // unknown join as lossless would be a claim the app cannot support.
-        val joined = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(
-                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
-                ConcatWorker.KEY_STRATEGY to "SMART_CONCAT_V2",
-            ),
-        ) as JoinState.Joined
-
-        assertEquals(ConcatStrategy.REENCODE, joined.strategy)
-    }
-
-    @Test
-    fun `a success with no strategy at all falls back the same way`() {
-        val joined = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4"),
-        ) as JoinState.Joined
-
-        assertEquals(ConcatStrategy.REENCODE, joined.strategy)
-    }
-
-    @Test
-    fun `a success from older work falls back to the format such a job really used`() {
-        val joined = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4"),
-        ) as JoinState.Joined
-
-        assertEquals(ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT), joined.suggestedName)
-        assertEquals(ConcatWorker.DEFAULT_FORMAT.mimeType, joined.mimeType)
-    }
-
-    @Test
-    fun `a blank name or type falls back the same way a missing one does`() {
-        val joined = map(
-            WorkInfo.State.SUCCEEDED,
-            data = workDataOf(
-                ConcatWorker.KEY_OUTPUT_PATH to "/cache/conversions/joined.mp4",
-                ConcatWorker.KEY_SUGGESTED_NAME to "",
-                ConcatWorker.KEY_MIME_TYPE to "  ",
-            ),
-        ) as JoinState.Joined
-
-        assertEquals(ConcatWorker.outputNameFor(ConcatWorker.DEFAULT_FORMAT), joined.suggestedName)
-        assertEquals(ConcatWorker.DEFAULT_FORMAT.mimeType, joined.mimeType)
-    }
-
-    @Test
-    fun `a failure carries the reason the worker gave`() {
-        assertEquals(
-            JoinState.Failed("Not enough free space to join these files."),
-            map(
-                WorkInfo.State.FAILED,
-                data = workDataOf(
-                    ConcatWorker.KEY_ERROR to "Not enough free space to join these files.",
-                ),
-            ),
-        )
-    }
-
-    @Test
-    fun `a failure with nothing said still says something`() {
-        assertEquals(
-            JoinState.Failed(ConcatWorker.GENERIC_FAILURE_MESSAGE),
-            map(WorkInfo.State.FAILED, data = Data.EMPTY),
-        )
-    }
-
-    @Test
-    fun `a failure whose message is blank falls back like a missing one`() {
-        assertEquals(
-            JoinState.Failed(ConcatWorker.GENERIC_FAILURE_MESSAGE),
-            map(WorkInfo.State.FAILED, data = workDataOf(ConcatWorker.KEY_ERROR to " ")),
-        )
-    }
-
-    @Test
-    fun `a cancellation lands wherever the caller said it should`() {
-        // A join started here goes back to Ready with the picked files; one picked up by reattach
-        // goes to Idle, because those URIs belong to a process that no longer exists.
-        assertEquals(
-            JoinState.Ready(INPUTS),
-            map(WorkInfo.State.CANCELLED, cancelled = JoinState.Ready(INPUTS)),
-        )
-        assertEquals(JoinState.Idle, map(WorkInfo.State.CANCELLED, cancelled = JoinState.Idle))
-    }
-
-    private fun map(
-        state: WorkInfo.State,
-        runAttemptCount: Int = 0,
-        data: Data = Data.EMPTY,
-        cancelled: JoinState = JoinState.Ready(INPUTS),
-    ): JoinState = joinStateFrom(
-        JoinUpdate(state = state, runAttemptCount = runAttemptCount, outputData = data),
-        inputs = INPUTS,
-        cancelled = cancelled,
-    )
-
-    private companion object {
-        val INPUTS = listOf(
-            InputFile(Uri.parse("content://test/a.mp4"), "a.mp4", 1024L),
-            InputFile(Uri.parse("content://test/b.mp4"), "b.mp4", 2048L),
-        )
-    }
-}

app/src/test/java/org/libremediaconverter/join/SharedFailureMessagesTest.kt

@@ -1,102 +0,0 @@
-package org.libremediaconverter.join
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.ListenableWorker
-import androidx.work.testing.TestListenableWorkerBuilder
-import androidx.work.workDataOf
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.RecordingPublisher
-import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.work.ConcatWorker
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-
-/**
- * The two layers that refuse a short join, refusing it with one sentence.
- *
- * ## Why this is not "assert a constant equals itself"
- *
- * `ConcatWorker` and `JoinViewModel` both reject a join of fewer than two files, and before #158
- * each carried **its own copy of the literal**. Only the worker's was pinned — by `RefusedJobTest`,
- * added in #139 — so the wording on the screen could drift away from the wording in the job with no
- * test saying anything, for one message the user sees from one condition.
- *
- * Sharing a constant makes them agree by construction. What it does *not* do is prove that both
- * layers still reach it: a refactor that stops `JoinViewModel` refusing at all, or that gives it a
- * different message, passes any test that only reads `TOO_FEW_INPUTS_MESSAGE`. So each layer is
- * driven for real here — the ViewModel through `onInputsPicked`, the worker through `doWork` — and
- * the assertion is that the two answers are **the same string**, taken from two running layers
- * rather than from one declaration.
- *
- * That is the shape `CLAUDE.md` asks for: revert the sharing and this goes red, because the two
- * sites drift the moment they are allowed to.
- *
- * ## Scope
- *
- * The arity guard's own behaviour on the ViewModel side — that it refuses one file, that it accepts
- * two, that it claims ownership first — is #155's, and this deliberately does not duplicate it.
- * This file is about the *agreement between layers*, which is what #158 changed.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class SharedFailureMessagesTest {
-
-    private lateinit var app: Application
-    private lateinit var viewModel: JoinViewModel
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        ConversionDependencies.publisher = { RecordingPublisher(app) }
-        installTestWorkManager(app, workDataOf(ConcatWorker.KEY_OUTPUT_PATH to "/dev/null"))
-        viewModel = JoinViewModel(app)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `both layers refuse a one-file join with the same sentence`() {
-        // The ViewModel, refusing before anything is enqueued.
-        viewModel.onInputsPicked(listOf(ONE_FILE))
-        val fromScreen = (viewModel.state.value as JoinState.Failed).message
-
-        // The worker, refusing a job that reached the queue anyway -- which it can, because
-        // ConcatWorker.request(...) takes a List<Uri> and checks nothing about its length.
-        val result = runBlocking { worker(ONE_FILE).doWork() }
-        val fromJob = (result as ListenableWorker.Result.Failure)
-            .outputData.getString(ConcatWorker.KEY_ERROR)
-
-        assertEquals(
-            "the screen and the job must say the same thing about the same refusal",
-            fromScreen,
-            fromJob,
-        )
-        // And that the shared sentence is the one either layer would have written on its own,
-        // rather than both having drifted together to something else.
-        assertEquals(ConcatWorker.TOO_FEW_INPUTS_MESSAGE, fromScreen)
-    }
-
-    private fun worker(vararg inputs: Uri): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
-        context = app,
-        inputData = workDataOf(
-            ConcatWorker.KEY_INPUT_URIS to inputs.map(Uri::toString).toTypedArray(),
-            ConcatWorker.KEY_TOTAL_BYTES to 1024L,
-        ),
-        runAttemptCount = 0,
-    ).build()
-
-    private companion object {
-        val ONE_FILE: Uri = Uri.parse("content://test/holiday.mp4")
-    }
-}

app/src/test/java/org/libremediaconverter/model/ContainerCapabilitiesTest.kt

@@ -451,99 +451,6 @@ class ContainerCapabilitiesTest {
         }
     }
 
-    /**
-     * The video twin of `no audio track is accepted by every container in both modes`.
-     *
-     * Dead in production today, and deliberately so: every caller guards `NONE` before asking the
-     * matrix, so nothing reaches this arm through the app. **The asymmetry is the argument, not the
-     * reachability** -- its audio counterpart at the top of the same `when` has had a dedicated
-     * test since #136, and one of a matched pair being covered is how a later reader concludes the
-     * other was considered and exempted. It was not; it was simply missed.
-     *
-     * Not the same shape as the two `COPY -> error(...)` arms, which `docs/coverage-read-findings.md`
-     * records as a named exemption (F4). Those are guards that must not be provokable. This is a
-     * documented answer -- "no video track fits anywhere" -- and an answer is a thing to pin.
-     */
-    @Test
-    fun `no video track is accepted by every container in both modes`() {
-        Container.entries.forEach { container ->
-            listOf(CodecMode.COPY, CodecMode.ENCODE).forEach { mode ->
-                assertTrue(
-                    "$container should accept no video track ($mode)",
-                    ContainerCapabilities.accepts(container, VideoCodec.NONE, mode),
-                )
-            }
-        }
-    }
-
-    /**
-     * A suggestion that keeps the codec the user asked for, rather than falling back to the
-     * container's first encodable one.
-     *
-     * `repairVideo`'s third arm -- "the request is not a copy, and this container can encode it" --
-     * is the one that preserves intent, and it was the only arm of the four nothing reached. The
-     * property test above executes `repairVideo` on every case it walks and lands elsewhere each
-     * time: an explicit COPY that works, a source the container can carry untouched, or no video
-     * track at all.
-     *
-     * The route is indirect because it is the only one the app has. VP9 into WebM is a perfectly
-     * good video request; what makes it invalid is the *audio* -- WebM carries Opus and Vorbis, not
-     * AAC. So `validateAudio` refuses, `suggestions` looks for a container that can hold what was
-     * asked for, and MP4 can encode VP9. The suggestion has to come back carrying VP9: swapping to
-     * the container's first encodable codec would discard the choice the user made.
-     */
-    @Test
-    fun `a repaired suggestion keeps the video codec the user chose`() {
-        val invalid = ContainerCapabilities.validate(
-            OutputSpec(Container.WEBM, VideoCodec.VP9, AudioCodec.AAC),
-            h264Source,
-        )
-
-        assertTrue("WebM cannot hold AAC, so this spec is invalid", invalid is Validation.Invalid)
-        val suggestions = (invalid as Validation.Invalid).suggestions
-        assertTrue(
-            "expected a suggestion that still encodes VP9, got $suggestions",
-            suggestions.any { it.videoCodec == VideoCodec.VP9 },
-        )
-        assertEverySuggestionValid(invalid, h264Source)
-    }
-
-    /**
-     * The fallback in `firstContainerHolding`: when the input's own container cannot hold the
-     * codec the user asked for, any container that can will do.
-     *
-     * The preferred half -- "the container the input already uses" -- is what every other case
-     * reaches, because they all start from a file whose own container carries the codec in
-     * question. The elvis after it had never run.
-     *
-     * AVI is the input that makes it run: AVI predates H.265 and has no mapping for it, so asking
-     * an AVI for H.265 is refused, and the container the input already uses cannot be part of the
-     * answer. Without the fallback the only candidates left are AVI itself and the container
-     * holding the *source* codec -- also AVI -- so the refusal still offers something, but what it
-     * offers is H.264: the app quietly declines the codec the user asked for instead of moving them
-     * to a container that supports it.
-     *
-     * That is why this asserts the codec survives rather than that the list is non-empty. A
-     * non-empty assertion passes with the fallback deleted -- measured, not assumed.
-     */
-    @Test
-    fun `an input whose container cannot hold the requested codec is moved, not downgraded`() {
-        val aviSource = InputProbe(videoCodec = "h264", audioCodec = "aac", container = Container.AVI)
-
-        val invalid = ContainerCapabilities.validate(
-            OutputSpec(Container.AVI, VideoCodec.H265, AudioCodec.AAC),
-            aviSource,
-        )
-
-        assertTrue("AVI has no mapping for H.265", invalid is Validation.Invalid)
-        val suggestions = (invalid as Validation.Invalid).suggestions
-        assertTrue(
-            "expected a container that can actually hold H.265, got $suggestions",
-            suggestions.any { it.videoCodec == VideoCodec.H265 },
-        )
-        assertEverySuggestionValid(invalid, aviSource)
-    }
-
     @Test
     fun `resolving audio COPY before asking the matrix is required`() {
         // The audio twin of `resolving COPY before asking the matrix is required`, and the reason is

app/src/test/java/org/libremediaconverter/ui/TagTableUniquenessTest.kt

@@ -28,7 +28,6 @@ class TagTableUniquenessTest {
     fun `every tag constant has its own value`() {
         val tags = tagsIn(
             TestTags::class.java,
-            TestTags.Shell::class.java,
             TestTags.Converter::class.java,
             TestTags.Join::class.java,
         )

app/src/test/java/org/libremediaconverter/ui/theme/ThemeFollowsSystemTest.kt

@@ -1,89 +0,0 @@
-package org.libremediaconverter.ui.theme
-
-import androidx.compose.material3.ColorScheme
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.ui.test.junit4.v2.createComposeRule
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Rule
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-/**
- * The theme called the way the app calls it: with no arguments at all.
- *
- * [ThemeColorSchemeTest] resolves every branch of the `when` and always passes `darkTheme`
- * explicitly, so the `$default` bridge is never entered and **`isSystemInDarkTheme()` is never
- * called**. `MainActivity.kt:79` is its only default-argument caller and does not execute on the
- * JVM, which left the app's actual call shape the one nothing exercised —
- * `LibreMediaConverterTheme` reported `mi=21, mb=6, cb=12` at method level.
- *
- * ## Not #68
- *
- * #68 is about the two **unreachable** arms, `DarkColorScheme` and `LightColorScheme`, which cannot
- * run because `dynamicColor` is always `true` and nothing can flip it. That is an open product
- * decision. This is the reachable half — whether the default follows the system — and closing it
- * does not close that.
- *
- * ## Why the assertion compares schemes rather than reading a number
- *
- * A luminance threshold would be a guess about the device palette. What is asserted instead is that
- * the no-argument call resolves to **the same scheme** an explicit `darkTheme` of the matching
- * value does, and a different one from its opposite. That holds whatever palette the platform
- * hands back, and it is exactly the claim: the default reads the system rather than picking a side.
- *
- * Both schemes are resolved in one composition because `setContent` may be called once per test.
- */
-@RunWith(RobolectricTestRunner::class)
-class ThemeFollowsSystemTest {
-
-    @get:Rule
-    val composeRule = createComposeRule()
-
-    @Test
-    @Config(qualifiers = "+night")
-    fun `with no arguments the theme follows a system in dark mode`() {
-        val resolved = resolve()
-
-        assertEquals("the default must resolve what darkTheme = true does", resolved.dark, resolved.bare)
-        assertNotEquals(resolved.light, resolved.bare)
-    }
-
-    @Test
-    @Config(qualifiers = "+notnight")
-    fun `with no arguments the theme follows a system in light mode`() {
-        val resolved = resolve()
-
-        assertEquals("the default must resolve what darkTheme = false does", resolved.light, resolved.bare)
-        assertNotEquals(resolved.dark, resolved.bare)
-    }
-
-    /**
-     * The three colours are read together as one value, because any single one could coincide
-     * between the two schemes on some palette while the schemes themselves differ. Background is
-     * what dark mode is chiefly about; primary and surface are along to make a coincidence
-     * implausible rather than merely unlikely.
-     */
-    private data class Fingerprint(val background: Long, val primary: Long, val surface: Long)
-
-    private fun ColorScheme.fingerprint() =
-        Fingerprint(background.value.toLong(), primary.value.toLong(), surface.value.toLong())
-
-    private class Resolved(val bare: Fingerprint, val dark: Fingerprint, val light: Fingerprint)
-
-    private fun resolve(): Resolved {
-        lateinit var bare: Fingerprint
-        lateinit var dark: Fingerprint
-        lateinit var light: Fingerprint
-        composeRule.setContent {
-            // No arguments — the call MainActivity makes, and the one nothing exercised.
-            LibreMediaConverterTheme { bare = MaterialTheme.colorScheme.fingerprint() }
-            LibreMediaConverterTheme(darkTheme = true) { dark = MaterialTheme.colorScheme.fingerprint() }
-            LibreMediaConverterTheme(darkTheme = false) { light = MaterialTheme.colorScheme.fingerprint() }
-        }
-        composeRule.waitForIdle()
-        return Resolved(bare, dark, light)
-    }
-}

app/src/test/java/org/libremediaconverter/work/ConcatFailureTest.kt

@@ -1,237 +0,0 @@
-package org.libremediaconverter.work
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.ListenableWorker
-import androidx.work.testing.TestListenableWorkerBuilder
-import androidx.work.workDataOf
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.ConcatJoiner
-import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.StagingNames
-import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.ffmpeg.ConcatEngine
-import org.libremediaconverter.model.ConcatStrategy
-import org.libremediaconverter.model.OutputFormat
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.io.File
-import java.util.UUID
-
-/**
- * What a join does when the engine fails partway.
- *
- * Everything past `ConcatWorker`'s `setForeground` was untested on **every** source set, and the
- * repo had already measured the cost: `PerJobStagingTest`'s KDoc records that reverting
- * `ConcatWorker` to a constant staging name left all 257 tests green, because nothing in the JVM
- * suite can get past a `ConcatEngine` constructed in place. `RefusedJobTest` says the same from the
- * other side -- "the next thing past the count guard is `ConcatEngine`, which is native".
- * `ConcatEngineTest` on a device tests the engine directly, bypassing the worker, and
- * `ConcatWorkerTest` covers only the too-few-inputs guard and the happy path.
- *
- * `ConversionDependencies.concat` is the seam that closes it, added here to sit beside the
- * `.hardware` and `.software` that `ConversionWorker` has had all along -- the asymmetry between the
- * two workers was the whole reason one of them had a tested failure path and the other did not.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class ConcatFailureTest {
-
-    private lateinit var app: Application
-    private lateinit var publisher: AlwaysRoomPublisher
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        publisher = AlwaysRoomPublisher(app)
-        ConversionDependencies.publisher = { publisher }
-        installTestWorkManager(app, Data.EMPTY)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `a join whose engine fails reports the engine's own reason`() {
-        ConversionDependencies.concat = { FailingJoiner { error(DEMUXER_MESSAGE) } }
-
-        val result = runBlocking { joinWorker().doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(workDataOf(ConcatWorker.KEY_ERROR to DEMUXER_MESSAGE)),
-            result,
-        )
-    }
-
-    /**
-     * A failure carrying no message at all, which Kotlin and Java both allow and FFmpegKit's
-     * wrappers can produce.
-     *
-     * Without the fallback the user is shown an empty error, and `JoinViewModel` cannot tell that
-     * from a job that reported nothing -- the two would be one blank screen with different causes.
-     */
-    @Test
-    fun `a failure with no message of its own still says something`() {
-        ConversionDependencies.concat = { FailingJoiner { throw RuntimeException() } }
-
-        val result = runBlocking { joinWorker().doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(
-                workDataOf(ConcatWorker.KEY_ERROR to ConcatWorker.GENERIC_FAILURE_MESSAGE),
-            ),
-            result,
-        )
-    }
-
-    /**
-     * The staged file is deleted on the way out.
-     *
-     * The joiner writes before it fails, exactly as `PartialThenFailingTranscoder` does on the
-     * conversion side: a stub that only threw would let a missing `staged.delete()` pass. What it
-     * costs to lose is a full-size partial per failed join, sitting in cache until the sweep is old
-     * enough to be sure nobody is coming back for it.
-     *
-     * Asserted against the file the joiner was actually handed rather than by scanning the staging
-     * directory for a name. The first draft did scan, for a `"join-"` prefix that
-     * `StagingNames.forJob` does not produce -- it names files `<jobId>.<ext>` -- so the assertion
-     * was trivially true and the mutation walked straight through it.
-     */
-    @Test
-    fun `a failed join leaves nothing behind in staging`() {
-        val joiner = FailingJoiner { error(DEMUXER_MESSAGE) }
-        ConversionDependencies.concat = { joiner }
-
-        runBlocking { joinWorker().doWork() }
-
-        val staged = requireNotNull(joiner.lastOutput) { "the joiner never ran, so this proves nothing" }
-        assertEquals(
-            "the fixture has to write before it fails, or the delete is unobservable",
-            PARTIAL_BYTES,
-            joiner.bytesWritten,
-        )
-        assertFalse("a failed join must not leave its partial behind: $staged", staged.exists())
-    }
-
-    /**
-     * The success path, and the staging name #159's fixture and `PerJobStagingTest` both care about.
-     *
-     * Worth its place rather than a happy-path formality: `PerJobStagingTest`'s KDoc records that
-     * **reverting `ConcatWorker` to a constant staging name left all 257 tests green**, because
-     * nothing could reach the line that names the file. This is the test that was missing when that
-     * was written -- the join's output `Data` had never been read by anything on the JVM.
-     *
-     * The staged path is asserted to carry the job id, not a constant: two joins of the same format
-     * sharing one name is the defect, and `ConcatEngine`'s list file collided harder still.
-     */
-    @Test
-    fun `a join that works reports its own staged file, strategy and name`() {
-        val joiner = SucceedingJoiner()
-        ConversionDependencies.concat = { joiner }
-
-        val result = runBlocking { joinWorker().doWork() }
-
-        assertTrue("got $result", result is ListenableWorker.Result.Success)
-        val data = (result as ListenableWorker.Result.Success).outputData
-        assertEquals(
-            "the staged file has to be this job's, not a name every join shares",
-            File(publisherStagingDir(), StagingNames.forJob(JOB_ID, OutputFormat.MP4_H264.extension)).absolutePath,
-            data.getString(ConcatWorker.KEY_OUTPUT_PATH),
-        )
-        assertEquals(ConcatStrategy.STREAM_COPY.name, data.getString(ConcatWorker.KEY_STRATEGY))
-        assertEquals(OutputFormat.MP4_H264.mimeType, data.getString(ConcatWorker.KEY_MIME_TYPE))
-        assertTrue(
-            "the save dialog needs a name with the right extension, got ${data.getString(
-                ConcatWorker.KEY_SUGGESTED_NAME,
-            )}",
-            data.getString(ConcatWorker.KEY_SUGGESTED_NAME).orEmpty().endsWith(".${OutputFormat.MP4_H264.extension}"),
-        )
-    }
-
-    /**
-     * The arm beside the count guard: no URI array at all.
-     *
-     * Covered today only by `UnopenableUriTest` on a device, although it runs before staging and
-     * before any native code. It is the exact sibling of `RefusedJobTest`'s ConversionWorker twin,
-     * and it belongs on the JVM with it -- a device test for a branch that needs no device is a
-     * slower test that reports later.
-     */
-    @Test
-    fun `a join with no input array at all is refused with a message`() {
-        val result = runBlocking {
-            TestListenableWorkerBuilder<ConcatWorker>(
-                context = app,
-                inputData = workDataOf(ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name),
-                runAttemptCount = 0,
-            ).setId(JOB_ID).build().doWork()
-        }
-
-        assertEquals(
-            ListenableWorker.Result.failure(workDataOf(ConcatWorker.KEY_ERROR to ConcatWorker.NO_INPUTS_MESSAGE)),
-            result,
-        )
-    }
-
-    private fun publisherStagingDir(): File? = publisher.createStagingFile("probe").parentFile
-
-    private fun joinWorker(): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
-        context = app,
-        inputData = workDataOf(
-            ConcatWorker.KEY_INPUT_URIS to arrayOf(FIRST.toString(), SECOND.toString()),
-            ConcatWorker.KEY_TOTAL_BYTES to TOTAL_BYTES,
-            ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name,
-        ),
-        runAttemptCount = 0,
-    ).setId(JOB_ID).build()
-
-    private companion object {
-        val FIRST: Uri = Uri.parse("file:///tmp/one.mp4")
-        val SECOND: Uri = Uri.parse("file:///tmp/two.mp4")
-        const val TOTAL_BYTES = 2048L
-        const val DEMUXER_MESSAGE = "the demuxer rejected the input list"
-        const val PARTIAL_BYTES = 2048
-        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000000b")
-    }
-}
-
-/** A joiner that writes something and then fails, so a missing `staged.delete()` cannot pass. */
-private class FailingJoiner(private val failure: () -> Nothing) : ConcatJoiner {
-
-    /** The handle the worker created, kept so a test can ask whether it survived the failure. */
-    var lastOutput: File? = null
-    var bytesWritten = 0
-
-    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): ConcatEngine.Result {
-        lastOutput = output
-        output.writeBytes(ByteArray(PARTIAL_BYTES))
-        bytesWritten = PARTIAL_BYTES
-        failure()
-    }
-
-    private companion object {
-        const val PARTIAL_BYTES = 2048
-    }
-}
-
-/** The joiner that finishes, so the success path and the output `Data` can be read on the JVM. */
-private class SucceedingJoiner : ConcatJoiner {
-    override suspend fun join(inputs: List<Uri>, output: File, format: OutputFormat): ConcatEngine.Result {
-        output.writeBytes(ByteArray(OUTPUT_BYTES))
-        return ConcatEngine.Result(ConcatStrategy.STREAM_COPY, output)
-    }
-
-    private companion object {
-        const val OUTPUT_BYTES = 4096
-    }
-}

app/src/test/java/org/libremediaconverter/work/DeniedForegroundStartTest.kt

@@ -27,6 +27,9 @@ import org.robolectric.RobolectricTestRunner
 import org.robolectric.RuntimeEnvironment
 import java.io.File
 import java.util.UUID
+import java.util.concurrent.ExecutionException
+import java.util.concurrent.Executor
+import java.util.concurrent.TimeUnit
 
 /**
  * That a refused foreground-service start does not end the job.
@@ -122,40 +125,6 @@ class DeniedForegroundStartTest {
         )
     }
 
-    @Test
-    fun `a join denied past the attempt bound fails with a message the user can act on`() {
-        // The join twin of the conversion case above. ConcatWorker reaches the same FailureOutcome
-        // through its own `when`, and that arm was the only one of its three with no test -- so a
-        // join that gave up silently, or gave up with an empty Data, would have looked identical to
-        // one that retried.
-        val worker = concatWorker(runAttemptCount = FailureOutcome.MAX_FOREGROUND_START_ATTEMPTS)
-
-        val result = runBlocking { worker.doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(
-                workDataOf(ConcatWorker.KEY_ERROR to FailureOutcome.FOREGROUND_DENIED_MESSAGE),
-            ),
-            result,
-        )
-    }
-
-    @Test
-    fun `a join that gives up collects the partial it had already staged`() {
-        // The delete lives on ConcatWorker's `catch (e: Throwable)` path, which every give-up goes
-        // through. Written first so a missing delete cannot pass by asking whether a file nobody
-        // wrote is absent.
-        concatStagedFile().writeBytes(ByteArray(PARTIAL_BYTES))
-
-        runBlocking { concatWorker(runAttemptCount = FailureOutcome.MAX_FOREGROUND_START_ATTEMPTS).doWork() }
-
-        assertEquals(
-            "a join that gave up must not orphan what it staged",
-            emptyList<String>(),
-            stagedNames(),
-        )
-    }
-
     private fun conversionWorker(runAttemptCount: Int = 0): ConversionWorker =
         TestListenableWorkerBuilder<ConversionWorker>(
             context = app,
@@ -172,22 +141,18 @@ class DeniedForegroundStartTest {
             .setForegroundUpdater(DenyingForegroundUpdater)
             .build()
 
-    private fun concatWorker(runAttemptCount: Int = 0): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
+    private fun concatWorker(): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
         context = app,
         inputData = workDataOf(
             ConcatWorker.KEY_INPUT_URIS to arrayOf(INPUT.toString(), "content://test/second.mp4"),
             ConcatWorker.KEY_TOTAL_BYTES to INPUT_BYTES,
-            ConcatWorker.KEY_FORMAT to CONCAT_FORMAT.name,
+            ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name,
         ),
-        runAttemptCount = runAttemptCount,
+        runAttemptCount = 0,
     ).setId(CONCAT_ID)
         .setForegroundUpdater(DenyingForegroundUpdater)
         .build()
 
-    /** The staging path the join will compute, asked for rather than spelled out here. */
-    private fun concatStagedFile(): File =
-        publisher.createStagingFile(StagingNames.forJob(CONCAT_ID, CONCAT_FORMAT.extension))
-
     /** The staging path the worker will compute, asked for rather than spelled out here. */
     private fun stagedFile(): File = publisher.createStagingFile(StagingNames.forJob(CONVERSION_ID, SPEC.extension))
 
@@ -199,7 +164,6 @@ class DeniedForegroundStartTest {
         const val INPUT_BYTES = 1024L
         const val PARTIAL_BYTES = 2048
         val SPEC = OutputFormat.MP4_H265.spec
-        val CONCAT_FORMAT = OutputFormat.MP4_H264
         val CONVERSION_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000001")
         val CONCAT_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000002")
     }
@@ -218,3 +182,18 @@ private object DenyingForegroundUpdater : ForegroundUpdater {
         ),
     )
 }
+
+/**
+ * An already-failed future, written out rather than pulled from a futures library.
+ *
+ * `await()` takes the `isDone` fast path and unwraps the `ExecutionException`, which is what puts
+ * the platform's own exception in front of the worker's catch rather than a wrapper.
+ */
+private class FailedFuture(private val failure: Throwable) : ListenableFuture<Void> {
+    override fun addListener(listener: Runnable, executor: Executor): Unit = executor.execute(listener)
+    override fun cancel(mayInterruptIfRunning: Boolean): Boolean = false
+    override fun isCancelled(): Boolean = false
+    override fun isDone(): Boolean = true
+    override fun get(): Void = throw ExecutionException(failure)
+    override fun get(timeout: Long, unit: TimeUnit): Void = throw ExecutionException(failure)
+}

app/src/test/java/org/libremediaconverter/work/ForegroundTypeRegimeTest.kt

@@ -1,88 +0,0 @@
-package org.libremediaconverter.work
-
-import android.content.pm.ServiceInfo
-import org.junit.Assert.assertEquals
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-/**
- * [ConversionForegroundType.current] answers differently on each of the three API regimes, and
- * until this file only one of them was ever executed.
- *
- * `app/src/test/resources/robolectric.properties` pins the whole JVM suite to `sdk=36`, so every
- * Robolectric test that reaches a `ForegroundInfo` takes the `mediaProcessing` arm and no other.
- * The 33 and 34 arms were cold: 3 lines and 3 of 4 branches, measured on `main` at `d354f64`.
- *
- * **The instrumented test is not a substitute, and the reason is specific.**
- * `ConversionWorkerTest.foregroundTypeMatchesTheRunningApiLevel` asserts against whichever API the
- * leg happens to be — one arm per leg, never the other two — and the legs that would cover 33 and
- * 34 are the ones issue #122 wedges. `docs/coverage-read-findings.md` records an API 33 run that
- * reported `received: 60` and `failed: unknown`: the regime *was* exercised, and that leg could
- * not have said so if it had broken. Four `@Config` classes here pin all three arms
- * deterministically, in the same `./gradlew` invocation as everything else.
- *
- * `minSdk` is 33, so none of these is dead code — each is a device someone is running the app on.
- *
- * **SDK 35 is in the list for the boundary, not for the answer.** It shares its answer with 36,
- * which would make it look redundant. It is not: relaxing `>= VANILLA_ICE_CREAM` to `>` is invisible
- * at every level except exactly 35, so without this class that mutation survives the suite.
- */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [33])
-class ForegroundTypeApi33Test {
-
-    /**
-     * Zero rather than a named constant because there is no constant to name: API 33 does not
-     * require a type, and `mediaProcessing` does not exist here to pass. `ForegroundInfo` reads 0
-     * as "no type at all", which is what this regime wants.
-     */
-    @Test
-    fun `api 33 asks for no foreground service type`() {
-        assertEquals(0, ConversionForegroundType.current())
-    }
-}
-
-/**
- * API 34 makes a type mandatory and still has no `mediaProcessing`, so `dataSync` is the only
- * sensible fit. See [ForegroundTypeApi33Test] for why this file exists.
- */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [34])
-class ForegroundTypeApi34Test {
-
-    @Test
-    fun `api 34 falls back to dataSync, the only type that fits`() {
-        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC, ConversionForegroundType.current())
-    }
-}
-
-/**
- * The first level with `mediaProcessing`, and therefore the one that tells `>=` from `>`.
- * See [ForegroundTypeApi33Test].
- */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class ForegroundTypeApi35Test {
-
-    @Test
-    fun `api 35 is the first level that takes mediaProcessing`() {
-        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
-    }
-}
-
-/**
- * The level the rest of the suite runs at, asserted here rather than assumed — it is the one arm
- * that was already covered, and leaving it out would make this file look like it is about the old
- * levels rather than about all three regimes. See [ForegroundTypeApi33Test].
- */
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [36])
-class ForegroundTypeApi36Test {
-
-    @Test
-    fun `api 36 keeps mediaProcessing`() {
-        assertEquals(ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROCESSING, ConversionForegroundType.current())
-    }
-}

app/src/test/java/org/libremediaconverter/work/HardwareFallbackTest.kt

@@ -1,226 +0,0 @@
-package org.libremediaconverter.work
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.ListenableWorker
-import androidx.work.testing.TestListenableWorkerBuilder
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertThrows
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.HardwareTranscoder
-import org.libremediaconverter.convert.SoftwareTranscoder
-import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.model.Container
-import org.libremediaconverter.model.ConversionRequest
-import org.libremediaconverter.model.DeviceCodecs
-import org.libremediaconverter.model.EnginePreference
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.model.OutputFormat
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.io.File
-import java.util.UUID
-
-/**
- * What happens when the hardware engine does not finish the job.
- *
- * `runMedia3OrFallBack` was eleven lines at 0% on the JVM and `isCancellation` had never been
- * called by any unit test at all. Its own KDoc calls the fallback the protection against vendor
- * hardware encoders that "cannot be tested for correctness", so it is the branch most likely to
- * matter on a device nobody here owns — and it was reachable the whole time through
- * `ConversionDependencies.hardware`, which no unit test had ever used.
- *
- * The sharp one is cancellation. `runMedia3OrFallBack` catches `Throwable`, so without the
- * `isCancellation` re-throw a user cancelling a hardware transcode would have the app quietly
- * start a *second* conversion in software — the one thing cancelling is supposed to prevent.
- *
- * `ForcedFailureTest` covers the failure half on a device. It does not cover the cancellation half,
- * and this host cannot run it either way.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class HardwareFallbackTest {
-
-    private lateinit var app: Application
-    private lateinit var hardware: RecordingHardwareTranscoder
-    private lateinit var software: RecordingSoftwareTranscoder
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        hardware = RecordingHardwareTranscoder()
-        software = RecordingSoftwareTranscoder()
-        ConversionDependencies.publisher = { AlwaysRoomPublisher(app) }
-        ConversionDependencies.hardware = { hardware }
-        ConversionDependencies.software = { software }
-        // A probe with real codecs, not the default: `InputProbe()` reports UNPARSEABLE, which
-        // PERMISSIVE.canDecode refuses, and the router would send every job here straight to
-        // FFmpeg without any of these tests mentioning why.
-        ConversionDependencies.probe = { _, _ -> H264_SOURCE }
-        ConversionDependencies.deviceCodecs = { DeviceCodecs.PERMISSIVE }
-        installTestWorkManager(app, Data.EMPTY)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `a hardware failure runs the job again in software, on a clean staging file`() {
-        hardware.failWith = { error("the vendor encoder produced nothing usable") }
-
-        val result = runBlocking { worker().doWork() }
-
-        assertTrue("the job should still succeed, got $result", result is ListenableWorker.Result.Success)
-        assertEquals("the hardware engine gets exactly one attempt", 1, hardware.attempts)
-        assertEquals("and the job then goes to software", 1, software.attempts)
-        // The `staged.delete()` between the two, asserted where it is observable: FFmpeg must not
-        // find a half-written hardware output sitting at the path it is about to write.
-        assertFalse(
-            "the partial hardware output must be gone before FFmpeg starts",
-            software.outputExistedOnEntry,
-        )
-        assertEquals("the hardware engine is closed either way", 1, hardware.closes)
-    }
-
-    @Test
-    fun `a cancelled hardware transcode is not quietly retried in software`() {
-        hardware.failWith = { throw CancellationException("the user pressed Cancel") }
-
-        assertThrows(CancellationException::class.java) { runBlocking { worker().doWork() } }
-
-        assertEquals("the hardware engine ran", 1, hardware.attempts)
-        assertEquals(
-            "cancelling must not start a second conversion -- that is the whole point of cancelling",
-            0,
-            software.attempts,
-        )
-        assertEquals("and the engine is still closed on the way out", 1, hardware.closes)
-    }
-
-    @Test
-    fun `a hardware transcode that works never reaches the software engine`() {
-        val result = runBlocking { worker().doWork() }
-
-        assertTrue("got $result", result is ListenableWorker.Result.Success)
-        assertEquals(1, hardware.attempts)
-        assertEquals("the fallback is a fallback, not a second pass", 0, software.attempts)
-        assertEquals(1, hardware.closes)
-    }
-
-    /**
-     * #169: the display-name fallback, which reaches further than the notification title.
-     *
-     * `inputData.getString(KEY_DISPLAY_NAME) ?: "input"` had never taken its right-hand side. The
-     * value is not only the foreground notification's title: it feeds `outputNameFor`, so it is
-     * also the filename offered in the user's save dialog. A job enqueued by an older build, or
-     * built by hand, carries no such key.
-     */
-    @Test
-    fun `a job that names no input file still suggests an output name`() {
-        val result = runBlocking { worker(displayName = null).doWork() }
-
-        assertTrue("got $result", result is ListenableWorker.Result.Success)
-        val suggested = (result as ListenableWorker.Result.Success)
-            .outputData.getString(ConversionWorker.KEY_SUGGESTED_NAME)
-        assertTrue(
-            "expected a name built from the fallback, got $suggested",
-            suggested.orEmpty().startsWith("input"),
-        )
-    }
-
-    private fun worker(displayName: String? = DISPLAY_NAME): ConversionWorker {
-        val spec = OutputFormat.MP4_H265.spec
-        val entries = buildMap<String, Any> {
-            put(ConversionWorker.KEY_INPUT_URI, INPUT.toString())
-            displayName?.let { put(ConversionWorker.KEY_DISPLAY_NAME, it) }
-            put(ConversionWorker.KEY_SIZE_BYTES, INPUT_BYTES)
-            put(ConversionWorker.KEY_CONTAINER, spec.container.name)
-            put(ConversionWorker.KEY_VIDEO_CODEC, spec.videoCodec.name)
-            put(ConversionWorker.KEY_AUDIO_CODEC, spec.audioCodec.name)
-            // AUTO rather than FORCE_SOFTWARE, which is what every other worker test uses and is
-            // exactly why this path had no coverage: forcing software never enters the function.
-            put(ConversionWorker.KEY_ENGINE_PREFERENCE, EnginePreference.AUTO.name)
-        }
-        return TestListenableWorkerBuilder<ConversionWorker>(
-            context = app,
-            inputData = Data.Builder().putAll(entries).build(),
-            runAttemptCount = 0,
-        ).setId(JOB_ID).build()
-    }
-
-    private companion object {
-        val INPUT: Uri = Uri.parse("file:///tmp/holiday.mp4")
-        const val DISPLAY_NAME = "holiday.mp4"
-        const val INPUT_BYTES = 1024L
-        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000009")
-        val H264_SOURCE = InputProbe(
-            videoCodec = "h264",
-            audioCodec = "aac",
-            container = Container.MP4,
-            durationMs = 1_000,
-        )
-    }
-}
-
-/**
- * A hardware engine that writes something before it fails, and remembers being closed.
- *
- * Writing first is the point, exactly as it is for `PartialThenFailingTranscoder`: an engine that
- * only threw would let a missing `staged.delete()` pass unnoticed.
- */
-@UnstableApi
-private class RecordingHardwareTranscoder : HardwareTranscoder {
-
-    var attempts = 0
-    var closes = 0
-    var failWith: (() -> Unit)? = null
-
-    override suspend fun transcode(input: Uri, output: File, request: ConversionRequest, onProgress: (Int) -> Unit) {
-        attempts++
-        output.writeBytes(ByteArray(PARTIAL_BYTES))
-        failWith?.invoke()
-    }
-
-    override fun close() {
-        closes++
-    }
-
-    private companion object {
-        const val PARTIAL_BYTES = 2048
-    }
-}
-
-/** The software engine, recording whether the hardware attempt's leftovers were cleared first. */
-private class RecordingSoftwareTranscoder : SoftwareTranscoder {
-
-    var attempts = 0
-    var outputExistedOnEntry = false
-
-    override suspend fun run(
-        request: ConversionRequest,
-        inputPath: String,
-        output: File,
-        durationMs: Long,
-        onProgress: (Int) -> Unit,
-    ) {
-        attempts++
-        outputExistedOnEntry = output.exists()
-        output.writeBytes(ByteArray(OUTPUT_BYTES))
-    }
-
-    private companion object {
-        const val OUTPUT_BYTES = 512
-    }
-}

app/src/test/java/org/libremediaconverter/work/JobSnapshotsTest.kt

@@ -16,7 +16,6 @@ import androidx.work.testing.WorkManagerTestInitHelper
 import androidx.work.workDataOf
 import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
@@ -126,39 +125,6 @@ class JobSnapshotsTest {
         assertEquals(newer.absolutePath, Reattachment.choose(snapshots)?.job?.outputPath)
     }
 
-    /**
-     * A job in the tag query that never recorded an output path at all.
-     *
-     * Distinct from the three cases above, which all *have* a path and differ in what it names. A
-     * job still running, or one that finished without writing its result key, carries no path at
-     * all -- and `getWorkInfosByTagFlow` returns it alongside the finished ones, because the tag is
-     * the worker class and every attempt ever enqueued carries it.
-     *
-     * The guard is the `?.` in `path?.let(::File)`. Without it the null goes straight into a `File`
-     * constructor. What this pins is the consequence rather than the null check: such a job must
-     * not be offered as a result, so `Reattachment.choose` has to walk past it to the job that
-     * really produced a file. Choosing it would put a Converted screen in front of the user with a
-     * Save button that has nothing to save.
-     */
-    @Test
-    fun `a job that recorded no output path is not offered as a result`() {
-        val real = stagedFile("real.mp4", bytes = 4096)
-        finishedWithOutput(real)
-        finishedWithNoOutput()
-
-        val snapshots = snapshots()
-
-        assertEquals("both jobs carry the tag, so both come back", 2, snapshots.size)
-        val silent = snapshots.single { it.outputPath == null }
-        assertFalse("no path means no output, not an empty one", silent.outputExists)
-        assertEquals("and no time either, for the same reason", 0L, silent.outputModifiedAt)
-        assertEquals(
-            "the reattachment has to walk past it to the job that really produced a file",
-            real.absolutePath,
-            Reattachment.choose(snapshots)?.job?.outputPath,
-        )
-    }
-
     private fun snapshots(): List<JobSnapshot> = runBlocking {
         workManager.jobSnapshots(
             tag = ConversionWorker::class.java.name,
@@ -186,11 +152,6 @@ class JobSnapshotsTest {
         ).result.get()
     }
 
-    /** A job that carries the tag and no result key -- still running, or finished without one. */
-    private fun finishedWithNoOutput() {
-        workManager.enqueue(OneTimeWorkRequestBuilder<ConversionWorker>().build()).result.get()
-    }
-
     private companion object {
         /** Two fixed moments a day apart, so the ordering is stated rather than raced for. */
         const val OLDER_MS = 1_700_000_000_000L

app/src/test/java/org/libremediaconverter/work/NotificationProgressTextTest.kt

@@ -1,89 +0,0 @@
-package org.libremediaconverter.work
-
-import android.app.Notification
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.installTestWorkManager
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.util.UUID
-
-/**
- * The two things a progress notification can say, and that they are not the same thing.
- *
- * An assertion gap rather than a coverage one, and the distinction is the reason this file exists.
- * JaCoCo is green on `build`'s `if (indeterminate)`, because `ProgressNotificationTest` drives it
- * through a real worker -- but that test reads only the notification id and
- * `Notification.EXTRA_PROGRESS`. **Nothing had ever read the text.** Swapping the two branches, or
- * collapsing them into one string, passed the entire suite.
- *
- * What it costs to get wrong is small and constant: a conversion that has been running for four
- * minutes still saying "Preparing", or one that has not started reporting yet claiming 0%. Neither
- * is a crash, and neither would be found by anything else here -- which is exactly the kind of
- * thing that survives for a long time.
- *
- * Nothing else in the suite constructs [ConversionNotifications] directly.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class NotificationProgressTextTest {
-
-    /**
-     * `build` reaches `WorkManager.getInstance` for the Cancel action's PendingIntent, so the
-     * notification cannot be built at all without one. That coupling is why nothing had ever
-     * constructed this class directly and read what it produced.
-     */
-    @Before
-    fun setUp() {
-        installTestWorkManager(RuntimeEnvironment.getApplication(), Data.EMPTY)
-    }
-
-    @Test
-    fun `an indeterminate notification says something different from a measured one`() {
-        val context = RuntimeEnvironment.getApplication()
-        val notifications = ConversionNotifications(context)
-
-        val preparing = notifications.build(JOB_ID, TITLE, percent = 0, indeterminate = true).text()
-        val measured = notifications.build(JOB_ID, TITLE, percent = 42, indeterminate = false).text()
-
-        assertNotEquals(
-            "the two states have to read differently, or the text says nothing at all",
-            preparing,
-            measured,
-        )
-        assertTrue(
-            "a measured notification has to carry its percentage, got \"$measured\"",
-            measured.contains("42"),
-        )
-        assertTrue(
-            "an indeterminate one must not invent one, got \"$preparing\"",
-            !preparing.contains("42") && !preparing.contains("0"),
-        )
-    }
-
-    /**
-     * The title is the caller's, not the builder's -- it is the file the user picked, and it is what
-     * tells two simultaneous conversions apart in the shade.
-     */
-    @Test
-    fun `the notification is titled with the file it is converting`() {
-        val context = RuntimeEnvironment.getApplication()
-
-        val built = ConversionNotifications(context).build(JOB_ID, TITLE, percent = 10)
-
-        assertEquals(TITLE, built.extras.getString(Notification.EXTRA_TITLE))
-    }
-
-    private fun Notification.text(): String = extras.getString(Notification.EXTRA_TEXT).orEmpty()
-
-    private companion object {
-        const val TITLE = "holiday.mp4"
-        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-00000000000a")
-    }
-}

app/src/test/java/org/libremediaconverter/work/ProgressNotificationTest.kt

@@ -21,10 +21,8 @@ import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.HardwareTranscoder
 import org.libremediaconverter.convert.SoftwareTranscoder
 import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.model.Container
 import org.libremediaconverter.model.ConversionRequest
 import org.libremediaconverter.model.DeviceCodecs
 import org.libremediaconverter.model.EnginePreference
@@ -131,40 +129,6 @@ class ProgressNotificationTest {
         )
     }
 
-    /**
-     * The same plumbing on the engine most conversions actually use, which had none.
-     *
-     * `ConversionWorker.kt:208-210` is a second `onProgress` lambda at a second call site — the one
-     * handed to `engine.transcode` — and it reported `ci == 0`. Every test above drives the FFmpeg
-     * path; `HardwareFallbackTest` reaches `runMedia3OrFallBack` but its recording transcoder
-     * records the call and never invokes the callback it was given. So the two engines' progress
-     * wiring was one tested and one not, and the untested one is the default: `ConversionRouter`
-     * sends everything it can to Media3.
-     *
-     * `AUTO` with a real H.264 probe, because `FORCE_SOFTWARE` is precisely what keeps the other
-     * tests out of this branch. The probe and the permissive codec profile are what let the router
-     * choose Media3 at all — `InputProbe()` reports `UNPARSEABLE`, which routes straight to FFmpeg.
-     *
-     * Asserted on the *percentage*, not merely on an update having happened: `publishProgress`
-     * takes a display name and a percent, and replacing the percent with a constant compiles.
-     */
-    @Test
-    fun `progress from the hardware engine reaches WorkManager the same way FFmpeg's does`() {
-        ConversionDependencies.probe = { _, _ -> H264_SOURCE }
-        val reporting = ReportingHardwareTranscoder { onProgress -> onProgress(PERCENT) }
-        ConversionDependencies.hardware = { reporting }
-
-        runBlocking { workerReporting(EnginePreference.AUTO) { }.doWork() }
-
-        assertEquals("the job must have gone to the hardware engine", 1, reporting.attempts)
-        val progressUpdates = updater.infos.drop(1)
-        assertEquals("one throttled progress update expected", 1, progressUpdates.size)
-        assertEquals(
-            PERCENT,
-            progressUpdates.single().notification.extras.getInt(Notification.EXTRA_PROGRESS),
-        )
-    }
-
     /**
      * A worker routed to the software engine, whose engine is [report] and a written output.
      *
@@ -173,10 +137,7 @@ class ProgressNotificationTest {
      * bridge, which is native. [report] is handed the worker's own progress callback, and runs with
      * the worker as its receiver so a test can stop it mid-transcode.
      */
-    private fun workerReporting(
-        enginePreference: EnginePreference = EnginePreference.FORCE_SOFTWARE,
-        report: ConversionWorker.((Int) -> Unit) -> Unit,
-    ): ConversionWorker {
+    private fun workerReporting(report: ConversionWorker.((Int) -> Unit) -> Unit): ConversionWorker {
         val worker = TestListenableWorkerBuilder<ConversionWorker>(
             context = app,
             inputData = workDataOf(
@@ -186,7 +147,7 @@ class ProgressNotificationTest {
                 ConversionWorker.KEY_CONTAINER to SPEC.container.name,
                 ConversionWorker.KEY_VIDEO_CODEC to SPEC.videoCodec.name,
                 ConversionWorker.KEY_AUDIO_CODEC to SPEC.audioCodec.name,
-                ConversionWorker.KEY_ENGINE_PREFERENCE to enginePreference.name,
+                ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
             ),
             runAttemptCount = 0,
         ).setId(JOB_ID)
@@ -210,17 +171,6 @@ class ProgressNotificationTest {
         const val TICKS = 50
         val SPEC = OutputFormat.MP4_H265.spec
         val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000021")
-
-        /**
-         * A probe the router can actually route. `InputProbe()` reports `UNPARSEABLE`, which
-         * `PERMISSIVE.canDecode` refuses, so every job would reach FFmpeg with no test saying why.
-         */
-        val H264_SOURCE = InputProbe(
-            videoCodec = "h264",
-            audioCodec = "aac",
-            container = Container.MP4,
-            durationMs = 1_000,
-        )
     }
 }
 
@@ -261,22 +211,3 @@ private class ReportingTranscoder(private val report: ((Int) -> Unit) -> Unit) :
         const val OUTPUT_BYTES = 512
     }
 }
-
-/** A hardware engine that reports whatever [report] wants reported, then writes an output. */
-@UnstableApi
-private class ReportingHardwareTranscoder(private val report: ((Int) -> Unit) -> Unit) : HardwareTranscoder {
-
-    var attempts = 0
-
-    override suspend fun transcode(input: Uri, output: File, request: ConversionRequest, onProgress: (Int) -> Unit) {
-        attempts++
-        report(onProgress)
-        output.writeBytes(ByteArray(OUTPUT_BYTES))
-    }
-
-    override fun close() = Unit
-
-    private companion object {
-        const val OUTPUT_BYTES = 16
-    }
-}

app/src/test/java/org/libremediaconverter/work/RefusedJobTest.kt

@@ -1,276 +0,0 @@
-package org.libremediaconverter.work
-
-import android.app.Application
-import android.net.Uri
-import androidx.media3.common.util.UnstableApi
-import androidx.work.Data
-import androidx.work.ListenableWorker
-import androidx.work.testing.TestListenableWorkerBuilder
-import androidx.work.workDataOf
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.libremediaconverter.convert.ConversionDependencies
-import org.libremediaconverter.convert.OutputPublisher
-import org.libremediaconverter.convert.SoftwareTranscoder
-import org.libremediaconverter.convert.installTestWorkManager
-import org.libremediaconverter.model.AudioCodec
-import org.libremediaconverter.model.ContainerCapabilities
-import org.libremediaconverter.model.ConversionRequest
-import org.libremediaconverter.model.DeviceCodecs
-import org.libremediaconverter.model.EnginePreference
-import org.libremediaconverter.model.InputProbe
-import org.libremediaconverter.model.OutputFormat
-import org.libremediaconverter.model.OutputSpec
-import org.libremediaconverter.model.Validation
-import org.libremediaconverter.model.VideoCodec
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.RuntimeEnvironment
-import java.io.File
-import java.util.UUID
-
-/**
- * Jobs the worker refuses before it converts anything, and what it says about them.
- *
- * Two exits, both cold before this file, and both reachable for the same underlying reason: **a job
- * does not have to come from the picker.** WorkManager keeps queued and finished work for about a
- * week, so a downgrade or a rollback hands this build a job enqueued by another one — the premise
- * `WorkerEnumFallbackTest` and `JobTags` are both written on — and `ConversionWorker.request(...)`
- * is callable directly.
- *
- * What makes these worth their own file rather than another case in an existing one is that both
- * are about the *message*. A refusal that fails with empty output `Data` renders the UI's generic
- * "Conversion failed." with nothing else to say, which is the defect shape `DeniedForegroundStartTest`
- * records from the device pass. Asserting the verdict alone would pass against exactly that.
- */
-@UnstableApi
-@RunWith(RobolectricTestRunner::class)
-class RefusedJobTest {
-
-    private lateinit var app: Application
-    private lateinit var publisher: OutputPublisher
-    private lateinit var engine: RefusingTranscoder
-
-    @Before
-    fun setUp() {
-        app = RuntimeEnvironment.getApplication()
-        publisher = AlwaysRoomPublisher(app)
-        engine = RefusingTranscoder()
-        ConversionDependencies.publisher = { publisher }
-        ConversionDependencies.software = { engine }
-        // Neither test is about probing or about this machine's codecs; both would otherwise decide
-        // the outcome for reasons no assertion mentions. See WorkerCancellationTest's setUp.
-        ConversionDependencies.probe = { _, _ -> InputProbe() }
-        ConversionDependencies.deviceCodecs = { DeviceCodecs.PERMISSIVE }
-        installTestWorkManager(app, Data.EMPTY)
-    }
-
-    @After
-    fun tearDown() {
-        ConversionDependencies.reset()
-    }
-
-    @Test
-    fun `a job with no input URI fails with a message rather than a bare failure`() {
-        val result = runBlocking { workerWithout(ConversionWorker.KEY_INPUT_URI).doWork() }
-
-        // `Failure.equals` compares output data, so this pins the message and the verdict together.
-        assertEquals(
-            ListenableWorker.Result.failure(workDataOf(ConversionWorker.KEY_ERROR to "No input file.")),
-            result,
-        )
-    }
-
-    @Test
-    fun `a job with no input URI stages nothing`() {
-        // The URI read is the first thing doWork does -- above the space check, above the staging
-        // name, above the try. A refusal there must not have reserved anything.
-        runBlocking { workerWithout(ConversionWorker.KEY_INPUT_URI).doWork() }
-
-        assertEquals("a job refused for having no input must not stage a file", emptyList<String>(), stagedNames())
-    }
-
-    @Test
-    fun `a spec the picker would never have allowed is refused with the reason`() {
-        // WAV carries PCM and nothing else. The picker cannot produce this combination today, which
-        // is exactly why the worker checks: the job can arrive from a queue written before the
-        // settings changed, or from a direct request(...) call.
-        val expected = ContainerCapabilities.validate(REFUSED_SPEC, InputProbe()) as? Validation.Invalid
-            ?: throw AssertionError("the fixture spec is supposed to be invalid; ContainerCapabilities disagrees")
-
-        val result = runBlocking { worker(REFUSED_SPEC).doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(workDataOf(ConversionWorker.KEY_ERROR to expected.message)),
-            result,
-        )
-    }
-
-    @Test
-    fun `a refused spec never reaches an engine`() {
-        // The half that says it failed *before* converting rather than during. Without this, a
-        // worker that ran the job and then reported the validation message would pass the test
-        // above -- and would have spent the user's battery on a file it was going to refuse.
-        runBlocking { worker(REFUSED_SPEC).doWork() }
-
-        assertTrue("a refused spec must be refused before any engine runs", engine.invocations.isEmpty())
-    }
-
-    @Test
-    fun `a valid spec is not refused`() {
-        // The control. Every assertion above is about a refusal, so without this they would all
-        // still pass against a worker that refused everything.
-        val result = runBlocking { worker(OutputFormat.MP4_H265.spec).doWork() }
-
-        assertEquals(ListenableWorker.Result.success(), stripOutput(result))
-        assertEquals(listOf(OutputFormat.MP4_H265.spec), engine.invocations)
-    }
-
-    // --- the same refusal, on the join side ----------------------------------
-
-    @Test
-    fun `a join of a single file is refused with a message rather than joined`() {
-        // The arm beside it -- a job with no URI array at all -- is covered on the device by
-        // `UnopenableUriTest.aJoinWithNoInputArrayFailsWithAMessage`. This one was covered by
-        // nothing in either source set, which a coverage report cannot say because it cannot see
-        // androidTest: the two arms are adjacent lines and only one of them had a test.
-        //
-        // Reachable for the reason this file's header gives, plus one of its own: `request(...)`
-        // takes a `List<Uri>` and checks nothing about its length, so a single-item join is a
-        // well-formed call, not a corrupted queue entry.
-        val result = runBlocking { joinWorker(INPUT).doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(
-                workDataOf(ConcatWorker.KEY_ERROR to ConcatWorker.TOO_FEW_INPUTS_MESSAGE),
-            ),
-            result,
-        )
-    }
-
-    @Test
-    fun `a join of two files is not refused for its count`() {
-        // The control, and the half that makes the test above bite on the boundary rather than on
-        // the message: without it, `uris.size < 3` passes everything here.
-        //
-        // It refuses the space instead of letting the job run, because the next thing past the
-        // count guard is `ConcatEngine`, which is native -- `NamingPublisher`'s KDoc records that
-        // no JVM test gets past it. A refusal with the *space* message is proof that execution
-        // reached line 57, which is proof it got past line 42, and it costs no engine to say so.
-        val noRoom = NamingPublisher(app).apply { refuseSpace = true }
-        ConversionDependencies.publisher = { noRoom }
-
-        val result = runBlocking { joinWorker(INPUT, SECOND_INPUT).doWork() }
-
-        assertEquals(
-            ListenableWorker.Result.failure(
-                workDataOf(ConcatWorker.KEY_ERROR to "Not enough free space to join these files."),
-            ),
-            result,
-        )
-    }
-
-    /** [ListenableWorker.Result.Success] compares its output data, which these tests do not pin. */
-    private fun stripOutput(result: ListenableWorker.Result): ListenableWorker.Result =
-        if (result is ListenableWorker.Result.Success) ListenableWorker.Result.success() else result
-
-    private fun worker(spec: OutputSpec): ConversionWorker = build(
-        workDataOf(
-            ConversionWorker.KEY_INPUT_URI to INPUT.toString(),
-            ConversionWorker.KEY_DISPLAY_NAME to DISPLAY_NAME,
-            ConversionWorker.KEY_SIZE_BYTES to INPUT_BYTES,
-            ConversionWorker.KEY_CONTAINER to spec.container.name,
-            ConversionWorker.KEY_VIDEO_CODEC to spec.videoCodec.name,
-            ConversionWorker.KEY_AUDIO_CODEC to spec.audioCodec.name,
-            ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
-        ),
-    )
-
-    /**
-     * The ordinary input `Data`, less one key.
-     *
-     * Built by removal rather than by spelling out a shorter map, so the test cannot drift into
-     * omitting something else as well and passing for a reason it does not name.
-     */
-    private fun workerWithout(key: String): ConversionWorker {
-        val full = OutputFormat.MP4_H265.spec
-        val entries = mapOf(
-            ConversionWorker.KEY_INPUT_URI to INPUT.toString(),
-            ConversionWorker.KEY_DISPLAY_NAME to DISPLAY_NAME,
-            ConversionWorker.KEY_SIZE_BYTES to INPUT_BYTES,
-            ConversionWorker.KEY_CONTAINER to full.container.name,
-            ConversionWorker.KEY_VIDEO_CODEC to full.videoCodec.name,
-            ConversionWorker.KEY_AUDIO_CODEC to full.audioCodec.name,
-            ConversionWorker.KEY_ENGINE_PREFERENCE to EnginePreference.FORCE_SOFTWARE.name,
-        ) - key
-        return build(Data.Builder().putAll(entries).build())
-    }
-
-    private fun build(data: Data): ConversionWorker =
-        TestListenableWorkerBuilder<ConversionWorker>(context = app, inputData = data, runAttemptCount = 0)
-            .setId(JOB_ID)
-            .build()
-
-    /**
-     * A join job carrying [inputs], a declared total, and a format.
-     *
-     * The total is declared so `hasRoomFor` takes its `hasSpaceFor` branch: the other branch is
-     * `hasSpaceForUnknownSize`, which `NamingPublisher` does not override and which would measure
-     * this machine's real disk.
-     */
-    private fun joinWorker(vararg inputs: Uri): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
-        context = app,
-        inputData = workDataOf(
-            ConcatWorker.KEY_INPUT_URIS to inputs.map(Uri::toString).toTypedArray(),
-            ConcatWorker.KEY_TOTAL_BYTES to INPUT_BYTES * inputs.size,
-            ConcatWorker.KEY_FORMAT to OutputFormat.MP4_H264.name,
-        ),
-        runAttemptCount = 0,
-    ).setId(JOB_ID).build()
-
-    private fun stagedNames(): List<String> =
-        publisher.createStagingFile("anything").parentFile?.listFiles().orEmpty().map { it.name }.sorted()
-
-    private companion object {
-        val INPUT: Uri = Uri.parse("file:///tmp/holiday.mp4")
-        const val DISPLAY_NAME = "holiday.mp4"
-        const val INPUT_BYTES = 1024L
-
-        /** A join needs two, and "two" is the boundary the count guard is about. */
-        val SECOND_INPUT: Uri = Uri.parse("file:///tmp/holiday-2.mp4")
-
-        /** WAV carries PCM and nothing else, so AAC in WAV has nowhere to go. */
-        val REFUSED_SPEC = OutputSpec(
-            org.libremediaconverter.model.Container.WAV,
-            VideoCodec.NONE,
-            AudioCodec.AAC,
-        )
-        val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000005")
-    }
-}
-
-/** An engine that records what it was asked for and writes an output, so a success is a success. */
-private class RefusingTranscoder : SoftwareTranscoder {
-
-    /** Every spec that actually reached an engine. Empty is the assertion for a refused job. */
-    val invocations = mutableListOf<OutputSpec>()
-
-    override suspend fun run(
-        request: ConversionRequest,
-        inputPath: String,
-        output: File,
-        durationMs: Long,
-        onProgress: (Int) -> Unit,
-    ) {
-        invocations += request.spec
-        output.writeBytes(ByteArray(OUTPUT_BYTES))
-    }
-
-    private companion object {
-        const val OUTPUT_BYTES = 512
-    }
-}

app/src/test/java/org/libremediaconverter/work/WorkerCancellationTest.kt

@@ -1,16 +1,12 @@
 package org.libremediaconverter.work
 
 import android.app.Application
-import android.content.Context
 import android.net.Uri
 import androidx.media3.common.util.UnstableApi
 import androidx.work.Data
-import androidx.work.ForegroundInfo
-import androidx.work.ForegroundUpdater
 import androidx.work.ListenableWorker
 import androidx.work.testing.TestListenableWorkerBuilder
 import androidx.work.workDataOf
-import com.google.common.util.concurrent.ListenableFuture
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.runBlocking
 import org.junit.After
@@ -22,7 +18,6 @@ import org.junit.runner.RunWith
 import org.libremediaconverter.convert.ConversionDependencies
 import org.libremediaconverter.convert.OutputPublisher
 import org.libremediaconverter.convert.SoftwareTranscoder
-import org.libremediaconverter.convert.StagingNames
 import org.libremediaconverter.convert.installTestWorkManager
 import org.libremediaconverter.model.ConversionRequest
 import org.libremediaconverter.model.DeviceCodecs
@@ -113,54 +108,6 @@ class WorkerCancellationTest {
         assertEquals("a failed attempt must not leave its partial behind", emptyList<String>(), stagedNames())
     }
 
-    @Test
-    fun `a cancelled join propagates instead of being turned into a Result`() {
-        val thrown = runCatching { runBlocking { concatWorker().doWork() } }.exceptionOrNull()
-
-        assertTrue(
-            "cancellation must leave doWork as cancellation, not as a Result; got $thrown",
-            thrown is CancellationException,
-        )
-    }
-
-    @Test
-    fun `a cancelled join still deletes the partial it had already staged`() {
-        // Written first, so a missing delete cannot pass by asking whether a file nobody wrote is
-        // absent -- the same reason PartialThenFailingTranscoder writes before it throws.
-        concatStagedFile().writeBytes(ByteArray(PARTIAL_STAGED_BYTES))
-
-        runCatching { runBlocking { concatWorker().doWork() } }
-
-        assertEquals("a cancelled join must not leave its partial behind", emptyList<String>(), stagedNames())
-    }
-
-    /**
-     * A join whose foreground start is cancelled rather than denied.
-     *
-     * The conversion twin cancels *inside the engine*, which is the honest shape there because
-     * `ConversionDependencies` has a seam for it. `ConcatWorker` calls `ConcatEngine` directly and
-     * has no such seam -- it is native, and nothing here gets past it -- so the cancellation is
-     * injected at the only other point inside the `try`: `setForeground`. That is not a contrivance.
-     * A job cancelled while WorkManager is promoting it to the foreground is precisely when the
-     * window is open, and what is being tested is the `catch` arm, which cannot tell where in the
-     * `try` the cancellation came from.
-     */
-    private fun concatWorker(): ConcatWorker = TestListenableWorkerBuilder<ConcatWorker>(
-        context = app,
-        inputData = workDataOf(
-            ConcatWorker.KEY_INPUT_URIS to arrayOf(INPUT.toString(), "file:///tmp/second.mp4"),
-            ConcatWorker.KEY_TOTAL_BYTES to INPUT_BYTES,
-            ConcatWorker.KEY_FORMAT to CONCAT_FORMAT.name,
-        ),
-        runAttemptCount = 0,
-    ).setId(CONCAT_ID)
-        .setForegroundUpdater(CancellingForegroundUpdater)
-        .build()
-
-    /** The staging path the join will compute, asked for rather than spelled out here. */
-    private fun concatStagedFile(): File =
-        publisher.createStagingFile(StagingNames.forJob(CONCAT_ID, CONCAT_FORMAT.extension))
-
     /**
      * A worker routed to the software engine, which is [failure] and nothing else.
      *
@@ -195,10 +142,7 @@ class WorkerCancellationTest {
         const val DISPLAY_NAME = "holiday.mp4"
         const val INPUT_BYTES = 1024L
         val SPEC = OutputFormat.MP4_H265.spec
-        val CONCAT_FORMAT = OutputFormat.MP4_H264
-        const val PARTIAL_STAGED_BYTES = 2048
         val JOB_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000003")
-        val CONCAT_ID: UUID = UUID.fromString("00000000-0000-4000-8000-000000000004")
     }
 }
 
@@ -223,19 +167,3 @@ private class PartialThenFailingTranscoder(private val failure: () -> Nothing) :
         const val PARTIAL_BYTES = 2048
     }
 }
-
-/**
- * Stands in for a job cancelled while WorkManager is promoting it to the foreground.
- *
- * The mechanism `DeniedForegroundStartTest` documents, carrying a different exception:
- * `WorkForegroundUpdater` propagates whatever the future failed with, and
- * `ListenableFuture.await()` unwraps the `ExecutionException`, so the worker meets a bare
- * `CancellationException` exactly where a real cancellation would put one.
- */
-private object CancellingForegroundUpdater : ForegroundUpdater {
-    override fun setForegroundAsync(
-        context: Context,
-        id: UUID,
-        foregroundInfo: ForegroundInfo,
-    ): ListenableFuture<Void> = FailedFuture(CancellationException("cancelled while going foreground"))
-}

app/src/test/java/org/libremediaconverter/work/WorkerStubs.kt

@@ -1,14 +1,10 @@
 package org.libremediaconverter.work
 
 import android.content.Context
-import com.google.common.util.concurrent.ListenableFuture
 import org.libremediaconverter.convert.OutputPublisher
 import org.libremediaconverter.convert.SoftwareTranscoder
 import org.libremediaconverter.model.ConversionRequest
 import java.io.File
-import java.util.concurrent.ExecutionException
-import java.util.concurrent.Executor
-import java.util.concurrent.TimeUnit
 
 /**
  * Scaffolding more than one worker test needs.
@@ -72,25 +68,3 @@ object WritingTranscoder : SoftwareTranscoder {
 
     private const val OUTPUT_BYTES = 512
 }
-
-/**
- * An already-failed future, written out rather than pulled from a futures library.
- *
- * `await()` takes the `isDone` fast path and unwraps the `ExecutionException`, which is what puts
- * the original exception in front of the worker's `catch` rather than a wrapper. That is the whole
- * mechanism behind driving a `ForegroundUpdater` to fail: `WorkForegroundUpdater` propagates
- * whatever the future failed with rather than swallowing it, so `setForeground()` throws exactly
- * what is handed here.
- *
- * Shared because two tests inject two different failures through it -- a denied foreground start
- * and a cancellation -- and Kotlin will not take two file-private top-level classes of one name in
- * one package.
- */
-internal class FailedFuture(private val failure: Throwable) : ListenableFuture<Void> {
-    override fun addListener(listener: Runnable, executor: Executor): Unit = executor.execute(listener)
-    override fun cancel(mayInterruptIfRunning: Boolean): Boolean = false
-    override fun isCancelled(): Boolean = false
-    override fun isDone(): Boolean = true
-    override fun get(): Void = throw ExecutionException(failure)
-    override fun get(timeout: Long, unit: TimeUnit): Void = throw ExecutionException(failure)
-}

app/src/test/resources/robolectric.properties

@@ -10,9 +10,3 @@
 # Set here rather than in a @Config on each class so a later Robolectric test does not have
 # to rediscover it. Remove it once Robolectric ships an android-all jar for 37.
 sdk=36
-
-# Every test gets TestLibreMediaConverterApp, whose only difference from the real one is that the
-# startup sweep runs inline rather than on Dispatchers.IO. Set suite-wide because the race it fixes
-# (#159) is suite-wide: any class that builds an Application leaves a sweep of the shared staging
-# directory in flight for whatever runs next. TestLibreMediaConverterApp explains the choice.
-application=org.libremediaconverter.TestLibreMediaConverterApp

docs/coverage-read-findings.md

@@ -1,27 +1,22 @@
 # Coverage-read findings
 
-**Status:** ten findings, none fixed, none urgent. F1-F4 came from the 2026-08-26 read; F5 was added
-on 2026-08-27 while decomposing #132; **F6-F10 were added on 2026-09-02 from the wave-4 read**. Every
-entry here is a *code* observation — something a test would document rather than repair. The test
-gaps found in the same reads are tickets, not entries here; see [Not covered here](#not-covered-here).
-**Scope:** what a JaCoCo read turned up that writing a test would not fix. This is a survey, not a
-work order. Acting on any entry is a separate decision and would be its own commit.
-**Last verified:** `main` at `54ca2dd`, 2026-09-02. Coverage measured that day with
-`./gradlew :app:jacocoTestReport`: **92.8% line (2183/2352), 81.3% branch (1091/1342)**, against
-**584 JVM tests in 87 classes**, matching what `CLAUDE.md` quotes.
-
-The wave-4 read that produced F6-F10 also produced twelve test tickets, **#192-#203**, plus **#204**
-for four candidates whose cost was not obviously worth paying. The split between them is the same one
-this document has always drawn: a ticket is where a test goes, an entry here is where a test would not
-help.
+**Status:** five findings, none fixed, none urgent. F5 was added on 2026-08-27, found while decomposing #132 into children — it had been listed there as a test gap, and is not one. Every entry here is a *code* observation —
+something a test would document rather than repair. The test gaps found in the same read are
+tickets #132 and #133, not entries here; see [Not covered here](#not-covered-here).
+**Scope:** what a JaCoCo read on 2026-08-26 turned up that writing a test would not fix. This is
+a survey, not a work order. Acting on any entry is a separate decision and would be its own commit.
+**Last verified:** `main` at `dc8b7c3`, 2026-08-26. Coverage re-measured that day with
+`./gradlew :app:jacocoTestReport`: **84.9% line (1971/2321), 63.8% branch (900/1410)**, against
+**456 JVM tests in 68 classes**. `CLAUDE.md` quotes 454 in 67 from four hours earlier; the
+percentages are unchanged, so no figure there is stale.
 
 ## Why this document is separate from `defect-audit.md`
 
 `defect-audit.md` is the record of the 2026-08-22 defect sweep: sixteen entries, each a thing that
 is *wrong at runtime*. Nothing here is wrong at runtime today. These are arms that cannot be
-reached, accessors nobody calls, and two KDocs that contradict the code beside them — the category
-`defect-audit.md` calls **latent**, plus several that are not defects at all and are recorded so the
-next coverage read does not re-file them.
+reached, accessors nobody calls, and one KDoc that contradicts the code beside it — the category
+`defect-audit.md` calls **latent**, plus one that is not a defect at all and is recorded so the
+next coverage read does not re-file it.
 
 They are here rather than in that document because folding them in would inflate a sixteen-entry
 audit whose status metadata has already gone stale once, and because they share a provenance:
@@ -29,7 +24,7 @@ every one fell out of reading a coverage report, and every one is the kind of th
 report is *good* at surfacing and a test is bad at fixing. F5 is the clearest case — it was filed
 as a test gap first, and only stopped being one when someone went looking for its callers.
 
-Entry ids are `F1`–`F10` so they cannot be confused with `defect-audit.md`'s `D1`–`D16`.
+Entry ids are `F1`–`F5` so they cannot be confused with `defect-audit.md`'s `D1`–`D16`.
 
 ## How to read the confidence labels
 
@@ -267,179 +262,6 @@ no way to make it happen now.
 
 ---
 
-## F6 — Four more arms that cannot be reached, and one KDoc among them that is false
-
-**Severity: low · Confirmed by inspection · F4's family, found in the wave-4 read**
-
-```
-app/src/main/java/org/libremediaconverter/model/ConversionRouter.kt:178-179
-app/src/main/java/org/libremediaconverter/model/ConversionRouter.kt:221
-app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt:297
-app/src/main/java/org/libremediaconverter/model/ContainerCapabilities.kt:324, :340
-```
-
-Four sites that a coverage report flags and that no test can reach. Each is recorded with the
-upstream guard that makes it unreachable, because that guard is what would have to change first.
-
-- **`ConversionRouter:178-179`** — the missed branch is `orEmpty()`'s absent-key arm on
-  `MEDIA3_MUXABLE_VIDEO[plan.container]`. `MEDIA3_CONTAINERS` is `setOf(MP4)` and `route()` returns at
-  `:104` for anything else, so `media3CanMux` only ever sees MP4, which both maps key. Same function
-  as F4's second pair, one line below it.
-- **`ConversionRouter:221`** — `DeviceCodecs.PERMISSIVE.canDecode` returning **false** for
-  `InputProbe.UNPARSEABLE`. `PERMISSIVE` has no production caller at all (tests only), and the
-  router's one `canDecode` call at `:128` is already preceded by `:117` returning FFMPEG for
-  `UNPARSEABLE`. **Its KDoc at `:214-217` is false as written:**
-
-  > That exception matters: a device double that claims it can decode an unparseable file would let
-  > the router send a doomed job to Media3.
-
-  It would not — `:117` already caught it. This is F2's shape: a comment that describes a hazard the
-  code upstream has removed. Correcting it is a one-line change and should not be bundled with
-  anything.
-- **`ContainerCapabilities:297`** — `if (container == GIF || container == IMAGE_SEQUENCE) return null`
-  in `repair`. `repair`'s only caller is `suggestions` (`:281`); `validate` returns at `:121` for
-  `isImageOutput` (which is exactly GIF ∥ IMAGE_SEQUENCE) before `suggestions` is reached, and
-  `firstContainerHolding` filters on `CARRIES_VIDEO`, which is empty for both.
-- **`ContainerCapabilities:324` and `:340`** — the `else ->` arms themselves are exercised; what is
-  missed is the elvis tail, `firstOrNull() ?: VideoCodec.NONE` / `?: AudioCodec.NONE`. Reaching it
-  needs a container with no encodable codec on that axis. Audio-only containers return early at
-  `:307`, and the only containers with an empty audio set are GIF and IMAGE_SEQUENCE, excluded at
-  `:297` above.
-
-**Recorded so the next read does not re-file them.** F4's rule applies unchanged: a second line of
-defence that can be provoked is not a second line of defence, and widening a private function to make
-one reachable buys a test that asserts a fallback fires when called in a way production cannot call
-it.
-
----
-
-## F7 — `probeWithExtractor`'s catch is unreachable for the same measured reason `probeForConcat`'s is
-
-**Severity: n/a · No action · completes a measurement already on record**
-
-```
-app/src/main/java/org/libremediaconverter/convert/MediaProbe.kt:180-182
-```
-
-```kotlin
-} catch (e: Exception) {
-    Log.i(TAG, "Platform extractor could not read $uri.", e)
-    null
-}
-```
-
-`CLAUDE.md` records the measurement for the *other* extractor site: Robolectric's `MediaExtractor`
-never throws from `setDataSource`, checked across an unregistered `content://` authority, a missing
-`file://`, a file of garbage bytes and an `http://` URL — all four returned with `trackCount = 0`.
-
-`probeWithExtractor` calls the same overload, three lines apart in the same file, and the measurement
-covers it identically. It was simply not written down for this site, so a future read would re-derive
-it. It stays device-only, alongside `probeForConcat`'s.
-
-**Two neighbouring line counts are artifacts of this, not separate gaps.** `MediaProbe:184` and
-`:331` each report 27 missed instructions and are the `finally` block's synthetic exception-path copy
-— JaCoCo duplicates a `finally` per exit path, and the exceptional one is unreachable for the reason
-above. Do not read them as a third and fourth site.
-
----
-
-## F8 — Three more dead members, and six unused defaults
-
-**Severity: low · Confirmed by inspection · F3's family**
-
-```
-app/src/main/java/org/libremediaconverter/model/CopyPlanner.kt:28          ConversionPlan.hasVideo
-app/src/main/java/org/libremediaconverter/codec/AndroidDeviceCodecs.kt:39  hardwareEncoders()
-app/src/main/java/org/libremediaconverter/ffmpeg/ConcatEngine.kt:30        Result.output
-app/src/main/java/org/libremediaconverter/convert/Transcoders.kt:28, :29, :40, :61
-app/src/main/java/org/libremediaconverter/work/Reattachment.kt:28, :30
-```
-
-- **`ConversionPlan.hasVideo`** — zero callers in `main`, `test` or `androidTest`. Every `hasVideo`
-  hit in the tree is `InputProbe.hasVideo`, `OutputSpec.hasVideo` or `Container.extensionFor(hasVideo)`,
-  which are different properties on different types. A test asserting
-  `plan.hasVideo == (plan.video != VideoPlan.Drop)` is vacuous by construction.
-- **`AndroidDeviceCodecs.hardwareEncoders()`** — its only caller is `RealMediaBenchmark`, in
-  `androidTest`. Production reads capabilities through `DeviceCodecs`, never the raw set.
-- **`ConcatEngine.Result.output`** — `ConcatWorker` reads `result.strategy` and uses the `staged`
-  file it passed in, never `.output`.
-- **`Transcoders.kt`'s default arguments** — `request` and `onProgress` on
-  `HardwareTranscoder.transcode` (`:28`, `:29`), `onProgress` on `SoftwareTranscoder.run` (`:40`),
-  and `format` on `ConcatJoiner.join` (`:61`). All three production call sites
-  (`ConversionWorker.kt:208`, `:234`, `ConcatWorker.kt:79`) pass every argument, so the synthesised
-  `$default` bridges and `$DefaultImpls` copies are never entered. The
-  `request: ConversionRequest = ConversionRequest(OutputFormat.MP4_H265.spec)` default is the one
-  worth a second look: nothing anywhere omits it, so an interface silently promises H.265 to a
-  caller that does not exist.
-- **`JobSnapshot`'s `outputModifiedAt` and `tags` defaults** — `JobSnapshots.kt:32-42` passes all
-  seven fields, so the synthesised `$default` constructor (20 missed instructions at
-  `Reattachment.kt:14`) is never entered.
-
-**Not a test gap, for F3's reason.** Delete them, or keep them and know they are unused; either is a
-decision, and a test restating the compiler is not.
-
----
-
-## F9 — Both workers' `getForegroundInfo` overrides are dead, and this is why
-
-**Severity: n/a · No action · sharpens #88 rather than reopening it**
-
-```
-app/src/main/java/org/libremediaconverter/work/ConversionWorker.kt:342-346
-app/src/main/java/org/libremediaconverter/work/ConcatWorker.kt:132-136
-```
-
-**#88 already closed on these**, after reading both and finding no decision worth a seam — the
-correct call, and it stands. What #88 did not name is the reason they are cold in the first place,
-which is stronger than "the JVM cannot reach them":
-
-WorkManager calls `getForegroundInfoAsync()` **only for expedited work**. `ConversionWorker`'s own
-KDoc says expedited is deliberately not used, and `grep -rn 'setExpedited\|OutOfQuotaPolicy' app/src`
-returns nothing. So both overrides are dead in production today, not merely untested — a test would
-assert the shape of something nothing invokes.
-
-They are still correct to keep: `ForegroundInfo` is required by the `CoroutineWorker` contract and
-`setForeground` is called explicitly elsewhere. **What would reopen this** is the same trigger #88
-named — a `getForegroundInfo` that starts branching — plus one more: the day anything calls
-`setExpedited`.
-
----
-
-## F10 — Three arms that are reachable, uncovered, and cannot be made to bite
-
-**Severity: n/a · No action · the shape a coverage number cannot distinguish**
-
-```
-app/src/main/java/org/libremediaconverter/convert/ConversionViewModel.kt:550, :553
-app/src/main/java/org/libremediaconverter/join/JoinViewModel.kt:349, :352, :278
-```
-
-F4 and F6 hold arms that cannot be *reached*. These can — and a test written against them would still
-pass under the mutation that ought to redden it, which is the harder case to spot and the more
-expensive one to discover halfway through writing the test.
-
-- **`observer?.cancel()`'s non-null arm** (`ConversionViewModel:550`, `JoinViewModel:349`). Reachable
-  by calling `convert()` twice. But `ScreenOwnership`'s token is what actually blocks the superseded
-  write — the ViewModel's own KDoc at `reset()` says the cancel is "a request honoured at the next
-  suspension point" and "the claim is what actually stops that write". Delete `observer?.cancel()`
-  and the suite stays green, correctly.
-- **`if (info == null) return@collect`** (`ConversionViewModel:553`, `JoinViewModel:352`). Reachable
-  through `pruneWork()`. But when the null arrives the state is already terminal, so removing the
-  guard crashes the collector and **leaves the state unchanged** — a state assertion is green under
-  the mutation. The only observable is an escaped coroutine exception, which the ViewModel's own KDoc
-  documents as unreliable on the JVM: kotlinx-coroutines-test's process-wide collector hands it to
-  whichever `runTest` starts next.
-- **`JoinViewModel:278`'s `Ambiguous` arm.** Looks like the twin of `ReattachGuardsTest`'s "a result
-  two jobs both claim", and is not. An `Ambiguous` requires a shared `outputPath`, so it can only be a
-  *finished* job — which maps to `Joined`, a state that reads nothing from `inputs`. **The Convert-side
-  twin does bite**, because `displayNameOf(tags)` reaches the file card; the asymmetry is the point.
-
-**Recorded because each of these was picked up as a candidate and put down again.** The wave-4 read
-lost time to all three before the mutation test was run in the head rather than the editor, which is
-the cheaper order.
-
----
-
 ## Summary
 
 | ID | Finding | Severity | Evidence | Action |
@@ -449,23 +271,12 @@ the cheaper order.
 | F3 | `ConversionRequest.videoCodec` / `.audioCodec` have no callers | low | confirmed by inspection | delete, or keep for symmetry — **not** a test gap |
 | F4 | Two private guards reachable only by direct call | n/a | confirmed by inspection | **no action** — named exemption, per #88 |
 | F5 | `ConversionNotifications.areEnabled()` is never called | low | confirmed by inspection; grep returns the declaration only | **decide**: act on it or delete it — **not** a test gap |
-| F6 | Four more unreachable arms; `ConversionRouter:214-217`'s KDoc is false | low | confirmed by inspection; each traced to its upstream guard | **no action**, except the one-line KDoc fix |
-| F7 | `probeWithExtractor`'s catch is unreachable, as `probeForConcat`'s is | n/a | measured across four URI shapes (recorded in `CLAUDE.md`) | **no action** — device-only, now written down for both sites |
-| F8 | Three more dead members and six unused defaults | low | confirmed by inspection; grep per member | delete or keep knowingly — **not** a test gap |
-| F9 | Both `getForegroundInfo` overrides are dead: expedited work is never used | n/a | confirmed by inspection; `grep setExpedited` returns nothing | **no action** — sharpens #88's close |
-| F10 | Three reachable arms where no mutation bites | n/a | confirmed by inspection; each mutation traced to its masking guard | **no action** — recorded to stop the next read re-picking them |
 
 Order, if these are acted on: **F1 and F5 first, separately.** They are the two with a possible
 user-visible answer — a format the app can produce and does not offer, and a warning the app
-documents and does not give — and either answer changes what the tidying should look like. F2, F3 and
-F8 are tidying and belong in one commit with each other, not with F1 or F5. F6's KDoc correction is a
-third kind: one line, no decision, and it should not wait on the tidying. F4, F7, F9 and F10 are
-finished by being written down.
-
-**Six of the ten are now "no action" or "not a test gap", and that is the useful shape.** By wave 4
-the report's remaining red is mostly this: arms nothing can reach, members nothing calls, and arms a
-test can reach but not pin. A coverage number cannot tell any of them from a real gap, which is why
-this document exists and why it grows faster than the percentage moves.
+documents and does not give — and either answer changes what the tidying should look like. F2 and F3
+are tidying and belong in one commit with each other, not with F1 or F5. F4 is finished by being
+written down.
 
 **F1 and F5 share a shape worth naming:** both are places where a comment describes behaviour the
 code does not have, and in both the tempting fix (delete the dead arm, test the dead method) would
@@ -476,15 +287,7 @@ freeze the wrong answer in place. The decision comes first.
 **The test gaps from the same read.** Seven JVM-side gaps (**#132**) and three seam questions
 (**#133**) came out of this coverage read and are tracked there, because they are work rather than
 observations. This document holds only what a test would not fix. #133 also records why
-`AndroidDeviceCodecs.probe()` was considered and left out **through `ShadowMediaCodecList`**, so that
-spike is not run a third time.
-
-**Updated 2026-09-02:** #194 proposes reaching the same code through a *pure seam* instead, which is a
-different mechanism and one #133 did not evaluate — the builder objection it turns on (no
-`setIsAlias`, no `setCanonicalName`) does not apply to a function taking its own entry type. #133's
-close stands for the shadow; it is not a close on the seam. #194 also carries the reason the seam is
-worth cutting at all, which is not coverage: the `runCatching` fallback logs "assuming permissive" and
-returns empty sets, which makes `canEncode` and `canDecode` answer *no* for everything.
+`AndroidDeviceCodecs.probe()` was considered and left out, so that spike is not run a third time.
 
 **`ConversionForegroundType.current()`**, which looked like the sharpest gap in the read and is not.
 Its API 33 and 34 arms are cold on the JVM, but issue **#88** already established that the class is
@@ -518,25 +321,6 @@ the real ones — **34 of 383** and **20 of 143** missed — and the screens are
 better-covered files in the repo, which is what #52, #57 and #61 were for. **Do not chase the
 branch number here.** If a future read wants a screen metric, use lines.
 
-**Updated 2026-09-02: the same codegen inflates the *instruction* count, which wave 3's filter did
-not allow for.** Wave 3 selected candidates on `mi > 0` — at least one missed instruction — which was
-right to prefer over a bare branch count and is still wrong on these files. `JoinScreen.kt:222` reads
-`mi=10` and looks uncovered; it also reads `ci=38`, and `JoinStateAffordancesTest` already clicks that
-Save button and asserts `save:joined.mp4`. Every `onClick` lambda body flagged this way turned out to
-be covered at method level, the missed instructions being the recomposition-skip path again.
-
-Use `ci == 0` — the line never executed, which is JaCoCo's own missed-line definition — and pair it
-with a method-level `ci > 0 && mb > 0` pass for covered methods with cold arms. Neither filter alone
-is enough: `ConversionViewModel.cancel()` misses no line at all, yet its non-null arm had never been
-entered in 584 tests (#192). `CLAUDE.md`'s coverage entry carries the same correction.
-
-**Also codegen, also not gaps**, recorded once so they are not re-derived: the synthetic
-`NoWhenBranchMatchedException` closing an exhaustive `when` (`ConverterScreen:399`, `:686`,
-`JoinScreen:278`, `MainActivity:160`); the inner `is Idle -> Unit` arms at `ConverterScreen:253-254`
-and `JoinScreen:158-159`, which are structurally unreachable because the outer `when` already routed
-`Idle`; and the closing brace of a `launch` block whose `collect` never terminates
-(`ConversionViewModel:578`, `JoinViewModel:371`).
-
 **Anything requiring a device.** `MediaProbe`'s FFprobe half (`MediaProbe.kt:151, 156-158, 173-188`)
 and `FFmpegEngine` in full report 0% on the JVM and are covered by `androidTest`. JaCoCo measures
 `testDebugUnitTest` only; their zeroes are a boundary, as #84, #85, #86 and #88 each recorded